From; Sophos Alert System: Name: W32/Agobot-RV Type: Win32 worm Date: 29 April 2005 A virus identity (IDE) file which provides protection is available now from the Sophos website, and will be incorporated into the June 2005 (3.94) release of Sophos Anti-Virus. Customers using EM Library, PureMessage or any of our Sophos small business solutions will be automatically protected at their next scheduled update. At the time of writing, Sophos has received a small number of reports of this worm from the wild. Information about W32/Agobot-RV can be found at: http://www.sophos.com/virusinfo/analyses/w32agobotrv.html * W32/Agobot-RV is a network worm with IRC backdoor functionality. W32/Agobot-RV connects to a preconfigured IRC server, joins a channel and awaits further instructions. These instructions can cause the bot to perform any of the following actions: start a UDP, TCP, ICMP, syn, http or ping flood start a socks4, socks5, http or https proxy server redirect TCP or GRE connections start an FTP server start a command shell server show statistics about the infected system reboot/shutdown the infected computer kill anti-virus and security processes list/terminate running processes scan randomly- or sequentially-chosen IPs for infectable computers make local drives network-shareable close down vulnerable services in order to secure the computer search for product keys search local drives for AOL user details sniff network traffic in order to find passwords start a keylogger download and install an updated version of itself install bot plugins for additional functionality The worm spreads to computers affected by known vulnerabilities and running network services protected by weak passwords. Vulnerabilities: RPC DCOM (MS03-026, MS04-012) MSSQL (MS02-039) Services: NetBios W32/Agobot-RV copies itself to the Windows system folder and creates the following registry entries to run itself automatically on computer login: HKLM\Software\Microsoft\Windows\CurrentVersion\Run NvagNT nvagNT.exe HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices nvagNT nvagNT.exe The worm blocks access to security-related websites by adding the following entries to the Windows hosts