Troj/Bckdr-GIR is a Trojan for the Windows platform.
When Troj/Bckdr-GIR is installed the following files are created:
<System>\AdService.bat - can be safely deleted
<System>\AdService.dll - detected as Troj/Bckdr-GIR
<System>\winyvo32.dll - detected as Troj/Bckdr-GIR
Troj/Bckdr-GIR includes functionality to inject code into IEXPLORE.EXE.
The following registry entries are created to run code exported by winyvo32.dll on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winyvo32
DllName
winyvo32.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winyvo32
Impersonate
0
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winyvo32
Startup
EvtStartup
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\MSSMGR\