The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1


Detected Nov 02 2006 17:06 GMT
Released Nov 02 2006 17:06 GMT
Published Jan 11 2007 13:22 GMT

Technical Details
Removal instructions

Technical Details

This Trojan has a malicious payload. It is a Windows PE EXE file. The file is 368 128 bytes in size. áàéò. It is not packed in any way. It is written in Borland Delphi.


Once launched, the Trojan will delete autoexec.bat from the C: root directory:


The Trojan will then attempt to delete explorer.exe from the Windows directory:


Removal instructions

  1. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
  2. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).

Bookmark and Share

This type of behaviour covers malicious programs that delete, block, modify, or copy data, disrupt computer or network performance, but which cannot be classified under any of the behaviours identified above.

This classification also covers “multipurpose” Trojan programs, i.e. those that are capable of conducting several actions at once and which demonstrate several Trojan behaviours in a single program. This means they cannot be indisputably classified as having any single behaviour.

Other versions