Trojan:Win32/Agent.AGA

Installation

Payload

• This Trojan creates a registry key in order to store data that it uses when connecting to a remote Web site. This information includes the Trojan version information and other data:
  Creates key with value: next_url_post_time = <10 digit time value>
  Within subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\DomainService
• This Trojan may disable the system tool System File Checker by altering a registry value:
  Modifies key with value: SFCDisable = 4
  Within subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
• Agent.AGA may alter the registry in order to bypass Windows Firewall:
  Modifies key with value: %Temp%\aupddc.exe = %Temp%\aupddc.exe
  Within subkey: 
  HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\
  Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
• Trojan:Win32/Agent.AGA may lower Web browser security by modifying a registry value related to bypassing an established Web proxy:
  Modifies key with value: ProxyBypass = 1
  Within subkey: 
   HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\