A simple HTML virus analysis

Always wanted to write this article, just to work, said to work, do not write, go home again busy playing games, throw aside. Now have to open the book, I hope the boss will not know my blog. Haha in a long time before the virus is very interested in HTML, very curious how can remote to local without permission to download the executable file, but has not been able to get the ASP's original code, so dare not take out of context to do what analysis. Recently heard a friend said he looked at a Web page virus firewall prompts me to be careful (first thanks to him first), I flashed a thought, opened flashget the virus on the home page down.
Look a little bit. Found in the following lines of the home code there is an implied floating frame. Its referenced URL address is not local, it feels like it should be, and then again use FlashGet down. Unexpectedly found that the space to put the virus does not support ASP, down the ASP file is the source file. This interest came, envelope all the virus related documents down.
Because this virus is very simple, so I have only a few excerpts from the excerpt, if you are interested, do not go to find a virus to look at the web, but, do not use IE to see, to use FlashGet download tools such as downloading, and then open with Notepad, or the recruit will not come to me, good text began.
The real virus has three files, one is the boot file, one is the download file, the third is the activation file.
The key part of the first boot file is: This role is to download and activate two files as the object of the page to reference and run, this is also a virus file can be infected locally in the key place, in the referenced file can not hinder the reference to the client's action component, alas, this is the knife ah.
The second is to download the EXE virus file and then how to download the EXE, and not pop-up download the prompt box. This is a download file to complete the task.
The virus's approach is to use the microsoft.xmlhttp component and Response.ContentType = "Image/gif" on the server side to download the virus file to the client's Web page cache in picture format (this is very simple get/ BinaryWrite operation, do not say in detail).
The third is to activate the sensory activation process is very clever, the virus is first with the FSO in C: Under the production of an HTA file, the activation process written to this file. Then use Wscript.Shell to run this file. In this way, operations that require large permissions during activation (for example, write registry operations) are fine.
The specific procedure is this. Move the virus file in the cached directory of the Web page to the system file directory and rename it to Win.exe. Then write the startup key to the registration table so that the virus can start automatically after the system restarts, and then delete the HTA file to complete the infection and activation.
This is the basic operating process of the virus (not mentioned in accordance with the usual Virus destruction section), but what is this for us, in fact, this virus I am very annoying, but its download EXE and activation process still have the place to use. For example: The system you make must have the client download some components and activate it before it can be used. This kind of operation is certainly not a problem for people who know it, but if you're dealing with a user who hasn't figured out what the Web is, I guess the system hasn't started using your phone. If you borrow a way to automatically download the component and activate it automatically when the other person allows it, it's much more convenient, right.
However, this way is very convenient for small files, if you want to download more than 1m of files. It is necessary to consider the operation of multithreaded download, of course, this is not the scope of this article. There's a chance to say it later. Using Asp+xml to upload multi-threaded download method of Web multithreading.