Sunday, January 25, 2004 


The following file is a 'folder' comprising both scripting and 
an executable [*.exe]. 

We inject scripting and an executable into the 'folder' which is 
designed to point back to the executable in the 'folder' and 
execute it. Provided the 'folder' is an html file, Windows XP 
Explorer will execute it. 

Because it is an 'folder' proper, Windows Explorer opens it. The 
scripting inside is then parsed and fired. That scripting is 
pointing back to the same executable file and because it is a 
self-executing 'folder',  it executes ! 

Fully self-contained harmless *.exe. 

Windows XP only: 


http://www.malware.com/my.pics.zip 


Be aware of 'folders' out there.



-- 
http://www.malware.com