Trojan.Win32.Agent.crhz Description

Trojan.Win32.Agent.crhz is able to penetrate a computer system and modify the registry to ensure that it’s loaded with each system start-up. Trojan.Win32.Agent.crhz exploits security holes and system vulnerabilities to enter a system. Trojan.Win32.Agent.crhz may be involved in the promotion and spread of a certain rogue anti-spyware programs. Trojan.Win32.Agent.crhz may also make an infected PC vulnerable to other malware attacks by opening a conduit through which an attacker can gain remote access. Trojan.Win32.Agent.crhz should be eradicated once detected.

Type: Trojans

Aliases: Trojan:Win32/Obvesa.A (Microsoft), Win32/Dzan.E (AhnLab).

How Can You Detect Trojan.Win32.Agent.crhz?

Trojan.Win32.Agent.crhz Technical Report

As new Trojan.Win32.Agent.crhz details are reported by our customers and findings from our Threat Research Center, we will update this section.

Trojan.Win32.Agent.crhz’s Country of Origin:

• China

Trojan.Win32.Agent.crhz has typically the following processes in memory:

• %Windir%\INETINFO.exe
• %Windir%\messenger\messenger.exe
• %System%\temp.dll
• %System%\Setup\licxnoc.dll

Trojan.Win32.Agent.crhz creates the following registry entries:

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\netra\Enum]
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETRA\0000\Control]
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\netra\Enum]
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_NETRA\0000\Control]
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\netra\Security]
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETRA\0000]
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\netra\Security]
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_NETRA\0000]
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent]
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\netra]
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETRA]
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\netra]
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_NETRA]
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

Important Article Disclaimer