Troj/Chast-A is a backdoor and keylogging Trojan for the Windows platform.
When first run Troj/Chast-A copies itself to <Windows>\<random>.exe and creates the following files:
<Windows>\isnopt.dat
<Windows>\isnsys.dll
<Windows>\isnsys32zx.dll
<System>\isndata\data\<Username>\logapps.dat
<System>\isndata\data\<Username>\logwin.dat
The file isnsys32zx.dll is detected as Troj/Wilcol-A, and may be used to stealth Troj/Chast-A. The dat files are clean data files, and may safely be deleted. The file isnsys.dll is the keylogging component of the Trojan, and is also detected as Troj/Chast-A.
Troj/Chast-A can also log Instant Messaging conversations, as well as retrieve information about infected systems.
The following registry entry is created to run win16svc.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
System32Check
<Windows>\<random>.exe