W32/Agobot-RN

Please follow the instructions for removing worms.

W32/Agobot-RN is a network worm with backdoor functionality for the Windows platform.

The worm allows a remote intruder to gain access and control over the computer via IRC channels. W32/Agobot-RN is a network worm with backdoor functionality for the Windows platform.

The worm allows a remote intruder to gain access and control over the computer via IRC channels.

The worm also modifies the system HOSTS file in order to prevent access to certain websites.

When first run the worm copies itself to ip7.exe in the Windows system folder.

The following registry entries are created to run ip7.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Configuration Loader10
ip7.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Configuration Loader10
ip7.exe

Registry entries are also created under:

HKCR\CLSID\{279816C0-3158-13D1-B2E4-0060975B8649}