JS/Agent.D!tr

Analysis

This JavaScript Trojan for Windows sytstems alters the home page value for Internet Explorer. The Java code instructions responsible monitor when a web page containing the home page changing script is closed. During closure, the Trojan alters the home page to point to the domain 'netster.com'.

Recommended Action

FortiGate systems:

• check the main screen using the web interface to ensure the latest AV/NIDS database has been downloaded and installed -- if required, enable the "Allow Push Update" option
  FortiClient systems:
  
• Quarantine/Delete infected files detected