Download/KASEcard

Analysis

The Downloader is installed to a computer who starts to accept the Active X Certificate issued by the web site http://stop-card.com. This certificate is a spoofed issued by "KAS NET." Upon accepting, the program installs the "Flashplayer E-Card" to the infected system.
Then the program download additional files, which are detected as follows:
C:\Winnt\install.exe => "Download/KASECard"
C:\Winnt\svchst.exe => "W32/Small.GA-tr
The Trojan may also attempt to download the Bizex worm as these file names -
C:\Winnt\System32\_kwui.dll => "W32/Bizex-tr"
C:\Winnt\System32\_kwuiex.dll => "W32/Bizex-tr"
C:\Winnt\System32\zztp\svchost.exe => "W32/Bizex-tr"