W32/Agobot-FN

Category	Viruses and Spyware
Type	Worm
What to do	If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.
Prevalence	low high

Summary

Summary
Action
More Information


Included in our products from	June 2005 (3.94)
Protection available since	1 April 2004 10:58:51 (GMT)
Last updated	6 May 2005 14:15:49 (GMT)
Detected by	All Sophos products

Action

Summary
Action
More Information

Please follow the instructions for removing worms.

More Information

Summary
Action
More Information

W32/Agobot-FN is a worm that spreads via network shares.

When first run the worm copies itself to aol.exe in the Windows system folder. The worm ensures that the copy is run each time Windows starts by addings the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
AOL Instant Messengar

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
AOL Instant Messengar

W32/Agobot-FN also attempts to run aol.exe as a service named AOL Instant Messengar.

The worm spreads by attempting to access shares on computers with weak user or administrator passwords.

The worm includes a backdoor that is controlled by a remote attacker over IRC. Functions available through the backdoor include proxies for Socks, HTTP and TCP and an FTP server.

W32/Agobot-FN attempts to terminate the following virus, anti-virus and security-related processes:
tftpd.exe dllhost.exe winppr32.exe mspatch.exe penis32.exe msblast.exe zonealarm.EXE zapro.EXE vsmon.EXE vshwin32.EXE vbcmserv.EXE sbserv.EXE rtvscan.EXE rapapp.EXE pcscan.EXE pccwin97.EXE pccntmon.EXE pavproxy.EXE nvsvc32.EXE ntrtscan.EXE npscheck.EXE notstart.EXE lockdown2000.EXE iamserv.EXE iamapp.EXE gbpoll.EXE gbmenu.EXE fsmb32.EXE fsma32.EXE fsm32.EXE fsgk32.EXE fsav32.EXE fsaa.EXE fnrb32.EXE fih32.EXE fch32.EXE fameh32.EXE f-stopw.EXE defscangui.EXE defalert.EXE cpd.EXE cleaner3.EXE cleaner.EXE ccPxySvc.EXE ccEvtMgr.EXE ccApp.EXE blackd.EXE avpm.EXE avkwctl9.EXE avkservice.EXE avkpop.EXE apvxdwin.EXE agentw.EXE _AVPM.EXE _AVPCC.EXE _AVP32.EXE ZONEALARM.EXE ZONALM2601.EXE ZAUINST.EXE ZATUTOR.EXE ZAPSETUP3001.EXE ZAPRO.EXE XPF202EN.EXE WrCtrl.EXE WrAdmin.EXE WYVERNWORKSFIREWALL.EXE WSBGATE.EXE WRCTRL.EXE WRADMIN.EXE WNT.EXE WINRECON.EXE WIMMUN32.EXE WHOSWATCHINGME.EXE WGFE95.EXE WFINDV32.EXE WEBTRAP.EXE WEBSCANX.EXE WATCHDOG.EXE W9X.EXE W32DSM89.EXE VetTray.EXE Vet95.EXE VbCons.EXE VSWINPERSE.EXE VSWINNTSE.EXE VSWIN9XE.EXE VSSTAT.EXE VSMON.EXE VSMAIN.EXE VSISETUP.EXE