WORM_AGOBOT.ACJ

Malware type: Worm

Aliases: Worm/Agobot.PD, Worm/Agobot.23.AO, Backdoor.Agobot.HM

In the wild: Yes

Destructive: No

Language: English

Platform: Windows 2000, XP

Encrypted: No

Overall risk rating:

Reported infections:

Damage potential:

High

Distribution potential:

High

Description: 

This worm arrives as the file VSTMGR.EXE on affected machines. It spreads by dropping a copy of itself on accessible network shares. If the said shares are inaccessible, it uses a hardcoded list of user names and passwords.

It may also propagate by taking advantage of the following Windows vulnerabiities:

  • The RPC/DCOM vulnerability, which allows an attacker to gain full access and execute any code on a target machine by sending a malformed packet to the DCOM service. It uses the RPC TCP port 135. More information on this vulnerability is found in Microsoft Security Bulletin MS03-026.

  • The IIS/WebDAV vulnerability, which enables arbitrary codes to execute on the WebDAV server by also sending a malformed request packet. This exploit is a service related to the HTTP on port 80. More information about this vulnerability is found in Microsoft Security Bulletin MS03-007.

  • The RPC Locator vulnerability, allows an attacker to execute codes on a target machine by sending a malformed packet request to the Locator service. The port related to this exploit is TCP port 445. More information on this vulnerability is found in Microsoft Security Bulletin MS03-001.

  • The Windows LSASS vulnerability, which is a buffer overrun that allows remote code execution and enables a malicious user to gain full control of the affected system. This vulnerability is discussed in detail in Microsoft Bulletin MS04-011 and Trend Micro's Vulnerability Description for MS04-011.

It uses random IRC port to connect to an IRC server, where it listens for commands from a remote malicious user. The said commands are executed locally on affected machines.

It performs a denial of service attack against target sites using different flood methods. It terminates processess, which are mostly related to antivirus, firewall, and system. Furthermore it steals CD keys of popular software.

It runs on Windows 2000 and XP.

For additional information about this threat, see:

Description created: Nov. 29, 2004 9:20:27 AM GMT -0800


TECHNICAL DETAILS


Size of malware: 118,960 Bytes

Initial samples received on: Nov 29, 2004

Payload 1: Terminates processes

Trigger condition 1: Upon execution

Payload 2: Steals CD keys of popular software

Trigger condition 1: Upon execution

Payload 3: Compromises security

Trigger condition 1: Upon execution

Details:

Installation and Autostart

Upon execution, this memory-resident worm drops a copy of itself as VSTMGR.EXE in the Windows system folder.

It creates the following autostart entries to ensure its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\Software\Microsoft
Windows\CurrentVersion\Run
WinWorks = "vstmgr.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft
Windows\CurrentVersion\RunServices
WinWorks = "vstmgr.exe"

It also creates a service for itself as TSYT.

Network Propagation

This worm spreads by dropping a copy of itself in the following network shares:

  • ADMIN$
  • PRINT$

If the said shares are inaccessible, it uses the following list of user names and passwords hardcoded in its body to gain access:

