Category: Viruses and Spyware
Type: Trojan
Prevalence: Small Number of Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

Troj/Dloader-MB is a Trojan downloader.

In order to run automatically when Windows starts up the Trojan copies
itself to the file mcc.exe in the Windows system folder and adds the following
registry entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Multimedia Codecs
= C:\Windows\System32\mcc.exe

Troj/Dloader-MB downloads a text file from a preconfigured URL to links.tmp in
the Windows temporary folder. The Trojan then registers itself as a service
process and periodically performs actions listed in the downloaded file. These
actions can be either URLs (which are opened in Internet Explorer) or
arbitrary commands.

Troj/Dloader-MB also creates a set of registry entries for its own use beneath
HKCU\Software\Media Codecs\DDMMYYYY\

(where DDMMYYYY represents the date on which the Trojan was run)