Agent.EO is a trojan that spies web traffic and modifies infected
computers desktop settings. It infects WININET.DLL for activating
its spying component. It also downloads and activates PSGuard, which
appears to be anti-spyware program.
FSAV is able to remove all infected components and disinfect the
modified WININET.DLL. However, a reboot is required for successful
In some cases, FSAV might not be able to disinfected WININET.DLL.
On Windows 2000 and XP, File System Protection (FSP) feature might
prevent automatic disinfection. In such situations, please follow
- Disinfect WININET.DLL manually or wait for FSAV notification for automatic disinfection
- Verify that WININET.DLL.$DIS file appears in the system folder
- Add the following value to the registry:
- Reboot the system
When the trojan's file is executed, it drops the following files:
'uninstIU.exe' is a simple program that uninstalls the trojan.
'olead.dll' is a spying DLL. It is loaded in every process that
imports WININET.DLL (see WININET.DLL infection). 'wp.bmp' is an
image that the trojan sets as desktop wallpaper.
The trojan also tries to download and activate PSGuard installation
program from psguard.com.
The most visible change in the desktop is the wallpaper image
which displays a fake error message:
The trojan modifies desktop settings by installing several
registry keys. Desktop wallpaper is set with the following
"Wallpaper" = "%SysDir%\wp.bmp"
"WallpaperStyle" = "0"
The desktop backgrond color is changed with the following key:
"Background" = "1 2 172"
The following keys are installed for disabling relevant configuration
tabs in windows explorer:
"NoDispAppearancePage" = 1
"NoDispBackgroundPage" = 1
"NoActiveDesktopChanges" = 1
The spying component oleadm.dll is activated by installing hooks
in Windows system component WININET.DLL. The hook code traps WININET.DLL
entry point and exported symbol 'HttpSendRequestA'. When these entry
points are called, oleadm.dll is loaded into the address space of
process. Infected WININET.DLL is detected as 'Virus.Win32.Nsag.a'.
Web traffic monitoring
When the spying component oleadm.dll is active, it monitors all accessed
web pages and sends information to several remote servers.
FSAV detects Agent.eo and related components with the following
Infected WININET.DLL is detected with the following version:
Jarkko Turkulainen, Jun 28 2005;
Jarkko Turkulainen, Aug 26 2005;