Win32/VB.OOB is a trojan that deletes files in specific folders. When executed, the trojan creates the following folders: The following files are dropped : The trojan creates and runs a new thread with its own program code within the following processes: Win32/VB.OOB is a trojan that deletes files in specific folders. The trojan searches local drives for files with the following file extensions: It avoids files which contain any of the following strings in their path: When the trojan finds a file matching the search criteria, it creates a new file.

The file name and extension of the newly created file is derived from the original one.

An additional ".T-652D.PNG" extension is appended. The file is JPEG image.

Some examples follow.
(1.)
(2.)
(3.)
(4.) Size of the file is 21901 B, 305801 B .

The trojan then deletes the original files. The trojan may execute the following commands: