Trojan.Win32.Agent.fkeh

Removal Instructions

If your computer has not been protected with anti-virus software and has been infected with malware, you will need to take the following actions to delete this:

  1. Delete the original trojan file (its location on the infected computer will depend on how the program got onto the computer).
  2. Delete the following file:
    %Temp%\install_temp.bat

  3. Install the current system time.
  4. Run a full Kaspersky Antivirus scan of the computer with updated antivirus databases (download trial version).


MD5: FE92DF16A7949A5C2DE6A2EA313250F6
SHA1: 60D3A0FB79A59BF9DF7C7C89C692C06264992882

Payload

After launching, the trojan retrieves the file saved in the current user's temporary file directory "%Temp%" as

%Temp%\install_temp.bat from its body (25 bytes)

The extracted file is a shell script and contains the following commands:
@echo off
time 0:00 >nul

The trojan then launches the following script:
cmd.exe /c "%Temp%\install_temp.bat"

The system time is changed to "0:00". The trojan then shuts down.

Technical Details

A trojan program that carries out destructive actions on the user's computer. It is a Windows application (PE-EXE file). 7710 bytes. Written in C++.