Trojan-Downloader.JS.Agent.gsv Description

JavaScript Trojans are designed usually to direct computer users to malware-laced websites. Malware-laced websites will use malicious components such as the BlackHole Exploit Kit to take advantage of vulnerabilities in the infected computer in order to infect them with malware. While most of these JavaScript redirect Trojans inject an iFrame which takes the victim's computer to an attack website, the Trojan-Downloader.JS.Agent.gsv Trojan uses a different approach. Trojan-Downloader.JS.Agent.gsv generates a domain name with a seemingly random URL. To generate this domain name it uses the current date. Although ESG security analysts have observed this approach before, it is not common in the case of browser redirect Trojans such as the many variants of Java redirect scripts used in spam email.

The Trojan-Downloader.JS.Agent.gsv Infection

The kind of pseudo-random domain generation that the Trojan-Downloader.JS.Agent.gsv uses has been observed in botnets and backdoor Trojans generating domains for command and control servers. This approach is quite new in the case of browser redirect Java scripts. The Trojan-Downloader.JS.Agent.gsv itself is a Trojan downloader that uses a malicious iFrame that is attached to an HTML file. It generates a random domain name with sixteen characters, with a .RU ending (indicating that the domain is located in the Russian Federation).

The Trojan-Downloader.JS.Agent.gsv HTML file is encrypted; both the malicious iFrame and the harmless content. This is definitely a problem. While other malicious JavaScript redirect Trojans would inject obfuscated code into an HTML file, making the different between the malicious content and the harmless content apparent, the Trojan-Downloader.JS.Agent.gsv obfuscates the whole HTML file as well. This means that this Trojan infection can be difficult to detect and remove while leaving the affected website intact.

Why the Trojan-Downloader.JS.Agent.gsv Generates New Domains

The technique of randomly generating new domain names allows criminals to avoid blacklisting. Every day, the Trojan-Downloader.JS.Agent.gsv generates a new domain name. This means that adding malicious URLs to a blacklist can be pointless due to the fact that new ones are generated constantly. Fortunately, these domain names are not entirely random and use an algorithm that takes its seed from the current date. With this information, PC security researchers can predict future domain names, allowing them to blacklist them preemptively. If you administrate a website, it is important to update your website's software and to apply all available security patches. ESG security analysts also advise changing all sensitive passwords, especially for FTP, SFTP and SSH accounts.

Site Disclaimer is not associated, affiliated, sponsored or owned by the malware creators or distributors mentioned on this article. This article should NOT be mistaken or confused in being associated in any way with the promotion or endorsement of malware. Our intent is to provide information that will educate computer users on how to detect, and ultimately remove, malware from their computer with the help of SpyHunter and/or manual removal instructions provided on this article.

This article is provided "as is" and to be used for educational information purposes only. By following any instructions on this article, you agree to be bound by the disclaimer. We make no guarantees that this article will help you completely remove the malware threats on your computer. Spyware changes regularly; therefore, it is difficult to fully clean an infected machine through manual means.

Leave a Reply

Please DO NOT use this comment system for support or billing questions. For SpyHunter technical support requests, please contact our technical support team directly by opening a customer support ticket via your SpyHunter. For billing issues, please refer to our "Billing Questions or Problems?" page. For general inquiries (complaints, legal, press, marketing, copyright), visit our "Inquiries and Feedback" page.