Troj/Blesh-A is a downloader Trojan.
Troj/Blesh-A will download a configuration file from a remote website. The Trojan will then attempt to download and run executable files listed in the downloaded configuration data.
When first run, Troj/Blesh-A will copy itself to the Windows system folder as BLES.EXE. In order to run automatically each time a user logs in, Troj/Blesh-A will set the following registry entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Bles
<Windows system folder>\bles.exe
Troj/Blesh-A will created a folder named BLES in the Windows folder.
Troj/Blesh-A will create the following registry branch:
HKCU\Software\Bles