file: 127.0.0.1 www.symantec.com 127.0.0.1 securityresponse.symantec.com 127.0.0.1 symantec.com 127.0.0.1 www.sophos.com 127.0.0.1 sophos.com 127.0.0.1 www.mcafee.com 127.0.0.1 mcafee.com 127.0.0.1 liveupdate.symantecliveupdate.com 127.0.0.1 www.viruslist.com 127.0.0.1 viruslist.com 127.0.0.1 viruslist.com 127.0.0.1 f-secure.com 127.0.0.1 www.f-secure.com 127.0.0.1 kaspersky.com 127.0.0.1 www.avp.com 127.0.0.1 www.kaspersky.com 127.0.0.1 avp.com 127.0.0.1 www.networkassociates.com 127.0.0.1 networkassociates.com 127.0.0.1 www.ca.com 127.0.0.1 ca.com 127.0.0.1 mast.mcafee.com 127.0.0.1 my-etrust.com 127.0.0.1 www.my-etrust.com 127.0.0.1 download.mcafee.com 127.0.0.1 dispatch.mcafee.com 127.0.0.1 secure.nai.com 127.0.0.1 nai.com 127.0.0.1 www.nai.com 127.0.0.1 update.symantec.com 127.0.0.1 updates.symantec.com 127.0.0.1 us.mcafee.com 127.0.0.1 liveupdate.symantec.com 127.0.0.1 customer.symantec.com 127.0.0.1 rads.mcafee.com 127.0.0.1 trendmicro.com 127.0.0.1 www.trendmicro.com W32/Agobot-RV terminates the following processes if they are running: '_AVP32.EXE' '_AVPCC.EXE' '_AVPM.EXE' 'ACKWIN32.EXE' 'ADAWARE.EXE' 'ADVXDWIN.EXE' 'AGENTSVR.EXE' 'AGENTW.EXE' 'ALERTSVC.EXE' 'ALEVIR.EXE' 'ALOGSERV.EXE' 'AMON9X.EXE' 'ANTI-TROJAN.EXE' 'ANTIVIRUS.EXE' 'ANTS.EXE' 'APIMONITOR.EXE' 'APLICA32.EXE' 'APVXDWIN.EXE' 'ARR.EXE' 'ATCON.EXE' 'ATGUARD.EXE' 'ATRO55EN.EXE' 'ATUPDATER.EXE' 'ATWATCH.EXE' 'AU.EXE' 'AUPDATE.EXE' 'AUTO-PROTECT.NAV80TRY.EXE' 'AUTODOWN.EXE' 'AUTOTRACE.EXE' 'AUTOUPDATE.EXE' 'AVCONSOL.EXE' 'AVE32.EXE' 'AVGCC32.EXE' 'AVGCTRL.EXE' 'AVGNT.EXE' 'AVGSERV.EXE' 'AVGSERV9.EXE' 'AVGUARD.EXE' 'AVGW.EXE' 'AVKPOP.EXE' 'AVKSERV.EXE' 'AVKSERVICE.EXE' 'AVKWCTl9.EXE' 'AVLTMAIN.EXE' 'AVNT.EXE' 'AVP.EXE' 'AVP32.EXE' 'AVPCC.EXE' 'AVPDOS32.EXE' 'AVPM.EXE' 'AVPTC32.EXE' 'AVPUPD.EXE' 'AVSCHED32.EXE' 'AVSYNMGR.EXE' 'AVWIN95.EXE' 'AVWINNT.EXE' 'AVWUPD.EXE' 'AVWUPD32.EXE' 'AVWUPSRV.EXE' 'AVXMONITOR9X.EXE' 'AVXMONITORNT.EXE' 'AVXQUAR.EXE' 'BACKWEB.EXE' 'BARGAINS.EXE' 'BD_PROFESSIONAL.EXE' 'BEAGLE.EXE' 'BELT.EXE' 'BIDEF.EXE' 'BIDSERVER.EXE' 'BIPCP.EXE' 'BIPCPEVALSETUP.EXE' 'BISP.EXE' 'BLACKD.EXE' 'BLACKICE.EXE' 'BLSS.EXE' 'BOOTCONF.EXE' 'BOOTWARN.EXE' 'BORG2.EXE' 'BPC.EXE' 'BRASIL.EXE' 