Js_dloadr.gq


 
Thread Tools Search this Thread
Special Forums Cybersecurity Malware Advisories (RSS) Js_dloadr.gq
# 1  
Old 07-26-2008
Js_dloadr.gq

This JavaScript may be hosted on a Web site and run when a user accesses the said Web site. Once a user visits the Web site hosting this malware, it downloads a file.

It takes advantage of the vulnerability in Microsoft Data Access Components (MDAC). That allows the scripts to download and execute malicious files.

More information of the said vulnerability is available in the following Web site:

Microsoft Security Bulletin MS06-014
It uses Microsoft.XMLHTTP object with CLSID BD96C556-65A3-11D0-983A-00C04FC29E36 and ADODB.Stream objects to download the file.

The Microsoft.XMLHTTP object is one of Microsoft's suite of XML DOM (Document Object Model) components that are initially designed to provide client-side access to XML documents on remote servers through the HTTP protocol. The said object is used to request or send any type of document.

The ADODB.Stream object is used to read, write, and manage a stream of binary data or text. Note that VBScript and JavaScript do not usually have capabilities to read and write files because they are programmed as safe client-side programming languages. To work with files, the use of a built-in or external ActiveX or COM object, such as Microsoft.XMLHTTP and ADODB.Stream objects, is required.



More...
Login or Register to Ask a Question

Previous Thread | Next Thread
Login or Register to Ask a Question
Web::Scraper::Filter(3pm)				User Contributed Perl Documentation				 Web::Scraper::Filter(3pm)

NAME
Web::Scraper::Filter - Base class for Web::Scraper filters SYNOPSIS
package Web::Scraper::Filter::YAML; use base qw( Web::Scraper::Filter ); use YAML (); sub filter { my($self, $value) = @_; YAML::Load($value); } 1; use Web::Scraper; my $scraper = scraper { process ".yaml-code", data => [ 'TEXT', 'YAML' ]; }; DESCRIPTION
Web::Scraper::Filter is a base class for text filters in Web::Scraper. You can create your own text filter by subclassing this module. There are two ways to create and use your custom filter. If you name your filter Web::Scraper::Filter::Something, you just call: process $exp, $key => [ 'TEXT', 'Something' ]; If you declare your filter under your own namespace, like 'MyApp::Filter::Foo', process $exp, $key => [ 'TEXT', '+MyApp::Filter::Foo' ]; You can also inline your filter function without creating a filter class: process $exp, $key => [ 'TEXT', sub { s/foo/bar/ } ]; Note that this function munges $_ and returns the count of replacement. Filter code special cases if the return value of the callback is number and $_ value is updated. You can, of course, stack filters like: process $exp, $key => [ '@href', 'Foo', '+MyApp::Filter::Bar', &baz ]; AUTHOR
Tatsuhiko Miyagawa perl v5.14.2 2009-03-24 Web::Scraper::Filter(3pm)