high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Protection available since | 19 September 2008 01:05:00 (GMT) |
| Detected by | All Sophos products |
Sophos beta program
- Endpoint Security and Control 9.0
- Small business solutions 4.0
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Agent-HRI is a Trojan for the Windows platform.
When first run, Troj/Agent-HRI copies itself to <System>\mscdexntx.exe and sets the following registry to run itself on startup:
HKLM\SOFTWARE\Microsoft\Windows_NT\CurrentVersion\Winlogon
Userinit
<System>\userinit.exe, <System>\mscdexntx.exe
Troj/Agent-HRI sets the following registry entry:
HKCU\Software\Microsoft
version
<random 8-letter string>
Troj/Agent-HRI attempts to download and execute a file from a remote website. At the time of writing this file is detected as Mal/EncPk-DG.
|
