Troj/Dloader-RA is a Trojan for the Windows platform.
Troj/Dloader-RA includes functionality to download, install and run new
software.
When first run Troj/Dloader-RA copies itself to <System>\popcorn72.exe and
creates the following files:
\%CurrentFolder%\1.dat
\%CurrentFolder%\2.dat
\%CurrentFolder%\3.dat
<System>\msblank.html
<System>\winctrl16.exe
<System>\winctrl32.exe
<System>\winctrl64.exe
The following registry entry is created to run popcorn72.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ControlPanel
<System>\popcorn72.exe rundll.dll,LoadMouseProfile
Troj/Dloader-RA changes the Start Page for Microsoft Internet Explorer by
setting the registry entry:
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page