Detection Names :	Worm.Win32.Agent.t
Category:	Malware
Type:	Worm
Type:	Trojan-Downloader
Platform:	W32
Date of Discovery:	March 22, 2007

A type of worm that replicates by sending complete, independent copies of itself over a network.

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.

Network Disinfection

For general instructions on disinfecting a local network infection, please see Eliminating A Local Network Outbreak.

Worm:W32/Agent.T drops several copies of itself onto the system and downloads other additional malware from the Internet.

Execution

Upon execution, Agent.T drops the following files:

It modifies the following autostart registry entry to enable its automatic execution every system boot-up:

Note: The default value is Userinit=%windir%\system32\userinit.exe

It may drop a copy of itself to several drives. The Autorun.inf file, which is a configuration file used to automatically execute the malware when a directory or drive is being opened, is also dropped together with the main executable file.

Activity

Agent.T downloads the following files from the Internet:

It then saves the files to the Windows directory using the following filenames:

One of the text files contains the following download sites:

The downloaded files are also trojan-downloaders that are now detected as Trojan-Downloader:W32/Small.EJW and Trojan-Downloader:W32/Small.ELM.