Summary

The trojan downloader family consists of dozens of different variants. The main characteristic of these downloaders is that they hiddenly download and run executable files on a user's computer.

Many of these downloaders are compressed with different file compressors to reduce their size and to hide their contents from users' eyes.

These Trojans are typically distributed via email attachments.

Disinfection

For the disinfection instructions for this type of malware please refer to this webpage:

http://www.f-secure.com/v-descs/trojdown.shtml

Additional Details

VARIANT:

Trojan-Downloader.Win32.Vidlo.q

This variant was distributed widely in July 2005, as fake bill from Deutsche Telekom. The filename used was rechnung.pdf.exe.

Writeup: Mikko Hypponen, July 20th, 2005;