(Trojan.Bredolab, TrojanDownloader:Win32/Waledac.C, Trojan:W32/Agent.NFY)
A computer has been infected with Trojan.Downloader.Bredolab.CW
* a process with random number name (e.g. 88359235.exe) appears in task manager;
* warnings that the computer is "infected with dangerous viruses" are shown constantly.
Please let BitDefender disinfect your files.
Daniel RADU, Senior Virus Researcher
is a standard downloader of rogue malware. It is distributed in a packed form, protected by custom packers with anti-emulator and anti-debugging tricks to avoid detection by antivirus scanners. The structure and code of these packers are constantly changing to evade signatures.
Once executed it tries to download two files from different addresses
Each file is downloaded in %system32%\Temp\
folder with a random name and executed from there:
* _ex-[Random Number].exe