Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

Win32/Agent.NEG

Aliases:Worm.Win32.AutoRun.hcg (Kaspersky), Trojan:Win32/Malagent (Microsoft), Mal/Generic-L (Sophos) 
Type of infiltration:Worm  
Size:61440 B 
Affected platforms:Microsoft Windows 
Signature database version:4958 (20100319) 

Short description

Win32/Agent.NEG is a worm that spreads by copying itself into the root folders of available drives. The worm contains a backdoor. It can be controlled remotely.

Installation

When executed, the worm copies itself into the following location:
  • %system%sysinfo.exe (61440 B)
The worm registers itself as a system service using the following filename:
  • Windows netware work information system setup
The following Registry entries are created:
  • [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices
    Wnetwiss]
    "Type" = 272
    "Start" = 2
    "ErrorControl" = 1
    "ImagePath" = "%system%sysinfo.exe"
    "DisplayName" = "Windows netware work information system setup"
    "ObjectName" = "LocalSystem"
    "Description" = "Provide security by Windows netware work system information"

Spreading

The worm copies itself into the root folders of all drives using the following filename:
  • sysinfo.exe
  • %variable%.exe
A string with variable content is used instead of %variable%.

The name of the file may be based on the name of an existing file or folder.

Other information

The worm acquires data and commands from a remote computer or the Internet. It uses its own P2P network for communication.

It can execute the following operations:
  • send files to a remote computer
  • run executable files
  • download files from a remote computer and/or the Internet
  • delete folders
  • delete files
The worm may create the following files:
  • %system%sysinfo.bat