'BS120.EXE' 'BUNDLE.EXE' 'BVT.EXE' 'CCAPP.EXE' 'CCEVTMGR.EXE' 'CCPXYSVC.EXE' 'CDP.EXE' 'CFD.EXE' 'CFGWIZ.EXE' 'CFIADMIN.EXE' 'CFIAUDIT.EXE' 'CFINET.EXE' 'CFINET32.EXE' 'Claw95.EXE' 'CLAW95CF.EXE' 'CLEAN.EXE' 'CLEANER.EXE' 'CLEANER3.EXE' 'CLEANPC.EXE' 'CLICK.EXE' 'CMD32.EXE' 'CMESYS.EXE' 'CMGRDIAN.EXE' 'CMON016.EXE' 'CONNECTIONMONITOR.EXE' 'CPD.EXE' 'CPF9X206.EXE' 'CPFNT206.EXE' 'CTRL.EXE' 'CV.EXE' 'CWNB181.EXE' 'CWNTDWMO.EXE' 'DATEMANAGER.EXE' 'DCOMX.EXE' 'DEFALERT.EXE' 'DEFSCANGUI.EXE' 'DEFWATCH.EXE' 'DEPUTY.EXE' 'DIVX.EXE' 'DLLCACHE.EXE' 'DLLREG.EXE' 'DOORS.EXE' 'DPF.EXE' 'DPFSETUP.EXE' 'DPPS2.EXE' 'DRWATSON.EXE' 'DRWEB32.EXE' 'DRWEBUPW.EXE' 'DSSAGENT.EXE' 'DVP95.EXE' 'DVP95_0.EXE' 'ECENGINE.EXE' 'EFPEADM.EXE' 'EMSW.EXE' 'ENT.EXE' 'ESAFE.EXE' 'ESCANH95.EXE' 'ESCANHNT.EXE' 'ESCANV95.EXE' 'ESPWATCH.EXE' 'ETHEREAL.EXE' 'ETRUSTCIPE.EXE' 'EVPN.EXE' 'EXANTIVIRUS-CNET.EXE' 'EXE.AVXW.EXE' 'EXPERT.EXE' 'EXPLORE.EXE' 'F-AGNT95.EXE' 'F-AGOBOT.EXE' 'F-PROT.EXE' 'F-PROT95.EXE' 'F-STOPW.EXE' 'FAMEH32.EXE' 'FAST.EXE' 'FCH32.EXE' 'FIH32.EXE' 'FINDVIRU.EXE' 'FIREWALL.EXE' 'FLOWPROTECTOR.EXE' 'FNRB32.EXE' 'FP-WIN.EXE' 'FP-WIN_TRIAL.EXE' 'FPROT.EXE' 'FRW.EXE' 'FSAA.EXE' 'FSAV.EXE' 'FSAV32.EXE' 'FSAV530STBYB.EXE' 'FSAV530WTBYB.EXE' 'FSAV95.EXE' 'FSGK32.EXE' 'FSM32.EXE' 'FSMA32.EXE' 'FSMB32.EXE' 'GATOR.EXE' 'GBMENU.EXE' 'GBPOLL.EXE' 'GENERICS.EXE' 'GMT.EXE' 'GUARD.EXE' 'GUARDDOG.EXE' 'HACKTRACERSETUP.EXE' 'HBINST.EXE' 'HBSRV.EXE' 'HIJACKTHIS.EXE' 'HOTACTIO.EXE' 'HOTPATCH.EXE' 'HTLOG.EXE' 'HTPATCH.EXE' 'HWPE.EXE' 'HXDL.EXE' 'HXIUL.EXE' 'IAMAPP.EXE' 'IAMSERV.EXE' 'IAMSTATS.EXE' 'IBMASN.EXE' 'IBMAVSP.EXE' 'ICLOAD95.EXE' 'ICLOADNT.EXE' 'ICMON.EXE' 'ICSUPP95.EXE' 'ICSUPPNT.EXE' 'IDLE.EXE' 'IEDLL.EXE' 'IEDRIVER.EXE' 'IEXPLORER.EXE' 'IFACE.EXE' 'IFW2000.EXE' 'INETLNFO.EXE' 'INFUS.EXE' 'INFWIN.EXE' 'INIT.EXE' 'INTDEL.EXE' 'INTREN.EXE' 'IOMON98.EXE' 'IPARMOR.EXE' 'IRIS.EXE' 'ISASS.EXE' 'ISRV95.EXE' 'ISTSVC.EXE' 'JAMMER.EXE' 'JDBGMRG.EXE' 'JEDI.EXE' 'KAVLITE40ENG.EXE' 'KAVPERS40ENG.EXE' 'KAVPF.EXE' 'KAZZA.EXE' 'KEENVALUE.EXE' 'KERIO-PF-213-EN-WIN.EXE' 'KERIO-WRL-421-EN-WIN.EXE' 'KERIO-WRP-421-EN-WIN.EXE' 'KERNEL32.EXE' 'KILLPROCESSSETUP161.EXE' 'LAUNCHER.EXE' 'LDNETMON.EXE' 'LDPRO.EXE' 