VSECOMR.EXE VSCHED.EXE VSCENU6.02D30.EXE VSCAN40.EXE VPTRAY.EXE VPFW30S.EXE VPC42.EXE VPC32.EXE VNPC3000.EXE VNLAN300.EXE VIRUSMDPERSONALFIREWALL.EXE VIR-HELP.EXE VFSETUP.EXE VETTRAY.EXE VET95.EXE VET32.EXE VCSETUP.EXE VBWINNTW.EXE VBWIN9X.EXE VBUST.EXE VBCONS.EXE VBCMSERV.EXE UPDATE.EXE UNDOBOOT.EXE TROJANTRAP3.EXE TRJSETUP.EXE TRJSCAN.EXE TRACERT.EXE TITANINXP.EXE TITANIN.EXE TGBOB.EXE TFAK5.EXE TFAK.EXE TDS2-NT.EXE TDS2-98.EXE TDS-3.EXE TCM.EXE TCA.EXE TC.EXE TBSCAN.EXE TAUMON.EXE TASKMON.EXE SymProxySvc.EXE SweepNet.SWEEPSRV.SYS.SWNETSUP.EXE Sphinx.EXE SYSEDIT.EXE SYMTRAY.EXE SYMPROXYSVC.EXE SWEEP95.EXE SUPPORTER5.EXE SUPFTRL.EXE ST2.EXE SS3EDIT.EXE SPYXX.EXE SPHINX.EXE SPF.EXE SOFI.EXE SMC.EXE SHN.EXE SHELLSPYINSTALL.EXE SH.EXE SGSSFW32.EXE SFC.EXE SETUP_FLOWPROTECTOR_US.EXE SETUPVAMEEVAL.EXE SERV95.EXE SD.EXE SCRSCAN.EXE SCANPM.EXE SCAN95.EXE SCAN32.EXE SBSERV.EXE SAFEWEB.EXE RULAUNCH.EXE RTVSCN95.EXE RSHELL.EXE RRGUARD.EXE RESCUE32.EXE RESCUE.EXE REGEDT32.EXE REGEDIT.EXE REALMON.EXE RAV8WIN32ENG.EXE RAV7WIN.EXE RAV7.EXE QSERVER.EXE QCONSOLE.EXE PVIEW95.EXE PURGE.EXE PSPF.EXE PROTECTX.EXE PROPORT.EXE PROGRAMAUDITOR.EXE PROCEXPLORERV1.0.EXE PROCESSMONITOR.EXE PPVSTOP.EXE PPTBC.EXE PPINUPDT.EXE PORTMONITOR.EXE PORTDETECTIVE.EXE POPSCAN.EXE POPROXY.EXE POP3TRAP.EXE PLATIN.EXE PINGSCAN.EXE PFWADMIN.EXE PF2.EXE PERSWF.EXE PERSFW.EXE PERISCOPE.EXE PDSETUP.EXE PCIP10117_0.EXE PCFWALLICON.EXE PCDSETUP.EXE PCCWIN98.EXE PCCIOMON.EXE PCC2K_76_1436.EXE PCC2002S902.EXE PAVW.EXE PAVSCHED.EXE PAVPROXY.EXE PAVCL.EXE PANIXK.EXE PADMIN.EXE OUTPOSTPROINSTALL.EXE OUTPOSTINSTALL.EXE OUTPOST.EXE OSTRONET.EXE Nupgrade.EXE Nui.EXE NeoWatchLog.EXE Navw32.EXE NWTOOL16.EXE NWService.EXE NWINST4.EXE NVC95.EXE NVARCH16.EXE NTXconfig.EXE NTVDM.EXE NSCHED32.EXE NPSSVC.EXE NPROTECT.EXE NPFMESSENGER.EXE NPF40_TW_98_NT_ME_2K.EXE NORTON_INTERNET_SECU_3.0_407.EXE NORMIST.EXE NOD32.EXE NMAIN.EXE NISUM.EXE NISSERV.EXE NETUTILS.EXE NETSTAT.EXE NETSPYHUNTER-1.2.EXE NETSCANPRO.EXE NETMON.EXE NETINFO.EXE NETARMOR.EXE NEOMONITOR.EXE NDD32.EXE NCINST4.EXE NC2000.EXE NAVWNT.EXE NAVW32.EXE NAVSTUB.EXE NAVNT.EXE NAVLU32.EXE NAVENGNAVEX15.NAVLU32.EXE NAVDX.EXE NAVAPW32.EXE NAVAPSVC.EXE NAVAP.navapsvc.EXE NAV Auto-Protect.NAV80TRY.EXE N32SCANW.EXE Monitor.EXE Mcshield.EXE MWATCH.EXE MU0311AD.EXE MSSMMC32.EXE MSINFO32.EXE MSCONFIG.EXE MRFLUX.EXE MPFTRAY.EXE MPFSERVICE.EXE MPFAGENT.EXE MOOLIVE.EXE MONITOR.EXE MINILOG.EXE MGUI.EXE