23 HTML Creator


· Overview ·
· Origins ·
· Distribution ·
· Operation ·
· Detection and Removal ·
· Research ·



Overview

Summary:

VBScript drops code in \Windows and runs it, exploiting HTA vulnerability in IE.

Alias:

Backdoor.Wow.23, Backdoor.Wow.23 [Kaspersky], Backdoor/Wow.2_3 [Computer Associates], Backdoor/Wow.2_3!Creator [Computer Associates], Backdoor/Wow.2_3!Server [Computer Associates], Backdoor/Wow.23 [Computer Associates], BackDoor-US [McAfee], Bck/Wow.23 [Panda], KeySpy [McAfee], security risk or a "backdoor" program [F-Prot], VBS.GMWC [Kaspersky], VBS.GMWC for HTML , VBS/GMW.C [F-Prot], VBS/GMWC [Panda], VBS/RunScript.gen2 [McAfee], Win32/Wow.23 trojan [Eset]

Category:

Exploit: A way of breaking into a system. An exploit takes advantage of a weakness in a system in order to hack it. Exploits are the root of the hacker culture. Hackers gain fame by discovering an exploit. Others gain fame by writing scripts for it. Legions of script-kiddies apply the exploit to millions of systems, whether it makes sense or not. Since people make the same mistakes over-and-over, exploits for very different systems start to look very much like each other. Most exploits can be classified under major categories: buffer overflow, directory climbing, defaults, Denial of Service.

Backdoor: A secret or undocumented means of getting into a computer system, or software that uses such a means to penetrate a system. Some software has a backdoor placed by the programmer to allow them to gain access to troubleshoot or change the program. Software that is classified as a "backdoor" is designed to exploit a vulnerability in a system, and open it to future access by an attacker.

Trojan: Any program with a hidden intent. Trojans are one of the leading causes of breaking into machines. If you pull down a program from a chat room, new group, or even from unsolicited e-mail, then the program is likely trojaned with some subversive purpose. The word Trojan can be used as a verb: To trojan a program is to add subversive functionality to an existing program. For example, a trojaned login program might be programmed to accept a certain password for any user's account that the hacker can use to log back into the system at any time. Rootkits often contain a suite of such trojaned programs.

Worm: A program that propagates itself by attacking other machines and copying itself to them. Both worms and viruses are self-replicating code that travels from machine to machine by various means. Both worms and viruses have, as their first objective, merely propagation. Both can be destructive, depending on what payload, if any, they have been given. But there are some differences: worms may replace files, but do not insert themselves into files. In contrast, viruses insert themselves in files, but do not replace them.

Variants:

  • 23 version 0.3
  • Similar Pests:

    Exploit · Backdoor · Trojan · Worm

    Origins

    Author:

    world Of wonder

    Programming Language:

    Assembler

    Date of Origin:

    Variants from August, 2001 to August, 2001

    Distribution

    Prevalence:

  • 23 HTML Creator: < 0.00005%
  • More Info

    Clot Factor:

  • 23 HTML Creator: < 1
  • The "Clot Factor" is a measure of how much a pest "gums up" a machine by adding registry entries, files, and directories. As more objects are placed in a machine, manual removal becomes more difficult and more error-prone.

    Countries Affected:

    In the past three months, we have received reports of 23 HTML Creator in United States.

    Operation

    Storage Required:

  • 23 HTML Creator: at least 301 KB
  • Restart:

    HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce "Taskmon"
    Autostarting Pests

    ScreenShot:


    23 version 0.3



    23 version 0.3


    Detection and Removal

    Automatic Removal:

    PestPatrol detects this.

    PestPatrol removes this.



    Manual Removal:

    Follow these steps to remove 23 HTML Creator from your machine. Begin by backing up your registry and your system, and/or setting a Restore Point, to prevent trouble if you make a mistake.
    Stop Running Processes:

    Kill these running processes with Task Manager:

    Remove Files:

    Remove these files (if present) with Windows Explorer:

    Research

    File Analyses:

    More Info:

  • AllTheWeb, AltaVista, AOL Search, Ask Jeeves, Google, HotBot, Lycos, LookSmart, MSN, Yahoo!
  • Research By:

  • PestPatrol's Pest Research Center
  • Last Revised:

    April 14, 2005