Home Malware Programs Trojans Trojan.MSIL.Agent

Trojan.MSIL.Agent

Posted: May 11, 2011

Trojan.MSIL.Agent is a very malicious computer trojan that was created to enable remote access to your computer system to largely capture precious system resources and track your Internet habits to record or steal your confidential data. Trojan.MSIL.Agent opens up firewalls and gathers personal details, such as personal financial information. Trojan.MSIL.Agent invades and installs the corrupted computer without a victim's awareness or consent when he/she opens unknown email attachment or image, use instant messaging, etc. Trojan.MSIL.Agent is very difficult to be detected, because it is disguised to hide in the system directory or the Windows registry itself. Trojan.MSIL.Agent is a dangerous risk to any computer system and has to be removed immediately.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %PROGRAM_FILES%\Trojan.MSIL.Agent
    2 c:\Documents and Settings\All Users\Start Menu\Trojan.MSIL.Agent\ c:\Documents and Settings\All Users\Trojan.MSIL.Agent\ and delete

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionWinlogon "Shell" = '%UserProfile%Application DataMicrosoft[SET OF RANDOM CHARACTERS].exe'HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionWinlogon "Shell" = '%UserProfile%Application Data[SET OF RANDOM CHARACTERS].exe'HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsegui.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsekrn.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsascui.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsmpeng.exe "Debugger" = 'svchost.exe'HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsseces.exe "Debugger" = 'svchost.exe'
Loading...