Troj/ProAgent-A is a Trojan for the Windows platform.
Troj/ProAgent-A includes functionality to send notification messages to remote locations.
When first run Troj/ProAgent-A copies itself to <System>\dtxservice.exe and creates the following files:
<Windows>\crss.exe
<Windows>\fps.atm
<Windows>\fps.exe
<Windows>\icq.dll
<Windows>\iss32.exe
<Windows>\kdd32.atm
<Windows>\kt.atm
<Windows>\ktd32.atm
<Windows>\mps.atm
<Windows>\mps.exe
The file fps.exe is detected as Troj/PSWDelf-CU and the file mps.exe is detected as Troj/PSWDelf-CT.
The following registry entry is created to run dtxservice.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DirectX For Microsoft® Windows
<System>\dtxservice.exe -atm
Registry entries are created under:
HKCU\Software\Microsoft\Dxdriver\LocalSettings