Trojan.Etsur

Trojan.Etsur is a memory resident trojan that logs keystrokes and clipboard data. When the trojan is executed, it creates the following registry entry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Mrvt\IDWin = [string of digits representing the time of day]

It then deletes all URLs from the Internet Explorer cache.

The trojan also creates the following file to store captured information:
%Windir%\Inites.ini

Information stored in the above file includes:
URLs opened with Internet Explorer
Clipboard data
Keystrokes entered into websites with the following strings in their titles:
e-gold
Key
bank
PayPal
Sign In
Fleet
Citi

The trojan then uses its own SMTP engine to send the Inites.ini file at regular intervals to an email address hardcoded into the trojan.

Summary