VBS/Agent.NDH [Threat Name] go to Threat

VBS/Agent.NDH [Threat Variant Name]

Category	trojan,worm
Size	23262 B
Detection created	Aug 25, 2010
Detection database version	8728
Aliases	Trojan.VBS.Agent.kq (Kaspersky)
	TrojanClicker:VBS/Lnkhit.A (Microsoft)
	Trojan.Malcol (Symantec)

Short description

VBS/Agent.NDH is a trojan which tries to promote certain web sites.

Installation

The trojan does not create any copies of itself.

Other information

VBS/Agent.NDH is a trojan which tries to promote certain web sites.

The trojan may create the following files:

%commondesktopdirectory%\낲좫짏췸.lnk
%commondesktopdirectory%\Internet Explorer.lnk
%commondesktopdirectory%\쳔놦쳘볛.lnk
%commondesktopdirectory%\잩쏻짨볆.lnk
%commondesktopdirectory%\힬잮쿮쒿.lnk
%commondesktopdirectory%\춬돇쏀얮.lnk
%commondesktopdirectory%\18뷻쫓욵.lnk
%commondesktopdirectory%\벤쟩죈컨.lnk
%commonstartmenu%\낲좫짏췸.lnk
%commonstartmenu%\Internet Explorer.lnk
%commonstartmenu%\쳔놦쳘볛.lnk
%commonstartmenu%\잩쏻짨볆.lnk
%commonstartmenu%\힬잮쿮쒿.lnk
%commonstartmenu%\춬돇쏀얮.lnk
%commonstartmenu%\18뷻쫓욵.lnk
%commonstartmenu%\벤쟩죈컨.lnk
%commonprograms%\낲좫짏췸.lnk
%commonprograms%\Internet Explorer.lnk
%commonprograms%\쳔놦쳘볛.lnk
%commonprograms%\잩쏻짨볆.lnk
%commonprograms%\힬잮쿮쒿.lnk
%commonprograms%\춬돇쏀얮.lnk
%commonprograms%\18뷻쫓욵.lnk
%commonprograms%\벤쟩죈컨.lnk
%favorites%\낲좫짏췸.lnk
%favorites%\Internet Explorer.lnk
%favorites%\쳔놦쳘볛.lnk
%favorites%\잩쏻짨볆.lnk
%favorites%\힬잮쿮쒿.lnk
%favorites%\춬돇쏀얮.lnk
%favorites%\18뷻쫓욵.lnk
%favorites%\벤쟩죈컨.lnk
%favorites\솴뷓\낲좫짏췸.lnk
%favorites\솴뷓\Internet Explorer.lnk
%favorites\솴뷓\쳔놦쳘볛.lnk
%favorites\솴뷓\잩쏻짨볆.lnk
%favorites\솴뷓\힬잮쿮쒿.lnk
%favorites\솴뷓\춬돇쏀얮.lnk
%favorites\솴뷓\18뷻쫓욵.lnk
%favorites\솴뷓\벤쟩죈컨.lnk
%appdata%\Microsoft\Internet Explorer\Quick Launch\낲좫짏췸.lnk
%appdata%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk
%appdata%\Microsoft\Internet Explorer\Quick Launch\쳔놦쳘볛.lnk
%appdata%\Microsoft\Internet Explorer\Quick Launch\잩쏻짨볆.lnk
%appdata%\Microsoft\Internet Explorer\Quick Launch\힬잮쿮쒿.lnk
%appdata%\Microsoft\Internet Explorer\Quick Launch\춬돇쏀얮.lnk
%appdata%\Microsoft\Internet Explorer\Quick Launch\18뷻쫓욵.lnk
%appdata%\Microsoft\Internet Explorer\Quick Launch\벤쟩죈컨.lnk
%favorites%\쳔놦쳘싴\쳔놦믊맚뗪.lnk
%favorites%\쳔놦쳘싴\쳔놦욷없헽욷.lnk
%favorites%\쳔놦쳘싴\ퟛ뫏욵뗀.lnk
%favorites%\쳔놦쳘싴\첨췥망욵뗀.lnk
%favorites%\쳔놦쳘싴\짌돇욵뗀.lnk
%favorites%\쳔놦쳘싴\얮죋욵뗀.lnk
%favorites%\쳔놦쳘싴\뗧웷돇욵뗀.lnk
%favorites%\쳔놦쳘싴\뻓볒췦뻟.lnk
%favorites%\쳔놦쳘싴\쫽싫욵뗀.lnk
%favorites%\쳔놦쳘싴\쓐죋욵뗀.lnk
%favorites%\쳔놦쳘싴\쏀죝욵뗀.lnk
%favorites%\쳔놦쳘싴\쪳욷욵뗀.lnk
%favorites%\쳔놦쳘싴\쫎욷킬냼.lnk
%favorites%\쳔놦쳘싴\볒ힰ욵뗀.lnk
%commonstartup%\낲좫짏췸.lnk

If the link is clicked the user is redirected to the target URL address.

The trojan contains a list of 23 URLs.

The trojan then removes itself from the computer.