What is M-soft Office .hta (WG blocked from running)

I just started up my PC and Wormguard gave me a warning that it had blocked a file from starting. I turned the logging on and found out that the file trying to start up is called:

M-soft Office .hta

It is in the start up folder in both my account and my wife's but I have no idea what it is, where it came from or if it's a file I need.

Can anyone help - Pilli?

Dave

 

Hi Dave, Have you run MS's Baseline security? This may have created the file.
Also check out this link:
http://msdn.microsoft.com/library/default.asp?url=/workshop/author/hta/overview/htaoverview.asp

If you are concerned about it submit@diamondcs.com.au.


HTH a bit Pilli

 

Hi Pilli,

I just deleted it because I had no idea what it was. Nothing catastropic seems to have happened.

I changed my ISP so I've been offline for almost 3 weeks because they don't have the fast churning facility. Glad to be out of their prison.

Dave

 

This file contains a embedded VBS Script Downloader. It downloads a gif file ( it's a executable ) drops it as C:\ide323.exe from http://??.50.???.248/323/count1.gif

Note: I changed for security reasons the IP into ??...

After executing the executable installs spyware.

 

http://computercops.biz/startuplist-6948.html

The log where I found it was at cexx.org which is at the moment down because they are moving server.

But it was handled here as well:
http://computercops.biz/postp419506.html

Regards,

Pieter

 

Thanks very much to you all for providing the info on this malware. I knew there was something wrong when WormGuard wouldn't let it load on start up and I knew I never had this file previously so I deleted it.

Thanks WormGuard!

Dave

 

Dave,

Next time i would move it rather than delete it, as this makes recovery easier if its ever needed again, and also then you still have the sample if any analysts want it ... . Moving it to a new folder has the effect of quarantining the sample - it won't be able to do any damage from the new location unless you manually run it, and because it's in a new location there won't be any 'autostart' entries pointing to it to make it load when Windows starts.

 

OK I'll remember that next time Wayne. That was my first real nasty that WG blocked and I must say it did a very good job because it simply refused to allow it to load and all I got was a window saying that it had refused a file permission to run. Real cool stuff and it saved me just when I needed it most.

Dave