*** PAY ATENTION BEFORE CLICK ON ANY LINK ON THAT MESSAGE *** I don't know if this thing is already known, but I just got this when I was "navigating" on a certain website. It was a sucession of hidden <frames> from diferent domains, ending on: http://69.50.183.34/m.html It will then call another frame, targeting to: http://69.50.183.34/xpl.wmf Which is the exploit itself. This WMF will download the file cj.exe on the same server (http://69.50.183.34/cj.exe) and run. It worked with me, and probably will work with a lot of people (hey, I just checked the windows update site for updates, and seems that I'm fully patched... even though, the exploit was triggered on me). After exploitation, cj.exe will try to install some browser helper objects (probably a spyware or something like that) Just checked on www.virustotal.com and it seems that both files are quite unknown. -- # (perl -e "while (1) { print "\x90"; }") | dd of=/dev/evil
