This Trojan may arrive bundled with malware packages as a malware component. It may arrive as a .DLL file that exports functions used by other malware.

This Trojan creates a registry entry to enable its automatic execution at every system startup.

When a user opens certain processes on the affected system, it displays fake messages that the system is infected with viruses and that the system has hardware errors.

It then prompts the user to download a fake virus scanner that Trend Micro detects as TROJ_CLICKER.FZ. It then connects to remote URLs to download a malicious file.

It then executes the downloaded file. As a result, routines of the downloaded file are exhibited on the afected system.



More...