Remove Agnet - Spyware Removal Information

More than 21875 spyware signatures and growing

Spywarelib Search

Search in:

Spywares

Files

Md5

Registry

Dialer-Porn.Agnet Analysis Report

Threat Submitted On: 7/12/2007 12:18:33 PM

Threat Analysed On: 7/12/2007 5:18:33 PM

Threat Updated On: 1/28/2011 1:32:53 PM

Type : Dialer-Porn

Symptoms of Agnet

Program that uses a computer’s modem to dial expensive paid numbers, to access to adult websites.
Dials these paid websites to increase revenue of the websites.

Removal Recommended (Click here to remove automatically)

Removal Recommended

Information

Alias : Dialer-Porn.Agnet.ao

Md5 Hash : [d194f994d3cc6e3eab4fb964ea93085f]

File Size : (97943 bytes)

Technical Details

Here are the Technical findings of our analysis team after analyzing this malware in detail :-

Creates the following infected Files on user's System

Note:

Delete the following Files to remove Infection

File: 4ba9eb87.lnk
Path : %homepath%\desktop
Md5Hash :6447bc57d7b741428164ad9d5a7a506d ( 1517 bytes)

File: 4ba9eb87.exe
Path : %programfiles%\montorgueil\4ba9eb87
Md5Hash :d194f994d3cc6e3eab4fb964ea93085f ( 97943 bytes)

File: 4ba9eb87.exe
Path : %workingdir%
Md5Hash :d194f994d3cc6e3eab4fb964ea93085f ( 97943 bytes)

File: 4ba9eb87.lnk
Path : %userprofile%\start menu
Md5Hash :eebb154e315af8a893a2483851d15247 ( 1517 bytes)

File: 4ba9eb87.lnk
Path : %userprofile%\start menu\programs\hot dialer
Md5Hash :8fcf922e6a79e978a104aef645e0f361 ( 1529 bytes)

File: uninstall 4ba9eb87.lnk
Path : %userprofile%\start menu\programs\hot dialer
Md5Hash :96809a48c015680eaeaa80f1d4e25c71 ( 1545 bytes)

Creates the following child process(s) on execution:

services.exe

%programfiles%\internet explorer\iexplore.exe http://adsl.carpediem.fr/perl/invoc_oneway.pl?id_service=10000&nom_exe=4ba9eb87&skin=exe&id_produit=0&id_tracking=0&nocache=0023837

Creates the Following MUTEX(s) on user's System:-

raspbfile

kit2connexion

shell.cmrupidllist

ctf.lbes.mutexdefaults-1-5-21-1614895754-1788223648-839522115-1005

ctf.compart.mutexdefaults-1-5-21-1614895754-1788223648-839522115-1005

ctf.asm.mutexdefaults-1-5-21-1614895754-1788223648-839522115-1005

ctf.layouts.mutexdefaults-1-5-21-1614895754-1788223648-839522115-1005

ctf.tmd.mutexdefaults-1-5-21-1614895754-1788223648-839522115-1005

Copies the Following Files to Given Location :-

Copies :%workingdir%\4ba9eb87.exe

To : %programfiles%\montorgueil\4ba9eb87\4ba9eb87.exe

Copies :%programfiles%\montorgueil\4ba9eb87\4ba9eb87.ico.2

To : %programfiles%\montorgueil\4ba9eb87\4ba9eb87.ico

Copies :%programfiles%\montorgueil\14.06268.2

To : %programfiles%\montorgueil\14.06268

NOTE:

1. %homepath% Refers to the windows current user's profile folder. By default it is 'C:\Documents and Settings\[user]'
2. %programfiles% Refers to the program files folder. By default it is 'C:\Program Files'
3. %workingdir% Refers to the current directory in which user is working.
4. %userprofile% Refers to the windows current user's profile folder. By default it is 'C:\Documents and Settings\[user]'

Important: We strongly recommend that you backup the Registry before making any changes to it. Incorrect changes to the Registry can result in permanent data loss or corrupted Files. Modify the malicious\suspicious Subkeys only.

Click Here for more spywarelib.com recommended PC Security and Optimization Tools

To modify registry entries in Windows Operating System:
Follow Steps:
1. Click Start > Run
2. Type “regedit” : to open registry editor
3. Navigate to required registry Key from the Left Tree control and modify accordingly.