Name :	Trojan:W32/Agent.DKJC
Detection Names :	Trojan.Agent.AQLJ Trojan-Spy.Win32.Zbot.amwm
Aliases :	PWS:Win32/Zbot.SV (Microsoft)
Category:	Malware
Type:	Trojan
Platform:	W32

Also known as a trojan horse program, this is a deceptive program that performs additional actions without the user's knowledge or permission. It does not replicate.

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.

Trojan:W32/Agent.DKJC identifies files involved in a recent spam run. On running the malicious file, a Zeus/Zbot variant is installed.

This malware is further discussed in our Labs Weblog:



Distribution

The spam run involves malicious ZIP files distributed using varying file names. Names seen so far include:



Activity

Manually executing the malicious ZIP file causes a variant from the Trojan-Spy:W32/Zbot family to install on the machine. For more information on Zeus/Zbot capabilities, please see the Trojan-Spy:W32/Zbot description.

The malware also downloads additional components from two Russian websites:


Note: Browsing Protection blocks access to these malicious sites.