McAfee > Theat Center > Virus Detail Page

Overview

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Characteristics

This trojan attempts to download files from a remote site and execute them on the local host.  When run, executable files are downloaded from retardedinternetgeek.com .  At the time of this writing, the following files were located at the download location:

Downloads the following files:

• embioso.exe - 65,536 bytes (AdClicker-O trojan )
• pup.exe - 65,536 bytes (AdClicker-O trojan )

Symptoms

Files specified above dropped on the target machine along with the registry entries as indicated above.

Method of Infection

This purpose of this trojan is simply to download a file from the Internet. It does not self-replicate. Downloader trojans are frequently sent in spammed emails designed to entice the recipient into running the file. Other likely distribution channels for this trojan include via IRC, via peer-to-peer file-sharing networks, as an attachment in newsgroup postings, etc. Trojans may also be received as a result of poor security practices (weak username/password combination on open shares, lack of/or misconfigured firewall protection), or unpatched and vulnerable systems.

Removal

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

Variants

N/A

All Information

Overview -

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Characteristics

Characteristics -

This trojan attempts to download files from a remote site and execute them on the local host.  When run, executable files are downloaded from retardedinternetgeek.com .  At the time of this writing, the following files were located at the download location:

Downloads the following files:

• embioso.exe - 65,536 bytes (AdClicker-O trojan )
• pup.exe - 65,536 bytes (AdClicker-O trojan )

Symptoms

Symptoms -

Files specified above dropped on the target machine along with the registry entries as indicated above.

Method of Infection

Method of Infection -

This purpose of this trojan is simply to download a file from the Internet. It does not self-replicate. Downloader trojans are frequently sent in spammed emails designed to entice the recipient into running the file. Other likely distribution channels for this trojan include via IRC, via peer-to-peer file-sharing networks, as an attachment in newsgroup postings, etc. Trojans may also be received as a result of poor security practices (weak username/password combination on open shares, lack of/or misconfigured firewall protection), or unpatched and vulnerable systems.

Removal -

Removal -

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

Variants -

N/A