W32/Abogot-GR

Please follow the instructions for removing worms.

Change any data that may have become compromised.

Check your administrator passwords and review network security.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Video Process
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\Video Process

and delete them if they exist.

Close the registry editor.

W32/Agobot-GR is an IRC backdoor Trojan and network worm that spreads via
the RPC/DCOM vulnerability or by using RPC calls on machines with weak passwords.

In order to run automatically when Windows starts up the worm copies
itself to the file wincrt32.exe in the Windows system folder, creates
its own service process named "Video Process" and adds the following registry
entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Video Process
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\Video Process

W32/Agobot-GR also creates registry entries under the following locations:

HKLM\System\ControlSet001\Enum\Root\
HKLM\System\CurrentControlSet\Enum\Root\
HKLM\System\CurrentControlSet\Services\

Each time W32/Agobot-GR is run it attempts to connect to a remote IRC server
and join a specific channel.

W32/Agobot-GR then runs continuously in the background, allowing a remote
intruder to access and control the computer via IRC channels.

W32/Agobot-GR collects system information and registration keys of popular
games that are installed on the computer.

The worm also opens backdoor ports and attempts to terminate and disable
various security-related programs.