By visiting a prepared webpage a HTA application is run on the client machine. The Visual Basic script (TrojanDownloader.VBS.Iwill.b) embedded in the HTA application will download a file named "S.EXE". S.EXE (size 1.199 bytes)(Not detected by AVP on september 18, 2003) will download and execute following server: c:WINDOWSTEMPMSCONFIG.EXE (OptixLite 5.0 server aka Backdoor.Delf.em)
TrojanDownloader.VBS.Iwill.b