Threat Database Trojans Trojan.win32.agent.azsy

Trojan.win32.agent.azsy

By Domesticus in Trojans

According to ESG security researchers, the Russian Federation and Ukraine are hotspots for malware activity, being a common point of origin for various malware threats as well as hosting some of the world's largest botnets. Trojan.win32.agent.azsy, first detected in late 2008 and having its highest number of reported attacks in 2009, is thought to have been designed by online scammers in the Russian Federation. Trojan.win32.agent.azsy has a particular characteristic that ESG malware analysts have observed in other similar malware threats: the fact that Trojan.win32.agent.azsy will not work on Windows operating systems in Russian. ESG security analysts speculate that this may also help these hackers stay under the radar since this characteristic means that Russian authorities will not consider Trojan.win32.agent.azsy as a local threat, giving Trojan.win32.agent.azsy a lower priority in comparison to other malware threats. Trojan.win32.agent.azsy is a Trojan dropper, usually infecting a computer system dropping various other files (usually components of a remote access tool or other malware) and then deleting itself in the process. Because of its nature, the effects of Trojan.win32.agent.azsy are entirely dependent on the payload of the particular version of Trojan.win32.agent.azsy infecting your computer system. Since Trojan.win32.agent.azsy deletes itself as part of its attack, preventing Trojan.win32.agent.azsy infections is the only way to deal with this threat. Using a reliable anti-malware scanner, a strong firewall, and following proper online security guidelines will ensure that you do not contract a Trojan.win32.agent.azsy infection.

Is Your Computer Actually Infected with Trojan.win32.agent.azsy?

While there is no doubt that Trojan.win32.agent.azsy is a real malware infection, the vast majority of Trojan.win32.agent.azsy infections are actually not real. This is because the error message 'Your computer is infected with Trojan.win32.agent.azsy' is a common component of various fake security programs. These bogus security programs, known as rogue anti-virus or rogue anti-malware applications, are designed to display constant error messages in an attempt to convince their victims to purchase useless security software. While these are also caused by a Trojan infection, they are often not associated with Trojan.win32.agent.azsy in particular. If you are receiving constant pop-ups from an unauthorized security program, chances are that your computer is not actually infected with Trojan.win32.agent.azsy but with a rogue anti-malware application. Regardless of the actual malware threat on your computer system, you should use a reliable anti-malware application to scan your machine and pinpoint the actual nature of your problem.

File System Details

Trojan.win32.agent.azsy may create the following file(s):
# File Name Detections
1. %Program Files%\Personal Antivirus\PerAvir.exe
2. %UserProfile%\Local Settings\Application Data\Microsoft\Windows\services.exe
3. %UserProfile%\Local Settings\Application Data\Microsoft\Internet Explorer\iv.exe
4. %UserProfile%\Application Data\Personal Antivirus\unins000.exe
5. %UserProfile%\Application Data\Microsoft\Windows\winlogon.exe
6. %Documents and Settings%\All Users\Start Menu\Programs\Personal Antivirus\Personal Antivirus Home Page.lnk
7. %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Personal Antivirus.lnk
8. %UserProfile%\Application Data\Personal Antivirus\uill.ini
9. %UserProfile%\Application Data\Personal Antivirus\db\config.cfg
10. %UserProfile%\Local Settings\Application Data\Microsoft\Windows\log.txt
11. %Program Files%\Personal Antivirus\activate.ico
12. %Program Files%\Personal Antivirus\uninstall.ico
13. %Program Files%\Personal Antivirus\db\DBInfo.ver
14. %Program Files%\Personal Antivirus\Languages
15. %Program Files%\Personal Antivirus\Languages\IAGer.lng
16. %UserProfile%\Local Settings\Application Data\Microsoft\Internet Explorer\iGSh.png
17. %Documents and Settings%\All Users\Start Menu\Programs\Personal Antivirus
18. %Documents and Settings%\All Users\Start Menu\Programs\Personal Antivirus\Purchase License.lnk
19. %UserProfile%\Application Data\Personal Antivirus\settings.ini
20. %UserProfile%\Application Data\Personal Antivirus\db
21. %UserProfile%\Application Data\Personal Antivirus\db\Urls.inf
22. %Program Files%\Personal Antivirus
23. %Program Files%\Personal Antivirus\unins000.dat
24. %Program Files%\Personal Antivirus\db
25. %Program Files%\Personal Antivirus\db\ia080618x.db
26. %Program Files%\Personal Antivirus\Languages\IAFr.lng
27. %WINDOWS%\system32\log.txt
28. %UserProfile%\Local Settings\Application Data\Microsoft\Internet Explorer\iPSh.png
29. %Documents and Settings%\All Users\Desktop\Personal Antivirus.lnk
30. %Documents and Settings%\All Users\Start Menu\Programs\Personal Antivirus\Personal Antivirus.lnk
31. %UserProfile%\Application Data\Personal Antivirus
32. %UserProfile%\Application Data\Personal Antivirus\Uninstall Personal Antivirus.lnk
33. %UserProfile%\Application Data\Personal Antivirus\db\Timeout.inf
34. %UserProfile%\Local Settings\Application Data\Microsoft\Windows\pguard.ini
35. %Program Files%\Personal Antivirus\Explorer.ico
36. %Program Files%\Personal Antivirus\working.log
37. %Program Files%\Personal Antivirus\db\ia080614.db
38. %Program Files%\Personal Antivirus\Languages\IAEs.lng
39. %Program Files%\Personal Antivirus\Languages\IAIt.lng
40. %UserProfile%\Local Settings\Application Data\Microsoft\Internet Explorer\iMSh.png

Registry Details

Trojan.win32.agent.azsy may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ITGrdEngine
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ITGRDENGINE
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Personal Antivirus"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Personal Antivirus_is1
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer "PrS"

7 Comments

I hope it works

i hope it works too

Let's hope for a good result

Need to get rid of spyware...

Did Trojan.win32.agent.azsy remove the trojan?

i hope it works

Trending

Most Viewed

Loading...