February 2, 2008

Trojan Arposon - ARP poisoning attack


Trojan.Arposon is a Trojan horse that performs an ARP poisoning attack in order to download a copy of W32.Pagipef.I onto the compromised computer.It may arrive on the computer as the following file:"%CurrentFolder%\alg.exe". This Trojan Gatheres the local subnet address and runs an ARP positioning attack on local network to infect other computer.


Source : Symantec.com

2 comments:

Anonymous said...

Thnx for d info, but i really would lyk to know if it is necessary to delete the file "alg.exe" in your windows folder just to counter attack the ARP poisoning? hope you can rply asap, tnx

Vidhu said...

Hi,
"alg.exe" - Application Layer Gateway Service is a very important program in Windows XP/ Vista. This file normally located under ‘:\Windows\System32’.

If you found this file in another location eg : "%CurrentFolder%\alg.exe", you are infected with Trojan Arposon.

Don’t try to remove this file manually. Leave that job to your Antivirus.

Install a good Anti virus,

1.Disable System Restore (Windows Me/XP).

2. Update the virus definitions.

3.Backup your system registry.

4.Restart your system in safe mode.

5. Run a full system scan.