Trojan.PWS.KATES will create a copy of itself and move it to %userprofile%Templatesmemory.memory.tmp. The file access, creation and write times are replaced with those of the user32.dll file. The call to action is triggered once the Trojan is loaded along with the Internet browser the computer owner uses to access web pages. The Trojan also peeps at users passwords and at whatever other critical data they provide on the Internet, shipping it to the malware developers servers.”]