Trojan-Dropper.Win32.Agent.bc

Technical Details

The Trojan program installs other files and programs to the victim machine without the user's knowledge or consent. The main Trojan file is a Windows PE EXE file 153719 bytes in size, packed using UPX. The unpacked file is approximately 222KB in size.

Payload

When launched, the Trojan creates a folder called "Winad Client" and drops the follwoing files to this folder:

• %Program Files%\Winad Client\ClientCom.dll
  776800 bytes in size
  this file will be detected by Kaspersky Anti-Virus as not-a-virus:AdWare.Win32.WinAD.a
• %Program Files%\Winad Client\Info.txt
  1720 bytes in size
• %Program Files%\Winad Client\Winad.exe
  24064 bytes in size
  This file will detected by Kaspersky Anti-Virus as not-a-virus:AdWare.Win32.WinAD
• %Program Files%\Winad Client\WinClt.exe
  12915 bytes in size
  This file will be detected by Kaspersky Anti-Virus as not-a-virus:AdWare.Win32.CaptainCode.a

The Winad.exe file will be registered in the system registry in order to ensure that it is launched each time Windows is rebooted on the victim machine.

The files dropped to the victim machine will then be launched for execution.

Removal instructions

1. Delete the following folder and all files that the folder contains:
   %Program Files%\Winad Client\
2. Delete the original Trojan file (the location of this file depends on how the victim machine became infected).
3. Perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).