Windows Infection Deleting The Program Files Content

**Anilrgowda** · 26-Nov-2007, 11:38 PM

Security company Trend Micro today released an advisory concerning TROJ_AGENT.ADNA, a new Trojan horse which attempts to remove a file usually placed inside Because the infection is pretty new, there's no report concerning the number of the affected computers yet but the consumers are still advised to keep their antiviruses up-to-date with the latest virus definitions and apply the latest patches as soon as they are released.
Program Files, a folder created by Windows which usually stores the content needed by the installed applications. According to the advisory, the infection affects most versions of Microsoft's operating system including Windows 98, ME, NT, 2000, XP and Server 2003. In addition to the Program Files removal, the Trojan also attempts to modify some registry entries which could change the way your firewall works and make it useless in front of other web attacks.
"It also attempts to delete the file TORUN.EXE, if found in the Windows Program Files folder," Trend Micro added. Just like many other infections, the Trojan creates a new registry entry in order to start every time the operating system is loaded. In case you're wondering how you can get infected you should know that this Trojan is usually installed by another malware or it can be downloaded through infected websites without users' approval.
"This Trojan arrives as a file downloaded unknowingly by a user when visiting malicious Web sites," Trend Micro wrote in the security advisory. "It drops copies of itself. It attempts to delete a certain file from the Windows Program Files folder. Moreover, it attempts to disable certain firewall applications by deleting registry entries."
Having a look at the ratings mentioned by Trend Micro, you might believe the Trojan is not as dangerous as it sounds because it only has a damage potential and a distribution potential set too low.

26-Nov-2007, 11:38 PM	#1 (permalink)
Anilrgowda Administrator Posts: 18,704 Join Date: Jan 2006 Rep Power: 10 IM:	Windows Infection Deleting The Program Files Content Security company Trend Micro today released an advisory concerning TROJ_AGENT.ADNA, a new Trojan horse which attempts to remove a file usually placed inside Because the infection is pretty new, there's no report concerning the number of the affected computers yet but the consumers are still advised to keep their antiviruses up-to-date with the latest virus definitions and apply the latest patches as soon as they are released. Program Files, a folder created by Windows which usually stores the content needed by the installed applications. According to the advisory, the infection affects most versions of Microsoft's operating system including Windows 98, ME, NT, 2000, XP and Server 2003. In addition to the Program Files removal, the Trojan also attempts to modify some registry entries which could change the way your firewall works and make it useless in front of other web attacks. "It also attempts to delete the file TORUN.EXE, if found in the Windows Program Files folder," Trend Micro added. Just like many other infections, the Trojan creates a new registry entry in order to start every time the operating system is loaded. In case you're wondering how you can get infected you should know that this Trojan is usually installed by another malware or it can be downloaded through infected websites without users' approval. "This Trojan arrives as a file downloaded unknowingly by a user when visiting malicious Web sites," Trend Micro wrote in the security advisory. "It drops copies of itself. It attempts to delete a certain file from the Windows Program Files folder. Moreover, it attempts to disable certain firewall applications by deleting registry entries." Having a look at the ratings mentioned by Trend Micro, you might believe the Trojan is not as dangerous as it sounds because it only has a damage potential and a distribution potential set too low. ------------------

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)