TrojanDownloader:Win32/Gida.A

TrojanDownloader:Win32/Gida.A is a malicious Adobe Flash program that intends to trick the user into believing their computer has data or security errors that require attention. The errors are false, and the malicious flash redirects the user to a Web site hosting unwanted software such as 'PerformanceOptimizer'.

The trojan Adobe flash file does not install files to the local computer, or alter startup configurations or load processes. When a user visits a Web site hosting the malicious flash file, the user is redirected to an animation page that simulates a local scan of the computer via a Web page. The flash file is activated from a landing page, on a Web site that contains three .PHP pages such as 'statsa.php', 'statsg.php' and 'statss.php'. The simulated scan is actually a flash file, such as GNIDA.SWF.

 

The flash file is run displays detections, erroneously suggesting the computer has data or security errors, as in the graphic below:

 

 

Meanwhile, the .PHP script sets a cookie used to track information or for statistical purposes. The flash file illustrates a completed scan, and a message is shown instructing the user to download a security product to fix found issues.

TrojanDownloader:Win32/Gida.A is hosted on a Web site with the intention of gaining Web traffic, and by virtue of a large pool of Internet users running an online scan, the goal is to trick someone into downloading and purchasing the deceptive program offered. The word "gnida" means "bad person" in Russian.