VBS/Agent.NDH [Threat Name] go to Threat

VBS/Agent.NDH [Threat Variant Name]

Category trojan,worm
Size 23262 B
Detection created Aug 25, 2010
Signature database version 8728
Aliases Trojan.VBS.Agent.kq (Kaspersky)
  TrojanClicker:VBS/Lnkhit.A (Microsoft)
  Trojan.Malcol (Symantec)
Short description

VBS/Agent.NDH is a trojan which tries to promote certain web sites.

Installation

The trojan does not create any copies of itself.

Other information

VBS/Agent.NDH is a trojan which tries to promote certain web sites.


The trojan may create the following files:

  • %commondesktopdirectory%\­낲좫짏췸.lnk
  • %commondesktopdirectory%\­Internet Explorer.lnk
  • %commondesktopdirectory%\­쳔놦쳘볛.lnk
  • %commondesktopdirectory%\­잩쏻짨볆.lnk
  • %commondesktopdirectory%\­힬잮쿮쒿.lnk
  • %commondesktopdirectory%\­춬돇쏀얮.lnk
  • %commondesktopdirectory%\­18뷻쫓욵.lnk
  • %commondesktopdirectory%\­벤쟩죈컨.lnk
  • %commonstartmenu%\­낲좫짏췸.lnk
  • %commonstartmenu%\­Internet Explorer.lnk
  • %commonstartmenu%\­쳔놦쳘볛.lnk
  • %commonstartmenu%\­잩쏻짨볆.lnk
  • %commonstartmenu%\­힬잮쿮쒿.lnk
  • %commonstartmenu%\­춬돇쏀얮.lnk
  • %commonstartmenu%\­18뷻쫓욵.lnk
  • %commonstartmenu%\­벤쟩죈컨.lnk
  • %commonprograms%\­낲좫짏췸.lnk
  • %commonprograms%\­Internet Explorer.lnk
  • %commonprograms%\­쳔놦쳘볛.lnk
  • %commonprograms%\­잩쏻짨볆.lnk
  • %commonprograms%\­힬잮쿮쒿.lnk
  • %commonprograms%\­춬돇쏀얮.lnk
  • %commonprograms%\­18뷻쫓욵.lnk
  • %commonprograms%\­벤쟩죈컨.lnk
  • %favorites%\­낲좫짏췸.lnk
  • %favorites%\­Internet Explorer.lnk
  • %favorites%\­쳔놦쳘볛.lnk
  • %favorites%\­잩쏻짨볆.lnk
  • %favorites%\­힬잮쿮쒿.lnk
  • %favorites%\­춬돇쏀얮.lnk
  • %favorites%\­18뷻쫓욵.lnk
  • %favorites%\­벤쟩죈컨.lnk
  • %favorites\­솴뷓\­낲좫짏췸.lnk
  • %favorites\­솴뷓\­Internet Explorer.lnk
  • %favorites\­솴뷓\­쳔놦쳘볛.lnk
  • %favorites\­솴뷓\­잩쏻짨볆.lnk
  • %favorites\­솴뷓\­힬잮쿮쒿.lnk
  • %favorites\­솴뷓\­춬돇쏀얮.lnk
  • %favorites\­솴뷓\­18뷻쫓욵.lnk
  • %favorites\­솴뷓\­벤쟩죈컨.lnk
  • %appdata%\­Microsoft\­Internet Explorer\­Quick Launch\­낲좫짏췸.lnk
  • %appdata%\­Microsoft\­Internet Explorer\­Quick Launch\­Internet Explorer.lnk
  • %appdata%\­Microsoft\­Internet Explorer\­Quick Launch\­쳔놦쳘볛.lnk
  • %appdata%\­Microsoft\­Internet Explorer\­Quick Launch\­잩쏻짨볆.lnk
  • %appdata%\­Microsoft\­Internet Explorer\­Quick Launch\­힬잮쿮쒿.lnk
  • %appdata%\­Microsoft\­Internet Explorer\­Quick Launch\­춬돇쏀얮.lnk
  • %appdata%\­Microsoft\­Internet Explorer\­Quick Launch\­18뷻쫓욵.lnk
  • %appdata%\­Microsoft\­Internet Explorer\­Quick Launch\­벤쟩죈컨.lnk
  • %favorites%\­쳔놦쳘싴\­쳔놦믊맚뗪.lnk
  • %favorites%\­쳔놦쳘싴\­쳔놦욷없헽욷.lnk
  • %favorites%\­쳔놦쳘싴\­ퟛ뫏욵뗀.lnk
  • %favorites%\­쳔놦쳘싴\­첨췥망욵뗀.lnk
  • %favorites%\­쳔놦쳘싴\­짌돇욵뗀.lnk
  • %favorites%\­쳔놦쳘싴\­얮죋욵뗀.lnk
  • %favorites%\­쳔놦쳘싴\­뗧웷돇욵뗀.lnk
  • %favorites%\­쳔놦쳘싴\­뻓볒췦뻟.lnk
  • %favorites%\­쳔놦쳘싴\­쫽싫욵뗀.lnk
  • %favorites%\­쳔놦쳘싴\­쓐죋욵뗀.lnk
  • %favorites%\­쳔놦쳘싴\­쏀죝욵뗀.lnk
  • %favorites%\­쳔놦쳘싴\­쪳욷욵뗀.lnk
  • %favorites%\­쳔놦쳘싴\­쫎욷킬냼.lnk
  • %favorites%\­쳔놦쳘싴\­볒ힰ욵뗀.lnk
  • %commonstartup%\­낲좫짏췸.lnk

If the link is clicked the user is redirected to the target URL address.


The trojan contains a list of 23 URLs.


The trojan then removes itself from the computer.

Please enable Javascript to ensure correct displaying of this content and refresh this page.