  • !@#$%
  • 000000
  • 00000000
  • 111111
  • 11111111
  • 121212
  • 123123
  • 12345
  • 123456
  • 1234567
  • 12345678
  • 123456789
  • 1234qwer
  • 123abc
  • 123asd
  • 123qwe
  • 54321
  • 654321
  • 88888888
  • abc123
  • ACCESS
  • Admin
  • admin
  • admin123
  • Administrador
  • administrador
  • Administrat
  • Administrateur
  • ADMINISTRATOR
  • Administrator
  • administrator
  • admins
  • alpha
  • asdfgh
  • asdfghjkl
  • askaban
  • athlon
  • azerty
  • azkaban
  • backdoor
  • BACKUP
  • biere
  • buckbeak
  • carte
  • cauldron
  • cederom
  • changeme
  • colin
  • computer
  • Convidado
  • Coordinatore
  • copin
  • copine
  • crash
  • database
  • Default
  • dementor
  • devil
  • drugs
  • dumbledore
  • ecran
  • enable
  • fanny
  • foobar
  • freak
  • fucked
  • george
  • godblessyou
  • gryffindor
  • Guest
  • hagrid
  • harry
  • hermine
  • hermione
  • hogwarts
  • homework
  • idiot
  • ihavenopass
  • imprimeur
  • Internet
  • Inviter
  • jackdaniels
  • kanri
  • kanri-sha
  • linux
  • LOCAL
  • Login
  • madre
  • merde
  • metal
  • mince
  • moonshine
  • mouse
  • mybaby
  • mybox
  • mypass
  • mysql
  • newfie
  • newfy
  • opteron
  • oracle
  • ordinateur
  • Ospite
  • owned
  • OWNER
  • Owner
  • owner
  • PASSWD
  • passwd
  • Password
  • password
  • password123
  • patrick
  • penis
  • peter
  • poiut
  • poiuytrewq
  • potter
  • private
  • pussy
  • pwned
  • quidditch
  • qwerty
  • qwertyuiop
  • red123
  • reseau
  • rooted
  • school
  • secret
  • secrets
  • SERVER
  • server
  • share
  • souris
  • stacey
  • stacy
  • Standard
  • stefan
  • steve
  • steven
  • student
  • super
  • superman
  • supersecret
  • switch
  • sybase
  • SYSTEM
  • teacher
  • Tennessee
  • tennessee
  • test123
  • Texas
  • texas
  • vagina
  • Verwalter
  • Washington
  • washington
  • werty
  • wh0re
  • whiskey
  • whisky
  • whore
  • windows2k
  • windows98
  • windowsME
  • WindowsXP
  • windoze
  • wwwadmin
  • xxyyzz
  • zxcvbnm

Exploits

This worm may also take advantage of the following Windows vulnerabilities to propagate:

  • The RPC/DCOM vulnerability, which allows an attacker to gain full access and execute any code on a target machine by sending a malformed packet to the DCOM service. It uses the RPC TCP port 135. More information on this vulnerability is found in Microsoft Security Bulletin MS03-026.

  • The IIS/WebDAV vulnerability, which enables arbitrary codes to execute on the WebDAV server by also sending a malformed request packet. This exploit is a service related to the HTTP on port 80. More information about this vulnerability is found in Microsoft Security Bulletin MS03-007.

  • The RPC Locator vulnerability, allows an attacker to execute codes on a target machine by sending a malformed packet request to the Locator service. The port related to this exploit is TCP port 445. More information on this vulnerability is found in Microsoft Security Bulletin MS03-001.

  • The Windows LSASS vulnerability, which is a buffer overrun that allows remote code execution and enables a malicious user to gain full control of the affected system. This vulnerability is discussed in detail in Microsoft Bulletin MS04-011 and Trend Micro's Vulnerability Description for MS04-011.

Backdoor Capabilities

This worm uses random IRC port to connect to an IRC server, where it listens for commands from a remote user. The said commands are executed locally on affected machines.

The said commands are as follows:

  • Change the server where the bot connects to
  • Reconnect to the server
  • Send a raw message to the IRC server
  • Quit as the bot
  • Sends a privmsg
  • Make the bot part a channel
  • Print network information
  • Let the bot perform a mode change
  • Make the bot join a channel
  • Print network information when host matches
  • Prints network information when the bot is .edu
  • Let the bot perform an action
  • Disconnect the bot from IRC
  • Run a command with system()
  • Enable shares
  • Enable DCOM
  • Delete shares
  • Disable DCOM
  • Flushe the bots DNS cache
  • Inquire on bot (If uptime > 7 days then bot responds)
  • Display system information
  • Give status
  • Make the bot generate a new random nick
  • Remove the bot if ID does not match
  • Remove the bot
  • Open a whaterver file
  • Change the nickname of the bot
  • Display the ID of the current code
  • Make the bot execute an .EXE file
  • Resolve IP/host name by DNS
  • Terminate the bot
  • Display the any information that the malware author wants affected users to see
  • Delete the following shares:
    • ADMIN$
    • C$
    • D$
    • E$
    • IPC$
  • List all available commands
  • Save configuration to a file
  • Load configuration from a file
  • Delete a service from system
  • Add a service to system
  • Delete an autostart entry
  • Add an autostart entry
  • Perform port scanning to connect to the malicious user
  • Steal CD keys
  • Encrypt packet that it sends using Secure Sockets Layer (SSL) to avoid detection

Denial of Service Attack

This worm performs a denial of service attack against target sites using the following flood methods:

  • Ping
  • SYN
  • UDP

Information Theft

This worm steals the CD keys of the following software:

  • Battlefield 1942
  • Battlefield 1942: Secret Weapons Of WWII
  • Battlefield 1942: The Road To Rome
  • Battlefield 1942: Vietnam
  • Black and White
  • Command and Conquer: Generals
  • Command and Conquer: Generals: Zero Hour
  • Command and Conquer: Red Alert2
  • Command and Conquer: Tiberian Sun
  • Counter-Strike
  • FIFA 2002
  • FIFA 2003
  • Freedom Force
  • Global Operations
  • Gunman Chronicles
  • Half-Life
  • Hidden and Dangerous 2
  • IGI2: Covert Strike
  • Industry Giant 2
  • James Bond 007: Nightfire
  • Medal of Honor: Allied Assault
  • Medal of Honor: Allied Assault: Breakthrough
  • Medal of Honor: Allied Assault: Spearhead
  • Microsoft Windows
  • Nascar Racing 2002
  • Nascar Racing 2003
  • Need For Speed: Hot Pursuit 2
  • Need For Speed: Underground
  • Neverwinter Nights
  • NHL 2002
  • NHL 2003
  • Ravenshield
  • Shogun: Total War: Warlord Edition
  • Soldier Of Fortune 2
  • Soldiers Of Anarchy
  • The Gladiators
  • Unreal Tournament 2003
  • Unreal Tournament 2004

Process Termination

This worm terminates the following processes, which are mostly related to antivirus, firewall, and system:

