Description:
This memory-resident Trojan arrives on a system as an attachment to mass-mailed email messages of WORM_BAGLE.GP.
Once a user executes the said attachment, it drops its copy on the affected machine. Presence of the file ANTI_TROJ.EXE indicates infection.
It looks for the legitimate Windows file NTIMAGE.GIF, which it displays using the default image viewer, in the Windows system folder of affected machines. It does the said routine to make it appear that the execution of this Trojan's dropped file only opens the said .GIF file.
This Trojan creates a registry entry as part of its installation routine, as well as two other registry entries to ensure that it executes every system startup.
Moreover, it downloads files from a list of URLs. The said routine puts users on risk of downloading possibly-malicious files.
For additional information about this threat, see:
Solution
Technical Details
Description created: Dec. 22, 2005 9:15:13 AM GMT -0800
Search a new malware
Tell us how we did. Take our quick survey.
|
Save & Share
