Trojan-Downloader.Java.OpenConnection.df

Technical Details

This Trojan downloads files from the Internet without the user's knowledge. It is a Java class file. It is 2555 bytes in size.

Payload

The Trojan code contains a "Ump_45" class file, which downloads a file from the Internet from a link sent to it. The downloaded file is saved in the current user's temporary files directory as

%Temp%\<rnd>.exe

where is a random fractional decimal number from 0 to 1. The Trojan constitutes a Java applet. It is launched from an infected HTML page using an "<APPLET>" tag, for which a link to a downloadable file is sent in parameter named "s".

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Delete the following file:

   %Temp%\.exe

2. Empty the Temporary Internet Files directory, which may contain infected files (see How to delete infected files from Temporary Internet Files folder?).

   %Temporary Internet Files%