Trojan-Downloader.Win32.Agent.fdi

Technical Details

This Trojan downloads another program to the computer and launches it for execution without the user's knowledge. It is a Windows application (PE EXE file). It is 16 384 bytes in size. It is written in C++.

Payload

Once launched, the Trojan determines the location of MS Internet Explorer and launches it for execution. It uses the "IEFrame" window class name to determine the process ID and uses this to open the current object of the process. It then injects its malicious script into the address space of the "iexplore.exe" process. Once the injected script is launched, the Trojan in cycles of 1055 seconds downloads files located at the following URLs:

http://218.***.159/qq.exe
http://www.we***163.cn/root/vip.exe

and saves them under the following names, respectively:

%Documents and Settings%\All Users\ieinst21.exe
%Documents and Settings%\All Users\ieinst1.exe

It then launches the downloaded files for execution. At the time of writing, these links were inactive.

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Use to terminate the "iexplore.exe" process.
2. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
3. Delete the following files, if they are present:

   %Documents and Settings%\All Users\ieinst21.exe
   %Documents and Settings%\All Users\ieinst1.exe