Name:

Trojan.Malagent.au

Added:

September 24, 2011

Type:

Trojan

Risk:

Low

Payload:

N/A

At risk systems:

Windows 95/98/ME/XP/NT/2003

Description:

When Trojan.Malagent.au is executed, it performs the following activities:

After execution, it drops the following files:

%Temp%\nkncgk.exe
%Temp%\winuhwl.exe
%Temp%\250078\{Random name}.exe
%System%\f5859b27.rdb
%Userprofile%\Application Data\Storm\update\%SESSIONNAME%\dwm.exe

It creates/modifies the following registry entries:

{Random name} = "%Userprofile%\Application Data\Storm\
update\%SESSIONNAME%\dwm.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\Run