Troj/Agent-FYY is a Trojan for the Windows platform.
Troj/Agent-FYY includes functionality to access the internet and communicate with a remote server via HTTP.
When first run, Troj/Agent-FYY may create the following files:
<System>\9A38481E.dll (detected as Troj/Agent-FYY)
<System>\FC9FEA75.exe (detected as Troj/Agent-FYY)
and copy itself to:
<System>\E69C6CEE.exe
The file E69C6CEE.exe is registered as a new system driver service named "2D98923D", with a display name of "2D98923D" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\2D98923D\
Registry entries may be created under:
HKLM\SOFTWARE\Microsoft\Windows NT\
HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\
Troj/Agent-FYY deletes registry entries under:
HKLM\SYSTEM\CurrentControlSet\Services\ERSvc\