Agent.AWF

AWF (or Agent.AWF) is a malicious Trojan downloader affecting the Microsoft Windows operating system.[1][2]

This article is about the Trojan. For the worm used in a 2008 cyberattack on the US, see Agent.BTZ.

Methods of infection

This Trojan is considered obsolete, and there are no known variants in the wild.

Affected operating systems

The following operating systems are known to be affected.[1]

Operation

Agent.AWF displays virus activity in that it replaces files on a user's computer with a copy of itself, and moves the original, legitimate file to a back sub-folder. It is known to attempt to terminate security software, and the Trojan downloads a backdoor onto the computer, allowing the attacker to further compromise the computer. It is also known to modify the Windows registry. Agent.AWF does not spread automatically: it needs an attacking user's intervention in order to reach the affected computer. The means of transmission used include, among others, floppy disks, CD-ROMs, emails with attached files, Internet downloads, FTP, IRC channels, peer-to-peer (P2P) file sharing networks, etc.[1]

Identification

During installation, the following files are created, and may be present on a compromised system.

  • abc123.pid
  • svcipa.exe
  • nod32kui.exe

References
  1. "Agent.AWF - at a glance". pandasecurity.com. Retrieved 8 January 2017.
  2. "Trojan-Downloader.Win32.Agent.awf Information and Removal". sunbeltsecurity.com. 5 October 2006. Retrieved 8 January 2017.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.