Trojan-Dropper.MSWord.Agent.bg

Technical Details

This Trojan is designed to install and launch other programs on the victim machine without the knowledge or consent of the user. +This program is an MS Word document (a DOC file). It is 128381 bytes in size. It is not packed in any way.

Payload

The Trojan exploits a buffer overrun vulnerability in Microsoft Word (MS06-027) which allows a remote malicious user to launch code on the victim machine.

The executable file is placed in the body of the document. When a document is opening in Microsoft Word, the embedded file will be launched for execution by using the buffer overrun vulnerability.

This file is 58880 bytes in size. It will be detected by Kaspersky Anti-Virus as Trojan-Dropper.Win32.Small.bdx.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
2. Install updates for Microsoft Word:
   http://www.microsoft.com/technet/security/bulletin/ms06-027.mspx
3. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).