Troj/Agent-JBO is a Trojan for the Windows platform.
Troj/Agent-JBO includes functionality to access the internet and communicate with a remote server via HTTP, injecting code into Internet Explorer.
When Troj/Agent-JBO is installed it may copy itself to uninstall.exe in all Startup folders, and drops a file detected as Mal/Behav-034 to the Application Data or Temp folder using one of the following filenames:
svchosts.exe
taskmon.exe
rundll.exe
service.exe
sound.exe
upnpsvc.exe
lsas.exe
logon.exe
helper.exe
event.exe
dumpreport.exe
msiexeca.exe
Troj/Agent-JBO then sets a registry entry at HKCU\Software\Microsoft\Windows\Current Version\Run to run this file with one of the following values (corresponding to the chosen filename):
svchosts
TaskMon
RunDll
System
Sound
UPNP
lsass
Init
Windows
EventLog
CrashDump
Setup
So for example it might create the following registry entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
UPNP
<Application Data>\upnpsvc.exe
Troj/Agent-JBO may also create the following registry entries:
HKCU\Software\Microsoft\Internet Explorer\Settings
GID
HKCU\Software\Microsoft\Internet Explorer\Settings
GatesList
HKCU\Software\Microsoft\Internet Explorer\Settings
KeyM
HKCU\Software\Microsoft\Internet Explorer\Settings
KeyE
HKLM\Software\Microsoft\9593275321