Vulnerability Development mailing list archives

Re: Outlook/HTML "proggie"


From: peter.royal () POBOX COM (kiss the sun and walk on air)
Date: Wed, 31 May 2000 07:34:55 -0400


On Mon, May 29, 2000 at 08:59:35PM -0500, Su Wadlow wrote:
What it does: using the SCR object, it creates a trojan.hta in your
c:\windows\start menu\startup

What is the SCR object? A quick check into my MSDN SDK docs returned
nothing.

My guess was the "Scripting" object, or SCRRUN.DLL. Thats the DLL that
contains the FileSystemObject classes and its subordinates that the
recent rash of VBS scripts have been using to access the disk.
-pete

--
(peter.royal|osi)@pobox.com - http://pobox.com/~osi
"god invented turn signals for a reason"
uin#153025



Current thread: