high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Protection available since | 9 March 2005 22:32:32 (GMT) |
| Detected by | All Sophos products |
Sophos beta program
- Endpoint Security and Control 9.0
- Small business solutions 4.0
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.
At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.
Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.
Locate the HKEY_LOCAL_MACHINE entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
USB 2.0 Driver
Winsys32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
USB 2.0 Driver
Winsys32.exe
and delete them if they exist.
Close the registry editor.
More Information
W32/Agobot-QM is a member of the W32/Agobot family of backdoor worms.
In order to run automatically when Windows starts up the worm copies itself to the file Winsys32.exe in the Windows system folder and adds the following registry entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
USB 2.0 Driver
Winsys32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
USB 2.0 Driver
Winsys32.exe
W32/Agobot-QM runs continuously in the background, allowing a remote intruder to access and control the computer via IRC channels.
|
