live casino online

This Trojan attempts to replace a system file with a copy of itself. This results to the crash of the affected computer.

This Trojan may be dropped by other malware.

It deletes itself after execution.

Arrival Details

This Trojan may be dropped by the following malware:

• TROJ_ARTIEF.BWZ

Installation

This Trojan drops the following copies of itself into the affected system and executes them:

• %System%\lsass.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
lsass.exe = %System%\lsass.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Session Manager
PendingFileRenameOperations = @\??\%System%\@%System%\lsass.exe.tmp

Other Details

This Trojan deletes itself after execution.

NOTES:

This Trojan attempts to replace the system file %System%\lsass.exe with a copy of itself. This results to the crash of the affected computer.