W32/Fujacks.aa is a copied variant of the W32/Fujacks worm that infects PE and possibly HTML files with malicious hyperlinks of Windows ANI 0-day exploit; and spreads over floppy drive and possibly other removable devices. It will also download additional malware on the infected machine.

Aliases
Trojan-Downloader.Win32.Agent.bky (Kaspersky)
Characteristics
Characteristics -

---Update April 1, 2007---
The risk assessment of this threat has been updated to Low-Profiled due to media attention at:
http://www.itnewsonline.com/showstory.php?storyid=9182&scatid=6&contid=3

W32/Fujacks.aa is a copied variant of the W32/Fujacks worm that infects PE and possibly HTM files with malicious hyperlinks of Windows ANI File Format Handling 0-day exploit; and spreads over floppy drive and possibly other removable devices. It will also download additional malware on the infected machine.

These malicious hyperlinks may be appended as JavaScript, and pointing to these site(s) containing the 0-day exploit:

hxxp://{hidden}.microfsot.com/{hidden}.jsMore information of the Windows ANI 0-day vulnerability at:

http://vil.nai.com/vil/content/v_vul28505.htmThis exploit is already proactively detected as Exploit-ANIFile.c using the current DATs.

Upon execution, it spawns notepad.exe and injects a malicious thread into this process. It also installs itself into %Windir%\System32.

(Where %Windir% is the Windows folder; e.g. C:\Windows)

The worm then contacts hxxp://{hidden}.2007ip.com/{hidde}.css to download a list of files that it can download. At the time of writing, these malware were found to be PWS-LegMir, PWS-Lineage and new variants of W32/Fujacks.aa.

Instead of the usual W32/Fujacks strings used in earlier variants, inside the virus body of each variant contain one or more of these silly messages:

"I Hate AVP!!" "Well, Boss will come in !!" "I will by one BMW this year!"The W32/Fujacks.aa thread in notepad.exe then prepends itself to Win32 PE files. It may also create a copy of itself in A:\tools.exe and A:\autorun.inf to autostart itself.

It creates the following registry key(s) to start itself at boot up time:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
"System Boot Check"="%Windir%\system32\{filename}.exe"
 

Read more here...

Exploit-TaroDrop.b is referred to as a "Zero-day attack" in the article at itpro.nikkeibp.co.jp.