W32/Blusod Trojan

 Information about the W32/Blusod Trojan:

W32/Blusod is a trojan. The trojan will infect Windows systems.

Upon execution, the trojan creates the following files:

.tt(Two Random Characters).tmp in the %UserProfile%\Local Settings\Temp folder,
lph(Two Random Characters).exe in the %System%\system32 folder,
blph(Random Characters).scr in the %System%\system32 folder.

The trojan creates the following registry entry in order to install the screensaver:

HKEY_CURRENT_USER\Software\Sysinternals\Bluescreen Screen Saver\"EULAAccepted" = "1"

It also creates and runs the following file, which disables System Restore:

.tt(Two Random Characters).tmp.vbs in the %UserProfile%\Local Settings\Temp folder.

The Trojan then creates ph(Ramdom Characters).bmp image file in %System%\system32

The image contains the following message:

Warning!
Spyware detected on your computer!
Install an antivirus or spyware remover to clean your computer.

The trojan changes the desktop background on the computer to the above image by modifying the registry.

The trojan tries to connect the following websites in order to download more files on to the affected computer:

youpornztube.com
antivirusxp2008.com

This trojan first appeared on June 30, 2008.

 Other names of W32/Blusod Trojan:

This trojan is also known as Trojan.Blusod.