NEW BLOG POST: Upgrading to Windows 10 not only means decreased risk; it also means multi-layered defense against ransomware and other advanced attacks. Read the post
Alert level: Severe Detected with Windows Defender Antivirus
Also detected as: Trojan horse Generic24.OJQ (AVG) Trojan.DownLoader4.48720 (Dr.Web) Win-Trojan/Helpagent.7184 (AhnLab) Troj/Agent-TEE (Sophos) Backdoor:Win32/Morto.gen!A (Microsoft)
Additional information for Enterprise users
In the wild, we have observed this threat infecting computers by targeting accounts that have 'weak' passwords.
To help prevent infection, and consequent re-infection, we recommend making sure that your organization uses strong passwords for system and user accounts, and verifying that you do not use passwords like those being used by the malware in order to spread. Changing your password will significantly decrease your chance of re-infection.
To thwart this and similar threats, it helps to adhere to best password practices, defined and enforced by appropriate policies. Good polices include, but are not limited to:
- Ensuring there are rules around password complexity, so that passwords meet basic strong password requirements, such as minimum length (long passwords are usually stronger than short ones)
- Ensuring passwords are not used for extended periods of time; consider setting an expiry every 30 to 90 days. You might also consider enforcing password history, so that users can not re-use the same password within a pre-defined time frame
- Ensuring passwords contain a combination of:
- Uppercase letters
- Lowercase letters
- Numerals, and
For general information about password best practices, please see the following articles:
To help prevent re-infection after cleaning, you may also want to consider changing the password for every account on the network, for every user in your environment.