McAfee > Theat Center > Virus Detail Page

Overview

This is a generic detection for exploits targeting a WordPad text convertor vulnerability reported by the vendor at:

• http://www.microsoft.com/technet/security/advisory/960906.mspx

Characteristics

-- Update December 11, 2008 --
The risk assessment of this threat has been updated to Low-Profiled due to disclosure at:
http://www.microsoft.com/technet/security/advisory/960906.mspx
--

This is a generic detection for exploits targeting a Microsoft WordPad text convertor vulnerability. Earlier DATs may detect this threat as Exploit-MSWord.a or Exploit-MSWord.b trojan.

When successful, the exploit may install further malware, and display a clean RTF document to the victim to spoof its malicious behavior.

Variants of this exploit discovered in the wild were found to be dropping file(s) such as the below:

• %Temp%\svchost.exe (BackDoor-DKI)

For more information about the vulnerability, please refer to the vendor's advisory at:

Symptoms

• Presence of the mentioned dropped file(s).
• WordPad unexpectingly closing and re-opening the document.

Method of Infection

This exploit targeting a Microsoft WordPad text convertor vulnerability.

Removal

AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

Additional Windows ME/XP removal considerations

Variants

Variants

N/A

All Information

Overview -

This is a generic detection for exploits targeting a WordPad text convertor vulnerability reported by the vendor at:

• http://www.microsoft.com/technet/security/advisory/960906.mspx

Characteristics

Characteristics -

-- Update December 11, 2008 --
The risk assessment of this threat has been updated to Low-Profiled due to disclosure at:
http://www.microsoft.com/technet/security/advisory/960906.mspx
--

This is a generic detection for exploits targeting a Microsoft WordPad text convertor vulnerability. Earlier DATs may detect this threat as Exploit-MSWord.a or Exploit-MSWord.b trojan.

When successful, the exploit may install further malware, and display a clean RTF document to the victim to spoof its malicious behavior.

Variants of this exploit discovered in the wild were found to be dropping file(s) such as the below:

• %Temp%\svchost.exe (BackDoor-DKI)

For more information about the vulnerability, please refer to the vendor's advisory at:

Symptoms

Symptoms -

• Presence of the mentioned dropped file(s).
• WordPad unexpectingly closing and re-opening the document.

Method of Infection

Method of Infection -

This exploit targeting a Microsoft WordPad text convertor vulnerability.

Removal -

Removal -

AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

Additional Windows ME/XP removal considerations

Variants

Variants -

N/A