Exploit.JS.IFrame.A

( Exploit.JS.IFrame )

SYMPTOMS:

Exploitation will not show any signs. After the attacker will take control the code can have any effect.

TECHNICAL DESCRIPTION:

This is a malicious JavaScript, that is part of an attack that took place in second half of May 2008 and is present until now (June 2008).

A visit to any compromised site is enough to get infected with this malicious script. It will test for several components having vulnerabilities, and will insert IFRAME tags that will point to attacker's other malicious scripts.

Vulnerabilities exploited by those scripts are:
(CVE-2007-5601) RealPlayer IERPCtl.IERPCtl.1
(CVE-2007-5722) GLCHAT.GLChatCtrl.1 ActiveX

All those malicious scripts will download and execute trojans on your computer.

Removal instructions:

Please let BitDefender disinfect your files.

ANALYZED BY:

Sorin Ciorceri, virus researcher