Troj/Dloader-ET is a downloader Trojan for the Windows platform. The Trojan
will create a folder called golumm under the Windows system folder and copy
itself there as services.exe. Troj/Dloader-ET will then download and execute
files from http://www.newiframe.biz. Some of the files downloaded are
recognized malware while others are configuration files telling the Trojan
other files to download and execute.
Every 60 seconds Troj/Dloader-ET will contact http://www.newiframe.biz to
download a file listing urls to display and executables to download and
execute.
Troj/Dloader-ET will create the following registry entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
golumm
<Windows system folder>\golumm\services.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
sysinit
<Windows system folder>\golumm\services.exe