This Trojan must be manually downloaded and installed.
When the Trojan is executed, it modifies the following file:
The Trojan then changes the login user name and password of the current user and restarts the computer.
Next, the Windows login screen is displayed with the new user name.
The user name is changed to a message (Chinese characters) asking the user to contact a Tencent QQ account in order to purchase a password.
Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":