Trojan-Downloader.Java.Agent.kj

Technical Details
Payload
Removal instructions

Technical Details

A trojan program that downloads files from the internet without the user's knowledge and launches them. It is a Java-archive (JAR-file). 2719 bytes.

Payload

When launching, the trojan downloads a file from the internet using the following link:

http://date.***healthabout.com/javas.exe

The link did not work when creating the description.

This file is saved in the current user's temporary file directory under the following name:

%Temp%\privzate.exe

The trojan then launches the downloaded file.

The trojan then launches the downloaded file and shuts down.

Removal instructions

If your computer has not been protected with anti-virus software and has been infected with malware, you will need to take the following actions to delete this:

1. Delete the original program file (its location on the infected computer will depend on how the program got onto the computer).
2. Delete the file downloaded by the trojan:

   %Temp%\privzate.exe

3. Run a full Kaspersky Antivirus scan of the computer with updated antivirus databases (download trial version).

MD5: 1fd0097649e0a07151a1338c1cdc5b19
SHA1: 3bfdcc636939fb817f33c0cd6092cf008dfe4f5a