TROJ_BUZUS.BDP

This Trojan launches certain flood attacks against target sites. It does the said routine to prevent users from reaching these sites at a given time.

Installation

This Trojan drops the following copies of itself into the affected system:

• %User Profile%\Application Data\srpp.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It injects itself into the following processes running in the affected system's memory:

• EXPLORER.EXE

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Taskman = "%User Profile%\Application Data\srpp.exe"

Denial of Service (DoS) Attack

This Trojan launches the following types of flood attack against target sites:

• unknown.carohosting.net:1995