W32/Botvoice Trojan

 Information about the W32/Botvoice Trojan:

W32/Botvoice is a trojan. The trojan will infect Windows systems and disables system tools on the infected computer.

The trojan usually arrives as a downloaded file of other malware or as an email attachment.

Upon execution, the trojan creates SP_[Random Characters].dat file in the (SystemDrive)\Documents and Settings\[USER NAME]\Application Data\Microsoft\Speech\Files\UserLexicons folder.

It modifies the following registry entries to disable Task Manager and Registry Editor:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\"DisableRegistryTools"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\"DisableTaskMgr"

The trojan also modifies the registry to prevent specific files from being opened.

The trojan attempts to block keyboard and mouse events.

It may end the following processes:

explorer.exe
msnmsgr.exe

It then attempts to delete files under the following folders:

C:\
Windows folder\ServicePackFiles\i386
Windows Folder\$NtServicePackUninstall$

The trojan uses the Microsoft Text-To-Speech (TTS) technology to play the following text in a spoken voice:

You have been infected I repeat You has been infected and your system files have been deleted. Sorry Have a Nice Day and bye bye

The trojan may display the following message box if a debugger is running:

Title: Bea TkMmMmMmM
Message: I ProMise ... I Will Love YoU AlWayS BEa!

This trojan first appeared on July 10, 2007.

 Other names of W32/Botvoice Trojan:

This trojan is also known as Trojan.Botvoice.