English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

Trojan-Downloader.Win32.Agent.fwcp

Detected Feb 20 2011 09:36 GMT
Released Feb 22 2011 08:34 GMT
Published Mar 16 2011 07:20 GMT

Technical Details
Payload
Removal instructions

Technical Details

This Trojan downloads another program to the computer and launches it for execution without the user's knowledge. It is a Windows application (PE EXE file) and is 56 320 bytes in size. It is packed using an unknown packer and is written in C++.

Installation

After launching, the Trojan checks the name of its original file. If the name of the malware's executable file does not contain the string "sdcml.exe", it copies its executable file to the current user's temporary files directory under the name:

%Temp%\<rnd>\<rnd2>sdcml.exe
where rnd and rnd2 are random sequences of letters. It then launches a copy of its file for execution. In order to ensure that it is launched automatically each time the system is restarted, the Trojan adds a link to its executable file in the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"<rnd3>"="%Temp%\<rnd>\<rnd2>sdcml.exe"
where rnd3 is a random sequence of letters.


Payload

To ensure that its process is unique within the system, the Trojan creates a unique ID with the name:

M192A9959A495455c9A91F31AD22B6833
To obtain additional parameters, the malware connects to the malicious user's server, sending an HTTP request of the following format in cycles of 30-second intervals:
GET /mod/ HTTP/1.1
User-Agent: Microsoft Internet Explorer
Host: ai***hk.com
Connection: Keep-Alive
At the time of writing, this link was inactive.

After obtaining additional data from the server, the Trojan obtains access to the reading and writing of files located on the ftp server:

ftp://ai***hk.com/mod
The malware also searches for the following strings:
index
indix
default
main
home
login
auth
user
check
head
headerA
footer
top
start
counters
redirect
go
in
out
feedback
feed
contact
support
page
news
blog
forum
stat
process
upload
payment
test
restore
in files with the extensions:
php
htm
html
aspx 
and also in the files "htm.php" and "html.php".


Removal instructions

If your computer does not have an antivirus, and is infected by this malicious program, follow the instructions below to delete it:

  1. Use Task Manager to terminate the process "iexplore.exe".
  2. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
  3. Delete the following system registry key parameter:
    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "<rnd3>"="%Temp%\<rnd>\<rnd2>sdcml.exe"
    
  4. Delete the following file:
    %Temp%\<rnd>\<rnd2>sdcml.exe
  5. Empty the Temporary Internet Files directory, which contains infected files (How to delete infected files from Temporary Internet Files folder?):
    %Temporary Internet Files%
  6. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

MD5: d18a551353ff197b67c361dec11bdbce
SHA1: c8d3e381da1d7bd78041b2e0bfd45982cb317fbd


Bookmark and Share
Share
Trojan-Downloader

Programs classified as Trojan-Downloader download and install new versions of malicious programs, including Trojans and AdWare, on victim computers. Once downloaded from the Internet, the programs are launched or included on a list of programs which will run automatically when the operating system boots up.

Information about the names and locations of the programs which are downloaded are in the Trojan code, or are downloaded by the Trojan from an Internet resource (usually a web page).

This type of malicious program is frequently used in the initial infection of visitors to websites which contain exploits.


Other versions