This Trojan downloads other files via the Internet and launches them for execution on the victim machine without the user’s knowledge or consent. It is a Windows PE EXE file. It is 113152 bytes in size. It is not packed in any way. This Trojan is written in Visual Basic.

Installation

Once launched, the Trojan copies its body to the Windows program files directory as "lsass.exe":

In order to ensure that the Trojan is launched automatically each time the system is rebooted, the Trojan registers its executable file in the system registry:

The Trojan then creates a command interpreter file called "vcdg.bat" in the same directory:

It writes the following strings to this file:

In doing so, the Trojan modifies the configuration of the Windows XP firewall, permitting any network activity created by the malicious process.

"%Program Files%\Microsoft Studio Files\vcdg.bat" is then launched for execution.

Once installed, the Trojan downloads files from the following URLs:

At the time of writing, these links were not active.

This file is 2603325 bytes in size. It will be detected by Kaspersky Anti-Virus as Trojan-Spy.Win32.Banbra.bak.

Files which are downloaded are saved to the Trojan's installation directory under random names and launched for execution.

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the Trojan process.


2. Delete the following system registry key parameter:
   
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   
   "lsass" = "%Program Files%\Microsoft Studio Files\lsass.exe"
   
   


3. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).


4. Delete the following directory and its contents:
   
   %Program Files%\Microsoft Studio Files
   
   


5. Delete all files from %Temporary Internet Files%.


6. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).