ÿþ<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <TITLE>W32/Agent.Evi Trojan</TITLE> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> <META NAME="Author" CONTENT="Webmaster - Proland Software"> <META NAME="Description" CONTENT="W32/Agent.Evi"> <META NAME="GENERATOR" CONTENT="Mozilla/3.04Gold (WinNT; I) [Netscape]"> <META NAME="KeyWords" CONTENT="W32/Agent.Evi, vista, longhorn, spyware, trojan, adware, backdoors, exploits, keyloggers, rootkits, TR/Agent.EvI.1, Trojan.Win32.Agent.evi, W32/Malware.BWSC, Trojan.Agent.EvI.1"> </HEAD> <BODY TEXT="#000000" BGCOLOR="#FFFFFF" LINK="#0000EE" VLINK="#408080" ALINK="#0000FF"> <P><A HREF="/profile.htm"><IMG SRC="/images/imgprobanner.gif" ALT="Proland Software" BORDER=0 HEIGHT=55 WIDTH=600></A> <A HREF="/download/downloadnow.htm"><IMG SRC="/images/imgbluedwldnow.gif" ALT="Download Anti virus software now!" BORDER=0 HEIGHT=55 WIDTH=143></A> <TABLE CELLSPACING=0 > <TR> <TD vAlign=top bgColor="#f7f7ef"> <CENTER><P><A HREF="/"><IMG SRC="/images/imghome.gif" ALT="Home" BORDER=0 HEIGHT=18 WIDTH=143></A><BR> <A HREF="/products/products.htm"><IMG SRC="/images/imgproducts.gif" ALT="Anti virus products" BORDER=0 HEIGHT=18 WIDTH=142></A><BR> <A HREF="/download/download.htm"><IMG SRC="/images/imgdownload.gif" ALT="Download Anti virus Software" BORDER=0 HEIGHT=19 WIDTH=143></A><BR> <A HREF="/order/order.htm"><IMG SRC="/images/imgorderonline.gif" ALT="Order On-line" BORDER=0 HEIGHT=18 WIDTH=142></A><BR> <A HREF="/support/support.htm"><IMG SRC="/images/imgsupport.gif" ALT="Support" BORDER=0 HEIGHT=18 WIDTH=143></A><BR> <A HREF="mailto:webmaster@protectorplus.com?subject=W32/Zaflen.A"><IMG SRC="/images/imgemail.gif" ALT="Email" BORDER=0 HEIGHT=20 WIDTH=142></A><BR> <IMG SRC="/images/imgppantivirussoft.gif" ALT="Protector Plus Anti virus Software for" HEIGHT=33 WIDTH=142><BR> <A HREF="/download/wntec.htm"><IMG SRC="/images/imgwinnt.gif" ALT="Anti virus Software for Windows XP and 2000" BORDER=0 HEIGHT=18 WIDTH=142></A><BR> <A HREF="/download/winvistaec.htm"><IMG SRC="/images/imgvista.gif" ALT="Antivirus Software for Windows Vista" BORDER=0 HEIGHT=18 WIDTH=142></A><BR> <A HREF="/download/w95ec.htm"><IMG SRC="/images/imgwin95.gif" ALT="Antivirus Software for Windows Me and 98" BORDER=0 HEIGHT=19 WIDTH=142></A><BR> <A HREF="/download/ppexgec.htm"><IMG SRC="/images/imgppexg.gif" ALT="Anti virus Software for Exchange" BORDER=0 HEIGHT=18 WIDTH=142></A><BR> <A HREF="/download/nwsec.htm"><IMG SRC="/images/imgnws.gif" ALT="Anti virus Software for NetWare" BORDER=0 HEIGHT=19 WIDTH=142></A><BR> <A HREF="/products/ppcd.htm"><IMG SRC="/images/imgppcdl.gif" ALT="Protector Plus Console" BORDER=0 HEIGHT=18 WIDTH=142></A><BR> <A HREF="/order/order.htm"><IMG SRC="/images/yellowbuy3.gif" ALT="Buy Anti virus software now!" BORDER=0 HEIGHT=46 WIDTH=143></A><BR> <IMG SRC="/images/imgroundcorner.gif" HEIGHT=15 WIDTH=142><BR> <A HREF="/pro/ppad.htm"><IMG SRC="/images/imgppad.gif" ALT="" BORDER=0 HEIGHT=47 WIDTH=142></A><BR> <B><FONT FACE="Arial"><A HREF="http://www.spamchoke.com">SpamChoke Antispam<BR> Software</A></FONT></B> <FORM action="/cgi-bin/vaml.cgi" method=post><INPUT type=hidden value="vaml@protectorplus.com" name=_MAILTO><INPUT