|Detected||Sep 04 2006 22:33 GMT|
|Released||Sep 04 2006 22:33 GMT|
|Published||Sep 25 2006 14:12 GMT|
This Trojan downloads files via the Internet without the user's knowledge or consent.
The Trojan itself is a Windows PE EXE file, written in Visual C++. It is not packed in any way. The file size may vary from 55KB to 95KB.
When launching, the Trojan causes the following dialogue box to be displayed:
Once the user clicks on "Continue", the Trojan connects to 66.244.***.178 (*****.errorsafe.com) and downloads software called ErrorSafe:
The Trojan loads the setup.exe file (2352848 bytes in size) to %temp%\NI.UERS_0001_N85M0906 and then launches it for execution. This files installs a program which contains another Trojan program within it. This Trojan will be detected by Kaspersky Anti-Virus as Trojan-Downloader.Win32.Agent.aqh.
The Trojan also creates a unique identifier, "InstallMutex", to flag its presence in the system.
Programs classified as Trojan-Downloader download and install new versions of malicious programs, including Trojans and AdWare, on victim computers. Once downloaded from the Internet, the programs are launched or included on a list of programs which will run automatically when the operating system boots up.
Information about the names and locations of the programs which are downloaded are in the Trojan code, or are downloaded by the Trojan from an Internet resource (usually a web page).
This type of malicious program is frequently used in the initial infection of visitors to websites which contain exploits.