This threat must be manually installed on the computer. It may
also be distributed by other means, such as Web Exploit
Toolkits. When the Trojan is executed, it drops the following
configuration file, which is a password-protected ZIP archive:
It also drops the following file, which contains a hard-coded
password to decrypt the above configuration file: Next, the
Trojan creates the following registry entry so that it executes
whenever Windows starts: HKEY_CURRENT_USER\Software\Microsoft\Wi
ndows\CurrentVersion\Run\"cleansweep.exe" =
"%SystemDrive%\cleansweep.exe\cleansweep.exe" The Trojan then
injects code into any currently running system processes so that
it can then perform the following functions: - Capture network
traffic - Send and receive network packets in order to bypass
application firewalls It also provides certain rootkit
capabilities, for example it can: - Hide its own process on
injected processes - Hide and prevent access to its own binary
code - Hide and prevent access to its startup registry e