A. Route of Infection

    HTML.S.Iframe.14818 does not spread out as itself, and it is downloaded from hacked site or ARP Spoofing attack.

B. Symptom of Infection

    1) Use vulnerability of UfPBCtrl.dll code execution.

[PIC 1] UfPBCtrl.dll code execution vulnerability

    2) Malicious URL is inserted by using Iframe.

[PIC 2] Inserted Iframe

    3) Connect to user request page and load the inserted page by iframe.

[PIC 3] Connect to iframe inserted address

    4) Malicious files can be downloaded from iframe inserted pages.

[How to repair]

Reparable by ViRobot engine ver.2011-08-20.00 or above.