Troj/Dloader-FC

Please follow the instructions for removing Trojans.

Troj/Dloader-FC is a downloader Trojan for the Windows platform.

Troj/Dloader-FC connects to the internet and downloads 3 files from a preconfigured address. At the time of writing the downloaded files are detected by Sophos's anti-virus products.

Troj/Dloader-FC copies itself to the Windows system folder and creates the following registry entries to run itself automatically on log-on:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
System =
"<Windows system folder>\kernels32.exe"

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
SystemTools =
"<Windows system folder>\kernels32.exe"

Troj/Dloader-FC alters the following registry entries:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
Shell =
"Explorer.exe C:\<Windows system folder>\kernels32.exe"

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\
DisableTaskMgr =
"1"

Troj/Dloader-FC blocks access to the following websites by adding them to the Windows hosts file. On NT based versions of Windows the hosts file can be found in the subfolder of the system folder called <Windows system folder>\drivers\etc. These added lines can be deleted from the file.

127.0.0.3 x.full-tgp.net
127.0.0.3 counter.sexmaniack.com
127.0.0.3 autoescrowpay.com
127.0.0.3 www.autoescrowpay.com
127.0.0.3 www.awmdabest.com
127.0.0.3 www.sexfiles.nu
127.0.0.3 awmdabest.com
127.0.0.3 sexfiles.nu
127.0.0.3 allforadult.com
127.0.0.3 www.allforadult.com
127.0.0.3 www.iframe.biz
127.0.0.3 iframe.biz
127.0.0.3 www.newiframe.biz
127.0.0.3 www.vesbiz.biz
127.0.0.3 vesbiz.biz
127.0.0.3 www.pizdato.biz
127.0.0.3 www.aaasexypics.com
127.0.0.3 aaasexypics.com
127.0.0.3 www.virgin-tgp.net
127.0.0.3 virgin-tgp.net

Troj/Dloader-FC attempts to delete the following Windows files:

<Windows system folder>\host32.exe
<Windows system folder>\telnet.exe.tmp
<Windows system folder>\mouse.exe
<Windows system folder>\com.exe
<Windows system folder>\fnnmqi.exe
<Windows system folder>\exdl.exe
<Windows system folder>\exe2bin.exe
<Windows system folder>\exul.exe
<Windows system folder>\fastopen.exe
<Windows system folder>\mscdexnt.exe
<Windows system folder>\printer32.exe
<Windows system folder>\ykyrtws.exe
<Windows system folder>\lpt.exe
<Windows system folder>\ir.exe
<Windows system folder>\intron.exe
<Windows system folder>\intronet.exe
<Windows system folder>\intron.exe
<Windows system folder>\twink64.exe
<Windows system folder>\usb.exe
<Windows system folder>\intron.exe
<Windowsfolder>\alchem.exe
<Windowsfolder>\adp8027_ISEARCHTECH5.exe
<Windowsfolder>\preInsTT.exe
<Windowsfolder>\preInsln.exe
<Windowsfolder>\preInMPP.exe
<Windowsfolder>\loadclean.exe

as well as files in the folder

<Program Files folder>\WebSiteViewer

if such a folder exists.