A remote administration utility which bypasses normal security mechanisms to secretly control a program, computer or network.
Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.
Find the latest advice in our Community Knowledge Base.
See the manual for your F-Secure product on the Help Center.
Submit a file or URL for further analysis.
Backdoor:W32/Agent.AMB is a malicious program that allows an attacker to remotely download and execute files on the infected computer. The backdoor may also be used to force the computer to perform Denial of Service (DoS) attacks.
It drops its main executable in Windows System directory using any of the following filenames:
Agent.AMB also drops the following file:
It installs itself as a service using any of the following service names:
Agent.AMB connects to a remote site and awaits for commands from a remote hacker.
It may also perform DoS attacks on certain websites and download other malware from the Internet.
Some variants of this backdoor may drop copies of its executable file (using random filenames) to the following locations:
Other variants also drop the configuration file, Autorun.inf, together with the main executable. If the Windows Autorun function is enabled in the system, the Autorun.inf file is used to automatically run the backdoor upon opening a drive or inserting a removable device into the machine.