Malware type: Trojan

Aliases: No Alias Found

In the wild: Yes

Destructive: No

Language: English

Platform: Windows 98, ME, NT, 2000, XP, Server 2003

Encrypted: No

Description: 

This Trojan may be dropped by the following malware:

• WORM_DOWNAD.AD
• WORM_DOWNAD.E

It is dropped in the main system folder as 0{random number}.TMP. It is loaded in the memory by its main worm component in order to create a device object named TcpIp_Perf and link the said object to the loaded TCPIP.SYS in memory. This aids in supporting its mother component in limiting the maximum TCP half-connection attempts in systems running Windows XP Service Pack 2.

Once it is loaded in the memory and becomes resident in the Windows environment, the main worm component deletes this file.

For additional information about this threat, see:
Solution
Technical Details

Description created: Apr. 5, 2009 8:19:22 PM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.