Troj/Dloader-NZ is a downloading Trojan for the Windows platform.
Troj/Dloader-NZ creates the following registry entry to run itself automatically on log-on:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CacheLoader
<path of filename>
Troj/Dloader-NZ attempts to download an executable from a preconfigured URL to a randomly named file with ".tmp" extension. It creates "Cache" subfolder of the Windows folder. If this download is interrupted Troj/Dloader-NZ will resume at the next logon.
Once the file has finished being downloaded, it is moved to the file "Security iGuard.exe" in the Program Files folder and executed.
Troj/Dloader-NZ creates the following registry entries for its own use:
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer
CachedFileName
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer
CachedActualFileSize