To get a one-glance comprehensive view of the behavior of this malware, refer to the Behavior Diagram shown below.
Malware Overview
This Trojan may be downloaded from remote sites by other malware. It may be dropped by other malware.
It may be downloaded unknowingly by a user when visiting malicious Web sites.
Upon execution, it connects to a certain URL to download and execute a file, which is also detected as TROJ_RENOS.ACO. It also drops a file which is detected as JOKE_BLUESCREEN. As a result, routines of the dropped file may be exhibited on the affected system.
This Trojan modifies the affected system’s desktop wallpaper by changing it to the following image:
Moreover, it disables the System Restore. This routine disallows the affected user to revert back to a good image of the system.