Home Malware Programs Trojans Trojan.Win.Agent.dcc

Trojan.Win.Agent.dcc

Posted: March 26, 2010

Trojan.Win.Agent.dcc is a Hoax virus which appears in a false system security threat related to User Protection. Other rogue programs may display warnings with Trojan.Win.Agent.dcc infection as well. There is also a real Trojan virus called Trojan.Win32.Agent.dcc so do not confuse them. Trojan.Win32.Agent.dcc also appears in fake warnings depending on the program you use. If this threat was reported by legitimate programs then it probably really exists, but if comes from a rogue program then the malware related to the rogue should be removed.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %UserProfile%\Local Settings\Temp\4otjesjty.mof
    2 %UserProfile%\Local Settings\Temp\usr.dat
    3 %UserProfile%\Local Settings\Temp\usrr.dat
    4 %UserProfile%\Start Menu\Programs\User Protection
    5 C:\Documents and Settings\All Users\Application Data\fiosejgfse.dll
    6 C:\Program Files\User Protection
    7 C:\Program Files\User Protection\usr.db
    8 C:\Program Files\User Protection\usrext.dll
    9 C:\Program Files\User Protection\usrhook.dll
    10 C:\Program Files\User Protection\usrprot.exe
    11 C:\Program Files\User Protection\virus.mp3

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "User Protection"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{5E2121EE-0300-11D4-8D3B-444553540000}"HKEY_LOCAL_MACHINE\SOFTWARE\User ProtectionHKEY..\..\..\..{RegistryKeys}HKEY_CLASSES_ROOT\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}User Protection
Loading...