It's a bad news that the Windows Animated Cursor Handling zero-day vulnerability has been used by malwares in China now. We have received this kind of new worm today. It has the same behavior as Worm.Win32.Fujacks. It also can infects .HTML .ASPX .HTM .PHP .JSP .ASP and .EXE files, and inserts the malicious links which contained Windows Animated Cursor Handling zero-day vulnerability into .HTML .ASPX .HTM .PHP .JSP .ASP files. It also can send out Chinese spams which are include the same zero-day vulnerability link.

And the author is updating the variants now. We have received different sizes and MD5 hashes. The worm can be downloaded from the following domains, we suggest all users should block now.


The size of this worm is about 13K. MD5 hashes are


Kaspersky can detect two of them as Trojan-Downloader.Win32.Agent.bky.

The main detailed technique report about this worm:

1. Upon execution, it drops the following file:


2. Adds the following entry into registry:


3. Use IE process to download the config file from:


The content of this config file:


5. It also can spread via email as the following:


There are two another links in this url:



The page use the .ani vulnerability,and two urls in it:

This two files are crafted .ANI files which used to download the copy of itself from:


6. Infects .HTML .ASPX .HTM .PHP .JSP .ASP and .EXE files, and inserts the following malicious links which contained Windows Animated Cursor Handling zero-day vulnerability into .HTML .ASPX .HTM .PHP .JSP .ASP files.


In this malicious link,there is another malicous url:


This is a crafted .ANI file which used to download the copy of itself from:


7. In the body of Worm, the author said that he or she hates Kaspersky.



1st Update 11:00pm, Apr.1, 2007
Mcafee has added detection: W32/Fujacks.aa
Kaspersky has added another detection: Trojan-Downloader.Win32.Agent.bkp
Symantec has added detection: W32.Fubalca
F-Secure has added detection: Agent.bky



Last modified by smallmo onApril 13, 2007 23:32