'LDPROMENU.EXE' 'LDSCAN.EXE' 'LNETINFO.EXE' 'LOADER.EXE' 'LOCALNET.EXE' 'LOCKDOWN.EXE' 'LOCKDOWN2000.EXE' 'LOOKOUT.EXE' 'LORDPE.EXE' 'LSETUP.EXE' 'LUALL.EXE' 'LUAU.EXE' 'LUCOMSERVER.EXE' 'LUINIT.EXE' 'LUSPT.EXE' 'MAPISVC32.EXE' 'MCAGENT.EXE' 'MCMNHDLR.EXE' 'MCSHIELD.EXE' 'MCTOOL.EXE' 'MCUPDATE.EXE' 'MCVSRTE.EXE' 'MCVSSHLD.EXE' 'MD.EXE' 'MFIN32.EXE' 'MFW2EN.EXE' 'MFWENG3.02D30.EXE' 'MGAVRTCL.EXE' 'MGAVRTE.EXE' 'MGHTML.EXE' 'MGUI.EXE' 'MINILOG.EXE' 'MMOD.EXE' 'MONITOR.EXE' 'MOOLIVE.EXE' 'MOSTAT.EXE' 'MPFAGENT.EXE' 'MPFSERVICE.EXE' 'MPFTRAY.EXE' 'MRFLUX.EXE' 'MSAPP.EXE' 'MSBB.EXE' 'MSBLAST.EXE' 'MSCACHE.EXE' 'MSCCN32.EXE' 'MSCMAN.EXE' 'MSCONFIG.EXE' 'MSDM.EXE' 'MSDOS.EXE' 'MSIEXEC16.EXE' 'MSINFO32.EXE' 'MSLAUGH.EXE' 'MSMGT.EXE' 'MSMSGRI32.EXE' 'MSSMMC32.EXE' 'MSSYS.EXE' 'MSVXD.EXE' 'MU0311AD.EXE' 'MWATCH.EXE' 'N32SCANW.EXE' 'NAV.EXE' 'NAVAP.NAVAPSVC.EXE' 'NAVAPSVC.EXE' 'NAVAPW32.EXE' 'NAVDX.EXE' 'NAVENGNAVEX15.NAVLU32.EXE' 'NAVLU32.EXE' 'NAVNT.EXE' 'NAVSTUB.EXE' 'NAVW32.EXE' 'NAVWNT.EXE' 'NCINST4.EXE' 'NDD32.EXE' 'NEOMONITOR.EXE' 'NEOWATCHLOG.EXE' 'NETARMOR.EXE' 'NETD32.EXE' 'NETINFO.EXE' 'NETMON.EXE' 'NETSCANPRO.EXE' 'NETSPYHUNTER-1.2.EXE' 'NETSTAT.EXE' 'NETUTILS.EXE' 'NISSERV.EXE' 'NISUM.EXE' 'NMAIN.EXE' 'NOD32.EXE' 'NORMIST.EXE' 'NORTON_INTERNET_SECU_3.0_407.EXE' 'NOTSTART.EXE' 'NPF40_TW_98_NT_ME_2K.EXE' 'NPFMESSENGER.EXE' 'NPROTECT.EXE' 'NPSCHECK.EXE' 'NPSSVC.EXE' 'NSCHED32.EXE' 'NSSYS32.EXE' 'NSTASK32.EXE' 'NSUPDATE.EXE' 'NT.EXE' 'NTRTSCAN.EXE' 'NTVDM.EXE' 'NTXconfig.EXE' 'NUI.EXE' 'NUPGRADE.EXE' 'NVARCH16.EXE' 'NVC95.EXE' 'NVSVC32.EXE' 'NWINST4.EXE' 'NWSERVICE.EXE' 'NWTOOL16.EXE' 'OLLYDBG.EXE' 'ONSRVR.EXE' 'OPTIMIZE.EXE' 'OSTRONET.EXE' 'OTFIX.EXE' 'OUTPOST.EXE' 'OUTPOSTINSTALL.EXE' 'OUTPOSTPROINSTALL.EXE' 'PADMIN.EXE' 'PANIXK.EXE' 'PATCH.EXE' 'PAVCL.EXE' 'PAVPROXY.EXE' 'PAVSCHED.EXE' 'PAVW.EXE' 'PCCIOMON.EXE' 'PCCNTMON.EXE' 'PCCWIN97.EXE' 'PCCWIN98.EXE' 'PCDSETUP.EXE' 'PCFWALLICON.EXE' 'PCSCAN.EXE' 'PDSETUP.EXE' 'PENIS.EXE' 'PERISCOPE.EXE' 'PERSFW.EXE' 'PERSWF.EXE' 'PF2.EXE' 'PFWADMIN.EXE' 'PGMONITR.EXE' 'PINGSCAN.EXE' 'PLATIN.EXE' 'POP3TRAP.EXE' 'POPROXY.EXE' 'POPSCAN.EXE' 'PORTDETECTIVE.EXE' 'PORTMONITOR.EXE' 'POWERSCAN.EXE' 'PPINUPDT.EXE' 