type=hidden value=vaml name=_TEMPLATE><INPUT type=hidden value="Subscribe VAML -W32/Agent.Evi" name=_SUBJECT><INPUT type=hidden value="/virus_info/vaml.htm" name=_THANKS> <P><B><FONT FACE="Arial,Helvetica"><FONT COLOR="#004080"><FONT SIZE=-1>Subscribe to Virus Alert<BR> Mailing List<BR> <BR> Enter your Email<BR> </FONT></FONT></FONT><FONT COLOR="#000000"><FONT SIZE=-2>(Ex : john@company.com)</FONT></FONT></B><BR> <INPUT size=12 name=_FROMEMAIL><BR> <INPUT type=submit value=Subscribe><BR> </FORM></P></CENTER> <P><BR> <BR> <BR> <BR> <A HREF="http://www.anti-virus-anti-spam.com/anti-virus/download/download.htm"><IMG SRC="/images/imgbside.gif" ALT="Download Anti virus software" BORDER=0 HEIGHT=18 WIDTH=141></A><FONT SIZE=-1> </FONT></P> </TD> <TD VALIGN=TOP> <H2 ALIGN=CENTER><FONT FACE="Arial,Helvetica"><FONT SIZE=+1>W32/Agent.Evi Trojan</FONT></FONT></H2> <P><IMG SRC="/images/imgblueball.gif" ALT="Blueball" HEIGHT=10 WIDTH=10><B><FONT FACE="Arial,Helvetica"><FONT COLOR="#0000A0">&nbsp;<FONT SIZE=+1>Information about the W32/Agent.Evi Trojan</FONT></FONT></FONT></B><FONT FACE="Arial,Helvetica"><FONT COLOR="#0000A0"><FONT SIZE=+1>:</FONT></FONT></FONT></P> <P><FONT FACE="Arial,Helvetica">W32/Agent.Evi is a Trojan. The Trojan will infect Windows systems.<BR> <BR> <FONT face=Arial>Upon execution, it drops <STRONG>powermgmt.sys </STRONG>in <STRONG>Windows System</STRONG> folder.<BR><BR>It registers itself as a windows service by name <STRONG>Advanced Power Management </STRONG>to load itself during each startup. It modifies the registry at the following location to achieve the same.<BR><BR><STRONG><FONT size=2>HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\</FONT></STRONG></FONT></FONT><P> <FONT FACE="Arial,Helvetica">This Trojan first appeared on Feb 08, 2008. <BR> <BR> <IMG SRC="/images/imgblueball.gif" ALT="Blueball" HEIGHT=10 WIDTH=10><B><FONT COLOR="#0000A0"><FONT SIZE=+1>&nbsp;Other names of W32/Agent.Evi Trojan:</FONT></FONT></B></FONT></P> <P><FONT FACE="Arial,Helvetica">This Trojan is also known as TR/Agent.EvI.1, Trojan.Win32.Agent.evi, W32/Malware.BWSC, Trojan.Agent.EvI.1.</FONT></P> <CENTER><FONT FACE="Arial,Helvetica"><A HREF="/download/downloadnow.htm"><IMG SRC="/images/imgdwldblue.gif" ALT="Download Now" BORDER=0 HEIGHT=45 WIDTH=300></A></FONT></CENTER><BR><BR> <CENTER><TABLE BORDER=1 CELLSPACING=0 CELLPADDING=0 width="100%"> <TR> <TD BGCOLOR="#F7F7EF"> <CENTER><B><FONT FACE="Arial,Helvetica" COLOR="#400080"><A HREF="/download/downloadnow.htm"> Download the FREE Evaluation copy of Protector Plus antivirus software</A></FONT></B></CENTER> </TD> </TR> </TABLE></center><BR><BR> </TD> </TR> </TABLE> <H3><IMG SRC="/images/imgblueball.gif" ALT="Blueball" HEIGHT=10 WIDTH=10><B><FONT FACE="Arial,Helvetica"><FONT COLOR="#0000A0">&nbsp;About Protector Plus Antivirus Software Packages:</FONT></FONT></B></H3> <P><FONT FACE="Arial,Helvetica"><A HREF="http://www.pspl.com/">Proland Software</A> is the developer of Protector Plus range of antivirus software packages. Protector Plus 2008 is available for Windows Vista, Windows 95/98/Me, Windows XP, Windows NT/2000/2003 servers and workstations, MS-Exchange 2000/2003, MS-DOS and NetWare