Trojan.Popdis

Trojan.Popdis is a Trojan horse that modifies the registry keys and overwrites the Hosts file. The file, Addcls.exe (detected as Downloader.Trojan), downloads Trojan.Popdis.

The Trojan.Popdis executable usually uses the file name Dp.dll, but other file names are possible.

Protection

• Initial Rapid Release version April 10, 2004
• Latest Rapid Release version August 20, 2008 revision 017
• Initial Daily Certified version April 10, 2004
• Latest Daily Certified version January 20, 2009 revision 048
• Initial Weekly Certified release date April 14, 2004

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 50 - 999
• Number of Sites: More than 10
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Difficult

Damage

• Damage Level: Medium

Distribution

• Distribution Level: Low