|Detected||Aug 31 2005 20:33 GMT|
|Released||Aug 31 2005 20:33 GMT|
|Published||Jan 12 2006 09:20 GMT|
This Trojan program is a Windows PE EXE file approximately 35KB in size.
Once launched, the Trojan registers itself in the system registry, ensuring that it will be launched each time Windows is rebooted on the victim machine:
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "<original file name>"="<path to Trojan program>"
Once activated, after a random interval, the Trojan will cause the following message to be displayed
An icon with the following announcement is created in the system tray:
Your computer might be at risk
If the user clicks on this icon, or clicks on 'Yes', the Trojan will open an internet page containing a range of advertisements:
The Trojan may also download other programs from the Internet, save them on the victim machine and launch them for execution.
Programs classified as Trojan-Downloader download and install new versions of malicious programs, including Trojans and AdWare, on victim computers. Once downloaded from the Internet, the programs are launched or included on a list of programs which will run automatically when the operating system boots up.
Information about the names and locations of the programs which are downloaded are in the Trojan code, or are downloaded by the Trojan from an Internet resource (usually a web page).
This type of malicious program is frequently used in the initial infection of visitors to websites which contain exploits.