Virus:TR/Agent.741376
Date discovered:30/07/2007
Type:Trojan
In the wild:Yes
Reported Infections:Low
Distribution Potential:Medium
Damage Potential:Low to medium
Static file:No
VDF version:6.39.00.196

 General Method of propagation:
   • Peer to Peer


Aliases:
   •  Kaspersky: Trojan.Win32.Agent.gjx
   •  F-Secure: Trojan.Win32.Agent.gjx
   •  Grisoft: Agent.VXA
   •  Eset: Win32/Agent.GJX
   •  Bitdefender: Trojan.Agent.AIRP


Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


Side effects:
   • Drops a file
   • Drops a malicious file
   • Registry modification


Right after execution the following information is displayed:


 Files It copies itself to the following locations:
   • %SYSDIR%\WinSpooler.exe
   • %TEMPDIR%\runme.exe



It copies itself within an archive to the following location:
   • %TEMPDIR%\temp01.rar



The following files are created:

– Non malicious file:
   • %SYSDIR%\rar.exe

– A file that is for temporary use and it might be deleted afterwards:
   • %TEMPDIR%\xx%number%

– %TEMPDIR%\temp_01.exe Furthermore it gets executed after it was fully created. Further investigation pointed out that this file is malware, too. Detected as: TR/Agent.741376

 Registry The following registry key is added in order to run the process after reboot:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\
   Run]
   • Windows Printing Driver = WinSpooler.exe



The following registry keys are changed:

– [HKLM\SOFTWARE\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
   Old value:
   • TrapPollTimeMilliSecs= 3a98
   New value:
   • TrapPollTimeMilliSecs= 3a98

– [HKLM\SOFTWARE\Licenses]
   Old value:
   • {K7C0DB872A3F777C0} = %hex values%
   New value:
   • {K7C0DB872A3F777C0} = %hex values%

– [HKLM\SOFTWARE\Licenses]
   New value:
   • {I29A5EA887C231048} = 04,00,00,00

 P2P In order to infect other systems in the Peer to Peer network community the following action is performed:  


– It searches for the following directories:
   • %BearShare's shared folder%
   • %Kazaa's shared folder%
   • %LimeWire's shared folder%
   • %Morpheus' shared folder%
   • %Shareaza's shared folder%

