Trojan:Win32/Dursg

System changes

The following system changes may indicate the presence of this malware:

• The presence of the following files:
• %APPDATA%\syswin\lsass.exe
• %APPDATA%\systemproc\lsass.exe
• The presence of the following registry modifications:
  
  
  In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
  Sets value: "RTHDBPL"
  To data: "%APPDATA%\syswin\lsass.exe"
   
  In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  Sets value: "RTHDBPL"
  To data: "%APPDATA%\systemproc\lsass.exe"
   
  The trojan creates other registry data.
   
  In subkey: HKCU\Identities
  Sets value: "KillSelf"
  To data: "ok"
   
  In subkey: HKLM\SOFTWARE
  Sets value: "KillSelf"

  To data: "ok"
• Alert notifications from installed antivirus software may be the only other symptoms.