Troj/Agent-CX is a Trojan for the Windows platform.
The Trojan creates a HTTP proxy server that allows redirection of network traffic. Troj/Agent-CX also attempts to open websites related to pornography using Internet Explorer.
Troj/Agent-CX creats the following registry entries to run itself automatically on user logon:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Microsoft Internet Acceleration Utility
<path to Trojan>
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Internet Acceleration Utility
<path to Trojan>
The Trojan also creates the following registry entries:
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyServer
127.0.0.1:8080
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyOverride
https://
Troj/Agent-CX may leave non-malicious files in the following locations:
%WINDOWS%\tlist.log
%WINDOWS%\tlist.dat
%WINDOWS%\ie.dat
C:\proxylog.txt