W32/Yabe.BT Trojan

 Virus Information - W32/Yabe.BT Trojan:

W32/Yabe.BT is a mass mailing trojan. The trojan will infect Windows systems and spreads through email.

The trojan usually arrives as a dropped or downloaded file of other malware from a remote site.

Upon execution, it drops a copy of ISCA.EXE in the Windows System folder.

It modifies the registry at the following location to ensure its automatic execution at every system startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The trojan attempts to download text file from any one of the following web sites:

http://{blocked}rthernsoulclub.com/biographies/images/alwilson.txt
http://{blocked}deonsarmy3.com/index_files/image002.txt
http://{blocked}leaseforlife.com/images/index09.txt
http://{blocked}aceinthedesert.org/images/photo_page/index21.txt
http://{blocked}pemanor.com/images/main_template.txt
http://{blocked}vitech.net/images/buttons/index31.txt
http://{blocked}tent-advocates.com/zip/readme.txt
http://{blocked}pnc.org/rudnicki/P7060022.txt
http://{blocked}arcleaningservice.com.au/images/index31.txt
http://{blocked}tercitiprojects.com.au/images/index31.txt

The downloaded text file contain encrypted link leads to download malicious file.