TROJ_DRPR.AL

This Trojan may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Arrival Details

This Trojan may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This Trojan drops and executes the following files:

• %User Temp%\softpro.dll - detected as TROJ_STARTPA.SW
• %User Temp%\sogou_pinyin_mini_5254.exe
• %User Temp%\silentOverwrite - empty file
• %User Temp%\Baidu-Toolbar.exe
• %User Temp%\SeFastInstall2_3290.exe
• %User Temp%\coopen_setup_100225.exe
• %User Temp%\install.tmp - encrypted file used by SOFTPRO.DLL

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

Dropping Routine

This Trojan executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Other Details

Based on analysis of the codes, it has the following capabilities:

• Displays advertisements and toolbars because of the following dropped files:
  • %User Temp%\sogou_pinyin_mini_5254.exe
  • %User Temp%\Baidu-Toolbar.exe
  • %User Temp%\SeFastInstall2_3290.exe
  • %User Temp%\coopen_setup_100225.exe
  The said files may or may not be malicious, depending on how users view them when executed.

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)