Low Risk 

Description

Troj/Dloadr-BLP when run downloads further malware to the folder <Documents and Settings>\All Users\_qbothome. Troj/Dloadr-BLP also creates the following registry entry so that the downloaded files autorun at startup: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run nwiz "C:\documents and settings\all users\_qbothome\_qbotinj.exe" "C:\documents and settings\all users\_qbothome\_qbot.dll" /c nwiz.exe /installquiet .

References

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrblp.html

Credits

Reported by Sophos

ChangeLog

2008-05-13 - Initial Release

Disclaimer

The information contained herein was obtained from third party sources and is solely based upon the data available at the time of publication.