Trojan-Clicker.JS.Agent.om

Technical Details
Payload
Removal instructions

Technical Details

This Trojan opens different websites in the browser without the user's knowledge. It is a Java Script. It is 2852 bytes in size.

Payload

Once an infected HTML page is opened, the Trojan sets a "cookie" in the browser until the year 2037 named "cook15" with the current date and time. The Trojan, in order to test the "cookies" functionality, adds to the browser a "cookie" named "test". If "cookies" are disabled in the browser the Trojan ceases running. The Trojan tracks three user clicks on any part of the HTML document if the document is opened in MS Internet Explorer 6.0 and earlier versions or in SV1 browser. It then opens the following web resource in a new browser window:

http://ne***be.org/in.cgi?8&group=dv

from which the user is redirected to the following web resource:

http://por***platno.com/

A malicious script is downloaded from the main page of this web resource:

http://por***platno.com/click3.js

This file is 3952 bytes in size. It is detected by Kaspersky Anti-Virus as Trojan-Clicker.JS.Agent.op.

In the following browsers:

Opera
Netscape
Firefox
MS Internet Explorer 7.0
MS Internet Explorer 8.0
Safari

etc. once the user clicks on any part of the document, the Trojan opens a web resource in a new tab. The Trojan also tracks when the user clicks on any link on the HTML document and then opens the following site in a new window:

http://por***platno.com/

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
2. Empty the Temporary Internet Files directory, which contains infected files (see How to delete infected files from Temporary Internet Files folder?):

   %Temporary Internet Files%

3. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

MD5: dbfb5d6712038db6cd20e5aa7c3f2a58
SHA1: 3595322c42a1eb53d6511e499cfcc03fbe56601c

Summary

• Trojan-Clicker. Opens various websites without the user's knowledge to raise the hit-count of those sites

Technical details

The main file is a Java Script scenario.

Malicious activity

Once launched, opens the following links:

• http://***-tube.org/in.cgi?8&group=dv