Trojan-Downloader.Java.OpenConnection.d

Technical Details
Payload
Removal instructions

Technical Details

This Trojan downloads files via the Internet and launches them on the victim machine without the user’s knowledge or consent. The Trojan is a Java class. It can be used as executable code on a HTML page. It is 2,872 bytes in size. It is written in Java.

Payload

The Trojan does the following:

1. It attempts to download two files called “fgc32.exe” and “fgc64.exe” from www.***group.com
2. It saves the files as follows:

   %username%\fgc32.exe
   %username%\fgc64.exe

3. It launches the files for execution.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
2. Delete the following files:

   %username%\fgc32.exe
   %username%\fgc64.exe

3. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).