This malicious JavaScript (JScript) may be downloaded from remote sites by other malware. It may be downloaded unknowingly by a user when visiting malicious Web sites. It may also be hosted on a Web site and run when a user accesses the said Web site.

It takes advantage of the following software vulnerability to download malicious files on the affected system:

  • Microsoft Security Bulletin MS06-014
  • When exploited, it accesses URLs to download malicious files, which Trend Micro detects as TROJ_AGENT.HFO, JS_AGENT.UXG, JS_REALEXPLOIT.C and JS_PSYME.AF.

    This JScript then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

    Bookmark and Share