Troj/Agent-HUA is a Trojan for the Windows platform.
When first run Troj/Agent-HUA copies itself to <System>\csrcs.exe and creates the following files:
<Temp>\<random>
<Temp>\suicide.bat
The following registry entry is created to run csrcs.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
csrcs
<System>\csrcs.exe
The following registry entry is changed to run csrcs.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe csrcs.exe
Registry entries are set as follows:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
2
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SuperHidden
0
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\DRM\amty