Once executed the trojan copies itself to the following location:
%windir%\system32\ctfmona.exe
It drops the following two files, a desktop wallpaper and a screensaver:
%windir%\system32\ctfmonb.bmp
%windir%\system32\blackster.scr
The ctfmonb.bmp file is set as the desktop wallpaper to warn the user of a non-existent spyware infection.
The file called blackster.scr is set as the system's screensaver. Once it activates, a legion of bugs appear to eat away the desktop. The screensaver appears to not have been made by authors of the trojan. The original version is available on the Internet as freeware.
Therefore having a similar screensaver alone does not mean you have a trojan on your computer.
To enable its execution on start-up and to change the wallpaper and screensaver, the trojan makes several changes to the system registry. Trojan:W32/Pakes.CSG also disables System Restore with a registry modification.
The following is a list of the registry changes made by Pakes.CSG:
The goal of this trojan is to install and push the sale of a rogue application. Rogue applications produce fraudulent scan results and use affiliate programs to market themselves. Trojans such as Pakes.CSG are designed and used by unscrupulous affiliates.
