Win32/Agent.NEG [Threat Name] go to Threat

Win32/Agent.NEG [Threat Variant Name]

Category virus,worm
Size 61440 B
Aliases Worm.Win32.AutoRun.hcg (Kaspersky)
  Trojan:Win32/Malagent (Microsoft)
  Mal/Generic-L (Sophos)
Short description

Win32/Agent.NEG is a worm that spreads by copying itself into the root folders of available drives. The worm contains a backdoor. It can be controlled remotely.


When executed, the worm copies itself into the following location:

  • %system%\­sysinfo.exe (61440 B)

The worm registers itself as a system service using the following name:

  • Windows netware work information system setup

The following Registry entries are created:

  • [HKEY_LOCAL_MACHINE\­SYSTEM\­CurrentControlSet\­Services\­Wnetwiss]
    • "Type"  = 272
    • "Start" = 2
    • "ErrorControl" = 1
    • "ImagePath" = "%system%\­sysinfo.exe"
    • "DisplayName" = "Windows netware work information system setup"
    • "ObjectName" = "LocalSystem"
    • "Description" = "Provide  security by Windows netware work system information"

The worm copies itself into the root folders of all drives using the following name:

  • sysinfo.exe
  • %variable%.exe

A string with variable content is used instead of %variable% .

The name of the file may be based on the name of an existing file or folder.

Other information

The worm acquires data and commands from a remote computer or the Internet. It uses its own P2P network for communication.

It can execute the following operations:

  • send files to a remote computer
  • run executable files
  • download files from a remote computer and/or the Internet
  • delete folders
  • delete cookies

The worm may create the following files:

  • %system%\­sysinfo.bat

Please enable Javascript to ensure correct displaying of this content and refresh this page.