McAfee > Theat Center > Virus Detail Page

Overview

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Aliases

• TrojanDropper.JS.Mimail (AVP)

Characteristics

The purpose of this trojan is to simply extract and run another program. This extracted program changes the default start page of Internet Explorer.

This trojan arrives in an e-mail message with a ZIP file called reg.zip. The ZIP file contains the file reg.html. If the reg.html file is opened (it does not open automatically in known email attachments), it creates a file named reg.exe, which is contained inside reg.html in MIME-encoded format, and runs it. This reg.exe file is a Start Page changing trojan, detected as StartPage-K with the 4267 DATs.

Symptoms

The e-mail message is written in Russian, and contains the attachment reg.zip.

Method of Infection

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email spam, etc.

Removal

Detection is included in our BETA DAT files and will also be included in the next scheduled DAT release. In addition to the DAT version requirements for detection, the specified engine version (or greater) must also be used.

Additional Windows ME/XP removal considerations

Variants

Variants

N/A

All Information

Overview -

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Aliases

• TrojanDropper.JS.Mimail (AVP)

Characteristics

Characteristics -

The purpose of this trojan is to simply extract and run another program. This extracted program changes the default start page of Internet Explorer.

This trojan arrives in an e-mail message with a ZIP file called reg.zip. The ZIP file contains the file reg.html. If the reg.html file is opened (it does not open automatically in known email attachments), it creates a file named reg.exe, which is contained inside reg.html in MIME-encoded format, and runs it. This reg.exe file is a Start Page changing trojan, detected as StartPage-K with the 4267 DATs.

Symptoms

Symptoms -

The e-mail message is written in Russian, and contains the attachment reg.zip.

Method of Infection

Method of Infection -

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email spam, etc.

Removal -

Removal -

Detection is included in our BETA DAT files and will also be included in the next scheduled DAT release. In addition to the DAT version requirements for detection, the specified engine version (or greater) must also be used.

Additional Windows ME/XP removal considerations

Variants

Variants -

N/A