This trojan was found by Virus Patrol in several newsgroup postings as the filename "QuickFlick.mpg.exe". This trojan downloads another trojan from the Internet and runs it silently. The downloaded trojan is identified as BackDoor-G2. A security group known as "NETSEC" alerted the Internet community about BackDoor-G2 by calling it "Serbian Badman Trojan (TSB Trojan".
Users most affected by this trojan are not running AntiVirus software. Other news stories suggest that the controlling trojan which is downloaded is a new threat - it is not. Although the trojan known as "Downloader" is new, the file downloaded is a known trojan.

This is a trojan which downloads components from the Internet via http transfer. This method makes it dangerous in that the transferred file could be anything.

When run, it connects via http to a host then downloads *and* silently runs the real trojan. Although the icon for initial trojan which downloads the second trojan is a standard EXE icon, the file which is downloaded is a movie player icon. If a user trusts the icon rather than the file extension, they will be deceived.

Symptoms
Open port connection. Use NETSTAT -A to determine if a port is open to the Internet which is not known or assigned to a known running application.

Method Of Infection
This trojan was created using a construction kit known as "WWWPW".

If this trojan is executed, it will attempt to connect to a predetermined url and download a predetermined file name. At present, this file name contains a remote access trojan known as BackDoor-G2 (Sub7).

Removal Instructions
Script,Batch,Macro and non memory-resident: Use specified engine and DAT files for detection and removal.

Note1- Microsoft has released an for Outlook as an email attachment security update. For a list of attachments blocked and a general FAQ, visit this link.
Additionally, Network Administrators can configure this update using an available tool - visit this link for more information.

Note2- It is very common for macro viruses to disable options within Office applications for
example in Word, the macro protection warning commonly is disabled. After cleaning macro viruses, ensure that your previously set options are again enabled.

PE,Trojan,Internet Worm and memory resident:
Use specified engine and DAT files for detection. To remove, boot to MS-DOS mode or use an
emergency boot diskette and use the command line scanner such as "SCANPM C: /CLEAN /ALL"