win2sys.dll is a Trojan.Dropper-BS. win2sys.dll spreads via open network shares.
Related files:
%Windows%\csrss.exe
%Windows%\win2sys.dll
More info: http://www.sophos.com/virusinfo/analyses...
Troj/Dropper-BS is a dropper Trojan for the Windows platform.
When Troj/Dropper-BS is installed the following files are created:
\csrss.exe
\win2sys.dll
The file csrss.exe is detected as Troj/LdPnch-V.
The following registry entry is created to run code exported by the Trojan library on startup:
HKLM\SOFTWARE\Microsoft\Windows\ CurrentVersion\ShellServiceObjectDelayLoad
MStask
(1B978A53-3D5E-4329-8A1A-97FE68699FC7)
The file win2sys.dll is registered as a COM object, creating registry entries under:
HKCR\CLSID\ (1B978A53-3D5E-4329-8A1A-97FE68699FC7)