Installation and Autostart
This memory-resident Trojan may be downloaded from the Internet, dropped by another malware, or manually installed by a user.
Upon execution, it adds the following registry entries:
LoadService = "Virus"
RavTimeXP = "Virus"
System4224411 = "Virus"
This autostart technique fails, however, since the said registry entries point to a non-existent file.
Based on the cited text strings, it appears that this Trojan aims to disrupt browsing activities related to adult or mature materials. This interference may cause annoyance to some users. The proceeding text further illustrates this Trojan's routine.
If the said strings are found, this Trojan minimizes the Internet Explorer (IE) window and displays the following image:
After a few seconds or if the Next button is clicked, this Trojan proceeds to display the following image in the center of the screen:
The said image disappears after a few seconds.
If the minimized window is restored, or another window containing the aforementioned strings is opened, this Trojan again displays two images in succession.
If another IE window containing the said strings is opened and the second cited image has been displayed six (6) times, the following image is shown together with the current time:
If the mouse cursor is moved within the shown gray area, the following image appears and "traps" the mouse cursor:
Clicking any of the buttons shown in the screen logs off the user from Windows.
Additionally if Registry Editor is opened, it is minimized by this Trojan.
This Trojan is compiled using Microsoft Visual Basic. It runs on Windows 98, ME, NT, 2000, and XP.
Analysis By: Zeus M. Laguerta