high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Included in our products from | December 2004 (3.88) |
| Protection available since | 20 October 2004 07:50:21 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Agobot-NL is an IRC backdoor Trojan and network worm which establishes an IRC channel to a remote server in order to grant an intruder access to the compromised machine.
This worm will move itself into the Windows System32 folder under the filename MSMSGS.EXE and may create the following registry entries so that it can execute automatically on system restart:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Msn Update Manager (Sp2) = MSMSGS.EXE
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Msn Update Manager (Sp2) = MSMSGS.EXE
W32/Agobot-NL may attempt to terminate anti-virus and other security-related processes, in addition to other viruses, worms or Trojans.
This worm may search for shared folders on the internet with weak passwords and copy itself into them. A text file named HOSTS may also be dropped into C:\<Windows System32>\drivers\etc\ which may contain a list of anti-virus and other security-related websites each bound to the IP loopback address of 127.0.0.1 which would effectively prevent access to these sites.
For example:
127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com
|
