Threat description
Worm:W32/Agent.T drops several copies of itself onto the system and downloads other additional malware from the Internet.
Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.
More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.
For further assistance, F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.
You may also refer to the Knowledge Base on the F-Secure Community site for more assistance.
For general instructions on disinfecting a local network infection, please see Eliminating A Local Network Outbreak.
Upon execution, Agent.T drops the following files:
It modifies the following autostart registry entry to enable its automatic execution every system boot-up:
Note: The default value is Userinit=%windir%\system32\userinit.exe
It may drop a copy of itself to several drives. The Autorun.inf file, which is a configuration file used to automatically execute the malware when a directory or drive is being opened, is also dropped together with the main executable file.
Agent.T downloads the following files from the Internet:
It then saves the files to the Windows directory using the following filenames:
One of the text files contains the following download sites:
The downloaded files are also trojan-downloaders that are now detected as Trojan-Downloader:W32/Small.EJW and Trojan-Downloader:W32/Small.ELM.
Description Created: 2010-06-02 06:24:30.0
Description Last Modified: 2010-06-02 06:27:58.0
Suspect a file or URL was wrongly detected?
Send it to our Labs for further analysis
Give advice. Get advice. Share the knowledge on our free discussion forum.