Agent.AWF
AWF (or Agent.AWF) is a malicious Trojan downloader affecting the Microsoft Windows operating system.[1]
Not to be confused with Agent.btz, which is a computer worm used in the 2008 cyberattack on United States.
Methods of infection
This Trojan is considered obsolete, and there are no known variants in the wild.[1]
Affected operating systems
The following operating systems are known to be affected.
Operation
Agent.AWF displays virus activity in that it replaces files on a user's computer with a copy of itself, and moves the original, legitimate file to a back sub-folder. It is known to attempt to terminate security software, and the Trojan downloads a backdoor onto the computer, allowing the attacker to further compromise the computer. It is also known to modify the Windows registry.
Identification
During installation, the following files are created, and may be present on a compromised system.[2]
- abc123.pid
- svcipa.exe
- nod32kui.exe
References
- http://www.pandasecurity.com/usa/homeusers/security-info/97906/information/Agent.AWF
- paretologic.com/resources/definitions.aspx?remove=Agent%20AWF%20Trojan