Symptoms

Removal instructions:

Analyzed By

Technical Description:

The trojan creates a file named sqhos32.wmf in %WINDIR% folder, file that contains some data the trojan uses. Then, it will create the following registry key in order to execute itself at each system startup:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run: "lre"="%path_to_trojan%"

The trojan tries to download a file named 'module.exe' from http://eased{...}.com/et.exe.

When the link becomes available, it will execute the downloaded file, delete the startup registry key and mark itself for deletion at the next system startup.