Troj/Agent-CCQ is a backdoor Trojan which allows a remote intruder to gain access and control over the computer.
The following registry entry is created to run Troj/Agent-CCQ on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DCOM Server
<pathname of the Trojan executable>
The following registry entries are created to run code exported by the Trojan libraries on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
{2C1CD3D7-86AC-4068-93BC-A02304BB8C34}
DCOM Server
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
DCOM Server
{2C1CD3D7-86AC-4068-93BC-A02304BB8C34}
The Troj/Agent-CCQ is registered as a COM object, creating registry entries under:
HKCR\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304BB8C34}