Name:

Trojan.Buzus.ixvg

Added:

November 1, 2011

Type:

Trojan

Risk:

Low

Payload:

N/A

At risk systems:

Windows 95/98/ME/XP/NT/2003

Malware problems?   We can help.  Free Removal Tools.

Description:

When Trojan.Buzus.ixvg is executed, it performs the following activities:

After execution, it drops the following files:

%Appdata%\aehost.exe
%Appdata%\behost.exe
%Appdata%\dehost.exe
%Appdata%\R07924.exe
%Appdata%\xgqag.exe
%Program Files%\LP\F019\1.tmp
%Program Files%\LP\F019\7CD.exe

It modifies/creates the following registry entries:

xgqag =  "%Appdata%\xgqag.exe /I"
HKU\Software\Microsoft\Windows\CurrentVersion\Run

7CD.exe = "%Program Files%\LP\F019\7CD.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

The Trojan may create the following files on Removable drives.

%Rootdrive%\gieuli.exe
%Rootdrive%\subst.exe