|Detected||Nov 27 2004 05:08 GMT|
|Released||Nov 27 2004 05:08 GMT|
|Published||Aug 28 2006 14:54 GMT|
This Trojan downloads software via the Internet without the knowledge or consent of the user.
The program itself is a Windows PE EXE file. It is written in C++. The size of infected files may vary slightly, from 62KB to 77KB.
Once launched, the Trojan registers itself in the system registry:
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "Upsfctl" = "<path to Trojan file>"
This ensures that the Trojan will be launched each time Windows is booted on the victim machine.
The name of the key parameter may vary according to different variants of the Trojan.
The Trojan takes its configuration from “preference.dat” and index.dat". These are located in a file indicated by the parameters of one of the following registry keys:
The Trojan creates the following registry key where it saves its configuration:
The Trojan checks for a connection to the Internet and attempts to connect to the following address:
If a connection is available, the Trojan will download the following file without the user’s knowledge:
and saves this file to the Windows temporary directory under the following name:
The file is then launched for execution.
The Trojan saves information about the most recently downloaded file in the following registry key:
At the time of writing, this file will be detected by Kaspersky Anti-Virus as not-a-virus:AdWare.Win32.DelphinMediaViewer.f
Programs classified as Trojan-Downloader download and install new versions of malicious programs, including Trojans and AdWare, on victim computers. Once downloaded from the Internet, the programs are launched or included on a list of programs which will run automatically when the operating system boots up.
Information about the names and locations of the programs which are downloaded are in the Trojan code, or are downloaded by the Trojan from an Internet resource (usually a web page).
This type of malicious program is frequently used in the initial infection of visitors to websites which contain exploits.