'PPTBC.EXE' 'PPVSTOP.EXE' 'PRIZESURFER.EXE' 'PRMT.EXE' 'PRMVR.EXE' 'PROCDUMP.EXE' 'PROCESSMONITOR.EXE' 'PROCEXPLORERV1.0.EXE' 'PROGRAMAUDITOR.EXE' 'PROPORT.EXE' 'PROTECTX.EXE' 'PSPF.EXE' 'PURGE.EXE' 'PUSSY.EXE' 'PVIEW95.EXE' 'QCONSOLE.EXE' 'QSERVER.EXE' 'RAPAPP.EXE' 'RAV7.EXE' 'RAV7WIN.EXE' 'RAV8WIN32ENG.EXE' 'RAY.EXE' 'RB32.EXE' 'RCSYNC.EXE' 'REALMON.EXE' 'REGED.EXE' 'REGEDIT.EXE' 'REGEDT32.EXE' 'RESCUE.EXE' 'RESCUE32.EXE' 'RRGUARD.EXE' 'RSHELL.EXE' 'RTVSCAN.EXE' 'RTVSCN95.EXE' 'RULAUNCH.EXE' 'RUN32DLL.EXE' 'RUNDLL.EXE' 'RUNDLL16.EXE' 'RUXDLL32.EXE' 'SAFEWEB.EXE' 'SAHAGENT.EXE' 'SAVE.EXE' 'SAVENOW.EXE' 'SBSERV.EXE' 'SC.EXE' 'SCAM32.EXE' 'SCAN32.EXE' 'SCAN95.EXE' 'SCANPM.EXE' 'SCRSCAN.EXE' 'SCRSVR.EXE' 'SCVHOST.EXE' 'SD.EXE' 'SERV95.EXE' 'SERVICE.EXE' 'SERVLCE.EXE' 'SERVLCES.EXE' 'SETUP_FLOWPROTECTOR_US.EXE' 'SETUPVAMEEVAL.EXE' 'SFC.EXE' 'SGSSFW32.EXE' 'SH.EXE' 'SHELLSPYINSTALL.EXE' 'SHN.EXE' 'SHOWBEHIND.EXE' 'SMC.EXE' 'SMS.EXE' 'SMSS32.EXE' 'SOAP.EXE' 'SOFI.EXE' 'SPERM.EXE' 'SPF.EXE' 'SPHINX.EXE' 'SPOLER.EXE' 'SPOOLCV.EXE' 'SPOOLSV32.EXE' 'SPYXX.EXE' 'SREXE.EXE' 'SRNG.EXE' 'SS3EDIT.EXE' 'SSGRATE.EXE' 'ST2.EXE' 'START.EXE' 'STCLOADER.EXE' 'SUPFTRL.EXE' 'SUPPORT.EXE' 'SUPPORTER5.EXE' 'SVC.EXE' 'SVCHOSTC.EXE' 'SVCHOSTS.EXE' 'SVSHOST.EXE' 'SWEEP95.EXE' 'SWEEPNET.SWEEPSRV.SYS.SWNETSUP.EXE' 'SYMPROXYSVC.EXE' 'SYMTRAY.EXE' 'SYSEDIT.EXE' 'SYSTEM.EXE' 'SYSTEM32.EXE' 'SYSUPD.EXE' 'TASKMG.EXE' 'TASKMO.EXE' 'TASKMON.EXE' 'TAUMON.EXE' 'TBSCAN.EXE' 'TC.EXE' 'TCA.EXE' 'TCM.EXE' 'TDS-3.EXE' 'TDS2-98.EXE' 'TDS2-NT.EXE' 'TEEKIDS.EXE' 'TFAK.EXE' 'TFAK5.EXE' 'TGBOB.EXE' 'TITANIN.EXE' 'TITANINXP.EXE' 'TRACERT.EXE' 'TRICKLER.EXE' 'TRJSCAN.EXE' 'TRJSETUP.EXE' 'TROJANTRAP3.EXE' 'TSADBOT.EXE' 'TVMD.EXE' 'TVTMD.EXE' 'UNDOBOOT.EXE' 'UPDAT.EXE' 'UPDATE.EXE' 'UPGRAD.EXE' 'UTPOST.EXE' 'VBCMSERV.EXE' 'VBCONS.EXE' 'VBUST.EXE' 'VBWIN9X.EXE' 'VBWINNTW.EXE' 'VCSETUP.EXE' 'VET32.EXE' 'VET95.EXE' 'VETTRAY.EXE' 'VFSETUP.EXE' 'VIR-HELP.EXE' 'VIRUSMDPERSONALFIREWALL.EXE' 'VNLAN300.EXE' 'VNPC3000.EXE' 'VPC32.EXE' 'VPC42.EXE' 'VPFW30S.EXE' 'VPTRAY.EXE' 'VSCAN40.EXE' 'VSCENU6.02D30.EXE' 'VSCHED.EXE' 'VSECOMR.EXE' 'VSHWIN32.EXE' 'VSISETUP.EXE' 'VSMAIN.EXE' 'VSMON.EXE' 'VSSTAT.EXE' 'VSWIN9XE.EXE' 