Troj/Agent-HFI

Category: Viruses and Spyware Protection available since:10 Jul 2008 10:08:42 (GMT)
Type: Trojan Last Updated:10 Jul 2008 10:08:42 (GMT)
Prevalence: Small Number of Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

Troj/Agent-HFI is a Trojan for the Windows platform.

When first run Troj/Agent-HFI copies itself to <System>\ubpr01.exe and creates the following files:

<Root>\42356d3.bat
<Root>\tmp2.reg
<System>\750623\750623.dll

The file 750623.dll is also detected as Troj/Agent-HFI, the rest of the files are not malicious on its own and could be deleted.

The following registry entry is created to run ubpr01.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
wblogon
<System>\ubpr01.exe

Troj/Agent-HFI changes settings for Microsoft Internet Explorer by modifying values under:

HKCU\Software\Microsoft\Internet Explorer\Main\
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\

download Try Sophos products for free
Download now