Information about the W32/Anicmoo.AX Trojan:

W32/Anicmoo.AX is a Trojan. The Trojan will infect Windows systems.

The trojan may arrive as an specially crafted animated cursor (.ANI) file, which is downloaded by the user from a remote website.

It takes advantage of the vulnerability found in the way the animated cursors are handled by the Microsoft (as explained by microsoft in MS07-017) and downloads and executes malicious files from any one of the following link:

http://www.[blocked]ia.net/exe/flash.exe
http://www.[blocked]ia.net/exe/flash.exe
http://www.[blocked]elp.com/update.exe
http://www.[blocked]elp.com/update.exe
http://www.[blocked]ek.com/2/11.exe
http://www.[blocked]ek.com/2/11.exe
http://[blocked]dg.biz/adv/198/win32.exe
http://[blocked]dg.biz/adv/186/win32.exe
http://[blocked]dg.biz/adv/185/win32.exe
http://[blocked]dg.biz/adv/180/win32.exe
http://[blocked]dg.biz/adv/177/win32.exe
http://[blocked]dg.biz/adv/176/win32.exe
http://[blocked]dg.biz/adv/171/win32.exe
http://[blocked]dg.biz/adv/169/win32.exe
http://[blocked]dg.biz/adv/165/win32.exe
http://[blocked]dg.biz/adv/163/win32.exe
http://[blocked]dg.biz/adv/161/win32.exe
http://[blocked]dg.biz/adv/159/win32.exe
http://[blocked]dg.biz/adv/153/win32.exe
http://[blocked]dg.biz/adv/152/win32.exe
http://[blocked]dg.biz/adv/147/win32.exe
http://[blocked]dg.biz/adv/139/win32.exe
http://[blocked]dg.biz/adv/139/
http://[blocked]dg.biz/adv/134/win32.exe
http://[blocked]dg.biz/adv/133/win32.exe
http://[blocked]dg.biz/adv/114/win32.exe
http://[blocked]dg.biz/adv/113/win32.exe
http://[blocked]dg.biz/adv/110/win32.exe
http://[blocked]dg.biz/adv/109/win32.exe
http://[blocked]dg.biz/adv/102/win32.exe
http://[blocked]dg.biz/adv/014/win32.exe
http://220.71.[blocked].189/wincf.exe

This worm first appeared on March 28, 2007.

 Other names of W32/Anicmoo.AX Trojan:

This Worm is also known as TROJ_ANICMOO.AX.