Trojan-Downloader.Win32.Agent.elrc

Technical Details
Payload
Removal instructions

Technical Details

This Trojan downloads files from the Internet and launches them without the user's knowledge. It is a Windows application (PE EXE file). It is 87 040 bytes in size. It is written in Delphi.

Payload

Once launched, the Trojan carries out the following actions:

• It opens this link in the default browser:

  http://www.i***s.gov/pub/irs-pdf/f941.pdf

  At the time of writing, a PDF document of 204 558 bytes in size was downloaded from this link.
• It modifies the following system registry key values:

  [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
  "TaskbarNoNotification" = "1"
  
  [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
  Advanced]
  "EnableBalloonTips" = "0"
  
  [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
  "EnableLUA" = "0"
  

  This results in the disabling of pop-up notifications in the notification area, screen tips, and User Account Control (UAC).
• It downloads files from the following links:

  http://77.***.168/~admin/install/1.jpg
  http://77.***.168/~admin/install/2.jpg
  http://77.***.168/~admin/install/ChilkatCert_NT4.dll
  http://77.***.168/~admin/install/extract_cert.exe
  

  The downloaded files are correspondingly saved in the system as:

  %System%\AcroIEHelper.dll
  %System%\ChilkatCert_NT4.dll
  %System%\extract_cert.exe
  

  At the time of writing, these links were inactive.
• It uses the system utility "regsvr32.exe" to register the previously downloaded library "AcroIEHelper.dll" in the system.
• It launches the downloaded file "extract_cert.exe".

The Trojan then ceases running.

Removal instructions

If your computer does not have an antivirus, and is infected by this malicious program, follow the instructions below to delete it:

1. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
2. Delete the following files:

   %System%\AcroIEHelper.dll
   %System%\ChilkatCert_NT4.dll
   %System%\extract_cert.exe
   

3. Restore the original system registry key values (see What is a system registry and how do I use it?):

   [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
   "TaskbarNoNotification" 
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
   Advanced]
   "EnableBalloonTips" 
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
   "EnableLUA"
   

4. Empty the Temporary Internet Files directory, which may contain infected files (see How to delete infected files from Temporary Internet Files folder?).
5. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).