When this trojan is executed, it opens a web page using Internet Explorer.
After opening the web site, the trojan attempts to drop a file to
"c:\winnt\profiles\all users\start menu\programs\startup\VirusChecker.vbs".
Because the path is hard coded, this file is dropped only in the default
Windows NT installations.
Next the trojan collects all mails except a mail with subject "Halloween
Elvis" from both inbox and sent mail folders from Outlook. These mails are
sent to particular email address that propably belongs to the virus writer.
The mail with the subject "Halloween Elvis" is deleted.
The "VirusChecker.vbs" file dropped into startup directory common for all
users will be executed when the system restarts. With this file the trojan
collects emails from the previous working day only. These mails are
collected from user's inbox and sent mail folders and sent to the same email
address mentioned above. On that way the trojan continues spying the
[Analysis: Katrin Tocheva and Sami Rautiainen; F-Secure Corp.; November 1st, 2002]