Symptoms

Removal instructions:

Analyzed By

Technical Description:

Trojan.Fotomoto.F is an trojan with adware functionality. When installed this version performs the following actions:

a) It connects to an internet server and reports some basic informations about the infected computer.

b) It modifies the following registry entry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = 4
This will stop the Windows File Protection from giving notification on replacement of system files or building a log for events.

c) If modifies the following registry entry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DomainService
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DomainService where register itself as a service.

d) It creates a process that runs as a service which creates an event that in case its process is closed it restarts itself thus changing it’s process ID.