Trojan.Win32.GhostSpy

Class Trojan
Platform Win32
Description

Technical Details

GhostSpy is a Trojan horse created to spy on the actions performed on victim machines. The GhostSpy program (virus) can perform the following:

  • record all actions to a log file (keystrokes, applications started, files opened, etc.)
  • tracking from a remote computer
  • blocking of victim computers
  • with the help an additional plugin called”GhostSpy Screen Spy” it can display pictures of the screen.

Once run the Trojan program registers itself in the system registry auto-run key so that it is run each time a victim computer is restarted. When run GhostSpy is not visible in the list of active processes. All events are entered into a log file and, depending on how the Trojan is setup, periodically archives the log-file and also sends it via e-mail to an indicated address.