   If successful, the following files are created:
   • 321 XviD Converter 1.2.rar; 3D Studio Max 9 + Tutorials and Keygen
      +.rar; 3D Studio Max 9 Last Version crack.rar; ACDSee 9 build 108
      Vista Compatible_.rar; Acronis Disk Director Server 10.0.216.rar;
      Acronis Disk Director Server 10.0.2169 Keygenerator Working.rar;
      Acronis True Image 11 Build 8053 Home..rar; Adobe Acrobat 8
      Professional Incl keygen..rar; Adobe Acrobat Professional 8.1 - Latest
      Version -.rar; Adobe Acrobat Professional 8.1 keygen.rar; Adobe
      Creative Suite 3.01 crack.rar; Adobe CS3 Master Collection Corporate
      Final +Keygen.rar; Adobe CS3 Master Collection Corporate ISO. .rar;
      Adobe CS3 Master Collection Full Version + Keygen ..rar; Adobe
      Illustrator CS3 with plugins (Thinstalled) .rar; Adobe Photoshop CS3
      Extended Version Full + .Crack.rar; Adobe Photoshop CS3 Extended+
      Crack.rar; Adobe Photoshop CS3 Keygen.rar; Adobe Photoshop CS3 Lite
      crack.rar; Adobe Photoshop CS3 Plugins Collection..rar; Adobe
      Photoshop CS3 v10 Extended Keygen.rar; Adobe Photoshop CS3 with
      Crack..rar; Adobe Photoshop Elements v6.0(Full Version with
      Keygen).rar; Adobe Photoshop Elements v6.0a Keygenerator.rar; Adobe
      Photoshop Lightroom 1.3..rar; Adobe Photoshop Lightroom 1.4 crack.rar;
      Adobe Premiere CS3 Pro Keygenerator.rar; Adobe Premiere Pro CS3
      Multi-language Crack.rar; Adobe.Audition.v3.WinAll.Cracked-NoPE+.rar;
      Adobe.Dreamweaver CS3 9.0.0.345 Latest Patched-RETAiL.rar; Advanced
      System Optimizer 2.20.4.747 keygen.rar; Advanced Uninstaller Pro 8.54
      Keygenerator.rar; Advanced Uninstaller Professional 8.5.2 + Working
      crack.rar; Alcohol 120 1.9.7.602 with KeyMaker v3.6
      (BetaMaster-24.Dec.2007).rar; Alcohol 120 v.1.9.7 crack.rar; Alcohol
      120% 1.9.6.471 Activation Key + Crack.rar; Alive YouTube Video
      Converter 1.2.7.rar; All Antivirus Keygenerator Pack.rar;
      ALL.Adobe.Products.Keygen.rar; All.MicroSoft.Products.Keygen.rar;
      Allok 3GP PSP MP4 iPod Video Converter 2.7.2 Keygen.rar;
      All_ADOBE_Products_Crack+Keygen_2008-ReLEASE.rar; Anti Hacker Expert
      2008 working License Key + Patch _.rar; Any DVD Converter Professional
      3.5.rar; AnyDVD & AnyDVD HD 6.3.0 - Final.rar; AnyDVD & AnyDVD HD 6.4
      keygen.rar; AnyDVD 6.3.0.6 +Activation Key.rar; Apollo No1 DVD Ripper
      6.2.rar; Ashampoo Office 2008 3.01 + crack.rar; Atomix Virtual DJ
      Professional 5 rev6 -.rar; Autodata v3.18 2 CDs Full +.rar; Autodesk
      3DS MAX 2008 crack.rar; Autodesk AutoCAD 2008 crack.rar; Autodesk
      AutoCAD Architecture Version 2008 (Full Version with Key).rar;
      Autodesk AutoCAD Architecture Version 2008..rar; Autodesk Inventor
      Suite 2008 .(Full Version with Crack).rar; Autodesk Inventor Suite
      2008 crack.rar; Avast Antivirus Pro 4.7 Licensed till 2009.rar; Avast
      Antivirus Pro 4.7.109 working Key.rar; AVG 7.5 Internet Security &
      Firewall _.rar; AVG Anti-Spyware Plus 7.5.1.43 con el key
      funcionante.rar; AVG Anti-Spyware Plus 7.5.1.43.333 Patched
      Multilingual-ReL.rar; AVG Anti-Virus Professional Edition Latest