servers. </FONT></P> <CENTER><TABLE CELLSPACING=0 CELLPADDING=5 > <TR VALIGN=TOP> <TD WIDTH="50%"><A HREF="/download/wntec.htm#wntecdownload"><IMG SRC="/images/imgantdown.gif" ALT="Anti virus for Windows Download Now!" BORDER=0 ></A></TD> <TD ALIGN=LEFT VALIGN=TOP WIDTH="50%"><A HREF="/order/order.htm"><IMG SRC="/images/imgsploffer.gif" ALT="Special Offer Order Protector Plus Antivirus software Now and get SpamChoke Antispam Software worth $29.95 FREE!" BORDER=0 ></A></TD> </TR> </TABLE></CENTER> <P><FONT FACE="Arial,Helvetica">Protector Plus range of antivirus products offer on-line virus detection and removal. All the packages have the ability to detect and isolate all types of viruses, trojans, worms and other types of malware. <BR> <BR> These products are updated on a continuous basis and the latest upgrades for all the platforms are made available for downloading from this site. </FONT><BR> </P> <CENTER><TABLE BORDER=1 CELLSPACING=0 CELLPADDING=0 BGCOLOR="#FFFFBB" > <TR> <TD> <TABLE CELLSPACING=0 CELLPADDING=0 > <TR> <TD> <CENTER><P><B><FONT FACE="Arial,Helvetica"><FONT SIZE=+1><A HREF="/order/order.htm">Click here to order<BR> Protector Plus anti virus&nbsp;software</A>&nbsp;</FONT></FONT></B></P></CENTER> </TD> <TD><A HREF="/order/order.htm"><IMG SRC="/images/yellowbuy5.gif" ALT="Buy Anti virus software now!" BORDER=0 HEIGHT=55 WIDTH=143 ALIGN=CENTER></A></TD> </TR> </TABLE> </TD> </TR> </TABLE></CENTER> <CENTER><P><BR> <B><FONT FACE="Arial,Helvetica">You can download the 30 day evaluation copy of the <BR> antivirus software free of cost for these platforms:<BR> <A HREF="/download/wntec.htm"><IMG SRC="/images/imgbelowe-wnt.gif" ALT="Anti virus Software for Windows XP and 2000" BORDER=0 HEIGHT=32 WIDTH=134></A> <A HREF="/download/w95ec.htm"><IMG SRC="/images/imgbelowe-w95.gif" ALT="Anti virus Software for Windows Me and 98" BORDER=0 HEIGHT=32 WIDTH=134></A> <A HREF="/download/ppexgec.htm"><IMG SRC="/images/imgbelowe-exg.gif" ALT="Anti virus Software for Exchange" BORDER=0 HEIGHT=32 WIDTH=134></A> <A HREF="/download/nwsec.htm"><IMG SRC="/images/imgbelowe-nws.gif" ALT="Anti virus Software for NetWare" BORDER=0 HEIGHT=32 WIDTH=134></A><BR> <BR><BR> <A HREF="/"><IMG SRC="/images/tophome.gif" ALT="Home" BORDER=0 HEIGHT=18 WIDTH=54></A><A HREF="/products/products.htm"><IMG SRC="/images/topproducts.gif" ALT="Anti virus products" BORDER=0 HEIGHT=18 WIDTH=53></A><A HREF="/download/download.htm"><IMG SRC="/images/topdownload.gif" ALT="Download Anti virus Software" BORDER=0 HEIGHT=18 WIDTH=71></A><A HREF="/order/order.htm"><IMG SRC="/images/toporderonline.gif" ALT="Order On-line" BORDER=0 HEIGHT=18 WIDTH=89></A><A HREF="mailto:webmaster@pspl.com?subject=W32/Agent.Evi"><IMG SRC="/images/topemail.gif" ALT="Email" BORDER=0 HEIGHT=18 WIDTH=36></A><BR> <IMG SRC="/images/imgblueline.gif" HEIGHT=2 WIDTH=450><BR> </FONT></B><FONT FACE="arial,helvetica"><FONT SIZE=-1>Copyright &copy; 2008 Proland Software. All rights reserved.</FONT></FONT><BR> </P></CENTER> <BR><CENTER> <A HREF="http://www.anti-virus-anti-spam.com/anti-virus/download/download.htm"> <IMG SRC="/images/imgwb.gif" ALT="Download Anti virus software" BORDER=0 HEIGHT=18 WIDTH=299></A></CENTER> </BODY> </HTML>