Troj/Agent-NFX is a Trojan for the Windows platform.
Troj/Agent-NFX includes functionality to run automatically.
When first run Troj/Agent-NFX moves itself to <User>\Local Settings\Application Data\inowjfgen\ygtowvqtssd.exe.
The following registry entries are created to run ygtowvqtssd.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ylbrooht
<User>\Local Settings\Application Data\inowjfgen\ygtowvqtssd.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ylbrooht
<User>\Local Settings\Application Data\inowjfgen\ygtowvqtssd.exe
Registry entries are set as follows:
HKCU\Software\Microsoft\Internet Explorer\Download
RunInvalidSignatures
0x00000001
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments
SaveZoneInformation
0x00000001
HKCU\Software\Microsoft\Internet Explorer\Download
CheckExeSignatures
no
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations
LowRiskFileTypes
.exe
Registry entries are created under:
HKLM\SOFTWARE\avsoft
HKLM\SOFTWARE\avsuite
HKCU\Software\Microsoft\Windows Script
HKCU\Software\avsoft
HKCU\Software\avsuite