We got reports of this trojan downloader on Jan 27th 2006. The trojan downloader was spammed to a large amount of email addresses. The downloader is programmed to download a backdoor from website.
Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.
Find the latest advice in our Community Knowledge Base.
See the manual for your F-Secure product on the Help Center.
Submit a file or URL for further analysis.
The trojan's file is a PE executable file packed with FSG file compressor. According to reports, the trojan was spammed in messages that looked like this:
Subject: YOUR BILL PAYMENT NOT APPROVED!Attachment: BILL_235563880.EXE
When the attachment is run, the trojan first tries to add its file to Windows XP built-in firewall policy using the following key:
After that, the trojan tries to download and activate backdoor from web site dalvabrothersinc.com . The backdoor is already detected as Trojan.Win32.Delf.qx with FSAV updates version 2005-12-23_1.