|Detected||Nov 16 2007 07:42 GMT|
|Released||Nov 16 2007 07:42 GMT|
|Published||Oct 25 2010 08:47 GMT|
This Trojan downloads another program to the computer and launches it for execution without the user's knowledge. It is a Windows application (PE EXE file). It is 16 384 bytes in size. It is written in C++.
Once launched, the Trojan determines the location of MS Internet Explorer and launches it for execution. It uses the "IEFrame" window class name to determine the process ID and uses this to open the current object of the process. It then injects its malicious script into the address space of the "iexplore.exe" process. Once the injected script is launched, the Trojan in cycles of 1055 seconds downloads files located at the following URLs:
http://218.***.159/qq.exe http://www.we***163.cn/root/vip.exeand saves them under the following names, respectively:
%Documents and Settings%\All Users\ieinst21.exe %Documents and Settings%\All Users\ieinst1.exeIt then launches the downloaded files for execution. At the time of writing, these links were inactive.
If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:
%Documents and Settings%\All Users\ieinst21.exe %Documents and Settings%\All Users\ieinst1.exe
Programs classified as Trojan-Downloader download and install new versions of malicious programs, including Trojans and AdWare, on victim computers. Once downloaded from the Internet, the programs are launched or included on a list of programs which will run automatically when the operating system boots up.
Information about the names and locations of the programs which are downloaded are in the Trojan code, or are downloaded by the Trojan from an Internet resource (usually a web page).
This type of malicious program is frequently used in the initial infection of visitors to websites which contain exploits.