TROJ_BUZUS.BDP
Windows 2000, XP, Server 2003
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Trojan
Destructiveness: No
Encrypted: No
In the wild: Yes
OVERVIEW
This Trojan launches certain flood attacks against target sites. It does the said routine to prevent users from reaching these sites at a given time.
TECHNICAL DETAILS
221,184 bytes
EXE
Yes
14 Sep 2010
Installation
This Trojan drops the following copies of itself into the affected system:
- %User Profile%\Application Data\srpp.exe
(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)
It injects itself into the following processes running in the affected system's memory:
- EXPLORER.EXE
Autostart Technique
This Trojan adds the following registry entries to enable its automatic execution at every system startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Taskman = "%User Profile%\Application Data\srpp.exe"
Denial of Service (DoS) Attack
This Trojan launches the following types of flood attack against target sites:
- unknown.carohosting.net:1995
SOLUTION
8.900
7.462.01
14 Sep 2010
Step 1
Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.
Did this description help? Tell us how we did.