'VSWINNTSE.EXE' 'VSWINPERSE.EXE' 'W32DSM89.EXE' 'W9X.EXE' 'WATCHDOG.EXE' 'WEBDAV.EXE' 'WEBSCANX.EXE' 'WEBTRAP.EXE' 'WFINDV32.EXE' 'WGFE95.EXE' 'WHOSWATCHINGME.EXE' 'WIMMUN32.EXE' 'WIN-BUGSFIX.EXE' 'WIN32.EXE' 'WIN32US.EXE' 'WINACTIVE.EXE' 'WINDOW.EXE' 'WINDOWS.EXE' 'WININETD.EXE' 'WININIT.EXE' 'WININITX.EXE' 'WINLOGIN.EXE' 'WINMAIN.EXE' 'WINNET.EXE' 'WINPPR32.EXE' 'WINRECON.EXE' 'WINSERVN.EXE' 'WINSSK32.EXE' 'WINSTART.EXE' 'WINSTART001.EXE' 'WINTSK32.EXE' 'WINUPDATE.EXE' 'WKUFIND.EXE' 'WNAD.EXE' 'WNT.EXE' 'WRADMIN.EXE' 'WRCTRL.EXE' 'WSBGATE.EXE' 'WUPDATER.EXE' 'WUPDT.EXE' 'WYVERNWORKSFIREWALL.EXE' 'XPF202EN.EXE' 'ZAPRO.EXE' 'ZAPSETUP3001.EXE' 'ZATUTOR.EXE' 'ZONALM2601.EXE' 'ZONEALARM.EXE' This IDE file also includes detection for: Troj/DComExp-M http://www.sophos.com/virusinfo/analyses/trojdcomexpm.html Troj/Bancban-CJ http://www.sophos.com/virusinfo/analyses/trojbancbancj.html Troj/Novad-A http://www.sophos.com/virusinfo/analyses/trojnovada.html Troj/PPdoor-F http://www.sophos.com/virusinfo/analyses/trojppdoorf.html Troj/LowZone-Z http://www.sophos.com/virusinfo/analyses/trojlowzonez.html Troj/Ablank-X http://www.sophos.com/virusinfo/analyses/trojablankx.html Troj/StartPa-FV http://www.sophos.com/virusinfo/analyses/trojstartpafv.html Troj/Novam-A http://www.sophos.com/virusinfo/analyses/trojnovama.html Download the IDE file from: http://www.sophos.com/downloads/ide/agob-rv.ide Download all the IDE files available for the current version of Sophos Anti-Virus in a single compressed file. The file is available in two formats: Zip file: http://www.sophos.com/downloads/ide/ides.zip Self-extracting file: http://www.sophos.com/downloads/ide/ides.exe Read about how to use IDE files at http://www.sophos.com/downloads/ide/using.html *********** MIKE"S REPLY SEPARATOR *********** Mike ~ It is a good day if I learned something new. Editor MikesWhatsNews see a sample on my web page http://www3.telus.net/mikebike <mikeswhatsnews-request@xxxxxxxxxxxxx?Subject=subscribe> http://www3.telus.net/mikebike/worm_removal.htm See my Anti-Virus pages http://virusinfo.hackfix.org/index <virusinfo-request@xxxxxxxxxxxxx?Subject=subscribe> A Technical Support Alliance and OWTA Charter Member