TROJ_AGENTT.SC

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Installation

This Trojan drops the following files:

• %User Temp%\$MsAutoUpdate.exe - also detected as TROJ_AGENTT.SC
• %User Temp%\{malware filename} - non-malicious PDF file

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
ClsPack = %User Temp%\$MsAutoUpdate.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
ClsPack = %User Temp%\$MsAutoUpdate.exe