      v7.5.5 + Key..rar; AVG Antivirus Latest Version 7.5 .Pro.rar; BayGenie
      eBay Auction Sniper Pro Edition 3.13 _.rar; BIG CODEC Pack colleci•n
      by Neo.rar; BitDefender Antivirus 10 LAST Working Crack .rar;
      BitDefender Antivirus 2008 Patcheado ESP-ENG.rar; Bitdefender
      AntiVirus 32bit 2008 patcheado + license_key.rar; Black XP 5.1 DVD
      crack.rar; BLACK XP 6.0.0.1 ULTMATE DREAM PACK.rar; BSPlayer Pro 2.23
      (player de DivX-XviD-MKV-RM-AVI-MPEG-MPG).rar; Computer FiX VoL1
      [App][MULTI5]..rar; Convert DAA (PowerISO). or UIF (MagicISO) to ISO
      ..rar; Convert.all.DivX.in.DVD.patched.+ guides.rar;
      Convert.all.MP3.in.WAV.and.create.CDMusical.rar;
      Convert.All.your.AVI-MPEG-RM-RMVB-MKV-DIVX-XVID.in.DVD.for.home.theatre..rar;
      ConvertXtoDVD 2.2.3.258 And Keygen (20th November 2007).rar;
      ConvertXtoDVD 2.2.3.258f And Keygen ( October 2007).rar; ConvertXtoDVD
      2.2.3.3 crack.rar; Cool Youtube Downloader Full..rar; Cute FTP Pro 8
      Patched-Multilingual.rar; CyberLink MakeDVD 2.0.0.202.rar; CyberLink
      PowerDVD 7.3.3516 crack.rar; Daemon Tools Pro 4.16 Patched.rar; Daemon
      tools pro Advanced 4.10.218.rar; DAEMON Tools Pro Advanced v4.10.021
      And Patch.rar; Daemon Tools Pro Basic 4.11.0220 crack.rar; DivX Bundle
      6.9 Professional + Keygenerator.rar; DivX Professional 6.8.0.3 con el
      media player actualizado col Coded.rar; DivX-XviD Multi Converter
      1.9.[Converte.movies.en.el.fomrat.de.tu.selci•n].rar; Download
      Accelerator Plus Premium 8.6.1.4 _.rar; Dr. Hardware 2008 9.0.0.rar;
      Dr.Web Anti-virus with AntiSpam 4.44.1112 (vers•n mui complete).rar;
      Driver Magic Pro 1.1.3 _ (update win drivers).rar; DVDFab Platinum
      4.0.1.3 crack.rar; DVDFab Platinum 4.0.3 - Final - Full License -.rar;
      DVDFab Platinum 4.0.4 crack.rar; DVDFab Platinum 4.0.5 + Best
      Guide.rar; DVDFab Platinum 4.0.5 Final Full Version.rar;
      DVDFab.Platinum.4.0.5_Final Keygen.rar; Easy DVD Creator 1.6.3 Working
      KEY! .rar; Easy RM RMVB to DVD Burner 1.4.1 (burn your .RM and .RMVB
      Movies)__.rar; Easy Video Downloader 1.1. (Download Videos From
      Youtube, Google).rar; eMule 0.48 Download Speed patch (80% more speed
      your download with emule and WORK).rar; eMule 0.48a Download Speed
      patch (Mui bonito)...rar; ESET NOD32 Antivirus 3.0.56 Patcher to have
      ALL updates.rar; Eset NOD32 Smart Security 3.0.621 + Working Update
      Code .rar; ESET NOD32 Smart Security 3.0.621 Retail 32-bit .rar; ESET
      Smart Security & NOD32 Antivirus 3.0.551 (el melior Antivirus en
      circolation).rar; ESET Smart Security & NOD32 Antivirus 3.0.551.rar;
      ESET.NOD32.Antivirus.Business.Edition.v3.0.566..CRACKED.rar; FL Studio
      7 keygen.rar; FlashFXP.v3.6.1
      MULTiLiNGUAL-(ESP-ITA-ENG-DEU-FRA)-crack.rar; FlashGet 1.9.6.1074
      [Best Download manager] + crack.rar; FLV to AVI MPEG WMV 3GP MP4 iPod,
      Zune Converter ..rar; Football Manager 2008 [MULTI 5]Keygen.rar;
      football manager 2008_v8_Patch.rar; Fruity Loops Studio 7 Full +
      Crack..rar; Full Set of Lynda.com -Adobe Creative Suite 3.rar;
