Agent.EO

GO TO: Summary | Removal | Technical Details

Classification

Category:

Rootkit

Type:

-

Platform:

-

Aliases:

Adolff, Agent.EO, Backdoor.Win32.Agent.eo, Virus.Win32.Nsag.a

Summary

Agent.EO is a trojan that spies web traffic and modifies infected computers desktop settings. It infects WININET.DLL for activating its spying component. It also downloads and activates PSGuard, which appears to be anti-spyware program.

Removal

Automatic action

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

Suspect a file is incorrectly detected (a False Positive)?

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest detection database updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    NOTE If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note You need administrative rights to change the settings.

Find out more

Knowledge Base

Find the latest advice in our Community Knowledge Base.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

FSAV is able to remove all infected components and disinfect the modified WININET.DLL. However, a reboot is required for successful WININET.DLL disinfection.

In some cases, FSAV might not be able to disinfected WININET.DLL. On Windows 2000 and XP, File System Protection (FSP) feature might prevent automatic disinfection. In such situations, please follow these steps:

  • - Disinfect WININET.DLL manually or wait for FSAV notification for automatic disinfection
  • - Verify that WININET.DLL.$DIS file appears in the system folder
  • - Add the following value to the registry: [HKLM\System\CurrentControlSet\Control\Session Manager] "AllowProtectedRenames"=dword:00000001
  • - Reboot the system

System installation

When the trojan's file is executed, it drops the following files:

  • %SysDir%\oleadm.dll
  • %SysDir%\wp.bmp
  • %WinDir%\uninstIU.exe

'uninstIU.exe' is a simple program that uninstalls the trojan. 'olead.dll' is a spying DLL. It is loaded in every process that imports WININET.DLL (see WININET.DLL infection). 'wp.bmp' is an image that the trojan sets as desktop wallpaper.

The trojan also tries to download and activate PSGuard installation program from psguard.com.

Desktop modifications

The most visible change in the desktop is the wallpaper image which displays a fake error message:

The trojan modifies desktop settings by installing several registry keys. Desktop wallpaper is set with the following registry keys:

[HKCU\Control Panel\Desktop]
"Wallpaper" = "%SysDir%\wp.bmp"
"WallpaperStyle" = "0"

The desktop backgrond color is changed with the following key:

[HKCU\Control Panel\Colors]
"Background" = "1 2 172"

The following keys are installed for disabling relevant configuration tabs in windows explorer:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"NoDispAppearancePage" = 1
"NoDispBackgroundPage" = 1



[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

"NoActiveDesktopChanges" = 1

WININET.DLL infection

The spying component oleadm.dll is activated by installing hooks in Windows system component WININET.DLL. The hook code traps WININET.DLL entry point and exported symbol 'HttpSendRequestA'. When these entry points are called, oleadm.dll is loaded into the address space of process. Infected WININET.DLL is detected as 'Virus.Win32.Nsag.a'.

Web traffic monitoring

When the spying component oleadm.dll is active, it monitors all accessed web pages and sends information to several remote servers.