Troj/Oscor-C is a Trojan for the Windows platform.
Troj/Oscor-C includes functionality to access the internet and communicate with a remote server via HTTP.
When first run Troj/Oscor-C copies itself to <Windows system folder>\temp1 and creates the following files:
<Windows system folder>\zsydll.dll
<Windows system folder>\zsyhide.dll
<Temp>\20060426.bak
The following registry entries are created to run code exported by zsydll.dll on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\zsydll
DllName
<Windows system folder>\zsydll.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\zsydll
Startup
DoStartup
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\zsydll
Impersonate
0
The following registry entry is set:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs
<Windows system folder>\zsyhide.dll