Troj/Dloader-YF is a Trojan for the Windows platform.
Troj/Dloader-YF includes functionality to access the internet and communicate with a remote server via HTTP.
When first run Troj/Dloader-YF copies itself to <System>\ipwf.exe and creates the file <System>\drivers\winut.dat.
Troj/Dloader-YF is a Trojan for the Windows platform.
Troj/Dloader-YF includes functionality to access the internet and communicate with a remote server via HTTP.
When first run Troj/Dloader-YF copies itself to <System>\ipwf.exe and creates the file <System>\drivers\winut.dat.
The following registry entry is created to run ipwf.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
IPFW
<System>\ipwf.exe
The Trojan makes registry changes in the following location, registering both the original file and the copy as authorized applications:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\List