Trojan-Downloader.Win32.Agent.rs

Detected	Sep 23 2005 10:47 GMT
Released	Jan 07 2006 04:23 GMT
Published	Sep 23 2005 10:47 GMT

Technical Details

This Trojan downloads files from the Internet without the knowledge or consent of the user.

The Trojan itself is a Windows PE EXE file 34681 bytes in size.

Once launched, the Trojan creates a file named "aclayer.dll" in the Windows system directory:

%System%/aclayer.dll

It then registers this file as a Browser Helper Object, adding the following record to the system registry:

[HKCR\CLSID\{5EB7CB50-E375-4718-B4C0-9AD12EFA2F84}]
[HKCR\Interface\{46C18A88-0915-48FC-A8BE-58A9FE7F6E45}]
[HKCR\TypeLib\{B37E0A2D-9A61-4A95-A0E0-6D6F6123DAB4}\1.0]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5EB7CB50-E375-4718-B4C0-9AD12EFA2F84}]

This file will download other files from the Internet without the user's knowledge or consent.

Print

Share

Malicious programs

Trojans

Trojan-Downloader

Programs classified as Trojan-Downloader download and install new versions of malicious programs, including Trojans and AdWare, on victim computers. Once downloaded from the Internet, the programs are launched or included on a list of programs which will run automatically when the operating system boots up.

Information about the names and locations of the programs which are downloaded are in the Trojan code, or are downloaded by the Trojan from an Internet resource (usually a web page).

This type of malicious program is frequently used in the initial infection of visitors to websites which contain exploits.

Other versions

Trojan-Downloader.Win32.Agent.ac

Trojan-Downloader.Win32.Agent.ahoe

Trojan-Downloader.Win32.Agent.alr

Trojan-Downloader.Win32.Agent.bl

Trojan-Downloader.Win32.Agent.brit

Trojan-Downloader.Win32.Agent.bvz

Trojan-Downloader.Win32.Agent.cvow

Trojan-Downloader.Win32.Agent.dlyf

Trojan-Downloader.Win32.Agent.ed

Trojan-Downloader.Win32.Agent.ehcj