Trojan.Dialer.CJ

( Trojan.Win32.Dialer.cj, TR/Dialer.CJ.82, Trojan:Win32/Adialer.NC )

SYMPTOMS:

The security level of the Internet Zone in Internet explorer is reduced. There is a new dial-up connection present on the system with a premium number associated with it.

TECHNICAL DESCRIPTION:

The malware consists of a packed executable with the size of approximately 27 Kb. It performs the following action once launched in execution:

• Lowers the security settings on the Internet Zone for Internet Explorer.
• Creates a new dial-up connection with a premium number.
• If a modem is attached to the computer, tries to dial the given number
• Opens in Internet Explorer a link hard coded in the malware's body. This opens up the way for further infections given the fact that the security settings for Internet Explorer were previously lowered.

Removal instructions:

Please let BitDefender delete disinfect your files. The connection with the premium number must be deleted manually. The security settings for the Internet Zone of Internet Explorer must be restored manually.

ANALYZED BY:

Attila-Mihály Balázs, virus researcher