      GetRight Pro 6.3.rar; Goldenfoundsoft MSN Webcam Recorder 13.rar;
      Google Earth 4.3 crack.rar; Google Earth Pro 4.2 + Sky FuLL ..rar;
      Great Battles of Rome [PcGame][MULTI5]Crack.rar; Guitar Pro v5.2 (Full
      Version with CD Keygenerator).rar; Guitar Pro v5.2a Keygenerator.rar;
      Hirens Boot CD 9.3..rar; Imtoo 3GP Video Converter 3.1.8.08.rar; ImTOO
      DVD Creator 3.0.33.010.rar; ImTOO iPod Movie Converter
      3.1.40.0831.rar; Internet Download Manager 5.11.11 crack.rar; Internet
      Download Manager 5.12 ._.rar; Intervideo WinDVD Platinum 8.1
      crack.rar; Karaoke Builder Studio 3.0.08 Patch.rar; Kaspersky
      Anti-Virus 7.0.1.32 Working Key file (till 2010).rar; Kaspersky
      Antivirus Tested Working crack.rar; KASPERSKY
      AntiVirus7.0.1.321FINAL.(with keys pack-key checker).rar; Kaspersky
      Internet Security 7 Full Update patch till 2009.rar; Kaspersky
      Internet Security and Antivirus 7.0.1 license key valid untill
      2010.rar; Kaspersky Internet Security v7.0.1.32 Final [ENG] [NewKeys]
      All.rar; Koyote IPOD Video Converter 2.4..rar; LavaSoft Ad-Aware 2007
      Professional 7.0.2.5 .rar; LimeWire Pro 4.14 Spped Download Patch.rar;
      Macromedia DreamWeaver CS3 +Plugins and Crack.rar; Macromedia
      DreamWeaver CS3 crack.rar; Magic DVD Ripper 5.2.2 crack.rar; Magic ISO
      5.4 + serial..rar; Magic ISO 5.41 crack.rar; Magic ISO Maker 5.4 with
      serial -.rar; Magic Video Converter 8.0.2.1 (The Ultimate Video
      Converter).rar; Magic Video Converter 8.0.2.19 crack.rar; Matlab 2007
      crack.rar; Maximus Multiband Maximizer 1.rar; McAfee Anti-Virus 10
      keygenerator.rar; McAfee Antivirus 10 ENG-ESP-FRA Cracked.rar; McAfee
      VirusScan Enterprise 8.5.0 Licensed.rar;
      McAfee.Total.Protection.2007.Multilingual.Crack.rar;
      McAfee.Total.Protection.2008.WorkingPatch.Update.TILL.201.rar;
      MediaMonkey 3.0.1 Full Multilingual.rar; Microsoft Office 2003
      Professional with SP1 2 3 .Working Serial.rar; Microsoft Office 2007
      Complete + Serial.rar; Microsoft Office 2007 Complete Version
      Keygenerator.rar; Microsoft Office 2007 COMPLETE..rar; Microsoft
      Office 2007 Enterprise Edition Incl Keygen..rar; Microsoft Office 2007
      Enterprise Genuine Patch _.rar; Microsoft Office 2007 FULL + Keygen (
      Vista comp..).rar; Microsoft Office 2007 keygenerator.rar; Microsoft
      Office 2007 Ultimate..rar; Microsoft Office Home and Student Edition
      2007 FULL Versions with Working Activation Key_.rar; Microsoft Office
      XP PRO includes word, excel, powerpoint, outloock..rar; Microsoft
      Visual Studio 2008 Professional Edition.rar; Microsoft Windows Vista
      32-X86-X64 Activation Key-(june 08).rar; Microsoft Windows Vista
      Ultimate x86 crack November 2007.rar; Microsoft Windows VISTA
      Validation Crack 01-2008.rar; Microsoft Windows XP Pro SP2 WGA
      Validation Patch.rar;
      Microsoft.Windows.VISTA.Ultimate.Activation.Code.Patch.rar;
      Microsoft.Windows.Vista.Ultimate.x64.Integrated.December.2007.rar;
      Microsoft.Windows.Vista.Ultimate.x64.Integrated.January.2008.OEM..rar;
