PLATFORM:

Windows

 OVER ALL RISK RATING:
 REPORTED INFECTION:
 Beeinträchtigung der Systemleistung ::
 INFORMATION EXPOSURE:
Low
Medium
High
Critical

  • Threat Type:
    Spyware

  • Destructiveness:
    No

  • Encrypted:
     

  • In the wild::
    Yes

  OVERVIEW


  TECHNICAL DETAILS

File size: 1,157,546 bytes
File type: EXE
Memory resident: No
INITIAL SAMPLES RECEIVED DATE: 26 de октября de 2015

Instalación

Crea las siguientes copias de sí mismo en el sistema afectado:

  • %System%\wwtask.exe

(Nota: %System% es la carpeta del sistema de Windows, que en el caso de Windows 98 y ME suele estar en C:\Windows\System, en el caso de Windows NT y 2000 en C:\WINNT\System32 y en el caso de Windows XP y Server 2003 en C:\Windows\System32).

)

Crea las carpetas siguientes:

  • %System%\TWH

(Nota: %System% es la carpeta del sistema de Windows, que en el caso de Windows 98 y ME suele estar en C:\Windows\System, en el caso de Windows NT y 2000 en C:\WINNT\System32 y en el caso de Windows XP y Server 2003 en C:\Windows\System32).

)

Otras modificaciones del sistema

Agrega las siguientes entradas de registro como parte de la rutina de instalación:

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver

HKEY_CURRENT_USER\Software\Tz0\
BIOS

HKEY_LOCAL_MACHINE\SOFTWARE\Tz0\
Plugins\EMTask

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
NetworkAgent

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
NetworkAgent

HKEY_LOCAL_MACHINE\Software\Tz0\
BIOS

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver\t0_secc

HKEY_LOCAL_MACHINE\Software\Tz0\
Agent

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver\tlb

Agrega las siguientes entradas de registro:

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_macid = "DC55E17B988987F362F345B5A9"

HKEY_CURRENT_USER\Software\Tz0\
BIOS
SMBiosType = "PHYSMEM"

HKEY_CURRENT_USER\Software\Tz0\
BIOS
SMBios = "{random values}"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_macid = "FA73C790F36D9BE776CF699995"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_s = "109139122142134090"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_deb = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_sp = "092083117112098103093104112108117140146140141126134076075117"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_sn = "144144141122140132071126145126"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_mut = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_mutp = "092083117112098103093104112108117140146140141126134076075117"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_mutt = "073"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_mutx = "073"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_tray = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_usrt = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_fpreset = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Tz0\
Plugins\EMTask
p_build = "1.0.0.20"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\NetworkAgent
ImagePath = "%System%\wwtask.exe -service"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\NetworkAgent
Description = "Manages objects protocols in the Network and Dial-Up synchronizations"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\NetworkAgent
DisplayName = "Network Agent Driver Tz0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_dlt = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_macid = "50D86DCECD47454DCB65F60B07"

HKEY_LOCAL_MACHINE\SOFTWARE\Tz0\
BIOS
SMBiosType = "PHYSMEM"

HKEY_LOCAL_MACHINE\SOFTWARE\Tz0\
BIOS
SMBios = "{random values}"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_macid = "9890A4B5D648464CCA64F50478"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_deb = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_p = "077076078082074"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_rport = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_pdie = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_max = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_ui = "074"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_pcrypt = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_pon = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_up = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_lvv = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_lvf = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_gtimer = "14997"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_comp = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_recp = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_shadow = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_lb = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_lc = "2"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_exs = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_htm = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_fcnv = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_fct0 = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_secu = "074"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_sece = "069"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_sect = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_secwa = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_secw = "4"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_secss = "211111111000000"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver\t0_secc
XT0 = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver\t0_secc
C0 = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver\t0_secc
C1 = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_rcimg = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_acti = "074073071074071074071078073"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_actp = "080080073"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_actr = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_fpreset = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_whw = "1f8"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_tmem = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_1 = "075078070073082070075073074076057074075083078080083077081068080076078074078074"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_mco = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_afpp = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_syssec = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_okey = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_ofiles = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_obrow = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_spkey = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_met_clip = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_Off_Prof_Adv = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_AgDetect_Adv = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_AgDetect_Abs = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_cri_up = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_hyber = "{random values}"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_st_p = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_prot = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_upi = "074073071074071074071078073"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_perft1 = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_perft2 = "f"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_perfast = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_perfr = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_afplog = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_rulog = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_pipe = "3CF309080F00051105010F2CE822F93EC346C254DD42E258CA40CB8DDB7DDA61F741113202"

