Threat Description

Worm: W32/Agent.T


Category: Malware
Type: WormTrojan-Downloader
Platform: W32
Date Discovered: 2007-03-22 02:00:25.0
Aliases: Trojan.Downloader-1419, Trojan.Downloader.Agent.ASH, W32/Generic.m


Worm:W32/Agent.T drops several copies of itself onto the system and downloads other additional malware from the Internet.


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More scanning & removal options

More information on scanning or removal options is available in the documentation for your F-Secure security product on the Downloads section of our Home - Global site.

Contact Support

For further assistance, F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for more assistance.

Network Disinfection

For general instructions on disinfecting a local network infection, please see Eliminating A Local Network Outbreak.

Technical Details


Upon execution, Agent.T drops the following files:

  • %windir%\yqqty.exe - A copy of itself.

It modifies the following autostart registry entry to enable its automatic execution every system boot-up:

  • [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] Userinit=%windir%\system32\userinit.exe,%windir%\yqqty.exe

Note: The default value is Userinit=%windir%\system32\userinit.exe

It may drop a copy of itself to several drives. The Autorun.inf file, which is a configuration file used to automatically execute the malware when a directory or drive is being opened, is also dropped together with the main executable file.


Agent.T downloads the following files from the Internet:


It then saves the files to the Windows directory using the following filenames:

  • listsas.txt
  • saslogww.txt

One of the text files contains the following download sites:


The downloaded files are also trojan-downloaders that are now detected as Trojan-Downloader:W32/Small.EJW and Trojan-Downloader:W32/Small.ELM.

Description Created: 2010-06-02 06:24:30.0

Description Last Modified: 2010-06-02 06:27:58.0


Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More