Troj/Tiotua-D is a Trojan for the Windows platform.
Troj/Tiotua-D includes functionality to access the internet and communicate with a remote server via HTTP.
When first run Troj/Tiotua-D copies itself to:
<Windows>\SVICHOSSST.exe
<System>\SVICHOSSST.exe
and creates the following files:
<System>\autorun.ini
<System>\setting.ini
The following registry entry is created to run SVICHOSSST.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Yahoo Messengger
<System>\SVICHOSSST.exe
The following registry entry is changed to run SVICHOSSST.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe SVICHOSSST.exe
The following registry entries are set, disabling system software:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1
The following registry entry is set:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NofolderOptions
1