Email-Worm.Win32.Agent.ev arrives on systems as an email attachment and attempts to download additional components onto the system if executed.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
Knowledge Base
Find the latest advice in our Community Knowledge Base.
User Guide
See the user guide for your product on the Help Center.
Submit a sample
Submit a file or URL for further analysis.
Email-Worm:W32/Agent.EV spreads as an attachment in spam email with attention grabbing lines in the subject field.
The following email subjects have been observed:
The attachment is named Saver.zip.
When the malware is extracted and executed, it will drop the following components:
%Windir% is the Windows directory. This is usually C:\Windows.[name] is a random filename. Observed examples are Mvd37.sys and Irv31.sys. The contents of the files are the same.WinData.cab is a copy of WinNt32.dll.
All of the dropped components are detected asTrojan-Downloader:W32/Agent.NSL.
The following registry entries are created to load WinNt32.dll on every system startup:
The following registry entries are created to start the [name].sys file as a service:
Similar changes are made in HKLM\SYSTEM\ControlSet001\Services\[name] and HKLM\SYSTEM\ControlSet002\Services\[name].
The Trojan-Downloader:W32/Agent.NSL DLL component will then attempt to connect to one of the following addresses:
Other slightly modified variants may attempt to connect to different addresses.
Date Created: -
Date Last Modified: -