Trojan-Downloader.Win32.Agent.td

Detected	Jan 12 2006 09:20 GMT
Released	Aug 28 2009 15:28 GMT
Published	Jan 12 2006 09:20 GMT

Technical Details

This Trojan program is a Windows PE EXE file approximately 35KB in size.

Once launched, the Trojan registers itself in the system registry, ensuring that it will be launched each time Windows is rebooted on the victim machine:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
 "<original file name>"="<path to Trojan program>"

Once activated, after a random interval, the Trojan will cause the following message to be displayed

An icon with the following announcement is created in the system tray:

Your computer might be at risk

If the user clicks on this icon, or clicks on 'Yes', the Trojan will open an internet page containing a range of advertisements:

http://www.msn*****.cc

The Trojan may also download other programs from the Internet, save them on the victim machine and launch them for execution.

Print

Share

Malicious programs

Trojans

Trojan-Downloader

Programs classified as Trojan-Downloader download and install new versions of malicious programs, including Trojans and AdWare, on victim computers. Once downloaded from the Internet, the programs are launched or included on a list of programs which will run automatically when the operating system boots up.

Information about the names and locations of the programs which are downloaded are in the Trojan code, or are downloaded by the Trojan from an Internet resource (usually a web page).

This type of malicious program is frequently used in the initial infection of visitors to websites which contain exploits.

Other versions

Trojan-Downloader.Win32.Agent.ac

Trojan-Downloader.Win32.Agent.ahoe

Trojan-Downloader.Win32.Agent.alr

Trojan-Downloader.Win32.Agent.bl

Trojan-Downloader.Win32.Agent.brit

Trojan-Downloader.Win32.Agent.bvz

Trojan-Downloader.Win32.Agent.cvow

Trojan-Downloader.Win32.Agent.dlyf

Trojan-Downloader.Win32.Agent.ed

Trojan-Downloader.Win32.Agent.ehcj