      Microsoft.Windows.XP.WGA.Validate.Patcher.(funciona.perfieto!)...rar;
      MIRC.6.3.+.Keygen.+Manuales.+instrucions+scripts.(Pack.by.eLs0M).rar;
      MKV to AVI Converter 3.0.01.rar; Movie Collector Pro 5.25.rar; MP3
      Remix Plus 3.31 Crack.rar; MP3Resizer 1.8 ESP.rar; MS Office 2007 Full
      DVD Incl SN..rar; MSN Messenger 8 Fully Patched for XP Sp2 and Windows
      ViSTA.rar; MSN.Messenger.8.Working.Patch.to.nudge.all.rar; My Screen
      Recorder Pro 2.3.rar; Nero 8 Ultra 8.1.1 ESPANOL co key funcionante
      actualizado!.rar; Nero 8 Ultra Edition Keygen.rar; Nero 8 Ultra
      Edition 8.1.1+KeyMaker.rar; Nero 8 Ultra Edition 8.2.8 (complete with
      Patch).rar; Nero 8 Ultra Edition 8.2.8+Keymaker.rar; Nero 8 Ultra
      Edition Serial Key -.rar; Nero 8 with instructions(Only version that
      is fully cracked).rar; Nero 8.2.8 Ultra Edition incl. Keygen (WORKS
      PERFECT).rar; NOD32 3.xxx Universal Fix.rar; NOD32 Antivirus 3.0.551
      ESP.rar; NOD32 AntiVirus BUSINESS EDITIONv3.0.621..(NEW
      FIX.FINAL).rar; Norton 360 Tested Working crack.rar; Norton Anti Virus
      2008 for Vista RETAiL + Crack .rar; Norton Antivirus 2008 Full Cracked
      INCL KEYGEN +..rar; Norton Ghost 12 keygen.rar; Norton Internet
      Security 2008 15.0.0.58 Cracked .rar; Norton Internet Security 2008
      Multilingual-(ESP-ITA-ENG-FRA)+ Guide to crack.rar; Norton Partition
      Magic 8Full Cracked.rar; Norton Product Suite 2007 Keygenerator.rar;
      Norton.Antivirus.2008.beta.with.crack.rar;
      Norton.Internet.Security.2008.+crack+instruciones.to.crack.it.rar;
      NortonInternetSecurity 2008 Espanol .rar; O&O Defrag Professional
      10.0.1635 Key (.rar; Oxygen Phone Manager for Nokia Phones II
      2.12.1.rar; Panda Antivirus 2008 CracKed_.rar; Panda Antivirus Plus
      Firewall (2008) crack.rar; Patch.all.Windows.XP.in.a.second-(and make
      updates!)...rar; PC Satellite TV 2007 Elite Working KeyGenerator.rar;
      PC Tools AntiVirus 3.6.0.3 (version complete).rar; PC Tools Internet
      Security 2008 Patch to 2009 Updates..rar; PhotoSphere Professional 2.2
      Keygen.rar; Pinnacle Studio Plus v11 crack.rar; Pinnacle Studio Plus
      v11 MultiLanguage Bonus DVD Incl Keygenerator.rar; PlayStation 2
      Emulator for PC .rar; Power ISO + serial 3.8. latest.rar; Power ISO
      3.8 + Aiudos + key.rar; Power ISO 3.9 crack.rar; PS3 Video Converter
      3.1.21.0115 NEW.rar; RapidGet Download Manager by kenshin.rar;
      Rapidshare Leecher + Rapidshare Tools.rar; RapidShare Manager
      _2008.rar; Rapidshare Premium Downloader Manager.rar; Real Player
      11.0.0.373 keygen-W0rking.rar; RealPlayer 11 Plus for XP-VISTA.rar;
      Registry First Aid Platinum 6.1.0.154 + Key.rar; Resident Evil 3
      Nemesis[PcGame][MULTI5]Crack.rar; Rosetta Stone 2007 and language
      pack..rar; Roxio Easy Media Creator 10a crack.rar; Screen Grab Pro
      Deluxe 1.1 (pics of your desktop)..rar; SlySoft AnyDVD & AnyDVD HD 6.3
      Crack.rar; SlySoft AnyDVD HD 6.3.0 FINAL incl. crack by Team
      Resurrection.rar; Slysoft AnyDVD HD 6.3.0.rar; SolSuite 2008 8 (Best
      Card Game!).rar; Sony DVD Architect Studio 4.5 (Complete Disk).rar;
