Virus Description - W32/Inject.ACI Trojan

W32/Inject.ACI Trojan

Name	W32/Inject.ACI Trojan
Aliases	Trojan.Win32.Inject.aci, Win32/PSW.Gamania.NAB, Trojan.PWS.OnlineGames.NKN
Discovered on	July 18, 2008

Virus Information - W32/Inject.ACI Trojan:

W32/Inject.ACI is a trojan. The trojan will infect Windows systems.

Upon execution, the trojan drops the following files in the Windows System folder:

systemlf.dll
syswin.sys
sysgrw.exe
Ir32_d.exe
Ir32_a.exe
Ir32_c.exe

The trojan modifies registry at the following location to load itself during each startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit