Troj/Agent-GAU

Category: Viruses and Spyware Protection available since:19 Aug 2007 11:42:29 (GMT)
Type: Trojan Last Updated:19 Aug 2007 11:42:29 (GMT)
Prevalence: No Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

Troj/Agent-GAU is a Trojan for the Windows platform.

Troj/Agent-GAU includes functionality to download, install and run new software.

When Troj/Agent-GAU is installed the following files are created:

<Temp>\guqf296\Keygen.exe
<Temp>\removalfile.bat
<Windows>\retadpu1000520.exe
<System>\efccdda.dll (Detected as PUA Adware Virtumundo)

The following registry entries are created to run code exported by efccdda.dll on startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\efccdda
DllName
efccdda.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\efccdda
Impersonate
0

The file efccdda.dll is registered as a COM object and shell extension, creating registry entries under:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{F4002052-AB29-4B33-8C8D-0E99084564EC}
HKCR\CLSID\{F4002052-AB29-4B33-8C8D-0E99084564EC

download Try Sophos products for free
Download now