Trojan:Win32/Dusvext.B is a malicious program that is unable to spread of its own accord. It may perform a number of actions of an attacker's choice on an affected computer.
When executed, Trojan:Win32/Dusvext.B copies itself to <system folder>\windows\aclobe.exe.
Note: <system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP, Vista, and 7 is C:\Windows\System32.
The malware modifies the following registry entries to ensure that its copy executes at each Windows start:
Adds value: "aclobe" With data: "c:\windows\system32\windows\aclobe.exe" To subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Contacts remote host
Trojan:Win32/Dusvext.B may contact a remote host at cobix.azok.org using port 80. Commonly, malware may contact a remote host for the following purposes:
To report a new infection to its author
To receive configuration or other data
To download and execute arbitrary files (including updates or additional malware)
To receive instruction from a remote attacker
To upload data taken from the affected computer
This malware description was produced and published using our automated analysis system's examination of file SHA1 fed7e99b89e195a245e6c64e25d2b0e29ed2664f.