Mal/Troco-A is a worm for the Windows platform.
When first run Mal/Troco-A copies itself to <System>\<predefined name1>.exe and creates the file <System>\<predefined name2>.exe, where <predefined name1> and <predefined name2> may vary with each sample.
The following registry entries are created to run these files on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
<predefined name1>.exe
<System>\<predefined name1>.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
<predefined name2>.exe
<System>\<predefined name2>.exe
Some variants of Mal/Troco-A also attempt to infect removable devices by copying themselves to the root folder of the device with filenames such as fotos.exe or mp3.exe, and creating an autorun.inf file to automatically execute this file when the device is inserted into a new computer.