Internet threat level: 1
Home→Descriptions→Trojan-Dropper.Win32.Agent.crbk
Trojan-Dropper.Win32.Agent.crbk
| Detected | Aug 10 2010 22:36 GMT |
| Released | Aug 11 2010 07:26 GMT |
| Published | Oct 25 2010 09:56 GMT |
Payload
Removal instructions
Technical Details
This Trojan is designed to install and launch other programs on the victim machine without the knowledge or consent of the user. It is a Windows application (PE EXE file). It is 27 136 bytes in size. It is written in C++.
Payload
Once launched, the Trojan extracts the following file from its resources to the current user's temporary directory:
%Temp%<rnd1>.vbswhere <rnd1> is a random set of numbers and letters, for example "4c9b4162" or "3b5d51c8".
This file is 2967 bytes in size. It is detected by Kaspersky Anti-Virus as Trojan-Downloader.VBS.Agent.aae.
The Trojan then launches the extracted file, deletes its original body, and ceases running.
Removal instructions
If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:
- Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
- Delete the following files:
%Temp%\<rnd>.tmp
where <rnd> is a random set of numbers and letters. - Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).
MD5: 681A4D8A9AFFC01C0D820235C86F0982
SHA1: 24E78E1E1D8C6C0E5C28F47BF40A22FF6FB70D5F
Trojan-Dropper programs are designed to secretly install malicious programs built into their code to victim computers.
This type of malicious program usually save a range of files to the victim’s drive (usually to the Windows directory, the Windows system directory, temporary directory etc.), and launches them without any notification (or with fake notification of an archive error, an outdated operating system version, etc.).
Such programs are used by hackers to:
- secretly install Trojan programs and/or viruses
- protect known malicious programs from being detected by antivirus solutions; not all antivirus programs are capable of scanning all the components inside this type of Trojans.
© 1997-2013 Kaspersky Lab ZAO. All Rights Reserved.
Industry-leading Antivirus Software.
Registered trademarks and service marks are the property of their respective owners.
The authors' opinions do not necessarily reflect the official positions of Kaspersky Lab.