This Trojan arrives on a system as a file dropped by other malware or as a downloaded file from a certain Web site.

When executed, it attempts to steal sensitive online banking information. When a user attempts to access any of the monitored sites in the configuration file, it captures user input (specifically those entered in the input boxes designed for user names and passwords) and saves it in %System%\wsnpoem\VIDEO.DLL.

(Note: %System% is the Windows system folder, which is usually C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

This routine risks the exposure of the user's account information, which may then lead to the unauthorized use of the stolen data.



More...