Trojan-Downloader.Win32.Agent.ac

Technical Details

This Trojan downloads software via the Internet without the knowledge or consent of the user.

The program itself is a Windows PE EXE file. It is written in C++. The size of infected files may vary slightly, from 62KB to 77KB.

Installation

Once launched, the Trojan registers itself in the system registry:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"Upsfctl" = "<path to Trojan file>"

This ensures that the Trojan will be launched each time Windows is booted on the victim machine.

The name of the key parameter may vary according to different variants of the Trojan.

Payload

The Trojan takes its configuration from “preference.dat” and index.dat". These are located in a file indicated by the parameters of one of the following registry keys:

The Trojan creates the following registry key where it saves its configuration:

The Trojan checks for a connection to the Internet and attempts to connect to the following address:

If a connection is available, the Trojan will download the following file without the user’s knowledge:

and saves this file to the Windows temporary directory under the following name:

The file is then launched for execution.

The Trojan saves information about the most recently downloaded file in the following registry key:

At the time of writing, this file will be detected by Kaspersky Anti-Virus as not-a-virus:AdWare.Win32.DelphinMediaViewer.f

Removal instructions

1. Use Task Manager to terminate the Trojan process.
2. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
3. Delete the following file:
   %Temp%\srtin.exe
4. Delete the following registry keys:
   [HKLM\Software\Dvx]
   [HKLM\Software\Upsf]
5. Delete the following registry key:
   [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
   "Upsfctl" = "<path to Trojan file>"
6. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).