|Detected||Dec 09 2010 07:30 GMT|
|Released||Dec 09 2010 12:40 GMT|
|Published||Mar 21 2011 08:24 GMT|
This Trojan downloads files from the Internet and launches them without the user's knowledge. It is a Java class file. It is 2241 bytes in size.
The malware is a component of a Trojan downloader and includes a class file named "a", which downloads a file from the Internet, from a link sent to it, and launches the downloaded file for execution. The file is saved in the current user's temporary files directory as
%Temp%\<rnd>.exewhere <rnd> is a random fractional decimal number between 0 and 1. Before downloading, it checks the name of the OS installed on the infected system. If the OS is not Windows, the download does not take place.
As well as the above-mentioned class file, the Trojan includes class files named "b" and "KAVS", which contain a functionality to decrypt a link sent to it, and to exploit the vulnerability CVE-2010-0840.
The Trojan constitutes a Java applet. It is launched from an infected HTML page, using an "<APPLET>" tag, one of the parameters of which is an encrypted link to a downloadable file.
If your computer does not have an antivirus, and is infected by this malicious program, follow the instructions below to delete it:
%Temporary Internet Files%
Programs classified as Trojan-Downloader download and install new versions of malicious programs, including Trojans and AdWare, on victim computers. Once downloaded from the Internet, the programs are launched or included on a list of programs which will run automatically when the operating system boots up.
Information about the names and locations of the programs which are downloaded are in the Trojan code, or are downloaded by the Trojan from an Internet resource (usually a web page).
This type of malicious program is frequently used in the initial infection of visitors to websites which contain exploits.