      Sony Vegas 8 Complete.rar; Sony Vegas Pro 8 0a build 179 .Corporate
      Full.rar; Sophos Antivirus 6.5.rar; Spyware Doctor 5.1.0.27.rar; Super
      Internet TV 7 2007 Patched.rar; Super Todo En Uno V3
      [DVD9][Spanish].rar; Symantec AntiVirus Corporate Edition 1.0.3-8 for
      Server.rar; System Mechanic 7.5 Keygen.rar; System Mechanic
      Professional 7.5.5.1 Full.rar; TechSmith Camtasia Studio 5 [Record
      your own videos]-Cracked.rar; TEU Essentials 2007 .rar; The Shield
      Antivirus 2007 Pro & Firewall_.rar; Total Commander 7 for
      XP-VISTA.rar; Trend Micro Anti-Spyware 3.5.0.104 (crackeado).rar;
      Trend Micro PC-Cillin Internet Security Pro 2008 16.05.10+ License Key
      patcher.rar; TuneUp Utilities 2007 6.0.2312 crack.rar; TuneUp
      Utilities 2008 7 working Key.rar; UltraISO Premium Edition 8.6.6.2180
      Working Crack + Keygenerator.rar; USB Safely Remove 3.3.0.61.rar;
      Video Fixer 3.23 .rar; Vista Codec Package 4.5(Audio and Video
      Codec).rar; VISTA.All.Version.Activation.Code.2008..rar; VLC Media
      Player 0.8.6d . (Latest Version.). -Legal-Ups.rar;
      WGA.Validate.2008.for.Windows.XP.Home+Professional..rar; Winamp 5.5.
      Pro incluido plugins-advanced system.rar; Winamp Pro v5.6 crack.rar;
      WinAVI Video Converter 8.0 crack.rar; WinAVI Video Converter
      9.0+Serial.rar; Windows 98 Second Edition Full Bootable CD + CD
      Key..rar; Windows UE V.9.5 Fina [App][MULTI5]+.rar; Windows vista All
      Versions - All languages..rar; Windows Vista Ultimate 32bit crack.rar;
      Windows Vista Ultimate 32bit.Full.rar; Windows Vista Ultimate OEM
      EDITION (Pre-Activated + Genuine Forever with Patcher).rar; Windows
      Vista x86 MultiLang.AutoPatcher.rar; Windows Vista x86 Ultimate
      Genuine OEM crack.rar; Windows Xp Pro Sp3 3264 Vista Style ..rar;
      Windows XP Professional Genuine Crack gennaio 2008.rar; Windows XP
      Professional Service Pack 2 ..rar; Windows XP Professional Student
      SP3-Integrated + CD Key ..rar; Windows XP Ultimate Edition
      [December2007-R3 4 .No serial or activation needed].rar; Windows XP
      Ultimate Edition [January2008-R3.5].iso.rar; WinRar 3.7 Crack.rar;
      WinRAR 3.7 Extreme cracked.rar; WinRar 3.7 Full.rar; WinRar 3.71 final
      + keygen .rar; WinRar 3.71 final Incl keygen (Works 100%)..rar; WinRAR
      3.71.1.0 Multilingual for XP and VISTA + cRack.rar; WinZip 11.2
      professional patched.rar; WinZIP 12 (co el key funcionante)_.rar;
      WirelessMon 2.1 Patched .rar; WS FTP Server with SSH 6.rar; Xilisoft
      iPod to PC Copy 1.0.54.110.rar; Yamicsoft Vista Manager 1.1.rar;
      YouTube FastDownloader.rar; ZoneAlarm Anti-Spyware + Firewall 7.0.462
      Retail-ReLEASD.rar; ZoneAlarm Anti-Spyware and Antivirus 7.0.462 +
      working Key and Serial.rar

   The archive contains a copy of the malware inside.



The shared directory might look like the following:


 File details Programming language:
 The malware program was written in Delphi.

Description inserted by Andrei Gherman on Friday, July 25, 2008
Description updated by Andrei Gherman on Friday, July 25, 2008

Back . . . .