Trojan-Downloader_Win32_Agent.nmi

Detection date: August 21, 2008

Specifications

The Trojan downloads another program through the Internet and launches it on the victim's computer without the user's knowledge or permission. It is an EXE file with size ranging from 18KB to 47KB.

Work

The Trojan will contact the following website:

http://xanjan.cn/*****update.txt

This is a list of files that will be downloaded to your computer. This list file will be downloaded to the directory:

% Application Data% update.dat

The links in the file are encrypted. Trojans will then download the files from the link in the file and save them at:

% Application Data% .exe

is an acronym for random strings of numbers and letters, for example: m2zpp.exe , 43m66m.exe .

After the files have been downloaded to the computer, they will start executing and then delete themselves. If the downloaded files are dll files, they will register themselves to the system registry and be started every time the system works.

After the distribution has been completed, the original Trojan deletes itself from the victim's computer.

Instructions for removal

a complete antivirus solution, follow these instructions to remove malicious code from your computer:

1. Delete the original Trojan file (file location depends on how it originally entered the victim computer).

2. Update the virus database and perform a full computer scan.