Sophos

Sophos blogs

Troj/Agent-IOM

Aliases
  • Trojan.Win32.Agent.asjk
  • Adware:Win32/AdRotator
  • Trojan.Fakeavalert
Category
Type
What to do
Prevalence low high

Summary

 
Affected operating systems Windows
Protection available since 9 January 2009 02:04:12 (GMT)
Detected by All Sophos products
  • Free virus, spyware, and adware scan
  • Test your existing anti-virus protection
  • Find threats your anti-virus missed

Action

More Information

Troj/Agent-IOM is a Trojan for the Windows platform.

Troj/Agent-IOM drops the following files:

<System>\<random letters>.dll (also detected as Troj/Agent-IOM)
<System>\<random letters>.exe (clean uninstall file)

Troj/Agent-IOM creates the following registry entries to run the DLL file on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
<random letters>
<System>\regsvr32.exe /s "<System>\<random letters>.dll"

Troj/Agent-IOM also installs the DLL file as a Browser Helper Object by creating registry entries under the following locations:

HKCR\CLSID\{<Trojan clsid>}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{<Trojan clsid>}

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer