Exploit.Win32.IMG-ANI.ak

From Total Malware Info

This Exploit uses vulnerability in some of the Windows(MS02-005) system libraries in the processing of graphic files. It’s graphic file (ANI-file). The program is unpacked and has size 1023 bytes.

Payload

The malware launches the harmful code which makes an error in the processing of graphic files of system library Windows USER32.DLL.When viewing the graphic file, the buffer overflow causes the custom code execution on the victim machine. The following link downloads the malware:

• http://209.***.***.80/70/NOTEPAD.EXE

This file has size 69120 bytes.

Removal Instructions

If your computer wasn’t protected by Antivirus and was infected by this malware, you should perform next actions:
1. Delete the following file:
   • NOTEPAD.EXE
2. Update your Windows Internet Explorer:
   • http://www.microsoft.com/technet/security/bulletin/ms05-002.mspx
3. Update your antivirus databases and perform a full scan of your computer with Kaspersky Antivirus.