Symptoms

Removal instructions:

Analyzed By

Technical Description:

The trojan launches "iexplore.exe" with a parameter consist from folowing URLs:
        http://209.167.111.110/[removed]/200948704/477/0/31/0[removed]12260025[varible].html
        http://222.133.3.210/[removed]/200948704/477/0/31/0[removed]12260025[varible].html
Tries to stop known security related processes:
         isafe.exe, ca.exe, caissdt.exe, cavrid.exe, cavtray.exe, avp.exe, apvxdwin.exe , avciman.exe, avengine.exe, pavfnsvr.exe, pavprsrv.exe, pavsrv51.exe, pnmsrv.exe, psimsvc.exe, pskmssvc.exe, srvload.exe,tpsrv.exe, webproxy.exe, vir.exe, sdhelp.exe, swdoctor.exe, mxtask.exe, wmiprvse.exe, hsockpe.exe, dpasnt.exe, kav.exe, kavpf.exe, tsantispy.exe, fsm32.exe, fspex.exe, fsaw.exe, fsguidll.exe, msascui.exe.