W32/Agobot-JW

Please follow the instructions for removing worms.

Check your administrator passwords and review network security.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\NeroAutoStartClient

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
NeroAutoStartClient

and delete them if they exist.

Close the registry editor.

W32/Agobot-JW is a worm which spreads to networks shares with weak passwords. The worm also includes backdoor functions which can be controlled over IRC by a remote attacker.

When first run the worm copies itself to neroasm.exe in the Windows system
folder and adds the registry entries

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\NeroAutoStartClient

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
NeroAutoStartClient

The worm removes registry entries and files used by a number of other worms
and terminates a large number of anti-virus and security related processes.

W32/Agobot-JW copies itself to shares with weak passwords as a file named
wrtx.exe.