Name: trojan-Dropper.Win32.Agent
    Size: 25,088 bytes
    Whether packers: No
    Platforms affected: WIN9X/ME/NT/2000/XP/2003/Vista/Win7
    Specific performance:
    Infected computer, the Trojan will be released the following documents to the system:
    % Systemroot% \ TEMP \ Sermon.sys% temp% \ Random.bat
    Also download the file:
    http://pc1.114central.com/ooo/0.exe

http://pc2.114central.com/ooo/0.exe

http://pc3.114central.com/ooo/0.exe

http://pc4 .114central.com/ooo/0.exe

http://pc5.114central.com/ooo/0.exe

http://pc6.114central.com/ooo/0.exe http://pc7.114central.com/ ooo/0.exe

http://pc8.114central.com/ooo/0.exe

http://pc9.114central.com/ooo/0.exe http://pc10.114central.com/ooo/0.exe http://pc11.dy2004.com/ooo/0.exe

Modify the Registry:
    HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ KVMonXP.kxp = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ KVMonXP.kxp \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ KVSrvXP.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ KVSrvXP.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ avp.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ avp.exe \ Debugger = 3 (times) “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ RavMonD.exe = new subkey

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ RavMonD.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ RavTask.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ RavTask.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ RsAgent.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ RsAgent.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ rsnetsvr.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ rsnetsvr.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ RsTray.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ RsTray.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ ScanFrm.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ ScanFrm.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ CCenter.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ CCenter.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ kavstart.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ kavstart.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ kissvc.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ kissvc.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ kpfw32.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ kpfw32.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ kpfwsvc.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ kpfwsvc.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ kswebshield.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ kswebshield.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ kwatch.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ kwatch.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ kmailmon.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ kmailmon.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ egui.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ egui.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ ekrn.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ ekrn.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ ccSvcHst.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ ccSvcHst.exe \ Debugger = 3 (times) “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ Mcagent.exe = new subkey

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ Mcagent.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ mcmscsvc.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ mcmscsvc.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ McNASvc.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ McNASvc.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ Mcods.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ Mcods.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ McProxy.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ McProxy.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ Mcshield.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ Mcshield.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ mcsysmon.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ mcsysmon.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ mcvsshld.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ mcvsshld.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ MpfSrv.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ MpfSrv.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ McSACore.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ McSACore.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ msksrver.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ msksrver.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ sched.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ sched.exe \ Debugger = 2 (times) “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ avguard.exe = new subkey

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ avguard.exe \ Debugger = 2 (times) “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ avmailc.exe = new subkey

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ avmailc.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ avwebgrd.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ avwebgrd.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ avgnt.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ avgnt.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ avcenter.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ avcenter.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ UfSeAgnt.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ UfSeAgnt.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ TMBMSRV.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ TMBMSRV.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ SfCtlCom.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ SfCtlCom.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ TmProxy.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ TmProxy.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ 360SoftMgrSvc.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ 360SoftMgrSvc.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ 360tray.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ 360tray.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ qutmserv.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ qutmserv.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ bdagent.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ bdagent.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ livesrv.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ livesrv.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ seccenter.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ seccenter.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ vsserv.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ vsserv.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ MPSVC.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ MPSVC.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ MPSVC1.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ MPSVC1.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ MPSVC2.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ MPSVC2.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ MPMon.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ MPMon.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ ast.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ ast.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ 360speedld.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ 360speedld.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ 360SoftMgrSvc.exe \ Debugger = ” ntsd-d “HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ 360tray.exe \ Debugger =” ntsd-d “HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ repair tool. exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ repair tool. Exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ 360hotfix.exe = new sub- key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ 360hotfix.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ 360rpt.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ 360rpt.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ 360safe.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ 360safe.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ 360safebox.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ 360safebox.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ krnl360svc.exe = new sub-key

 HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ krnl360svc.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ zhudongfangyu.exe = new sub-key HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ zhudongfangyu.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ 360sd.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ 360sd.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ 360rp.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ 360rp.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ 360se.exe = new sub-key

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ 360se.exe \ Debugger = “ntsd-d” HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ safeboxTray. = New subkey

HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ safeboxTray. \ Debugger = “ntsd-d”

Running the operating system, the Trojan will first release a driver file Sermon.sys, and it is loaded into the service to run. This service will be taking all the common anti-virus software installed on the system, and forced to shut down the software.

Meanwhile, the Trojans will be released a batch file random.bat under the temporary directory on the computer, run and delete the driver files, Trojans, and the batch file itself,  without leaving any trace of infection.

After obtaining permission to control the computer, started the service program will connect the remote server to download malicious programs to your computer, to more serious computer users caused the loss.