Troj/CWS-I is a Trojan dropper.
Troj/CWS-I copies itself to the Windows system folder with the filenames ALGU.EXE and SPOOLSV32.EXE and creates the following entries in the registry so as to run these files on system startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
ALGU
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
SPOOLSV32
Troj/CWS-I drops a file to the Windows folder called ATLASS.DLL and runs it. This file is detected as Troj/CWS-C.
Troj/CWS-I may create the following entries in the registry:
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\
ATLASSstp
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\
WTLBAstp
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\
MSMsgSvc
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\
SEHLPstp
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\
HTASSstp
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
Browser Helper Objects\
{E3D3AFEE-2172-4ef5-8509-1638AFFF0374}