Home Malware Programs Trojans Troj/Agent-KPU

Troj/Agent-KPU

Posted: July 23, 2009

Troj/Agent-KPU (also referred to as Trojan.Agent.KPU) is a keylogger Trojan virus that infiltrates your PC through manual download or via malicious web sites, often masquerading as something else entirely. Troj/Agent-KPU first alters registry files in order to begin running as soon as Windows starts up, and from here, it monitors and records keys that you type, compiling information on usernames, passwords and financial data. This data is then stored in a file called kklog and sent, periodically, to a remote web site.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 \kklog
    2 \UsrClassEx.exe
    3 \UsrClassEx.exe.reg
    4 \doc.exe
    5 \make.exe
    6 \Novel H1N1 Flu Situation Update.doc

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKCU\Software\Microsoft\Windows\CurrentVersion\RunHKEY..\..\..\..{RegistryKeys}UsrClassEx
Loading...