Trojan.NSIS.Voter

Detect Date 12/03/2010
Class Trojan
Platform NSIS
Description

The Trojan copies its executable file to all removable media under the following name:

<x>:smss.exe

It also copies the extracted image:

<x>:Raila Odinga.gif

<x> stands for the letter of the removable disk.

The Trojan creates an autorun.inf file in the root of the removable disk. This file will automatically launch the Trojan executable file when the user attempts to open the infected disk using Explorer.

The Trojan also recursively copies its executable file to all folders on the removable disk. These copies use the names of files which are located in these folders together with an .exe extension.