Name :	Trojan:W32/Agent.DPL
Size:	95918
Category:	Malware
Type:	Trojan, Worm
Platform:	W32
Origin:	KENYA
Date of Discovery:	October 24, 2007

Trojan.W32/Agent.DPL totally paralyzes the victim's computer after execution by removing access to many basic functions of the Windows OS.

Its motives appear to be completely malicious. It makes references to a Kenyan politician and may be a form of political mudslinging.

When the malware is active on the system, many basic functions are crippled, system tools are disabled, and there is little that can be done with the computer.

However, the malware will terminate itself when a process named MsAutoPro.exe is launched.

An application such as Notepad.exe can be renamed as MsAutoPro.exe. Running "notepad" with this new name will display a dialog box with the text "Illegal Application" and the malware will terminate itself.

The Registry key changes will still need to be undone, but the malware will no longer close system tools and other applications.

Upon execution Trojan:W32/Agent.DPL opens the "My Documents" folder on the Windows Desktop.

Agent.DPL attempts to connect to the following website:


The website is the official presidential campaign page of Kenyan politician Stephen Kalonzo Musyoka.

Before Windows starts and enters the Welcome screen the following message will appear:




The malware creates the following file:


It creates the following Startup files for itself:


It copies itself into the following folders as:


Spreading Vectors

The malware spreads itself by creating a file called "Autorun.inf" and a folder called "WindowXP" onto hard drive partitions, including removeable media (such as USB drives), and copies itself into the folder as "Explorer.exe". It hides the "Autorun.inf" file by changing its file attributes.


It also copies itself to every folder opened and viewed by the user. The copy uses the same name as the folder itself.

It modifies the following registry keys:


The Registry modifications result in a crippled Start Menu:



It disables/hides the following System tools:


It will remove the following files if they exist:


If the malware finds that the user is trying to launch a process called "MsAutoPro.exe" or that the process is already running, the malware terminates itself by displaying a message box with the text "Illegal Application". This process name can be used to disable the malware.



It terminates following processes and prevents them to run:


It terminates all the processes that have one of the following strings:


Agent.DPL also repeatedly opens the CD/DVD-Rom drive door.

The malware was written with Visual Basic.