Virus:TR/Click.Agent.HF
Date discovered:20/09/2006
Type:Trojan
In the wild:No
Reported Infections:Low
Distribution Potential:Low
Damage Potential:Low to medium
Static file:Yes
File size:155.648 Bytes
MD5 checksum:fc59165dec86b8cf17e1151029200D26
VDF version:6.35.01.115
IVDF version:6.35.01.116 - Monday, August 21, 2006

 General Method of propagation:
   • No own spreading routine


Aliases:
   •  Kaspersky: Trojan-Clicker.Win32.Agent.hf
   •  Bitdefender: Trojan.Clicker.Agent.HB


Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


Side effects:
   • Downloads files
   • Registry modification

 Files  It deletes the following files:
   • %temporary internet files%\Content.IE5\%all directories%\*.gif
   • %temporary internet files%\Content.IE5\%all directories%\*.xml
   • %temporary internet files%\Content.IE5\%all directories%\*.js
   • %temporary internet files%\Content.IE5\%all directories%\*.css
   • %temporary internet files%\Content.IE5\%all directories%\*.cab
   • %temporary internet files%\Content.IE5\%all directories%\*.jsp
   • %temporary internet files%\Content.IE5\%all directories%\*.htm




It tries to download some files:

– The location is the following:
   • http://www.baidu.com/**********
It is saved on the local hard drive under: %temporary internet files%\Content.IE5\%randomly chosen directory%\s.htm

– The location is the following:
   • http://www.baidu.com/img/**********
It is saved on the local hard drive under: %temporary internet files%\Content.IE5\%randomly chosen directory%\logo-yy.gif

 Registry The following registry key is added:

– [HKCU\Software\Microsoft\Internet Explorer\International]
   • "W2KLpk"=dword:00000001

 Backdoor Contact server:
The following:
   • http://lilainet.vicp.net/001/**********

Once connected it will retrieve an additional list of servers.
As a result it may send some information.

Sends information about:
    • Current malware status

 Miscellaneous Mutex:
It creates the following Mutex:
   • InternetClick

 File details Programming language:
 The malware program was written in MS Visual C++.


Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
   • UPX

Description inserted by Monica Ghitun on Wednesday, September 20, 2006
Description updated by Andrei Ivanes on Wednesday, October 18, 2006

Back . . . .