Trojan-Downloader.HTML.Agent.sn

Technical Details
Payload
Removal instructions

Technical Details

This Trojan opens different websites in the browser without the user's knowledge. It is an HTML page. It is 70 869 bytes in size.

Payload

When an infected page is opened in the browser, the Trojan launches a Java applet placed on the same server:

http://<site>/games/tetris.jar

Where <site> is the infected site's domain name.

Most likely this malicious file is a part of the Exploit.Java.CVE-2010-0840 family. The "Mjjdo##pOOZDLsGdzsVO#wsdMdCRWqL&/W1" string is sent to the applet as parameter.

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
2. Empty the Temporary Internet Files directory, which may contain infected files (see How to delete infected files from Temporary Internet Files folder?).
3. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

MD5: ccb243bf95ff73620c2faa0577b164dc
SHA1: 1129c265e0b94e947310140891a8c6da8a7a78a8