Trojan.Blusod

28 June 2008 28 Comments

Trojan.Blusod is a harmful Trojan developed to spread maliciously created security programs also known as rogue anti-virus. When executed on computer, Trojan.Blusod tries to contact distant server and download additional threats. The Trojan will set screen saver that acts as security alert messages containing the following strings:

Warning!
Spyware detected on your computer!
Install an antivirus or spyware remover to clean your computer.

 

Damage Level: Medium

Systems Affected: Windows 9x, ME, 2000, XP

Screen Shot Image:

 

How to Remove Trojan.Blusod:

FIRST AID TO STOP Trojan.Blusod:
When Trojan.Blusod virus infects a computer, it will modify system settings and inject itself to legitimate Windows files. System Restore is the tool-to-go-to in bringing back clean files and restoring earlier configuration. If you have saved previous restore point, please restore Windows to an earlier date.

REMOVAL TOOL:
Trojan.Blusod uses randomly created file names to hardly identify. With this, spotting associated files and deleting them manually is not advisable for beginners. Automatic removal is advised using legitimate and effective anti-malware solution called MalwareBytes’ Anti-Malware. Download removal tool here.

MANUAL REMOVAL OF Trojan.Blusod:
1. If an anti-virus program is present, update the definition file.
2. Reboot Windows in Safe Mode
- After turning on the power, press F8 on the keyboard.
- From the menu, select Safe Mode.

3. Run a full system scan and clean/delete all infected file(s).
4. Delete/Modify any values added to the registry if present.
- To edit the registry, click on Start. Search or Run regedit.exe.

Note: For a complete guide on Safe Mode and Registry Editor, please see tutorial links on the sidebar.

5. Exit registry editor and restart Windows.

Technical Details and Additional Information:

Other functionalities of this Trojan:
- Trojan.Blusod modifies registry entries to show available image as background.
- This Trojan will drop files with two random file names.
- It will connect to predefined web sites to download more malware and execute on compromised computer.

Malicious Files Added by Trojan.Blusod:
%UserProfile%\Local Settings\Temp\.tt[TWO RANDOM CHARACTERS].tmp
%UserProfile%\Local Settings\Temp\.tt[TWO RANDOM CHARACTERS].tmp
%System%\system32\lph[RANDOM CHARACTERS].exe
%System%\system32\blph[RANDOM CHARACTERS].scr
%UserProfile%\Local Settings\Temp\.tt[TWO RANDOM CHARACTERS].tmp.vbs (This entry will disable System Restore)
%System%\system32\ph[RANDOM CHARACTERS].bmp (This is the image file displayed on screen)

File Location for Windows Versions:

  • %UserProfile% for Vista/7 user is C:\Users\<Current User> for Windows Vista/7, for Windows XP/2000 this is C:\Documents and Settings\<Current User>.
  • %System% for all versions of Windows it is located under C:\Windows\System32

Associated Windows Registry Entries:
HKEY_CURRENT_USER\Software\Sysinternals\Bluescreen Screen Saver\”EULAAccepted” = “1″ (This install the screen saver)