BHO malware used IE vulnerability for install

News | Forum | Free Software | Online Scanners | Tutorials - HowTo

Been infected with spyware? Tell us about your problem.
For fast automatic spyware removal, try CounterSpy, SUPERAntiSpyware

BHO malware used IE vulnerability for install

BHO malware used IE vulnerability for install. Sans reported

There are several sites that have been compromised and now contain the exploit code. These sites all run the exploit code and get a file called ca.exe which in turn gets a file called calc.exe and installs it. It is calc.exe that we want to focus on briefly.

This malware installs a dll that is used as a Browser Helper Object (BHO) and also runscopies itself to directory you see below as nm32.exe and runs as a process. The malware creates the following on install: