Trojan.Downloader.JKIJ

( Trojan-Downloader.Win32.Murlo.nn, Trj/Downloader.UCP, TROJ_MURLO.BA )

SYMPTOMS:

- presence of the following files:
    %windir%\Temp\wmsetup.dll
    %temp%\wmsetup.dll
    %temp%\QQ_Update.cab

TECHNICAL DESCRIPTION:

- the trojan is a DLL which is dropped and loaded by another malware;
- its only action is to download a trojan to %temp%\QQ_Update.cab which is heuristically detected by BitDefender as BehavesLike:Win32.ExplorerHijack;
- after executing the new trojan it moves itself to %temp%\qqsXXXX.tmp\qqsXXXX.tmp and schedules to be deleted at next reboot (XXXX represents a string of at least 1 and maximum 4 hex digits);
- although it seems as a simple trojan, it is very dangerous because the downloaded trojan also downloads over 40 other malware.

Removal instructions:

Please let BitDefender delete your malware files.

ANALYZED BY:

Vlad Constantin Ilie, virus researcher