Content
Downloader-ARR
- Type
- Trojan
- SubType
- Downloader
- Discovery Date
- 12/01/2005
- Length
- Minimum DAT
- 4641 (12/01/2005)
- Updated DAT
- 6546 (11/30/2011)
- Minimum Engine
- 5.1.00
- Description Added
- 12/01/2005
- Description Modified
- 09/29/2006 2:18 PM (PT)
Tab Navigation
Characteristics
Downloaders are designed to pull files from a remote website and execute the files that have been downloaded.
This trojan configures itself to load at startup.
System Changes
Files Added
- %SYSTEMDIR%\dmltt.exe
- %SYSTEMDIR%\dmbxb.exe
Registry
The following registry entries are added:
- hkey_local_machine\software\microsoft\windows\currentversion\ruins
- hkey_local_machine\software\microsoft\windows\currentversion
\ruins\ttlmd="31-4f-00-00-00-03-38-08-10-e2-53-64-43-11-00-00-00" - hkey_local_machine\software\microsoft\windows\currentversion
\ruins\bxbmd="b5-2b-00-00-8c-bf-b2-80-a2-5e-df-e0-cf-11-00-00-00" - hkey_local_machine\software\microsoft\windows\currentversion\run
\dmltt.exe="%SYSTEMDIR%\dmltt.exe" - hkey_local_machine\software\microsoft\windows\currentversion\run
\dmbxb.exe="%SYSTEMDIR%\dmbxb.exe"
Symptoms
Presence of the files and registry entries mentioned.
Method of Infection
N/A. Downloaders are not viruses, and as such do not themselves contain any method to replicate. However they may themselves be downloaded by other viruses and/or Trojans to be installed on the user's system.
Many of these additionally are mass spammed by the author to entice people into double-clicking on them.
Alternatively they may be installed by visiting a malicious web page (either by clicking on a link, or by the website hosting a scripted exploit which installs the Downloader onto the user's system with no user interaction.
Removal
All Users:
Use specified engine and DAT files for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Variants
Variants
N/A
All Information
Overview -
Downloader serves as a downloading/updating component for other malicious files.
Generally it makes Internet connectons without user's knowledge and downloads malicious contents.
Aliases
- Trj/Ruins.MB (Panda)
- Troj/RuinDl-Gen (Sophos)
- Trojan.Win32.Small.fb (Kaspersky)
Characteristics
Characteristics -
Downloaders are designed to pull files from a remote website and execute the files that have been downloaded.
This trojan configures itself to load at startup.
System Changes
Files Added
- %SYSTEMDIR%\dmltt.exe
- %SYSTEMDIR%\dmbxb.exe
Registry
The following registry entries are added:
- hkey_local_machine\software\microsoft\windows\currentversion\ruins
- hkey_local_machine\software\microsoft\windows\currentversion
\ruins\ttlmd="31-4f-00-00-00-03-38-08-10-e2-53-64-43-11-00-00-00" - hkey_local_machine\software\microsoft\windows\currentversion
\ruins\bxbmd="b5-2b-00-00-8c-bf-b2-80-a2-5e-df-e0-cf-11-00-00-00" - hkey_local_machine\software\microsoft\windows\currentversion\run
\dmltt.exe="%SYSTEMDIR%\dmltt.exe" - hkey_local_machine\software\microsoft\windows\currentversion\run
\dmbxb.exe="%SYSTEMDIR%\dmbxb.exe"
Symptoms
Symptoms -
Presence of the files and registry entries mentioned.
Method of Infection
Method of Infection -
N/A. Downloaders are not viruses, and as such do not themselves contain any method to replicate. However they may themselves be downloaded by other viruses and/or Trojans to be installed on the user's system.
Many of these additionally are mass spammed by the author to entice people into double-clicking on them.
Alternatively they may be installed by visiting a malicious web page (either by clicking on a link, or by the website hosting a scripted exploit which installs the Downloader onto the user's system with no user interaction.
Removal -
Removal -
All Users:
Use specified engine and DAT files for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Additional Windows ME/XP removal considerations
Variants
Variants -
N/A