Trojan.Win32.GhostSpy

Technical Details

GhostSpy is a Trojan horse created to spy on the actions performed on victim machines. The GhostSpy program (virus) can perform the following:

• record all actions to a log file (keystrokes, applications started, files opened, etc.)
• tracking from a remote computer
• blocking of victim computers
• with the help an additional plugin called”GhostSpy Screen Spy” it can display pictures of the screen.

Once run the Trojan program registers itself in the system registry auto-run key so that it is run each time a victim computer is restarted. When run GhostSpy is not visible in the list of active processes. All events are entered into a log file and, depending on how the Trojan is setup, periodically archives the log-file and also sends it via e-mail to an indicated address.