[virusinfo] W32/Agobot-RB
- From: "Mike" <mikebike@xxxxxxxxx>
- To: virusinfo@xxxxxxxxxxxxx
- Date: Thu, 24 Mar 2005 09:40:52 -0800
From; Sophos Alert System:
Name: W32/Agobot-RB
Type: Win32 worm
Date: 24 March 2005
A virus identity (IDE) file which provides protection is
available now from the Sophos website, and will be incorporated
into the May 2005 (3.93) release of Sophos Anti-Virus.
Customers using EM Library, PureMessage or any of our Sophos
small business solutions will be automatically protected at
their next scheduled update.
At the time of writing, Sophos has received a small number of
reports of this worm from the wild.
Information about W32/Agobot-RB can be found at:
http://www.sophos.com/virusinfo/analyses/w32agobotrb.html
W32/Agobot-RB is a network worm with IRC backdoor functionality.
W32/Agobot-RB connects to a preconfigured IRC server, joins a channel and
awaits further instructions. These instructions can cause the bot to perform
any of the following actions:
start a UDP, TCP, ICMP, syn, http or ping flood
start a socks4, socks5, http or https proxy server
redirect TCP or GRE connections
start an FTP server
start a command shell server
show statistics about the infected system
reboot/shutdown the infected machine
kill anti-virus and security processes
list/terminate running processes
scan randomly- or sequentially-chosen IPs for infectable machines
make local drives network-shareable
close down vulnerable services in order to secure the machine
search for product keys
search local drives for AOL user details
sniff network traffic in order to find passwords
start a keylogger
download and install an updated version of itself
install bot plugins for additional functionality
The worm spreads to machines affected by known vulnerabilities, running network
services protected by weak passwords or infected by common backdoor Trojans.
Vulnerabilities:
Universal PNP (MS01-059)
WebDav (MS03-007)
RPC DCOM (MS03-026, MS04-012)
WorKStation service (MS03-049)
LSASS (MS04-011)
DameWare (CAN-2003-1030)
Services:
NetBios
MS SQL
Backdoors:
W32/Bagle
W32/MyDoom
Troj/Optix
W32/Sasser
W32/Agobot-RB deletes files and folders containing the text "sound".
W32/Agobot-RB copies itself to the Windows system folder and creates the
following registry entries to run itself automatically on computer login:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Systems Backups =
windrives.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Systems Backups =
windrives.exe
On NT-based versions of Windows (NT,2000,XP) windrives.exe is registered as a
service process with a servicename "Restoreds" and a displayname "Systems
Backups". The service has a start-type of automatic. Registry entries are
created under:
HKLM\SYSTEM\CurrentControlSet\Services\Restoreds
The worm blocks access to security-related websites by adding the following
entries to the Windows hosts file:
127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com
This IDE file also includes detection for:
Troj/Drever-A
http://www.sophos.com/virusinfo/analyses/trojdrevera.html
Troj/Drever-B
http://www.sophos.com/virusinfo/analyses/trojdreverb.html
W32/Sdbot-WF
http://www.sophos.com/virusinfo/analyses/w32sdbotwf.html
W32/Crowt-C
http://www.sophos.com/virusinfo/analyses/w32crowtc.html
W32/Bimoco-A
http://www.sophos.com/virusinfo/analyses/w32bimocoa.html
Download the IDE file from:
http://www.sophos.com/downloads/ide/agobo-rb.ide
Download all the IDE files available for the current version of
Sophos Anti-Virus in a single compressed file. The file is
available in two formats:
Zip file:
http://www.sophos.com/downloads/ide/ides.zip
Self-extracting file:
http://www.sophos.com/downloads/ide/ides.exe
Read about how to use IDE files at
http://www.sophos.com/downloads/ide/using.html
*********** MIKE"S REPLY SEPARATOR ***********
Mike ~ It is a good day if I learned something new.
Editor MikesWhatsNews see a sample on my web page
http://www3.telus.net/mikebike
<mikeswhatsnews-request@xxxxxxxxxxxxx?Subject=subscribe>
http://www3.telus.net/mikebike/worm_removal.htm
See my Anti-Virus pages http://virusinfo.hackfix.org/index
<virusinfo-request@xxxxxxxxxxxxx?Subject=subscribe>
A Technical Support Alliance and OWTA Charter Member
Other related posts:
- » [virusinfo] W32/Agobot-RB
