Trojan-Downloader.Java.OpenConnection.bs

Technical Details
Payload
Removal instructions

Technical Details

This Trojan downloads files from the Internet and launches them on the victim machine without the user’s knowledge or consent. It is a Java class (class file). It is 2,413 bytes in size.

Payload

The Trojan code contains a Java class called “XecYv_N” which includes functionality for downloading a file from the Internet in a separate thread and launching it for execution. The downloaded file is saved in the current user’s temporary folder under the name:

%Temp%\WINDOWS_SECURITY_CENTER.exe

The link to download the file is specified as a parameter to the object constructor for the malicious class.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Delete the original Trojan file (its location will depend on how the program originally penetrated the victim machine).
2. Delete the following file:

   %Temp%\WINDOWS_SECURITY_CENTER.exe

3. Empty the Temporary Internet Files folder, which may contain infected files (How to delete infected files from Temporary Internet Files folder?).
4. Update your antivirus databases and perform a full scan of the computer (Download a trial version of Kaspersky Anti-Virus).