Troj/Agent-HAS is a Trojan for the Windows platform.
When run Troj/Agent-HAS copies itself to <Windows>\winlogin.exe and creates the following registry entries:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\winlogon
del
0
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
runwinlogon
<Windows>\winlogon.exe
HKLM\SOFTWARE\Microsoft\SecurityCenter
FirewallDisableNotify
1
HKLM\SOFTWARE\Microsoft\SecurityCenter
FirewallOverride
1
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
EnableFirewall
0
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
EnableFirewall
0