Agentdoc.c

By ESGI Advisor in Trojans

Agentdoc.c is a seditious computer Trojan that drops malicious files on the affected computer. Once executed, Agentdoc.c opens a Microsoft Word document written in Japanese or Chinese, and installs itself to the PC system. Agentdoc.c also installs a rootkit and keylogger that logs all user keystrokes. Collected data by Agentdoc.c is gathered locally on the targeted computer. Agentdoc.c uses a rootkit to cover its files and registry entries, and therefore avoid detection. Agentdoc.c also tries to download other malware from the web and execute other malicious files. Agentdoc.c runs as a service on every Windows start-up. Remove Agentdoc.c instantly after you detect it.

File System Details

Agentdoc.c may create the following file(s):
# File Name Detections
1. dbacf.exe
2. nbsanovj.dll
3. nbsanovj.sys
4. icesword.exe
5. nbsanovj.tmp
6. nbsanovj.drv

Registry Details

Agentdoc.c may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_NBSANOVJ
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\nbsanovj
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\nbsanovj
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NBSANOVJ
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Sens\Parameters\ServiceDll=%System%\nbsanovj.dll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_NBSANOVJ
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nbsanovj
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sens\Parameters\ServiceDll=%System%\nbsanovj.dll

Trending

Most Viewed

Loading...