Aliases

Trojan-Downloader.Win32.IstBar.gen (Kaspersky Lab) is also known as: Trojan.StartPage.61 (Doctor Web),   TR/Dldr.IstBar.G.1 (H+BEDV),   Trojan.Downloader.Istbar-38 (ClamAV)

Detection added	Dec 01 2004
Description added	Apr 12 2005
Behavior	TrojanDownloader

Technical details

This is a generic detection for a family of Trojan downloaders. These malicious programs will download a range of other malicious programs from the Internet to the victim machine.

Programs from this family may create the following registry values:

[HKLM\SOFTWARE\DR_S]
[HKCU\SOFTWARE\DR_S]
[HKLM\SOFTWARE\Classes\drs.n\uID]
[HKCU\SOFTWARE\Classes\drs.n\uID]

All programs in this family have an identical way of getting URLs from where they will download additional malicious programs. Every 30 minutes a program from this family will download a file from, for instance, http://www.adzhooter.com/DR_S/gSD.html. This file contains addresses which direct the Trojan to other sites where it can download additional malicious programs: