Sophos

Sophos blogs

Troj/Agent-GG

Aliases
  • Backdoor.Win32.Agent.ah
  • Trojan-Downloader.Win32.PurityScan.d
  • W32/Backdoor.ALU
Category
Type
What to do
Prevalence low high

Summary

 
Affected operating systems Windows
Protection available since 19 December 2005 21:38:49 (GMT)
Detected by All Sophos products
Download Free virus scan
Download the Threat Detection Test
  • Free virus, spyware, and adware scan
  • Test your existing anti-virus protection
  • Find threats your anti-virus missed

Action

More Information

Troj/Agent-GG is a Trojan for the Windows platform.

Troj/Agent-GG includes functionality to access the internet and communicate with a remote server via HTTP. Troj/Agent-GG is a Trojan for the Windows platform.

Troj/Agent-GG includes functionality to access the internet and communicate with a remote server via HTTP.

When Troj/Agent-GG is installed the following files are created:

<Windows system folder>\vld5750.dll

The file vld5750.dll is registered as a COM object and Browser Helper Object (BHO) for Microsoft Internet Explorer, creating registry entries under:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CF021F40-3E14-23A5-CBA2-71766C645750}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CF021F40-3E14-23A5-CBA2-71766C645750}
HKCR\CLSID\{CF021F40-3E14-23A5-CBA2-71766C645750}
HKCR\Interface\{CF021F40-3E14-23A5-CBA2-71766C645750}
HKCR\TypeLib\{CF021F40-3E14-23A5-CBA2-71766C645750}
HKCR\VLD5750.VLD5750.1\

Registry entries are created under:

HKCR\VLD5750.VLD5750\

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer