Berok installs a new desktop background. The Trojan itself is a Windows PE .EXE file 45,056 bytes in size.
Berok contains a .BMP file 40,150 bytes in size.
When launched, the Trojan drops this file to the Windows root directory
The desktop background will then be changed to the image contained in this file.
- Delete desktop.bmp from %WinDir%.
- Delete the main program.