|Detected||Aug 06 2007 13:24 GMT|
|Released||Aug 06 2007 13:24 GMT|
|Published||Jan 25 2008 14:12 GMT|
This Trojan is a Windows PE EXE file. It is approximately 27KB in size.
Once launched, the Trojan copies its executable file to the Windows system directory:
In order to ensure that the Trojan is launched automatically each time the system is booted, the Trojan adds a link to its executable file in the system registry:
Once installed, the Trojan deletes its original executable file.
The Trojan disables antivirus protection on the victim machine by:
parameters with the names listed below:
The Trojan harvests QQMessenger account data. It scans the system for log-in windows associated with this program. If it finds such windows it harvest text entered in the files and saves them to the following log file:
The log file will periodically be sent to the remote malicious user by email.
If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:
Programs classified as Trojan-Downloader download and install new versions of malicious programs, including Trojans and AdWare, on victim computers. Once downloaded from the Internet, the programs are launched or included on a list of programs which will run automatically when the operating system boots up.
Information about the names and locations of the programs which are downloaded are in the Trojan code, or are downloaded by the Trojan from an Internet resource (usually a web page).
This type of malicious program is frequently used in the initial infection of visitors to websites which contain exploits.