[virusinfo] W32/Rbot-AGG
- From: "Mike" <mikebike@xxxxxxxxx>
- To: virusinfo@xxxxxxxxxxxxx
- Date: Thu, 23 Jun 2005 09:12:04 -0700
From; Sophos Alert System:
Name: W32/Rbot-AGG
Type: Win32 worm
Date: 23 June 2005
Sophos has issued protection for W32/Rbot-AGG.
At the time of writing, Sophos has received a small number of
reports of this worm from the wild.
Customers using EM Library, Enterprise Console, PureMessage or
any of our Sophos small business solutions will be automatically
protected at their next scheduled update.
Information about W32/Rbot-AGG can be found at:
http://www.sophos.com/virusinfo/analyses/w32rbotagg.html
W32/Rbot-AGG is a worm and IRC backdoor Trojan for the Windows platform.
W32/Rbot-AGG spreads by copying itself to network shares protected by weak
passwords.
W32/Rbot-AGG runs continuously in the background, providing a backdoor server
which allows a remote intruder to gain access and control over the computer via
IRC channels.
W32/Rbot-AGG includes functionality to:
- steal confidential information
- carry out DDoS flooder attacks
- provide a proxy server
- silently download, install and run new software, including updates of its
software and other malicious executables
- send notification messages to remote locations
When first run W32/Rbot-AGG copies itself to <System>\winsound.exe.
The following registry entries are created to run winsound.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Microsoft Sound Technology
"winsound.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Sound Technology
"winsound.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Microsoft Sound Technology
"winsound.exe"
Registry entries are set as follows:
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
The W32/Rbot-AGG virus identity file (IDE) includes detection for:
Troj/Bdoor-IR
http://www.sophos.com/virusinfo/analyses/trojbdoorir.html
Troj/Bdoor-IQ
http://www.sophos.com/virusinfo/analyses/trojbdooriq.html
Troj/Pupsv-A
http://www.sophos.com/virusinfo/analyses/trojpupsva.html
Troj/QZap172-A
http://www.sophos.com/virusinfo/analyses/trojqzap172a.html
Troj/Winsdldr-A
http://www.sophos.com/virusinfo/analyses/trojwinsdldra.html
Troj/Suij-A
http://www.sophos.com/virusinfo/analyses/trojsuija.html
Customers with 3.xx or lower versions of Sophos Anti-Virus,
who are not running EM Library, can manually download the IDE
for W32/Rbot-AGG from:
http://www.sophos.com/downloads/ide/rbot-agg.ide
Read about how to use IDE files at
http://www.sophos.com/support/knowledgebase/article/363.html
*********** MIKE"S REPLY SEPARATOR ***********
Mike ~ It is a good day if I learned something new.
Editor MikesWhatsNews see a sample on my web page
http://www3.telus.net/mikebike
<mikeswhatsnews-request@xxxxxxxxxxxxx?Subject=subscribe>
http://www3.telus.net/mikebike/worm_removal.htm
See my Anti-Virus pages http://virusinfo.hackfix.org/index
<virusinfo-request@xxxxxxxxxxxxx?Subject=subscribe>
A Technical Support Alliance and OWTA Charter Member
Other related posts:
- » [virusinfo] W32/Rbot-AGG
