TROJ_DLOAD.XPL

This Trojan may be dropped by other malware.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system. As of this writing, the said sites are inaccessible.

Arrival Details

This Trojan may be dropped by the following malware:

• TROJ_ARTIEF.XPL

Installation

This Trojan injects codes into the following process(es):

• IExplore.exe

Autostart Technique

This Trojan drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\dns.exe

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

Download Routine

This Trojan accesses the following websites to download files:

• http://{BLOCKED}1.{BLOCKED}0.202.198/jp/soft2.rar

It saves the files it downloads using the following names:

• %Windows%\tasks\conime.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

As of this writing, the said sites are inaccessible.

NOTES:

It connects to the following URL to inform a remote malicious user of its installation:

• http://{BLOCKED}.{BLOCKED}.202.198/jp/news2.asp?id={random}host:{hostname}user:{username}OS:{OS}vm:{vm}proxy:{proxy}