Trojan-Dropper.Win32.Agent.ate

Technical Details

This Trojan is designed to install other Trojan programs to the victim machine without the knowledge or consent of the user. The program itself is a Windows PE EXE file 717 488 byes in size. The file is 717,488 bytes in size.

Payload

Once launched, the Trojan extracts two Windows PE EXE files from itself. These files are saved to the Windows temporary directory as "Pinch.exe" (21 398 bytes in size, will be detected by Kaspersky Anti-Virus as Trojan-PSW.Win32.LdPinch.ato) and "icq_f.exe" (626 176 bytes in size, will be detected by Kaspersky Anti-Virus as IM-Flooder.Win32.Delf.g). Both files are then launched for execution.

Pinch.exe intercepts passwords to a range of Internet programs.

icq_f.exe floods instant messaging networks.

Every 10 seconds, the program will cause an image contained adult content to be displayed.

The Trojan is designed to give the user the impression that s/he is using a flooder program. However, at the same time a password stealing Trojan will be installed on the system.

Removal instructions

1. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine)..
2. Delete the files created by the Trojan:

   %temp%\icq_f.exe
   %temp%\Pinch.exe

3. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).