Trojan.Kotver

Trojan.Kotver is Trojan whose primary purpose is to execute click-fraud campaigns on the computers of its victims. The Trojan is programmed to infiltrate the computers of its victims silently, followed by a strict multi-stage operation that allows Trojan.Kotver to open and click advertisements automatically without the user's knowledge. When Trojan.Kotver is first introduced to a computer, the threat checks whether Windows PowerShell is installed or not. If PowerShell is present and enabled, Trojan.Kotver executes all of its operations via this platform. However, if PowerShell is not installed, then Trojan.Kotver uses a different approach and creates several Registry entries whose purpose is to ensure that Trojan.Kotver will run at all times. Also, Trojan.Kotver injects itself into the 'regsrv32.exe' process and downloads Microsoft.NET Runtime, Microsoft Internet Explorer and Adobe Flash Player from a remote server automatically. This software is used by Trojan.Kotver to carry out its click-fraud operations and the threat cannot function without them. The ads that Trojan.Kotver opens may be affiliated with the Trojan's authors, and by opening them, they may generate advertising avenue fraudulently. This way, they can make thousands of dollars by infecting users with Trojan.Kotver and causing their computers to open and click on ads in a hidden instance of Internet Explorer silently. Users whose computers are infected with Trojan.Kotver may not notice any performance issues, and the only obvious trace of this infection is the unusual number of 'IEXPLORE.EXE' processes found in the task manager. If you suspect that your computer may be infected with Trojan.Kotver, you should download a reliable anti-malware scanner and use it to scan and remove the threat immediately.