Trojan-Downloader:W32/Agent.ICF attempts to download files. It also drops files and writes to the system registry.

Find out more

Knowledge Base

Find the latest advice in our Community Knowledge Base.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

File System Changes

Attention: %windir% represents the default Windows directory.Creates these files:

  • %windir%\system32\dx6vcl.dll
  • %windir%\system32\notepod.exe
  • %windir%\system32\disk.ico
  • %windir%\system32\xtemp1.exe
  • %windir%\system32\xtemp2.exe

Replaces the following file with a copy of itself:

  • %windir%\system32\rsvp.exe

Note: The file called rsvp.exe is a Windows system file. Deletion of the malware file during disinfection will require the repair of the system file.Creates these directories:

  • %windir%\Web\webpf
  • %windir%\Web\webdc
  • %windir%\Web\webpt
  • %windir%\Web\webhp
  • %windir%\Web\webxs

Process Changes

Creates these processes:

  • %windir%\system32\rsvp.exe

Uses these temporary processes:

  • %windir%\system32\xtemp1.exe
  • %windir%\system32\xtemp2.exe

These modules were loaded into other processes:

  • %windir%\system32\dx6vcl.dll Loaded into %windir%\system32\svchost.exe

Creates these mutexes:

  • c:!windows!system32!config!systemprofile !local settings!temporary internet files!content.ie5!
  • c:!windows!system32!config!systemprofile!cookies!
  • c:!windows!system32!config!systemprofile!local settings!history!history.ie5!

Network Connections

Attempts to download files from:


Registry Modifications

Sets these values:

  • HKLM\System\CurrentControlSet\Control\Session Manager\SFC ProgramFilesDir = C:\Program Files\x174
  • HKLM\System\CurrentControlSet\Control\Session Manager\SFC CommonFilesDir = C:\Program Files\Common FilesurrentControlSet \Control\Session Manager
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt Application = notepod.exe
  • HKLM\System\CurrentControlSet\Services\RSVP Type = 00000010
  • HKLM\System\CurrentControlSet\Services\RSVP Start = 00000002
  • HKLM\System\CurrentControlSet\Services\RSVP ErrorControl = 00000000
  • HKCU\Software\Microsoft\Windows Script\Settings JITDebug = 00000000

Creates these keys:

  • HKLM\Software\Classes\Applications\notepod.exe
  • HKLM\Software\Classes\Applications\notepod.exe\shell
  • HKLM\Software\Classes\Applications\notepod.exe\shell\open
  • HKLM\Software\Classes\Applications\notepod.exe\shell\open\command
  • HKCU\Software\Microsoft\Windows Script
  • HKCU\Software\Microsoft\Windows Script\Setting

Additional Details

Notepod: Agent.ICF creates a file called notepod.exe and sets a registry value to associate .TXT files with it. If the system user opens a text file notepod.exe will be launched, which in turn calls on notepad.exe. Notepad.exe is a legitimate Windows file.The launching of notepod.exe will once again execute the trojan-downloader mechanisms.Automatic Updates: Agent.ICF attempts to delete the Automatic Updates service. The Automatic Update service enables the download and installation of Windows updates.Autorun Features: Agent.ICF also contains autorun features. See the Worm/W32:Autorun description for additional details. The autorun.inf file will copy to the root of a removable drive. Under a folder called recycled there is a file called cleardisk.pif. The PIF file a copy of the trojan-downloader.

Date Created: -

Date Last Modified: -