JS.SillyDlScript Family (Ca.com)

Description Published: 2005. július 4.
Description Modified: 2005. július 5.

Type: Trojan
Category: Java Script
Also known as Troj/Codebase-K (Sophos), Exploit.HTML.CodeBaseExec (Kaspersky), Adware-ISTBar (McAfee), JScript/IstBar!Downloader, Trojan-Downloader.JS.IstBar.j (Kaspersky), JS/ObjCode.G@expl (F-Secure), JScript/SillyDLScript.7688!Trojan, JS.SillyDlScript.C, JS.SillyDlScript.D, JS.SillyDlScript.E, JS.SillyDlScript.F, JS.SillyDlScript.G, JS.SillyDlScript.H, JS.SillyDlScript.I

Description

SillyDlScript variants are JavaScript-based malware which attempt to download and install programs and Browser Helper Objects (BHOs) on the user´s system. They may be installed via Internet Explorer exploits when users visit malicious web pages; other trojan downloaders or components; or they may be packaged with software that the user has chosen to install.

A downloader is a program that automatically downloads and runs and/or installs other software without the user´s knowledge or permission.

Note: Many SillyDl variants are installed on an affected machine by another component. In this scenario, a component downloads SillyDl, which then in turn downloads other files and installs them on an affected machine. In the vast majority of cases, these files are adware.

Analysis by Paul Taylor

More information on CA Virus Information Center:
http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=43284

Computer Associates – the Trusted Source of Security Knowledge