W32/Dloader.SAW is a trojan. The trojan will infect Windows systems and spreads through email.

The trojan arrives as an email message spammed by another malware or a malicious user.

The body of the infected mail will be:

Dear {name of recipient may vary},

This is an automated email that confirms the registration of your complaint case number : CX231938138 filed by your company on 8/-1/2007 concerning Online Identity Theft.
While The Better Bussiness Bureau Online does not resolve individual consumer problems, your complaint helps us investigate fraud, and can lead to law enforcement action.

ATTACHED you will find a copy of your complaint .Please print and keep this copy for your personal records.
We use secure socket layer (SSL) encryption to protect the transmission of the information you submit to us when you use our secure online forms. The information you provided to us is stored securely.

The form you used to register this complaint is designed to improve public access to the Better Business Bureau of Consumer Protection Consumer Response Center, and is voluntary. Through this form, consumers may electronically register a complaint with the BBB.Under the Paperwork Reduction Act, as amended, an agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid OMB control number. That number is 355-783.

Our staff will keep you updated regarding the status of our investigation.

The email message contains an attached RTF document Complaint_(random numbers).doc containing an embedded .EXE file.

Upon execution the trojan drops:

C__Adobe[1].exe in the User Profile\Local Settings\Temporary Internet Files folder
msie.dat in the Users Temp folder.

The MSIE.DAT is injected into the legitimate process, IEXPLORE.EXE, allowing it to open a hidden Internet Explorer (IE) window.

It then attempts to access the following URL to download a malicious file and save it as msie.exe in the User's Temp folder

http://www.(Blocked)arty.com/down.php

The trojan terminates itself after performing its download routine.

This trojan first appeared on August 08, 2007.

 Other names of W32/Dloader.SAW Trojan:

This trojan is also known as TROJ_DLOADER.SAW.