Trojan.DownLoader.22201
(Downloader.gen.a, Trojan.Downloader.Small.EQE, TR/Dldr.Small.eqe, Downloader.Generic5.GYF, W32/NGVCK.dr.gen, Virus.Win32.Jolla.EPO, TROJ_DLOADER.NUP, TR/Crypt.XPACK.Gen, Parser error, TrojanDownloader:Win32/Murlo.gen, Trojan-Downloader.Win32.Small.eqe, TrojanDownloader:Win32/Troxen!rts, Trojan-Downloader.Win32.Tiny.hn)
Added to the Dr.Web virus database:
2007-05-11
Virus description added:
2007-05-11
Virus Type: Malware Loader
Affected OS: Win95/98/Me/NT/2000/XP
Size: 2 560 bytes
Packed by: -
Technical Information
This malicious program is downloaded from Internet. It installs on infected computer other malicious programs - BackDoor.Bulknet и Trojan.PWS.LDPinch.1755.
At its startup this virus copies Trojan.PWS.LDPinch.1755 into the folder with installed Windows and registers it into the section of system registry autorun:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
system = C:\WINDOWS\csrss.exe
As a result, all passwords which are registered in the system, are going to be stolen.
As a result of BackDoor.Bulknet performance, infected computer will get unique number. Malefactor, in his turn, will get information on ip-address of infected computer and its name. Thus, infected computer can be used by malefactor for spam distribution and for loading other malicious programs.
System recovery information
1. Run Windows in Safe Mode (F8 button when Windows starts)
2. Use disk scanner Dr.Web® or free utility Dr.Web CureIT! in order to scan local discs. Apply “Cure” to all infected files, which have been detected.
3. It is a must to change all passwords, which are registered throughout system.
