Exploit.JS.Pdfka.agu

Technical Details
Payload
Removal instructions

Technical Details

This exploit program abuses vulnerabilities in Adobe Reader and Acrobat to run on the victim machine. It is a PDF document containing Java Script scenarios. It is 17,524 bytes in size.

Payload

The malicious PDF document contains a compressed data stream which unpacks when the document is opened and pretends to be an obfuscated Java Script scenario. After the script is decrypted, the malicious program exploits vulnerabilities in the processing of the util.printf method (CVE-2008-2992), Collab.GetIcon (CVE-2009-0927), and the vulnerability (CVE-2007-5659) in Adobe Reader and Adobe Acrobat, versions 9.1, 8.1.4, 7.1.1 and earlier. To exploit these vulnerabilities, the malicious program downloads a file from the Internet at the following link:

http://www.el***tr.com/dm/load.php?e=2

At the time of writing, this file could not be downloaded.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Delete the original exploit file (its location will depend on how the program originally penetrated the victim machine).
2. Install the following security patches:
   http://www.adobe.com/support/security/bulletins/apsb09-04.html
   http://www.adobe.com/support/security/bulletins/apsb09-06.html
   http://www.adobe.com/support/security/bulletins/apsb08-13.html
   http://www.adobe.com/support/security/advisories/apsa09-07.html
3. Empty the Temporary Internet Files folder, which may contain infected files (How to delete infected files from Temporary Internet Files folder?).
4. Update your antivirus databases and perform a full scan of the computer (Download a trial version of Kaspersky Anti-Virus).