Troj/Dloader-QD is a downloader Trojan for the Windows platform.
Troj/Dloader-QD includes functionality to download, install and run new software. When first run Troj/Dloader-QD copies itself to <System>\downloader.exe. The Trojan attempts to download a file from a predefined URL as <windows>\svchosts.exe. The downloaded file is detected by Sophos as Troj/Bancb-Fam.
The following registry entry is created to run downloader.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
cartao =
<path of Trojan>