Exploit.JS.Pdfka.dna

Деструктивная активность
Рекомендации по удалению

Деструктивная активность

Initialization and execution of the malicious payload is done on opening of an infected PDF document containing an XFA form. An obfuscated malicious Java Script is used as a handler of the “initialize” event in the XFA form. After removing of obfuscation, the malicious script exploits the CVE-2010-0188 vulnerability in Adobe Reader with a purpose to download the following file:

http:// fi***old.info/1TF19pd

This file is stored in the following location:

%Temp%\<rnd>.exe

here rnd – random Latin characters.

The malware then launches the downloaded file for execution. At the time of writing, these links were inactive. Adobe Reader and Acrobat 8 (up to version 8.2.1) and 9 (up to 9.3.1) are vulnerable to this exploit.

Рекомендации по удалению

If your computer does not have an antivirus, and is infected by this malicious program, follow the instructions below to delete it:

1. Delete the original exploit file (its location will depend on how the program originally penetrated the infected computer).
2. Delete the downloaded malicious file:

   %Temp%\<rnd>.exe

3. Update Adobe Reader and Acrobat or install updates using the link:

   http://www.adobe.com/support/security/bulletins/apsb10-07.html

4. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).