Trojan-Dropper.Win32.Agent.cxdv

This file is 20480 bytes in size. It will be detected by Kaspersky Anti-Virus as Trojan.Win32.Agent2.lom.

After this the Trojan uploads the extracted file to its address space and launches its malware code which performs the following destructive actions:

• If Microsoft Office is installed on the user's computer, the Trojan will set the security level to low, entering the following values to the system registry key:

  [HKCU\Software\Microsoft\Office\11.0\Word\Security]
  "Level" = "1"
  "AccessVBOM" = "1"
  

  And performs the macros, which it uses to run the original body of the Trojan.
• In order to flag its presence in the system, the Trojan creates a unique identifier:

  249305880edc1b18

• It creates a process named "svchost.exe" and integrates the malicious code into it:

  svchost.exe

• The Trojan sends a request to the following address:

  http://****m5.ru/bmw/bb.php

  And receives a configuration file to carry out further actions.
• The Trojan saves download links for other malicious files received from the configuration file in the following registry key:

  [HKCR\idid]

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
2. Delete the following files:

   %Temp%\<rnd1>.tmp
   %System%\fvfj.sxo
   

   Where <rnd1> stands for a random set of digits and Latin letters.
3. Delete all Temporary Internet Files, which may contain infected files (How to delete infected files from the Temporary Internet File directory):

   %Temporary Internet Files%

4. Delete the following system registry key: (see What is a system registry and how do I use it?for details on how to edit the registry):

   [HKCR\idid]

5. If necessary, restore values for "Level" and "AccessVBOM" parameters in the system registry key (What is a system registry and how do I use it?):

   [HKCU\Software\Microsoft\Office\11.0\Word\Security]
   "Level"
   "AccessVBOM"
   

6. Restore parameter value for the system registry key for the following (What is a system registry and how do I use it?):

   [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
   "Shell" = "Explorer.exe"
   

7. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).