Troj/Agent-NRC is a Trojan for the Windows platform.
Troj/Agent-NRC includes functionality to run automatically.
When first run Troj/Agent-NRC copies itself to <User>\Local Settings\Application Data\gsptpf\gcjydr.exe.
The following registry entries are created to run gcjydr.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
buohxqtfswb
<User>\local settings\application data\gsptpf\gcjydr.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
buohxqtfswb
<User>\local settings\application data\gsptpf\gcjydr.exe
Registry entries are set as follows:
HKCU\Software\Microsoft\Internet Explorer\Download
RunInvalidSignatures
0x00000001
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments
SaveZoneInformation
0x00000001
HKCU\Software\Microsoft\Internet Explorer\Download
CheckExeSignatures
no
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations
LowRiskFileTypes
.exe
Registry entries are created under:
HKLM\SOFTWARE\avsoft
HKLM\SOFTWARE\avsuite
HKCU\Software\avsoft
HKCU\Software\avsuite