Win32/Taterf is a family of worms that spread via mapped drives in order to steal login and account details for popular online games.
When executed, Taterf copies itself to the system directory as a hidden file using one of the following file names:
The registry is modified to run the copy at each Windows start (for example):
Adds value: "amva" With data: "<system folder>\amvo<number>.exe" To subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Adds value: "avpa" With data: "<system folder>\avpo<number>.exe" To subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Note: Filenames and registry modifications differ according to variant.
The functionality to perform Taterf's password-stealing payload is contained in a dll component which is also dropped to the system directory using one of the following file names:
<random 7 or 8 letter name>.dll
Where <number> may be omitted entirely, or be a numeral from 0-9.
Once dropped, the dll is injected into explorer.exe or iexplore.exe. These dlls may be detected as Worm:Win32/Taterf.<variant letter>.dll, according to variant.
It should be noted, that in order to evade detection, the authors of this family may pack the worm's executable. In cases such as these, the worm may be detected with the following names:
A driver with a randomly generated file name may also be dropped in the %temp% directory depending on which packer is used. This driver is detected as either VirTool:WinNT/Vanti.A or VirTool:WinNT/Vanti.B. The above mentioned dlls may also be written to the %temp% directory when these packers are used.
Mapped removable and network drives
The worm continually enumerates drives from C- Z, copying itself to the root of the drive, and creating an 'autorun.inf' file, which points to one of the copies that it creates. When the removable or networked drive is accessed from another computer supporting the Autorun feature, the malware is launched automatically. This 'autorun.inf' file is detected as Worm:Win32/Taterf!inf.
The name that the worm uses to copy itself to in the root of the drive differs across variants, however, it usually consists of random letters and numbers with a '.com', 'cmd' or an '.exe' extension.