virus Name: trojan-PSW.Win32.Bjlog.a
Risk level: Medium

Virus Description

  The size of the virus samples after shelling were "200,704" bytes, it's icon "" using the "exe" extension, through the file bundle, pages linked to horse, download tools to download, etc. and spread. The main purpose is to obtain the target viruses all computer control, remote control the target computer's become a puppet, after the user's computer infected, it will found completely controlled by others.

Infection in the operating system
Windows 2000/Windows XP / Windows 2003/Windows Vista / Windows 7

Manual removal:

1, manually delete the following files

D: \ druswmlskc.exe

2, manually delete the following Registry key:

HKEY_LOCAL_MACHINE \ SODTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Shell Folders \ Cache

Variable declaration:

% SystemDriver% system partition, usually "C: \"
% SystemRoot% WINDODWS directory, usually "C: \ Windows"
% Documents and Settings% user's documents directory, usually "C: \ Documents and Settings"
% Temp% temp folder, usually "C: \ Documents and Settings \ current user name \ Local Settings \ Temp"
% ProgramFiles% system program the default installation directory, typically: "C: \ ProgramFiles"

Analysis of the virus:

1 in the D drive to create the file druswmlskc.exe
(2) to obtain the absolute path to the location itself, create a thread
3. To speak their own way with a copy of the copy to replace the D: \ druswmlskc.exe next, and run their own
4 registered their service
5 Create registry entries
HKEY_LOCAL_MACHINE \ SODTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Shell Folders to achieve their own boot entry.
6. Create a process to find the system memory directory in soft kill
7. To create a remote process. Wait for the remote service client operating test once every 20 seconds.
8 detection time more than 1800 seconds to delete the original file itself


Viruses create a file:

D: \ druswmlskc.exe

Virus creates registry:

HKEY_LOCAL_MACHINE \ SODTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Shell Folders \ Cache

Virus access to the network:

202.103 .***.* 9