A bot for computers running Windows. Once the system becomes infected, the malware places its copy into the %APPDATA%\{GUID}\ directory and modifies SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run to ensure its autorun on system startup.
The Trojan gets injected into all running processes intercepting Internet functions if any of the following processes is found:
- maxthon,
- browser,
- firefox,
- iexplo,
- safari,
- mozill,
- chrome,
- avant,
- opera,
- netsc.
If the user conducts a web search in one of the monitored browsers, the Trojan gets the search query's URL and forwards it to the remote server. The server, in turn, sends the bot a specially generated command containing a web address, with which the original URL will be replaced.
