This Trojan may be downloaded from remote sites by other malware. It may be downloaded unknowingly by a user when visiting malicious Web sites.

This Trojan creates folders. This Trojan drops component files which Trend Micro detects as the following malware:

• JOKE_BLUESCREEN
• TROJ_FAKEALRT.BM
• TROJ_RENOS.AAM

This Trojan creates registry entries to enable its automatic execution at every system startup. It also creates registry entries to add an Uninstall option in the Control Panel.

It modifies a registry entry to enable System Restore and to change the default wallpaper. It then deletes itself after execution.

This Trojan disguises as a fake Windows XP Antivirus application. It changes the afected systems' wallpaper.



More...