My Bitdefender
  • 0 Shopping Cart

SHARE
THIS ON

Facebook Twitter Google Plus

Trojan.Exploit.ANOW

MEDIUM
MEDIUM
~1kb
(Trojan-Downloader.VBS.Agent.qo; JS/Objsnapt.A; VBS:SanpshotView-A [Expl])

Symptoms

There are no obvious signs until the attacker manages to infiltrate the system.

Removal instructions:

Keep updated your products.

You can disable this ActiveX control by setting the kill bit for the following CLSIDs:

    {F0E42D50-368C-11D0-AD81-00A0C90DC8D9}
    {F0E42D60-368C-11D0-AD81-00A0C90DC8D9}
    {F2175210-368C-11D0-AD81-00A0C90DC8D9}

You can find information about setting a kill bit here.

Please let BitDefender delete the infected files.

Analyzed By

Dana Stanut, virus researcher

Technical Description:

    This malware is written in Javascript and exploits a vulnerability in the Snapshot Viewer ActiveX control for Microsoft Access(snapview.ocx). The payload will be the download of a file from the following link http://www.oiutr.net/new/[removed].css (detected by Bitdefender as Rootkit.Agent.AIWN). The file will be saved to the following path [c or d or e]:/Program Files/Outlook EXpress/WAB.EXE.
    You can find more information about this vulnerability here CVE-2008-2463.