Troj/Tiotua-D

Please follow the instructions for removing Trojans.

Troj/Tiotua-D is a Trojan for the Windows platform.

Troj/Tiotua-D includes functionality to access the internet and communicate with a remote server via HTTP.

When first run Troj/Tiotua-D copies itself to:

<Windows>\SVICHOSSST.exe
<System>\SVICHOSSST.exe

and creates the following files:

<System>\autorun.ini
<System>\setting.ini

The following registry entry is created to run SVICHOSSST.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Yahoo Messengger
<System>\SVICHOSSST.exe

The following registry entry is changed to run SVICHOSSST.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe SVICHOSSST.exe

The following registry entries are set, disabling system software:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1

The following registry entry is set:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NofolderOptions
1