Short description
Win32/VB.OSV is a trojan that steals sensitive information. The trojan is able to log keystrokes. The trojan attempts to send gathered information to a remote machine.
Installation
When executed, the trojan copies itself into the following location:
- C:\WINDOWS\system\MCISEQ.exe
In order to be executed on every system start, the trojan sets the following Registry entries:
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Run]
"%originalfilename%" = "C:\WINDOWS\system\MCISEQ.exe"
"mciseq" = "C:\WINDOWS\system\MCISEQ.exe"
Other information
The trojan is able to log keystrokes.
The data is saved in the following file:
- %windir%\%computername%.txt
The trojan attempts to send gathered information to a remote machine.
The trojan contains a list of (1) addresses.
The FTP protocol is used.
