Alias:Trojan.Downloader.Small.AIQ,Trojan.DownLoader.1588
Type:Worm 
Size:4.608 bytes 
Origin: 
Date:03-22-2005 
Damage: 
VDF Version:6.30.00.42 
Danger:Low 
Distribution:Low 

General DescriptionAffected Platforms:
* Windows 95
* Windows 98
* Windows ME
* Windows NT
* Windows 2000
* Windows XP
* Windows Server 2003

SymptomsDamage Routine:
- Downloads files
- Terminates processes

DistributionThis trojan gets executed due to security issues in your web browser. To prevent this, it is recommended to increase the security level in your web browser settings, or to update it.

Technical DetailsThe trojan TR/Dldr.Small.air is a downloader programm, which gets other malwares from the Internet using HTTP-requests. If the trojan downloader is executed, the following files are created on the local computer:

- <%windir%>\mstasks1.exe
- <%windir%>\mstasks2.exe
- <%Windir%>\mstask3.exe
- <%Sysdir%>\paydial.exe
- <%Sysdir%>\systime.exe
- <%Sysdir%>\dktibs.exe
- <%Windir%>\toolbar.exe

The trojan is able to terminate the following processes:

wisadwsfndos.exe
wisadsadndos.exe
intasdsaron.exe
isadsr.exe
lpsadsadt.exe
services.exe
msxmidi.exe
bitmap.tmp
file.exe
exploit.exe
fucker.exe
winmm64.exe
s-PEPE.exe
PEPEmsPE.exe
lpt.exe
ir.exe
intron.exe
intronet.exe
twink64.exe
usb.exe
teur.exe
host32.exe
sidefind.exe
alchem.exe
powerscan.exe
bdl74125.exe
Installer2.exe
ttgkirnl.exe
bargains.exe
WinClt.exe
Winad.exe
istsvc.exe
actalert.exe
optimize.exe
iinstall.exe
fnnmqi.exe
exdl.exe
printer.exe
printer32.exe
ykyrtws.exe
loadclean.exe
telnet.exe

The file <%sysdir%>\drivers\etc\hosts is also changed.
Description inserted by Crony Walker on Tuesday, June 15, 2004

Back . . . .