Troj/Taterf-G is a Trojan for the Windows platform.
Troj/Taterf-G includes functionality to:
- run automatically
- steal confidential information
- access the internet and communicate with a remote server via HTTP
- disable other software, including anti-virus, firewall and security related applications
Troj/Taterf-G communicates via HTTP with the following locations:
yahooui0 . com
When Troj/Taterf-G is installed the following files are created:
<Temp>\cvasds0.dll
<Temp>\herss.exe
<Root>\y6cqb2is.exe
The following registry entry is created to run herss.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
cdoosoft
<Temp>\herss.exe
Registry entries are set as follows:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
CheckedValue
0x00000000
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
0x00000002
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden
0x00000000
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\DownloadManager