|Detected||Nov 05 2005 12:46 GMT|
|Released||Nov 05 2005 12:46 GMT|
|Published||Mar 15 2006 15:46 GMT|
This Trojan is designed to download and install other Trojan programs without the user's knowledge or consent. The main Trojan file is a Windows PE EXE file 31480 bytes in size, packed using UPack. The unpacked file is 356KB in size.
Once launched, the Trojan copies itself to the Windows root directory as dupadupam1.exe:
It then registers this file in the Windows system registry, ensuring that the Trojan will be launched each time Windows is rebooted on the victim machine:
When the Trojan is launched, a file called waudio.exe will also be installed to the Windows root directory without the user's knowledge:
This file will be detected by Kaspersky Anti-Virus as Trojan.Win32.Agent.lj.
This file will also be registered in the system registry and launched for execution.
To manually remove the Trojan:
Trojan-Dropper programs are designed to secretly install malicious programs built into their code to victim computers.
This type of malicious program usually save a range of files to the victim’s drive (usually to the Windows directory, the Windows system directory, temporary directory etc.), and launches them without any notification (or with fake notification of an archive error, an outdated operating system version, etc.).
Such programs are used by hackers to: