Home Malware Programs Trojans Trojan.Win32.Agent.bcn

Trojan.Win32.Agent.bcn

Posted: January 5, 2010

Trojan.Win32.Agent.bcn is a popular name for several broad variations of Bifrose-based backdoor Trojans. All versions of Trojan.Win32.Agent.bcn are considered to be extremely serious security threats, and may contain keylogging or rootkit capabilities, in addition to attacking your firewall to enable unauthorized contact with remote criminals. Signs of Trojan.Win32.Agent.bcn infections may be difficult to detect, and preemptive self-defense is important to avoid Trojan.Win32.Agent.bcn attacks. You should protect yourself from Trojan.Win32.Agent.bcn, and remove Trojan.Win32.Agent.bcn infections with the help of regularly-updated anti-malware programs.

The Origin of Trojan.Win32.Agent.bcn and How It Hides

Although Trojan.Win32.Agent.bcn has a modest spread of infection incidents in nearby countries, the vast bulk of Trojan.Win32.Agent.bcn infection reports originate from Sweden. Exercising extreme caution when using file sources from that region can help you avoid Trojan.Win32.Agent.bcn attacks. As of late May 2011, many different Trojan.Win32.Agent.bcn attacks are being reported, and keeping updated browsers and security applications is also crucial to insure that your security program can thwart Trojan.Win32.Agent.bcn infections.

Many different types of Trojan.Win32.Agent.bcn infections are able to hook themselves into the Internet Explorer's 'iexplore.exe' process; this allows them to both access Internet Explorer's capabilities and hide from sight, even if you examine your memory processes in Task Manager. If you suspect having a Trojan.Win32.Agent.bcn infection on your PC, you should consider Trojan.Win32.Agent.bcn active, unless you've used Safe Mode or taken other reboot-based precautions to prevent Trojan.Win32.Agent.bcn from launching itself.

Depending on the version of Trojan.Win32.Agent.bcn and the type of security tool used to detect it, Trojan.Win32.Agent.bcn may also be detected by other names: BackDoor-CEP.svr, Backdoor:Win32/Bifrose.ACI, Trojan Horse, Win-Trojan/Bifrose.29053 and Virus.Win32.Bifrose are some of the most common synonyms in use (listed in descending order of popularity).

The Malice Your PC may Suffer under Trojan.Win32.Agent.bcn

As a subgroup of a popular type of Trojan, Trojan.Win32.Agent.bcn may cause even worse harm than in the attacks listed below, but the below problems are some of the most commonly-recorded Trojan.Win32.Agent.bcn assaults:

  • Trojan.Win32.Agent.bcn has been noted to use Trojan.Win32.Agent.bcn's Internet Explorer-hooking functions to be a keylogger. Keyloggers can record all keystrokes on your keyboard and may have other abilities like screen capturing that can record information in secondary ways. The main purpose of a Trojan.Win32.Agent.bcn keylogger is to steal credit card numbers, passwords, and other private information.
  • Trojan.Win32.Agent.bcn is extremely likely to disable your firewall or create exceptions for itself to make the firewall meaningless for preventing unauthorized data transfers. Trojan.Win32.Agent.bcn can use this function to send data to or collect data from confirmed malicious websites like paradoxcod6.no-ip.biz and hacker-2011.zapto.org.
  • Trojan.Win32.Agent.bcn may force your PC to participate in DDoS attacks by joining a predefined IRC server and taking instructions from that server. In addition to being illegal, DDoS attacks can use up large amounts of your system resources including RAM and bandwidth.
  • Some versions of Trojan.Win32.Agent.bcn may also install Remote Administration Tools or have built-in RAT functions. RATs allow remote criminals to control your PC and represent an incredibly serious breach of privacy and security.
  • Finally, Trojan.Win32.Agent.bcn infections are known to modify the Host file on your system to hijack your web browser, primarily with the intent of blocking access to websites.

As is the case with most Trojans, Trojan.Win32.Agent.bcn is an advanced threat that should be deleted by the application of good anti-virus software whenever it is available.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %AppData%\addon.dat
    2 %ProgramFiles%\jgk\klog.dat
    3 %ProgramFiles%\jgk\server.exe
    4 %Temp%\ixp000.tmp\hassan~1.exe
    5 %Temp%\IXP000.TMP\PROCDUMP.EXE

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}[HKEY_CURRENT_USER\Software\Bifrost][HKEY_LOCAL_MACHINE\SOFTWARE\Bifrost][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9B71D88C-C598-4935-C5D1-43AA4DB90836}]HKEY..\..\..\..{RegistryKeys}HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideoHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\S1TRACE\Enum][HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\S1TRACE\Security][HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\S1TRACE][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\S1TRACE\Enum][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\S1TRACE\Security][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\S1TRACE]HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
Loading...