[virusinfo] W32/Rbot-AGQ
- From: "Mike" <mikebike@xxxxxxxxx>
- To: virusinfo@xxxxxxxxxxxxx
- Date: Thu, 30 Jun 2005 09:38:59 -0700
From; Sophos Alert System:
Name: W32/Rbot-AGQ
Type: Win32 worm
Date: 30 June 2005
Sophos has issued protection for W32/Rbot-AGQ.
At the time of writing, Sophos has received a small number of
reports of this worm from the wild.
Customers using EM Library, Enterprise Console, PureMessage or
any of our Sophos small business solutions will be automatically
protected at their next scheduled update.
Information about W32/Rbot-AGQ can be found at:
http://www.sophos.com/virusinfo/analyses/w32rbotagq.html
W32/Rbot-AGQ is a worm and IRC backdoor Trojan for the Windows platform.
W32/Rbot-AGQ spreads by copying itself to network shares protected by weak
passwords.
W32/Rbot-AGQ runs continuously in the background, providing a backdoor server
which allows a remote intruder to gain access and control over the computer via
IRC channels.
W32/Rbot-AGQ includes functionality to:
- steal confidential information
- carry out DDoS flooder attacks
- silently download, install and run new software, including updates of its
software
When first run W32/Rbot-AGQ copies itself to <System>\syscfg.exe.
The following registry entries are created to run syscfg.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
System Support
syscfg.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
System Support
syscfg.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
System Support
syscfg.exe
The W32/Rbot-AGQ virus identity file (IDE) includes detection for:
Troj/Dloader-PQ
http://www.sophos.com/virusinfo/analyses/trojdloaderpq.html
Troj/MiniDl-B
http://www.sophos.com/virusinfo/analyses/trojminidlb.html
Troj/Dloader-PP
http://www.sophos.com/virusinfo/analyses/trojdloaderpp.html
Troj/StartPa-ZY
http://www.sophos.com/virusinfo/analyses/trojstartpazy.html
Customers with 3.xx or lower versions of Sophos Anti-Virus,
who are not running EM Library, can manually download the IDE
for W32/Rbot-AGQ from:
http://www.sophos.com/downloads/ide/rbot-agq.ide
Read about how to use IDE files at
http://www.sophos.com/support/knowledgebase/article/363.html
*********** MIKE"S REPLY SEPARATOR ***********
Mike ~ It is a good day if I learned something new.
Editor MikesWhatsNews see a sample on my web page
http://www3.telus.net/mikebike
<mikeswhatsnews-request@xxxxxxxxxxxxx?Subject=subscribe>
http://www3.telus.net/mikebike/worm_removal.htm
See my Anti-Virus pages http://virusinfo.hackfix.org/index
<virusinfo-request@xxxxxxxxxxxxx?Subject=subscribe>
A Technical Support Alliance and OWTA Charter Member
Other related posts:
- » [virusinfo] W32/Rbot-AGQ
