W32/Agobot-RR

Category: Viruses and Spyware
Type: Win32 worm
Prevalence: No Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

W32/Agobot-RR is a member of the W32/Agobot family of network worms. The worm can spread to weakly protected network shares and open Microsoft SQL servers, to computers vulnerable to the RPC-DCOM exploit, and via NetBIOS.

The following patches for the operating system vulnerabilities exploited by W32/Agobot-RR can be obtained from the Microsoft website:

MS04-012

In order to run automatically when Windows starts up the worm copies itself to the Windows SYstem folder as ggtb32.exe and creates the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
google toolbar
ggtb32.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
google toolbar
ggtb32.exe

Once installed, W32/Agobot-RR connects to a preconfigured IRC server and joins a channel from which an attacker can issue further commands. These commands can cause the infected computer to perform any of the following actions:

Modify the computer's HOSTS file to deny access to certain computer security websites
Execute, upload, and download files
Log any keystrokes made on an infected computer
Scan for remote computers to infect
Particiapte in Distributed Denial-of-Service (DDoS) attacks
Add and delete services via the Service Control Manager
Search the registry, and delete autostart registry entries
Shutdown, reboot, or log off an infected computer
List and terminate running processes
Act as a SOCKS, HTTP, or FTP proxy server
Harvest email addresses

When the HOSTS file (located in '<System>\drivers\etc\') is modified, entries are created for the major anti-virus software websites that redirect attempted access to those sites to the IP address 127.0.0.1.

The worm can be commanded to secure an infected computer from further infection, or open it up for further infection. Securing an infected computer involves deleting any network shares and disabling DCOM by setting the following registry entry:

HKLM\Software\Microsoft\OLE
EnableDCOM
N

To allow further infection on an infected computer C$, D$, E$, ADMIN$ and IPC$ network shares are added, and DCOM is enabled by setting the following registry entry:

HKLM\Software\Microsoft\OLE
EnableDCOM
Y