JS_DLOADR.ABO

February 26, 2009
 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Downloaded from the Internet

Trend Micro has received multiple samples of this JavaScript (JS) malware from multiple, independent sources, including customer reports and internal sources. These indicate that this script poses a high risk to users due to the increased possibility of infection.

This Trojan may be hosted on a website and run when a user accesses the said website.

  TECHNICAL DETAILS

File Size:

5,260 bytes

Memory Resident:

Yes

Initial Samples Received Date:

26 Jun 2009

Payload:

Downloads files

Arrival Details

This Trojan may be hosted on a website and run when a user accesses the said website.

It may be downloaded from the following remote sites:

  • http://{BLOCKED}9.cn/d/all.htm

NOTES:

Upon execution, it attempts to connect to the following URL to download other scripts:

  • http://{BLOCKED}9.cn/d/b.htm - inaccessible

It then checks if the affected system's Internet browser is Internet Explorer 7. If so, it then connects to a certain URL to download a malicious script detected as JS_DLOADR.RE. Furthermore, it connects to the following URLs to download other scripts:

  • http://{BLOCKED}9.cn/d/0.htm - detected as JS_DLOADR.ACF
  • http://{BLOCKED}9.cn/d/1.htm - detected as JS_DLOADR.ACE
  • http://{BLOCKED}9.cn/d/5.htm - detected as JS_DLOADR.ABP

It then checks for ActiveX controls and downloads other malicious scripts based on the installed ActiveX controls:

  • Ourgame 'GLIEDown2.dll' ActiveX Control:
    http://{BLOCKED}9.cn/d/newlz.htm - detected as JS_DLOADR.ACC
  • Sina Downloader.DLoader.1 ActiveX Control:
    http://{BLOCKED}9.cn/d/s.htm - detected as JS_DLOADR.ACD
  • Microsoft Office Snapshot Viewer ActiveX Control:
    http://{BLOCKED}9.cn/d/office.htm - detected as JS_DLOADR.ABZ
  • Baofeng Storm MPS.StormPlayer.1 ActiveX control:
    http://{BLOCKED}9.cn/d/bf.htm - detected as JS_DLOADR.ABW
  • SSReader Pdg2 Control ActiveX:
    http://{BLOCKED}9.cn/d/cx.htm - detected as JS_DLOADR.ABY
  • UUUpgrade ActiveX Control:
    http://{BLOCKED}9.cn/d/uu.htm - detected as JS_DLOADR.ABU
  • Ourgame GLWorld HanGamePluginCn18 Class ActiveX Control:
    http://{BLOCKED}9.cn/d/2.htm - detected as JS_DLOADR.ABV
  • RealPlayer IERPCtl.IERPCtl.1 AciveX Control:
    http://{BLOCKED}9.cn/d/3.htm - detected as JS_DLOADR.ABQ
    http://{BLOCKED}9.cn/d/4.htm - detected as JS_DLOADR.ABS

  SOLUTION

Minimum Scan Engine:

9.200

FIRST VSAPI PATTERN FILE:

5.872.02

FIRST VSAPI PATTERN DATE:

26 Feb 2009

VSAPI OPR PATTERN File:

5.873.00

VSAPI OPR PATTERN Date:

27 Feb 2009

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Remove malware/grayware files dropped/downloaded by JS_DLOADR.ABO

     
    • JS_AGENT.AWMU
    • JS_DLOADR.RE
    • JS_DLOADR.ACF
    • JS_DLOADR.ACE
    • JS_DLOADR.ABP
    • JS_DLOADR.ACC
    • JS_DLOADR.ACD
    • JS_DLOADR.ABZ
    • JS_DLOADR.ABW
    • JS_DLOADR.ABY
    • JS_DLOADR.ABU
    • JS_DLOADR.ABV
    • JS_DLOADR.ABQ
    • JS_DLOADR.ABS

Step 3

Close all opened browser windows

Step 4

Scan your computer with your Trend Micro product to delete files detected as JS_DLOADR.ABO. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.