JS/Agent.E!tr

Analysis

• file.exe
• update.exe

• One example is http://r52host.[blocked]/stat/2.png, where the malicious EXE files mentioned above may be secretly downloaded from

Recommended Action

FortiGate Systems

• Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the 'Allow Push Update' option.
  FortiClient Systems
  
• Quarantine/delete files that are detected and replace infected files with clean backup copies.