Trojan-Downloader:W32/Agent.ICF

Classification

Malware

Trojan-Downloader

W32

Trojan-Downloader:W32/Agent.ICF

Summary

Trojan-Downloader:W32/Agent.ICF attempts to download files. It also drops files and writes to the system registry.

Suspect a file is incorrectly detected (a False Positive)?

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest detection database updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    NOTE If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note You need administrative rights to change the settings.

Find out more

Knowledge Base

Find the latest advice in our Community Knowledge Base.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

File System Changes

Attention: %windir% represents the default Windows directory.Creates these files:

  • %windir%\system32\dx6vcl.dll
  • %windir%\system32\notepod.exe
  • %windir%\system32\disk.ico
  • %windir%\system32\xtemp1.exe
  • %windir%\system32\xtemp2.exe

Replaces the following file with a copy of itself:

  • %windir%\system32\rsvp.exe

Note: The file called rsvp.exe is a Windows system file. Deletion of the malware file during disinfection will require the repair of the system file.Creates these directories:

  • %windir%\Web\webpf
  • %windir%\Web\webdc
  • %windir%\Web\webpt
  • %windir%\Web\webhp
  • %windir%\Web\webxs

Process Changes

Creates these processes:

  • %windir%\system32\rsvp.exe

Uses these temporary processes:

  • %windir%\system32\xtemp1.exe
  • %windir%\system32\xtemp2.exe

These modules were loaded into other processes:

  • %windir%\system32\dx6vcl.dll Loaded into %windir%\system32\svchost.exe

Creates these mutexes:

  • c:!windows!system32!config!systemprofile !local settings!temporary internet files!content.ie5!
  • c:!windows!system32!config!systemprofile!cookies!
  • c:!windows!system32!config!systemprofile!local settings!history!history.ie5!

Network Connections

Attempts to download files from:

  • http://www.why001.com/[Removed].exe
  • http://www.koreaara.com/down/[Removed].rar
  • http://63.245.209.10/[Removed].dat

Registry Modifications

Sets these values:

  • HKLM\System\CurrentControlSet\Control\Session Manager\SFC ProgramFilesDir = C:\Program Files\x174
  • HKLM\System\CurrentControlSet\Control\Session Manager\SFC CommonFilesDir = C:\Program Files\Common FilesurrentControlSet \Control\Session Manager
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt Application = notepod.exe
  • HKLM\System\CurrentControlSet\Services\RSVP Type = 00000010
  • HKLM\System\CurrentControlSet\Services\RSVP Start = 00000002
  • HKLM\System\CurrentControlSet\Services\RSVP ErrorControl = 00000000
  • HKCU\Software\Microsoft\Windows Script\Settings JITDebug = 00000000

Creates these keys:

  • HKLM\Software\Classes\Applications\notepod.exe
  • HKLM\Software\Classes\Applications\notepod.exe\shell
  • HKLM\Software\Classes\Applications\notepod.exe\shell\open
  • HKLM\Software\Classes\Applications\notepod.exe\shell\open\command
  • HKCU\Software\Microsoft\Windows Script
  • HKCU\Software\Microsoft\Windows Script\Setting

Additional Details

Notepod: Agent.ICF creates a file called notepod.exe and sets a registry value to associate .TXT files with it. If the system user opens a text file notepod.exe will be launched, which in turn calls on notepad.exe. Notepad.exe is a legitimate Windows file.The launching of notepod.exe will once again execute the trojan-downloader mechanisms.Automatic Updates: Agent.ICF attempts to delete the Automatic Updates service. The Automatic Update service enables the download and installation of Windows updates.Autorun Features: Agent.ICF also contains autorun features. See the Worm/W32:Autorun description for additional details. The autorun.inf file will copy to the root of a removable drive. Under a folder called recycled there is a file called cleardisk.pif. The PIF file a copy of the trojan-downloader.