Trojan.WinLNK.Agent explained

A Trojan.WinLNK.Agent (also Trojan:Win32/Startpage.OS) is the definition from Kaspersky Labs of a Trojan downloader, Trojan dropper, or Trojan spy.

Its first known detection goes back to May 31, 2011, according to Microsoft Malware Protection Center. This Trojanware opens up an Internet Explorer browser to a predefined page (like to i.163vv.com/?96). Trojan Files with the LNK extension (expression) is a Windows shortcut to a malicious file, program, or folder. A LNK file of this family launches a malicious executable or may be dropped by other malware. These files are mostly used by worms to spread via USB drives (i.e.).^{[1] [2]}

Other aliases

• Win32/StartPage.NZQ (ESET)
• Trojan.WinLNK.Startpage (Kaspersky Labs) ^[3]
• Trojan:Win32/Startpage.OS (Microsoft)

Other Variants

• Trojan.WinLNK.Agent.ae
• Trojan.WinLNK.Agent.ew ^[4]

Statistics

• In 2016, India had the most incidents relating to this Trojan with 18,36 % worldwide.

External links

• Analysis of a file at VirusTotal

Notes and References

1. https://threats.kaspersky.com/en/threat/Trojan.WinLNK.Runner/ Kaspersky Threats — TROJAN.WINLNK.RUNNER
2. https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Trojan%3aWin32%2fStartpage.OS Trojan:Win32/Startpage.OS
3. https://threats.kaspersky.com/en/threat/Trojan.WinLNK.StartPage/ Kaspersky Threats — TROJAN.WINLNK.STARTPAGE
4. https://securelist.com/analysis/kaspersky-security-bulletin/73038/kaspersky-security-bulletin-2015-overall-statistics-for-2015/ Kaspersky Security Bulletin 2015. Overall statistics for 2015 - Securelist