[virusinfo] W32/Agobot-IX
- From: "Mike" <mikebike@xxxxxxxxx>
- To: virusinfo@xxxxxxxxxxxxx
- Date: Sat, 22 May 2004 10:09:15 -0700
From; Sophos Alert System:
Name: W32/Agobot-IX
Aliases: WORM_AGOBOT.GEN, W32.HLLW.Gaobot.gen, W32/Gaobot.worm.gen.d
Type: Win32 worm
Date: 20 May 2004
A virus identity (IDE) file which provides protection is
available now from the Sophos website, and will be incorporated
into the July 2004 (3.83) release of Sophos Anti-Virus.
Customers using Enterprise Manager, PureMessage and any of the
Sophos small business solutions will be automatically protected
at their next scheduled update.
At the time of writing, Sophos has received just one report of
this worm from the wild.
Information about W32/Agobot-IX can be found at:
http://www.sophos.com/virusinfo/analyses/w32agobotix.html
Description
W32/Agobot-IX is an IRC backdoor Trojan and network worm.
W32/Agobot-IX copies itself to network shares protected by weak passwords.
When first run W32/Agobot-IX copies itself to the Windows system folder as
winlogin.exe and sets the following registry entries to ensure it is run at
system logon:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
WinLogin = winlogin.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
WinLogin = winlogin.exe
On NT-based version of Windows the worm creates a new service named
"winlogin" with the startup property set to automatic, so that the service
starts automatically each time Windows is started.
Each time W32/Agobot-IX is run it attempts to connect to a remote IRC server
and join a specific channel. The worm then runs in the background allowing a
remote intruder to issue commands which control the computer.
W32/Agobot-IX can be instructed to download and install other programs on
the system as well as to flood other computers with network packets.
W32/Agobot-IX will terminate and disable various anti-virus and security
related programs.
W32/Agobot-IX will write to the hosts file so that various security related
internet sites can no longer be accessed.
These sites include:
www.sophos.com
sophos.com
www.symantec.com
securityresponse.symantec.com
symantec.com
www.mcafee.com
mcafee.com
liveupdate.symantecliveupdate.com
www.viruslist.com
viruslist.com
f-secure.com
www.f-secure.com
kaspersky.com
www.avp.com
www.kaspersky.com
avp.com
www.networkassociates.com
networkassociates.com
www.ca.com
ca.com
mast.mcafee.com
www.my-etrust.com
download.mcafee.com
dispatch.mcafee.com
secure.nai.com
nai.com
www.nai.com
update.symantec.com
updates.symantec.com
us.mcafee.com
liveupdate.symantec.com
customer.symantec.com
rads.mcafee.com
trendmicro.com
www.trendmicro.com
Recovery
Please follow the instructions for removing worms.
This IDE file also includes detection for:
W32/Sdbot-MU
http://www.sophos.com/virusinfo/analyses/w32sdbotmu.html
Troj/PSWDelf-CT
http://www.sophos.com/virusinfo/analyses/trojpswdelfct.html
Troj/Radnag-A
http://www.sophos.com/virusinfo/analyses/trojradnaga.html
W32/Sdbot-IP
http://www.sophos.com/virusinfo/analyses/w32sdbotip.html
Troj/ToonCom-D
http://www.sophos.com/virusinfo/analyses/trojtooncomd.html
Troj/Spyvb-B
http://www.sophos.com/virusinfo/analyses/trojspyvbb.html
Troj/RpcLsa-A
http://www.sophos.com/virusinfo/analyses/trojrpclsaa.html
Download the IDE file from:
http://www.sophos.com/downloads/ide/agobotix.ide
Download all the IDE files available for the current version of
Sophos Anti-Virus in a single compressed file. The file is
available in two formats:
Zip file:
http://www.sophos.com/downloads/ide/ides.zip
Self-extracting file:
http://www.sophos.com/downloads/ide/ides.exe
Read about how to use IDE files at
http://www.sophos.com/downloads/ide/using.html
*********** MIKE"S REPLY SEPARATOR ***********
Mike ~ It is a good day if I learned something new.
Editor MikesWhatsNews see a sample on my web page
http://www3.telus.net/mikebike
<mikeswhatsnews-request@xxxxxxxxxxxxx?Subject=subscribe>
http://www3.telus.net/mikebike/worm_removal.htm
See my Anti-Virus pages http://virusinfo.hackfix.org/index
<virusinfo-request@xxxxxxxxxxxxx?Subject=subscribe>
A Technical Support Alliance and OWTA Charter Member
Other related posts:
- » [virusinfo] W32/Agobot-IX