HKEY_LOCAL_MACHINE\SOFTWARE\Tz0\
Agent
Build = "b"

HKEY_LOCAL_MACHINE\SOFTWARE\Tz0\
Agent
DateBuild = "13.07.2011"

HKEY_LOCAL_MACHINE\SOFTWARE\Tz0\
Agent
Codename = "NerdCast.x2"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_perf_r = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_macid = "3C340059BAABD9203E172052CE"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver
t0_uid = "VPC5618252832641194198215246371816497952X43386"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
NetworkAgentDriver\tlb
1 = "{random characters}"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%System%\wwtask.exe = "%System%\wwtask.exe:*:Enabled:Tz0 Network Agent Driver"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\AuthorizedApplications\
List
Tz0 Network Agent Driver = "%System%\wwtask.exe:*:Enabled:Tz0 Network Agent Driver"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
Tz0 Network Agent Driver = "%System%\wwtask.exe:*:Enabled:Tz0 Network Agent Driver"

Rutina de infiltración

Infiltra los archivos siguientes:

  • %System%\actt0.dep

(Nota: %System% es la carpeta del sistema de Windows, que en el caso de Windows 98 y ME suele estar en C:\Windows\System, en el caso de Windows NT y 2000 en C:\WINNT\System32 y en el caso de Windows XP y Server 2003 en C:\Windows\System32).

)

  SOLUTION

Minimum scan engine: 9.750

Step 1

Los usuarios de Windows ME y XP, antes de llevar a cabo cualquier exploración, deben comprobar que tienen desactivada la opción Restaurar sistema para permitir la exploración completa del equipo.

Step 2

Eliminar esta clave del Registro

[ learnMore ]

Importante: si modifica el Registro de Windows incorrectamente, podría hacer que el sistema funcione mal de manera irreversible. Lleve a cabo este paso solo si sabe cómo hacerlo o si puede contar con ayuda de su administrador del sistema. De lo contrario, lea este artículo de Microsoft antes de modificar el Registro del equipo.

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients
    • NetworkAgentDriver
  • In HKEY_CURRENT_USER\Software\Tz0
    • BIOS
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Tz0\Plugins
    • EMTask
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal
    • NetworkAgent
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network
    • NetworkAgent
  • In HKEY_LOCAL_MACHINE\Software\Tz0
    • BIOS
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_secc
  • In HKEY_LOCAL_MACHINE\Software\Tz0
    • Agent
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • tlb

Step 3

Eliminar este valor del Registro

[ learnMore ]

Importante: si modifica el Registro de Windows incorrectamente, podría hacer que el sistema funcione mal de manera irreversible. Lleve a cabo este paso solo si sabe cómo hacerlo o si puede contar con ayuda de su administrador del sistema. De lo contrario, lea este artículo de Microsoft antes de modificar el Registro del equipo.

