Troj/Delf-KR is a Trojan for the Windows platform.
Troj/Delf-KR includes functionality to access the internet and communicate with a remote server via HTTP.
When first run Troj/Delf-KR copies itself to \DriverLoad\svchost.exe.
The following registry entries are created to run svchost.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
DriverLoad
C:\DriverLoad\svchost.exe -dl
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
DriverCheck
C:\DriverLoad\svchost.exe -dc
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
SystemDriverLoad
C:\DriverLoad\svchost.exe -sdl
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
SystemDriverCheck
C:\DriverLoad\svchost.exe -sdc
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
SystemCheck
C:\DriverLoad\svchost.exe -sc