Don’t put your trust in any AV: make sure to patch the vulnerabilities that let these drive-by downloads happen. Here is a list of exploits used in a current attack:
Then the exploit script itself is also double encoded, again with the Neo-algorithm, and contains the following exploits...
(1) first is the venerable MDAC (MS06-014). It’s old, (worked up to Sep 2006), but it works like a charm if you’re not patched.
(2) second is one of the many QuickTime exploits. It’s not easy to determine which version it is, but it’s probably one of last years.
(3) three is AOL’s SuperBuddy, from April 2007
(4) is an NCTAudioFile2 overflow from January 2007
(5) is the GomWebCtrl from October 2007, and which has recently appeared in the Storm exploit pack as well (an idea that is Catching On ™)
(6) is SetSlice, patched in October 2006 and
(7) is the ANI exploit from April 2007.
http://explabs.blogspot.com/2008/01/neosploit-january-2008.html
