Name :	Trojan-Downloader:W32/Tracur.J
Detection Names :	Trojan.Spy.Agent.OEV Trojan-downloader.win32.agent.dter
Category:	Malware
Type:	Trojan-Downloader
Platform:	W32

A trojan that secretly downloads malicious files from a remote server, then installs and executes the files.

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.

Trojan-Downloader:W32/Tracur.J identifies a malicious DLL file that installs a malicious plug-in for the Internet Explorer and/or Mozilla Firefox web browsers in order to redirect searches to an unsolicited website.

This file is probably dropped by a separate dropper program.


Installation

The DLL file is registered as a Browser Helper Object (BHO) with the Internet Explorer web browser. If the Mozilla Firefox web browser is installed, the file will also install a malicious extension (the browser's equivalent of a BHO) for Firefox.


Activity

Once installed, the BHO in either web browser will redirect searches made using various search engines to:


The site may host more malicious content.

The list of targeted search engines is hard-coded; targeted search engines are:



Registry Changes

During installation, Tracur.J creates the following registry keys: