high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | September 2007 (4.21) |
| Protection available since | 21 July 2007 00:00:49 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Agent-FYY is a Trojan for the Windows platform.
Troj/Agent-FYY includes functionality to access the internet and communicate with a remote server via HTTP.
When first run, Troj/Agent-FYY may create the following files:
<System>\9A38481E.dll (detected as Troj/Agent-FYY)
<System>\FC9FEA75.exe (detected as Troj/Agent-FYY)
and copy itself to:
<System>\E69C6CEE.exe
The file E69C6CEE.exe is registered as a new system driver service named "2D98923D", with a display name of "2D98923D" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\2D98923D\
Registry entries may be created under:
HKLM\SOFTWARE\Microsoft\Windows NT\
HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\
Troj/Agent-FYY deletes registry entries under:
HKLM\SYSTEM\CurrentControlSet\Services\ERSvc\
|