MGHTML.EXE MGAVRTE.EXE MGAVRTCL.EXE MFWENG3.02D30.EXE MFW2EN.EXE MCVSSHLD.EXE MCVSRTE.EXE MCUPDATE.EXE MCTOOL.EXE MCMNHDLR.EXE MCAGENT.EXE LUSPT.EXE LUINIT.EXE LUCOMSERVER.EXE LUAU.EXE LUALL.EXE LSETUP.EXE LOOKOUT.EXE LOCKDOWN2000.EXE LOCKDOWN.EXE LOCALNET.EXE LDSCAN.EXE LDPROMENU.EXE LDPRO.EXE LDNETMON.EXE KILLPROCESSSETUP161.EXE KERIO-WRP-421-EN-WIN.EXE KERIO-WRL-421-EN-WIN.EXE KERIO-PF-213-EN-WIN.EXE KAVPF.EXE KAVPERS40ENG.EXE KAVLITE40ENG.EXE JEDI.EXE JAMMER.EXE ISRV95.EXE IRIS.EXE IPARMOR.EXE IOMON98.EXE IFW2000.EXE IFACE.EXE ICSUPPNT.EXE ICSUPP95.EXE ICMON.EXE ICLOADNT.EXE ICLOAD95.EXE IBMAVSP.EXE IBMASN.EXE IAMSTATS.EXE IAMSERV.EXE IAMAPP.EXE HWPE.EXE HTLOG.EXE HACKTRACERSETUP.EXE GUARDDOG.EXE GUARD.EXE GENERICS.EXE GBPOLL.EXE GBMENU.EXE FSAV95.EXE FSAV530WTBYB.EXE FSAV530STBYB.EXE FSAV.EXE FRW.EXE FPROT.EXE FP-WIN_TRIAL.EXE FP-WIN.EXE FLOWPROTECTOR.EXE FIREWALL.EXE FINDVIRU.EXE FAST.EXE F-STOPW.EXE F-PROT95.EXE F-PROT.EXE F-AGNT95.EXE EXPERT.EXE EXE.AVXW.EXE EXANTIVIRUS-CNET.EXE EVPN.EXE ETRUSTCIPE.EXE ESPWATCH.EXE ESCANV95.EXE ESCANHNT.EXE ESCANH95.EXE ESAFE.EXE ENT.EXE EFPEADM.EXE ECENGINE.EXE DVP95_0.EXE DVP95.EXE DRWEB32.EXE DRWATSON.EXE DPFSETUP.EXE DPF.EXE DOORS.EXE DEPUTY.EXE DEFWATCH.EXE Claw95cf.EXE Claw95.EXE CWNTDWMO.EXE CWNB181.EXE CV.EXE CTRL.EXE CPFNT206.EXE CPF9X206.EXE CPD.EXE CONNECTIONMONITOR.EXE CMON016.EXE CMGRDIAN.EXE CLEANPC.EXE CLEANER3.EXE CLEANER.EXE CLEAN.EXE CLAW95CF.EXE CFINET32.EXE CFINET.EXE CFIAUDIT.EXE CFIADMIN.EXE CFGWIZ.EXE CDP.EXE BlackICE.EXE BS120.EXE BORG2.EXE BOOTWARN.EXE BLACKICE.EXE BLACKD.EXE BISP.EXE BIPCPEVALSETUP.EXE BIPCP.EXE BIDSERVER.EXE BIDEF.EXE BD_PROFESSIONAL.EXE Avsched32.EXE AvkServ.EXE Avgctrl.EXE AvgServ.EXE AvSynMgr.AVSYNMGR.EXE AutoTrace.EXE AckWin32.EXE AVXQUAR.EXE AVXMONITORNT.EXE AVXMONITOR9X.EXE AVWUPSRV.EXE AVWUPD32.EXE AVWINNT.EXE AVWIN95.EXE AVPUPD.EXE AVPTC32.EXE AVPM.EXE AVPDOS32.EXE AVPCC.EXE AVP32.EXE AVP.EXE AVNT.EXE AVGW.EXE AVGUARD.EXE AVGSERV9.EXE AVGSERV.EXE AVGNT.EXE AVGCTRL.EXE AVGCC32.EXE AVE32.EXE AVCONSOL.EXE AUTOUPDATE.EXE AUTODOWN.EXE AUPDATE.EXE ATWATCH.EXE ATUPDATER.EXE ATRO55EN.EXE ATGUARD.EXE ATCON.EXE APVXDWIN.EXE APLICA32.EXE APIMONITOR.EXE ANTS.EXE ANTIVIRUS.EXE ANTI-TROJAN.EXE AMON9X.EXE ALOGSERV.EXE ALERTSVC.EXE AGENTSVR.EXE ADVXDWIN.EXE ACKWIN32.EXE

Get reports about the latest virus and spyware threats delivered to your computer

In this section

W32/Agobot-FN

Summary

Action

More Information