Misplaced Pages

This article needs additional citations for verification. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed. Find sources: "Agent.AWF" – news · newspapers · books · scholar · JSTOR (May 2015) (Learn how and when to remove this message)

AWF (or Agent.AWF) is a malicious Trojan downloader affecting the Microsoft Windows operating system.

Methods of infection

This Trojan is considered obsolete, and there are no known variants in the wild.

Affected operating systems

The following operating systems are known to be affected.

• Windows XP
• Windows 2003
• Windows 2000
• Windows ME
• Windows 98
• Windows 95
• Windows NT

Operation

Agent.AWF displays virus activity in that it replaces files on a user's computer with a copy of itself, and moves the original, legitimate file to a back sub-folder. It is known to attempt to terminate security software, and the Trojan downloads a backdoor onto the computer, allowing the attacker to further compromise the computer. It is also known to modify the Windows registry. Agent.AWF does not spread automatically: it needs an attacking user's intervention in order to reach the affected computer. The means of transmission used include, among others, floppy disks, CD-ROMs, emails with attached files, Internet downloads, FTP, IRC channels, peer-to-peer (P2P) file sharing networks, etc.

Identification

During installation, the following files are created, and may be present on a compromised system.

• abc123.pid
• svcipa.exe
• nod32kui.exe

References

1. ^ "Agent.AWF - at a glance". pandasecurity.com. Retrieved 8 January 2017.
2. "Trojan-Downloader.Win32.Agent.awf Information and Removal". sunbeltsecurity.com. 5 October 2006. Retrieved 8 January 2017.
3. "E-Book Downloader". scribddownloader.com. 5 October 2024. Retrieved 8 January 2024.

• v
• t
• e

• Windows trojans
• Malware stubs