W32/Agobot-XX

Please follow the instructions for removing worms.

Check your administrator passwords and review network security.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DSService = dmrss.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
DSService = dmrss.exe

and delete them if they exist.

Close the registry editor.

W32/Agobot-XX is capable of spreading to computers on the local network
protected by weak passwords.

When first run W32/Agobot-XX copies itself to the Windows system folder as
dmrss.exe and creates the following registry entries to run itself on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DSService = dmrss.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
DSService = dmrss.exe

Each time W32/Agobot-XX is run it attempts to connect to a remote IRC server
and join a specific channel.

W32/Agobot-XX then runs continuously in the background, allowing a remote
intruder to access and control the computer via IRC channels.

W32/Agobot-XX attempts to terminate and disable various anti-virus and
security-related programs.

This worm will search for shared folders on the internet with weak passwords
and copy itself into them. A text file named HOSTS may also be dropped into
C:\<Windows System32>\drivers\etc which may contain a list of anti-virus
and other security-related websites each bound to the IP loopback address of
127.0.0.1 which would effectively prevent access to these sites.
For example:

127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com