high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | June 2005 (3.94) |
| Protection available since | 5 October 2004 07:50:37 (GMT) |
| Last updated | 13 May 2005 08:47:52 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Agent-V is a Trojan used in DDoS attacks.
The Trojan opens multiple SMTP connections to IP addresses chosen at random within a 24-bit netmask specified by the author.
Troj/Agent-V copies itself to the file svchost.exe in the Windows system folder then creates the following registry entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
WindowsUpdate = "C:\Windows\svchost.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
WindowsUpdate = "C:\Windows\svchost.exe"
After installing itself, the Trojan waits for up to five minutes before executing its payload.
|
