Troj/Agent-TR is a Trojan for the Windows platform.
Troj/ Agent-TR includes functionality to access the internet and communicate with a remote server via HTTP.
When first run Troj/Agent-TR copies itself to <Windows folder>\smss.exe.
The following registry entries are created to run Troj/Agent-TR on startup:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
Run
<Windows folder>\smss.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
smss
<Windows folder>\smss.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
smss
<Windows folder>\smss.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Runservices
smss
<Windows folder>\smss.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices
smss
<Windows folder>\smss.exe
Troj/Agent-TR changes the Start Page for Microsoft Internet Explorer by modifying values under:
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page