I - Mô tả:
II - Chi tiết kỹ thuật:
Khi lây nhiễm vào máy Trojan tạo ra các file như:

• C:\Documents and Settings\All Users\Desktop\Your PC Protector.lnk
• %ProgramFiles%\adc32.dll
• %ProgramFiles%\alggui.exe
• %ProgramFiles%\nuar.old
• %ProgramFiles%\schtml\dbsinit.exe
• %ProgramFiles%\schtml\images\i1.gif
• %ProgramFiles%\schtml\images\i2.gif
• %ProgramFiles%\schtml\images\i3.gif
• %ProgramFiles%\schtml\images\j1.gif
• %ProgramFiles%\schtml\images\j2.gif

III - Cách diệt:

1. Vào Start > Run.
2. Gõ  regedit
3. Click OK.
4. Tìm và xóa các file trong Registry sau

• HKEY_CLASSES_ROOT\CLSID\{77DC0Baa-3235-4ba9-8BE8-aa9EB678FA02}\"(Default)" = "ADC PlugIn"
• HKEY_CLASSES_ROOT\CLSID\{77DC0Baa-3235-4ba9-8BE8-aa9EB678FA02}\InprocServer32\"(Default)" = "%SYSTEM%\Program Files\adc32.dll"
• HKEY_CLASSES_ROOT\CLSID\{77DC0Baa-3235-4ba9-8BE8-aa9EB678FA02}\InprocServer32\"ThreadingModel" = "Apartment"
• HKEY_CURRENT_USER\Software\Your PC Protector\Your PC Protector\setdata\"scantime" = "[CURRENT TIMESTAMP]"
• HKEY_CURRENT_USER\Software\Your PC Protector\Your PC Protector\setdata\"scantime" = "[CURRENT TIMESTAMP]"
• HKEY_CURRENT_USER\Software\Your PC Protector\Your PC Protector\setdata\"scncnt" = "[NUMBER]"
• HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\AdbUpd\"DisplayName" = "Adobe Update Service"
• HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\AdbUpd\"ErrorControl" = "0x00000001"
• HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\AdbUpd\"ImagePath" = "%SYSTEM%\Program Files\svchost.exe""
• HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\AdbUpd\"ObjectName" = "LocalSystem"
• HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\AdbUpd\"Start" = "0x00000002"
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AdbUpd\"Type" = "0x00000010"
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AdbUpd\Security\"Security" = "[DATA]"

      5. Phục hồi lại file bị ảnh hưởng như sau:

• HKEY_CLASSES_ROOT\exefile\shell\open\command\"(Default)" = "%SYSTEM%\Program Files\alggui.exe "%1" %*"
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\"Locked" = "0x00000001"

      6. Thoát khỏi registry