W32/Ryknos is a trojan. The trojan will infect Windows systems and spreads through email. The trojan exploits DRM security risk to hide its presence in the infected computer.

The subject of the infected mail will be:

Requesting Photo Approval

This trojan arrives as an email attachment. The name of the infected attachment will be any one of the following;

article_december_3621.exe
Photo+Article.exe

The content of the infected mail will be:

Hello,

Your photograph was forwarded to us as part of an article we are publishing for our December edition of Total Business Monthly. Can you check over the format and get back to us with your approval or any changes? If the picture is not to your liking then please send a preferred one. We have attached the photo with the article here.

Kind regards,
Jamie Andrews
Editor
www.TotalBusiness.co.uk
*************************************************
The Professional Development Institute
*************************************************

Upon execution, the trojan copies itself as $sys$drv.exe in the Windows System folder.

The string $sys$ used by the trojan to utilize Sony Digital Rights Management (DRM) software for hiding its process, file and registry keys.

The trojan modifies registry at the following location to load itself during each startup.

HKEY_CURRENT_USER\Software\WkbpsevaXImgvkwkbpXSmj`kswXGqvvajpRavwmkjXVqj
HKEY_LOCAL_MACHINE\Software\WkbpsevaXImgvkwkbpXSmj`kswXGqvvajpRavwmkjXVqj

It connects to the Internet Relay Chat (IRC) server. After the connection is established, it joins an IRC channel and listens for commands coming from a remote malicious user.

This trojan first appeared on November 10, 2005.

 Other names of W32/Ryknos Trojan:

This trojan is also known as BKDR_BREPLIBOT.C, Troj/Stinx-E, Breplibot.b, Backdoor.Ryknos, Win32.Ryknos.