Troj/Dloader-IX is a downloading Trojan for the Windows platform.
Troj/Dloader-IX creates the following registry entry to run itself automatically on log-on:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
CacheLoader
<filename>
(where <filename> is the full path to the Trojan executable)
Troj/Dloader-IX attempts to download an executable from a preconfigured URL to a randomly named file in the "Cache" subfolder of the Windows folder. If this download is interrupted Troj/Dloader-IX will resume at the next logon.
Once the file has finished being downloaded, it is moved to the file "Security iGuard.exe" in the Program Files folder and executed.
Troj/Dloader-IX creates the following registry entries for its own use:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
CachedFileName
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
CachedActualFileSize