Virus:Trojan-Spy.Win32.BZub.jj

• Technical details
• Payload
• Removal instructions

This Trojan is designed to steal confidential data. It is a Windows PE EXE file. It is 99,032 bytes in size. It is not packed in any way. It is written in Delphi.

Installation

When launched, the Trojan drops a .dll file called "ipv6monl.dll" to the Windows system directory:

When Internet Explorer is launched, the Trojan will be launched automatically. Once launched, the Trojan searches for cached passwords. It also saves passwords entered by the user to a file called "form.txt".

The Trojan also creates a file called "info.txt" and save the following information to this file:

• computer name
• IP address
• operating system
• name of user account
• data from Outlook

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Close Internet Explorer.
2. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
3. Delete the following file:
   %System%\ipv6monl.dll
4. Update your antivirus databases and perform a full scan of the computer ( download a trial version of Kaspersky Anti-Virus).