Troj/Delf-IT is a downloading Trojan.
Troj/Delf-IT runs in the background and monitors the title bar of Internet Explorer. When this contains certain words or phrases (mostly relating to adult material), the Trojan attempts to download and run further malware.
The Trojan copies itself as LAN.EXE to the Windows folder.
Troj/Delf-IT is a downloading Trojan.
Troj/Delf-IT runs in the background and monitors the title bar of Internet Explorer. When this contains certain words or phrases (mostly relating to adult material), the Trojan attempts to download and run further malware.
Phrases used as triggers by the Trojan horse include:
amateur
barely legal
beauty
bigcocks
bigtits
bikini
bisexual
bizarre
blowjob
bondage
closeup
couple
deepthroat
doggystyle
domination
extreme
facial
femdom
fetish
fisting
fucking
gangbang
handjob
hardcore
hentai
hiddencam
hugecocks
innocent
ladyboy
lesbian
masturbating
messyfacials
monstercock
nympho
outdoor
pantyhose
parksex
pissing
pornstar
pornstars
shemale
spanked
striptease
sucking
tinytits
tittyfuck
topless
tranny
upskirt
vibrator
virgin
lolita
The Trojan copies itself as LAN.EXE to the Windows folder and creates the following registry entry:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\
RunLan<Windows>\Lan.exe