Threat Search: 

ThreatExpert's Statistics for Win-Trojan/Xema.121020 [AhnLab]:

Win-Trojan/Xema.121020 [AhnLab] is also known as:
Threat AliasNumber of Incidents
Trojan-Spy.Win32.Agent.qj [Kaspersky Lab]3
W32.Xema.A [Symantec]3
WORM_AGENT.TBW [Trend Micro]3
Troj/Agent-FXF [Sophos]2
TrojanSpy.Agent.CZRD [PC Tools]2
Trojan-Spy.Win32.Agent.qj [Ikarus]1

Win-Trojan/Xema.121020 [AhnLab] has the following possible country of origin:
OriginNumber of Incidents
China1

Win-Trojan/Xema.121020 [AhnLab] is known to be created as:
%Programs%\startup\officexp.exe
%System%\serlibk.exe
Notes:
  • %Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.
  • %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).