Exploit-CVE2006-3730

This page shows details and results of our analysis on the malware Exploit-CVE2006-3730

Download Current DAT: 6617

Threat Detail

Malware Type: Trojan

Malware Sub-type: Exploit

Discovery Date: 2006-09-27

Next Steps:

Overview
Characteristics
Symptoms
Method of Infection
Removal

Overview

This detection covers an exploit that could be used to install other trojans, viruses, and potentially unwanted programs (adware, spyware, etc). This method of exploitation is often referred to as "drive by installs" or "drive by downloads", meaning that upon visiting a site hosting malicious code, a vulnerable system is automatically instructed to install files.

Minimum DAT

4862 (2006-09-28)

Updated DAT

5336 (2008-07-10)

Minimum Engine

5.1.00

File Length

Varies

Description Added

2006-09-27

Description Modified

2006-10-01

Malware Proliferation

Characteristics

This detection covers an exploit in the WebViewFolderIcon ActiveX control that can result in the execution of arbitrary code. The exploit targets multiple versions Microsoft Internet Explorer.

As this threat utilizes script in order to carry out exploitation, VirusScan's ScriptScan component, or a gateway scanner, is required for the DAT files to offer protection from this threat. Identification is available via other DAT consuming scanners. Scanners may identify malicious files as either Exploit-CVE2006-3730 or JS/Exploit-BO.gen.

For more details on the vulnerability that is exploited by this threat, see:
http://vil.nai.com/vil/Content/v_vul26600.htm

Symptoms

Internet Explorer will likely crash upon exploitation. Any number of subsequent actions may be taken by the malware.

Method of Infection

Users may be lured (such as through spam or spim) to visit a malicious site. Upon loading the web page, a vulnerable web browser will execute the payload.

This detection is sufficiently generic, such that it can cover an endless number of threats that contain the exploit code. Therefore, it is not possible to describe specific symptoms or details about system charges that can occur from this threat. However, simply seeing this detection does not mean that any exploit code was run at all as such exploit code could only run on a vulnerable system.

Removal

All Users:
Use current engine and DAT files for detection. Delete any file which contains this detection.