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_macid = "DC55E17B988987F362F345B5A9"
  • In HKEY_CURRENT_USER\Software\Tz0\BIOS
    • SMBiosType = "PHYSMEM"
  • In HKEY_CURRENT_USER\Software\Tz0\BIOS
    • SMBios = "{random values}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_macid = "FA73C790F36D9BE776CF699995"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_s = "109139122142134090"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_deb = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_sp = "092083117112098103093104112108117140146140141126134076075117"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_sn = "144144141122140132071126145126"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_mut = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_mutp = "092083117112098103093104112108117140146140141126134076075117"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_mutt = "073"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_mutx = "073"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_tray = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_usrt = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_fpreset = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Tz0\Plugins\EMTask
    • p_build = "1.0.0.20"
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetworkAgent
    • ImagePath = "%System%\wwtask.exe -service"
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetworkAgent
    • Description = "Manages objects protocols in the Network and Dial-Up synchronizations"
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetworkAgent
    • DisplayName = "Network Agent Driver Tz0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_dlt = "{random characters}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_macid = "50D86DCECD47454DCB65F60B07"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Tz0\BIOS
    • SMBiosType = "PHYSMEM"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Tz0\BIOS
    • SMBios = "{random values}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_macid = "9890A4B5D648464CCA64F50478"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_deb = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_p = "077076078082074"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_rport = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_pdie = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_max = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_ui = "074"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_pcrypt = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_pon = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_up = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_lvv = "{random characters}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_lvf = "{random characters}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_gtimer = "14997"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_comp = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_recp = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_shadow = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_lb = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_lc = "2"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_exs = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_htm = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_fcnv = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_fct0 = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_secu = "074"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_sece = "069"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_sect = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_secwa = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_secw = "4"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_secss = "211111111000000"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver\t0_secc
    • XT0 = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver\t0_secc
    • C0 = "{random characters}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver\t0_secc
    • C1 = "{random characters}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_rcimg = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_acti = "074073071074071074071078073"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_actp = "080080073"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_actr = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_fpreset = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_whw = "1f8"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_tmem = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_1 = "075078070073082070075073074076057074075083078080083077081068080076078074078074"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_mco = "{random characters}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_afpp = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_syssec = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_okey = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_ofiles = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_obrow = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_spkey = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_met_clip = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_Off_Prof_Adv = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_AgDetect_Adv = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_AgDetect_Abs = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_cri_up = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_hyber = "{random values}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_st_p = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_prot = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_upi = "074073071074071074071078073"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_perft1 = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_perft2 = "f"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_perfast = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_perfr = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_afplog = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_rulog = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_pipe = "3CF309080F00051105010F2CE822F93EC346C254DD42E258CA40CB8DDB7DDA61F741113202"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Tz0\Agent
    • Build = "b"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Tz0\Agent
    • DateBuild = "13.07.2011"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Tz0\Agent
    • Codename = "NerdCast.x2"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_perf_r = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_macid = "3C340059BAABD9203E172052CE"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver
    • t0_uid = "VPC5618252832641194198215246371816497952X43386"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Clients\NetworkAgentDriver\tlb
    • 1 = "{random characters}"
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
    • %System%\wwtask.exe = "%System%\wwtask.exe:*:Enabled:Tz0 Network Agent Driver"
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List
    • Tz0 Network Agent Driver = "%System%\wwtask.exe:*:Enabled:Tz0 Network Agent Driver"
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
    • Tz0 Network Agent Driver = "%System%\wwtask.exe:*:Enabled:Tz0 Network Agent Driver"

Step 4

Buscar y eliminar este archivo

[ learnMore ]
Puede que algunos de los archivos del componente estén ocultos. Asegúrese de que tiene activada la casilla Buscar archivos y carpetas ocultos en la opción Más opciones avanzadas para que el resultado de la búsqueda incluya todos los archivos y carpetas ocultos.
  • %System%\actt0.dep

Step 5

Buscar y eliminar esta carpeta

[ learnMore ]
Asegúrese de que tiene activada la casilla Buscar archivos y carpetas ocultos en la opción Más opciones avanzadas para que el resultado de la búsqueda incluya todas las carpetas ocultas.
  • %System%\TWH

Step 6

Explorar el equipo con su producto de Trend Micro para eliminar los archivos detectados como TSPY_BANCOS.XJOT En caso de que el producto de Trend Micro ya haya limpiado, eliminado o puesto en cuarentena los archivos detectados, no serán necesarios más pasos. Puede optar simplemente por eliminar los archivos en cuarentena. Consulte esta página de Base de conocimientos para obtener más información.


Did this description help? Tell us how we did.