|Detected||Sep 15 2006 09:41 GMT|
|Released||Jun 28 2008 16:09 GMT|
|Published||Sep 15 2006 09:41 GMT|
This Trojan modifies the system configuration. The Trojan itself is a Windows PE EXE file 8704 bytes in size
When launching, the Trojan creates a file with a random name composed of numbers and a BAT extension in the Windows temporary directory. This file will be launched for execution, then deleted, and the Trojan will cease running.
When launched, this packed file creates a system registry configuration file called c:\reg.reg. The configuration from this file will be transferred to the system registry, and the file will then be deleted.
These modifications to the system registry will cause the following message to be displayed every time the victim system is started:
The Internet Explorer home page will be altered to http://www.playboy.com/. Additionally, the function of the left and right mouse keys will be swapped, and the speed at which the computer reacts to a double click on the mouse and to keys being depressed will be altered.
This type of behaviour covers malicious programs that delete, block, modify, or copy data, disrupt computer or network performance, but which cannot be classified under any of the behaviours identified above.
This classification also covers “multipurpose” Trojan programs, i.e. those that are capable of conducting several actions at once and which demonstrate several Trojan behaviours in a single program. This means they cannot be indisputably classified as having any single behaviour.