Resolve for Agent-L and Agent-GB

Resolve is the name for a set of small, downloadable Sophos utilities designed to remove and undo the changes made by certain viruses, Trojans and worms.

They terminate any virus processes and reset any registry keys that the virus changed. Existing infections can be cleaned up quickly and easily, both on individual workstations and over networks with large numbers of computers.

Troj/Agent-L is a backdoor proxy Trojan.

In order to run automatically when Windows starts up the Trojan creates the registry entry:

HKLMSoftwareMicrosoftWindowsCurrentVersionRunSysUpd

pointing to itself.

Troj/Agent-L also creates registry entries below:

HKCUSoftwareMicrosoftSysUpd.

Troj/Agent-GB is a downloader Trojan. Troj/Agent-GB is a downloader Trojan that is usually used by Troj/Dloader-CS.

The Trojan is implemented as a DLL file and attempts to access remote websites and download other files from them.

Troj/Agent-L and Troj/Agent-GB can be removed from Windows computers automatically with the following Resolve tools:

AGENTGUI is a disinfector for standalone Windows computers. To use it you have to do the following: ￭ Open AGENTGUI.com file from your desktop after downloading it. ￭ Click on the Start Scan Button. ￭ Wait for the process to complete.

AGENTSFX.EXE is a self-extracting archive containing BDLAACLI, a Resolve command line disinfector for use by system administrators on Windows networks.