Troj/VB-EMF is a Trojan for the Windows platform.
Troj/VB-EMF includes functionality to run automatically.
When Troj/VB-EMF is installed it copies itself to:
<System>\msupdt.exe
When Troj/VB-EMF is installed the following files are created:
<System>\sblog.txt which is not detect-worthy
The following registry entry is set:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Winlogon
Userinit
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\MsUpdater
HKLM\SOFTWARE\Microsoft
HKCU\Software\Microsoft\Visual Basic