W32/Agobot-RR is a member of the W32/Agobot family of network worms. The worm can spread to weakly protected network shares and open Microsoft SQL servers, to computers vulnerable to the RPC-DCOM exploit, and via NetBIOS.
The following patches for the operating system vulnerabilities exploited by W32/Agobot-RR can be obtained from the Microsoft website:
MS04-012
In order to run automatically when Windows starts up the worm copies itself to the Windows SYstem folder as ggtb32.exe and creates the following registry entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
google toolbar
ggtb32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
google toolbar
ggtb32.exe
Once installed, W32/Agobot-RR connects to a preconfigured IRC server and joins a channel from which an attacker can issue further commands. These commands can cause the infected computer to perform any of the following actions:
Modify the computer's HOSTS file to deny access to certain computer security websites
Execute, upload, and download files
Log any keystrokes made on an infected computer
Scan for remote computers to infect
Particiapte in Distributed Denial-of-Service (DDoS) attacks
Add and delete services via the Service Control Manager
Search the registry, and delete autostart registry entries
Shutdown, reboot, or log off an infected computer
List and terminate running processes
Act as a SOCKS, HTTP, or FTP proxy server
Harvest email addresses
When the HOSTS file (located in '<System>\drivers\etc\') is modified, entries are created for the major anti-virus software websites that redirect attempted access to those sites to the IP address 127.0.0.1.
The worm can be commanded to secure an infected computer from further infection, or open it up for further infection. Securing an infected computer involves deleting any network shares and disabling DCOM by setting the following registry entry:
HKLM\Software\Microsoft\OLE
EnableDCOM
N
To allow further infection on an infected computer C$, D$, E$, ADMIN$ and IPC$ network shares are added, and DCOM is enabled by setting the following registry entry:
HKLM\Software\Microsoft\OLE
EnableDCOM
Y