Trojan-Clicker.Win32.Delf.cl

0 0

This primitive Trojan will cause Internet Explorer to open http://www.g*****ikme.com/random.php without the users knowledge or consent.

The Trojan itself is a Windows PE EXE file written in Delphi and approximately 10240 bytes in size.

Once launched, the Trojan copies itself to the Windows root directory as svchost.exe:

%Windir%\svchost.exe

It then registers this file in the system registry, ensuring that the Trojan will be launched each time Windows is rebooted on the victim machine.

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"Generic Host Process" = "%Windir%\svchost.exe"

The Trojan is designed to falsify data about the number of times http://www.g*****ikme.com is visited. This is why it causes infected machines to contact the site.