Exploit.Java.Agent.bz

Technical Details
Payload
Removal instructions

Technical Details

This Trojan downloads files from the Internet and launches them without the user's knowledge. It is a Java class file. It is 1564 bytes in size.

Payload

The malicious functionality is implemented in "Main" class file. This class file contains functionality that enables file download from the Internet via a special link and launches it for execution. The file download link is sent using "main" function parameter of the malicious file class. The downloaded file is saved in the current user's temporary files directory as

%Temp%\<rnd>.exe

where <rnd> is a random fractional decimal number from 0 to 1.

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
2. Delete the following file:

   %Temp%\<rnd>.exe

3. Empty the Temporary Internet Files directory, which may contain infected files (see How to delete infected files from Temporary Internet Files folder?).
4. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

MD5: 78C5108D2B147B20CDFB3E9F5055B2CC
SHA1: 9CBA095CF121122106B87EABAC9A90C221D58C34