W32/Bagle.QU Trojan

 Virus Information - W32/Bagle.QU Trojan:

W32/Bagle.QU is a trojan. The trojan will infect Windows systems.

Upon execution, the trojan copies itself as:

hldrrr.exe in the Windows System\drivers folder,
srosa.sys in the Windows System\drivers folder,
SOUNDMAN.exe in the Windows Temp folder.

The trojan modifies registry at the following location to load itself during each startup;

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa

The trojan also attempts to connect to remote web-sites to download malicious files.

The trojan may exhibit some Rootkit Capabilities like hiding files, processes, and/or registry entries.

It corrupts the file NTRTSCAN.EXE.