Trojan-Dropper.Win32.Agent.aaj

Technical Details

This Trojan is designed to download and install other Trojan programs without the user's knowledge or consent. The main Trojan file is a Windows PE EXE file 31480 bytes in size, packed using UPack. The unpacked file is 356KB in size.

Once launched, the Trojan copies itself to the Windows root directory as dupadupam1.exe:

%Windir%\dupadupam1.exe

It then registers this file in the Windows system registry, ensuring that the Trojan will be launched each time Windows is rebooted on the victim machine:

When the Trojan is launched, a file called waudio.exe will also be installed to the Windows root directory without the user's knowledge:

%Windir%\waudio.exe

This file will be detected by Kaspersky Anti-Virus as Trojan.Win32.Agent.lj.

This file will also be registered in the system registry and launched for execution.

Removal instructions

To manually remove the Trojan:

1. Delete the following files:

   %Windir%\dupadupam1.exe
   %Windir%\waudio.exe

2. Delete the following keys from the system registry:
   [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
    "WindowsUpdatem1"="<path to original file>"
3. Perform a full scan of your computer (download a trial version of Kaspersky Anti-Virus here).