Troj/Dorf-O is a Trojan dropper that may download and install additional malicious components.
When first run Troj/Dorf-O copies itself to <Windows>\spooldr.exe and creates the file <System>\spooldr.sys.
The file spooldr.sys is detected as
Troj/Dorf-M.
Troj/Dorf-O also infects the file tcpip.sys with a code that loads the Trojan driver spooldr.sys into memory and activates it. Spooldr.sys contains code to hide the presence of the dropped malicious files.