Tervserv is a backdoor that provides the attacker with unauthorized remote access to the compromised computer. The intruder can download and execute arbitrary files, gather file system information, execute system commands, update or uninstall the backdoor. The parasite injects malicious code into legitimate system processes such as Internet Explorer. It runs as a service on every Windows startup, and every time the user launches the web browser.