Troj/Delf-EZZ is a Trojan for the Windows platform.
Troj/Delf-EZZ includes functionality to access the internet and communicate with a remote server via HTTP.
When first run Troj/Delf-EZZ copies itself to <System>\qtplugin.exe and creates the following files:
<System>\qtprot.sys which also is detected as Troj/Delf-EZZ
<System>\hdport.sys which is detected as Troj/Delf-EZY
The following registry entry is created to run qtplugin.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RegistryMonitor1
<System>\igfxpers.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup
RegistryMonitor2
<Windows>\ServicePackFiles\ServicePackCache
The file qtprot.sys is registered as a new system driver service named "qtprot", with a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\qtprot
The file hdport.sys is registered as a new system driver service named "hdport", with a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\hdport