Troj/Agent-CJ is a Windows Trojan that drops another Trojan and changes browser settings.
The Trojan copies itself to the Windows System folder as alg32.exe and spoolsvu.exe, and runs in the background as a process. Troj/Agent-CJ also drops htass.dll in the Windows folder, which is detected by Sophos as Troj/CWS-C.
The Trojan creates the following registry entries so as to run automatically on user logon:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ALG32
%SYSTEM%\ALG32.EXE
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
SPOOLSVU
%SYSTEM%\SPOOLSVU.EXE
The Trojan also creates the following registry entries:
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main
MSMsgSvc
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main
SEHLPstp
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main
WTLBAstp
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
Browser Helper Objects
(9E6EC32A-7C19-4409-99E8-FC980BCDAF26)
HKCR\CLSID\(9E6EC32A-7C19-4409-99E8-FC980BCDAF26)\