Troj/Dloader-XF is a Trojan for the Windows platform.
When Troj/Dloader-XF is installed it creates and executes the file <System>\run.dll without notifying the user. The Trojan will also attempt to download files from a remote URL to the locations:
<System>\q4.pak
<System>\prc.exe
The file run.dll is also detected as Troj/Dloader-XF.
The following registry entry is created to run the exported code on startup using the name SecurePatch:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
SharedTaskScheduler
(2F212B1B-1313-1BBC-02A8-7CA23A23E13F)
SecurePatch
The following registry entry is set:
HKCU\Software\Classes\CLSID\(2F212B1B-1313-1BBC-02A8-7CA23A23E13F)\
InProcServer32
(default)
<System>\run.dll
Registry entries are created under:
HKCU\Software\Classes\CLSID\(2F212B1B-1313-1BBC-02A8-7CA23A23E13F)\
InProcServer32\
Troj/Dloader-XF will attempt to delete registry entries under:
HKLM/SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
SharedTaskScheduler
Windows Update
Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
Windows Update