Threat Search: 

ThreatExpert's Statistics for W32.Gosys [Symantec]:

W32.Gosys [Symantec] is also known as:
Threat AliasNumber of Incidents
Generic VB.b [McAfee]5
Malware.Gosys [PC Tools]5
Trojan.Win32.VB.yfq [Kaspersky Lab]5
Generic VB.k [McAfee]2
Troj/VB-EKD [Sophos]2
Trojan.Win32.VB.yyv [Kaspersky Lab]2
Generic VB.i [McAfee]1
Trojan.Win32.VB.aabn [Kaspersky Lab]1
W32/Mofksys-A [Sophos]1
Worm:Win32/Mofksys.A [Microsoft]1

W32.Gosys [Symantec] is known to be created as:
%AppData%\icsys.icn.exe
%AppData%\mrsys.exe
%System%\explorer.exe
%Windir%\spoolsv.exe
%Windir%\svchost.exe
Notes:
  • %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
  • %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
  • %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.