Trojan-Downloader.Win32.Agent.td

Technical Details

This Trojan program is a Windows PE EXE file approximately 35KB in size.

Once launched, the Trojan registers itself in the system registry, ensuring that it will be launched each time Windows is rebooted on the victim machine:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
 "<original file name>"="<path to Trojan program>"

Once activated, after a random interval, the Trojan will cause the following message to be displayed

An icon with the following announcement is created in the system tray:

Your computer might be at risk

If the user clicks on this icon, or clicks on 'Yes', the Trojan will open an internet page containing a range of advertisements:

http://www.msn*****.cc

The Trojan may also download other programs from the Internet, save them on the victim machine and launch them for execution.