The UPX-packed Trojan, Dasmin, is installing itself to Windows System folder as two separate files:
jdbgmrg.exe
avirchk.exe
Worth noting is that the Trojan uses the "jdbgmrg.exe" name, which is quite close to the name of a common Windows component: "jdbgmgr.exe" (Java Debug Manager). Also, one Jdbgmgr hoax variant that was widespread in May 2002 had a typo -- the "jdbgmrg.exe" file name mentioned there should have read "jdbgmgr.exe".
The Dasmin trojan uses the same teddy bear icon that looks exactly like the icon of JDBGMBR.EXE file.
The Trojan creates autostartup keys for itself in the Registry. It also changes startup and search pages of Internet Explorer.
To disinfect a system simply kill Trojan's tasks from Task Manager and to delete both Trojan's files from a hard drive.
To find out about the different variants and aliases the Trojan is using, visit this F-Secure page.
Compiled by Esther Shein.
Images
IE 7
Firefox 2.0
