|
|
|
>>
Troj/Agent-MLD Information |
|
Alert ID : VUPEN/ALRT-2010-00978
Aliases : N/A
Size : N/A
Rated as : Low Risk 
Release Date : 2010-02-09
Description
Troj/Agent-MLD is a Trojan for the Windows platform. When run Troj/Agent-MLD copies itself to <System>\sounds\sounds.exe and sets the following registry entries: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Policies <System>\sounds\sounds.exe HKCU\Software\Microsoft\Windows\CurrentVersion\Run HKCU <System>\sounds\sounds.exe HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{10E0OBO6-5UX8-70E2-LT0B-TB0NQ1340IX4} StubPath <System>\sounds\sounds.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKLM <System>\sounds\sounds.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run Policies <System>\sounds\sounds.exe HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{AA7723A3-6A34-4484-A98C-4EA3227923C5} RegisterAdapterName 0 HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{AA7723A3-6A34-4484-A98C-4EA3227923C5} RegistrationEnabled 0 .
References
http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentmld.html
Credits
Reported by Sophos
ChangeLog
2010-02-09 - Initial Release
Disclaimer
The information contained herein was obtained from third party sources and is solely based upon the data available at the time of publication. | |
|
