Variant: Trojan.Bohu
Operating Systems Affected: Windows 2000, Windows 9x, Windows Me, Windows NT, Windows Server, Windows XP, Windows Vista, Windows 7
Trojan.Bohu is a recently discovered Trojan horse dated January 19, 2011. The malware is primarily designed to disable cloud based Antivirus software and its corresponding web dependent service. It proliferates through social networking sites by sharing the download link of the trojan, a bogus video playback application as shown in the image above.
The Trojan.Bohu threat is acknowledged as the first of its kind that targets cloud-based antivirus application but definitely not the last one.
A Trojan horse, or Trojan, is a malware that appears to perform a desirable function for the user prior to run or install but instead facilitates unauthorized access of the user’s computer system. [source: Wikipedia]
Step by step manual removal guide:
• Temporarily disable system restore [Windows ME / XP only]
• Reboot and login under safe mode with networking
[Press the F8 key on Windows boots up]
• Temporarily show hidden files and folders
[My Computer → Tools → Folder Options → View Tab → Tick show hidden folders, files and drives → Untick hide operating systems files → OK]
• Navigate and delete the Trojan.Bohu created files:
• Navigate and delete the Trojan.Bohu created registry key:
[Click Start → run → type regedit → click OK]
• Navigate and delete the Trojan.Bohu created registry subkeys:
• Navigate and restore the original registry value:
Windows XP Registry Backup
Windows 7 Registry Backup
• Update Antivirus definition files
• Run Antivirus full system scan
• Restore hidden files and folders settings
[My Computer → Tools → Folder Options → View Tab → untiick show hidden folders, files and drives → tick hide operating systems files → OK]
• Re-enable system restore [Windows ME / XP only]
• Reboot and login under normal mode