TROJ_PACKED.BDI

This Trojan may arrive bundled with malware packages as a malware component. It may arrive as a file that exports functions used by other malware. It may be dropped by other malware. It may be dropped by other malware.

It modifies registry entries to hide files with System and Read-only attributes.

It requires its main component to successfully perform its intended routine.

Arrival Details

This Trojan may arrive bundled with malware packages as a malware component.

It may arrive as a file that exports functions used by other malware.

It may be dropped by other malware.

It may be dropped by the following malware:

• WORM_AUTORUN.ZZT

Installation

This Trojan stays memory-resident by injecting codes into the following processes:

• IExplore.exe

Other System Modifications

This Trojan modifies the following registry entries to hide files with System and Read-only attributes:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = 2

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = 0

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
SHOWALL
CheckedValue = 0

(Note: The default value data of the said registry entry is 1.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}5.com/hg2/ll.rar

It requires its main component to successfully perform its intended routine.