Overview
Downloader serves as a downloading/updating component for other malicious files.
Generally it makes Internet connectons without user's knowledge and downloads malicious contents.
|
Minimum DAT
4826 (2006-08-10) Updated DAT5548 (2009-03-09) |
Minimum Engine
5.1.00 File LengthN/A |
Description Added
2006-08-10 Description Modified2006-09-29 |
Malware Proliferation
Characteristics
This trojan configures itself to load at startup.
Symptoms
When executed the trojan creates copies of itself in the victim's system and configures itself to load at system startup as well.
System Changes
Files Added
- c:\documents and settings\%USER%\local settings\temp\3e6285.dmp
- c:\documents and settings\%USER%\local settings\temp\wer2.tmp.dir00\appcompat.txt
- %SYSTEMDIR%\wdfmgr32.exe ( 5242 bytes )
Registry
The following registry keys are created:
- hkey_local_machine\software\microsoft\windows\currentversion\run
\wdfmgr32="%SYSTEMDIR%\wdfmgr32.exe"
Method of Infection
N/A. Downloaders are not viruses, and as such do not themselves contain any method to replicate. However they may themselves be downloaded by other viruses and/or Trojans to be installed on the user's system.
Many of these additionally are mass spammed by the author to entice people into double-clicking on them.
Alternatively they may be installed by visiting a malicious web page (either by clicking on a link, or by the website hosting a scripted exploit which installs the Downloader onto the user's system with no user interaction.
Removal
All Users:
Use specified engine and DAT files for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Variants