Posted 08 September 2006 - 09:02 AM
I didn't see this one in the database, so I thought I would contribute. I picked up this nasty little bastard when I accidentally clicked on the wrong button when a rogue web site offered to install something on my computer (gotta learn to aim better with that mouse). Anyway, the spyware cleaners I used got all the nasties EXCEPT this one. In particular, I think this one turns on the Bosnian language keyboard attribute in Windows, which makes it impossible to roll back your SP2 installation to SP1 until you kill it.
Registry Value Name: KBDIC
Command: c:\windows\system32\kbdic.exe (loads from HKLM)
File Location: c:\windows\system32\kbdic.exe
Description: Part of a trojan package. Make sure you delete the right file! KBDIC.DLL and KBDIC.KBD seem to be valid Windows files.