|Detected||Nov 21 2005 13:23 GMT|
|Released||Nov 21 2005 13:23 GMT|
|Published||Jun 08 2006 14:12 GMT|
This Trojan downloads files via the Internet without the user’s knowledge or consent. It is a Windows PE EXE file 4096 bytes in size.
Once launched, the Trojan attempts to terminate processes if the names contain the following strings:
Every second, the Trojan will check the IP address of the victim machine; this will continue until the Trojan establishes that the IP address is not 127.0.0.1
The Trojan then downloads several files from the Internet and launches them for execution:
The remote malicious user may place different malicious programs on the links.
Programs classified as Trojan-Downloader download and install new versions of malicious programs, including Trojans and AdWare, on victim computers. Once downloaded from the Internet, the programs are launched or included on a list of programs which will run automatically when the operating system boots up.
Information about the names and locations of the programs which are downloaded are in the Trojan code, or are downloaded by the Trojan from an Internet resource (usually a web page).
This type of malicious program is frequently used in the initial infection of visitors to websites which contain exploits.