Trojan-Dropper.Win32.Agent.dfqk

Technical Details

This Trojan installs and launches other programs on the infected computer without the user's knowledge. It is a Windows application (PE EXE file). It is 24 576 bytes in size. It is packed using UPX. The unpacked file is approximately 47 KB in size. It is written in C++.

Payload

Once launched, the Trojan carries out the following actions:

• It extracts a file named "msdaozls.dll" from its body to the Windows system directory:

  %System%\msdaozls.dll

  This file is 36 865 bytes in size. It is detected by Kaspersky Anti-Virus as Trojan-GameThief.Win32.OnLineGames.xfck. This library is designed to steal passwords from user accounts for the game "World of Warcraft".
• It launches the system utility "Rundll32.exe" with the following settings:

  %System%\msdaozls.dll,w

  Thereby, a function named "w" is called from the extracted library.
• It searches in the system for a window with the class name "GxWindowClassD3d" and closes it, by sending the message WM_CLOSE.
• In its working directory, it creates a script for the command interpreter, launches it, and executes its task; this script deletes the original Trojan file and deletes itself.

Removal instructions

If your computer does not have an antivirus, and is infected by this malicious program, follow the instructions below to delete it:

1. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
2. Delete the following files:

   %System%\msdaozls.dll

3. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).