W32.Balick.Trojan

Symantec Security Response - W32.Balick.Trojan

W32.Balick.Trojan is a Trojan horse that attempts to obtain an ad-click credit for the Trojan's author. It will copy itself to the \System folder as Csss.exe.

Type: Trojan Horse
Infection Length: 28,672 bytes
Systems Affected: Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me
Systems Not Affected: Windows 3.x, Macintosh, OS/2, Unix, Linux

technical details

When it is executed, W32.Balick.Trojan displays this message box:

http://securityresponse.symantec.com/avcenter/graphics/w32.balick.trojan.1.gif

• If you click "I agree," the Trojan:
  • 
    1. Copies itself as the file %windir%\System\Csss.exe
    
    NOTE: %windir% is a variable. The Trojan locates the Windows installation folder (by default this is C:\Windows or C:\Winnt) and copies itself to the \System folder in that location.
    
    2. It adds the value
    
    csss %windir%\System\Csss.exe
    
    to the registry key
    
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    
    As a result, then next time that you start Windows (and each time after that) the Trojan runs and contacts many Web sites in an attempt to gain ad-clicks for the Trojan's author.
• If I click "I do not Agree," the Trojan exits.

removal instructions

NOTE: These instructions are for all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

• 
  1. Update the virus definitions
  2. Run a full system scan.
  3. Delete all files that are detected as W32.Balick.Trojan.
  4. Delete the value
  
  csss %windir%\System\Csss.exe
  
  from the registry key
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

To delete the value from the registry:

CAUTION: Symantec strongly recommends that you back up the registry before you make any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify only the keys that are specified. Read the document How to make a backup of the Windows registry for instructions.

• 
  1. Click Start, and click Run. The Run dialog box appears.
  2. Type regedit and then click OK. The Registry Editor opens.
  3. Navigate to the key
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  
  4. In the right pane, delete the value
  
  csss %windir%\System\Csss.exe
  
  5. Exit the Registry Editor.