  • _AVP32.EXE
  • _AVPCC.EXE
  • _AVPM.EXE
  • ACKWIN32.EXE
  • ADAWARE.EXE
  • ADSPIDER.EXE
  • ADVXDWIN.EXE
  • AGENTSVR.EXE
  • AGENTW.EXE
  • ALERTSVC.EXE
  • ALEVIR.EXE
  • ALOGSERV.EXE
  • AMON9X.EXE
  • ANTI-TROJAN.EXE
  • ANTIVIRUS.EXE
  • ANTS.EXE
  • APIMONITOR.EXE
  • APLICA32.EXE
  • APVXDWIN.EXE
  • ARR.EXE
  • ASCLT.EXE
  • ATCON.EXE
  • ATGUARD.EXE
  • ATRO55EN.EXE
  • ATUPDATER.EXE
  • ATWATCH.EXE
  • AU.EXE
  • AUPDATE.EXE
  • AUTODOWN.EXE
  • AUTO-PROTECT.NAV80TRY.EXE
  • AUTOTRACE.EXE
  • AUTOUPDATE.EXE
  • AVCONSOL.EXE
  • AVE32.EXE
  • AVGCC32.EXE
  • AVGCTRL.EXE
  • AVGNT.EXE
  • AVGSERV.EXE
  • AVGSERV9.EXE
  • AVGUARD.EXE
  • AVGW.EXE
  • AVKPOP.EXE
  • AVKSERV.EXE
  • AVKSERVICE.EXE
  • AVKWCTl9.EXE
  • AVLTMAIN.EXE
  • AVNT.EXE
  • AVP.EXE
  • AVP32.EXE
  • AVPCC.EXE
  • AVPDOS32.EXE
  • AVPM.EXE
  • AVPTC32.EXE
  • AVPUPD.EXE
  • AVSCHED32.EXE
  • AVSYNMGR.EXE
  • AVWIN95.EXE
  • AVWINNT.EXE
  • AVWUPD.EXE
  • AVWUPD32.EXE
  • AVWUPSRV.EXE
  • AVXMONITOR9X.EXE
  • AVXMONITORNT.EXE
  • AVXQUAR.EXE
  • BACKWEB.EXE
  • BARGAINS.EXE
  • BD_PROFESSIONAL.EXE
  • BEAGLE.EXE
  • BELT.EXE
  • BIDEF.EXE
  • BIDSERVER.EXE
  • BIPCP.EXE
  • BIPCPEVALSETUP.EXE
  • BISP.EXE
  • BLACKD.EXE
  • BLACKICE.EXE
  • BLSS.EXE
  • BM98BODY.EXE
  • BOOTCONF.EXE
  • BOOTWARN.EXE
  • BORG2.EXE
  • BPC.EXE
  • BRASIL.EXE
  • BS120.EXE
  • BUNDLE.EXE
  • BVT.EXE
  • CCAPP.EXE
  • CCEVTMGR.EXE
  • CCINFO.EXE
  • CCPXYSVC.EXE
  • CDP.EXE
  • CFD.EXE
  • CFGWIZ.EXE
  • CFIADMIN.EXE
  • CFIAUDIT.EXE
  • CFINET.EXE
  • CFINET32.EXE
  • Claw95.EXE
  • CLAW95CF.EXE
  • CLEAN.EXE
  • CLEANER.EXE
  • CLEANER3.EXE
  • CLEANPC.EXE
  • CLICK.EXE
  • CMD32.EXE
  • CMESYS.EXE
  • CMGRDIAN.EXE
  • CMON016.EXE
  • CONF.EXE
  • CONNECTIONMONITOR.EXE
  • CPD.EXE
  • CPF9X206.EXE
  • CPFNT206.EXE
  • CSRS32.EXE
  • CTRL.EXE
  • CV.EXE
  • CWNB181.EXE
  • CWNTDWMO.EXE
  • D3DUPDATE.EXE
  • DATEMANAGER.EXE
  • DCOMX.EXE
  • DEFALERT.EXE
  • DEFSCANGUI.EXE
  • DEFWATCH.EXE
  • DEPUTY.EXE
  • DIVX.EXE
  • DL32.EXE
  • DLLCACHE.EXE
  • DLLREG.EXE
  • DNTUS26.EXE
  • DOORS.EXE
  • DPF.EXE
  • DPFSETUP.EXE
  • DPPS2.EXE
  • DRWATSON.EXE
  • DRWEB32.EXE
  • DRWEBUPW.EXE
  • DSSAGENT.EXE
  • DVP95.EXE
  • DVP95_0.EXE
  • ECENGINE.EXE
  • EFPEADM.EXE
  • EMSW.EXE
  • ENT.EXE
  • ESAFE.EXE
  • ESCANH95.EXE
  • ESCANHNT.EXE
  • ESCANV95.EXE
  • ESPWATCH.EXE
  • ETHEREAL.EXE
  • ETRUSTCIPE.EXE
  • EVPN.EXE
  • EXANTIVIRUS-CNET.EXE
  • EXE.AVXW.EXE
  • EXPERT.EXE
  • EXPL.EXE
  • EXPLORE.EXE
  • EXPLORED.EXE
  • F-AGNT95.EXE
  • F-AGOBOT.EXE
  • FAMEH32.EXE
  • FAST.EXE
  • FCH32.EXE
  • FIH32.EXE
  • FINDVIRU.EXE
  • FIREDAEMON.EXE
  • FIREWALL.EXE
  • FLOWPROTECTOR.EXE
  • FNRB32.EXE
  • FPROT.EXE
  • F-PROT.EXE
  • F-PROT95.EXE
  • FP-WIN.EXE
  • FP-WIN_TRIAL.EXE
  • FRW.EXE
  • FSAA.EXE
  • FSAV.EXE
  • FSAV32.EXE
  • FSAV530STBYB.EXE
  • FSAV530WTBYB.EXE
  • FSAV95.EXE
  • FSGK32.EXE
  • FSM32.EXE
  • FSMA32.EXE
  • FSMB32.EXE
  • F-STOPW.EXE
  • FVPROTECT.EXE
  • GATOR.EXE
  • GBMENU.EXE
  • GBPOLL.EXE
  • GENERICS.EXE
  • GMT.EXE
  • GT.EXE
  • GUARD.EXE
  • GUARDDOG.EXE
  • HACKTRACERSETUP.EXE
  • HBINST.EXE
  • HBSRV.EXE
  • HIJACKTHIS.EXE
  • HOTACTIO.EXE
  • HOTPATCH.EXE
  • HTLOG.EXE
  • HTPATCH.EXE
  • HWPE.EXE
  • HXDEF370.EXE
  • HXDL.EXE
  • HXIUL.EXE
  • IAMAPP.EXE
  • IAMSERV.EXE
  • IAMSTATS.EXE
  • IBMASN.EXE
  • IBMAVSP.EXE
  • ICLOAD95.EXE
  • ICLOADNT.EXE
  • ICMON.EXE
  • ICSUPP95.EXE
  • ICSUPPNT.EXE
  • IDLE.EXE
  • IEDLL.EXE
  • IEDRIVER.EXE
  • IEXPLORER.EXE
  • IFACE.EXE
  • IFW2000.EXE
  • INETLNFO.EXE
  • INFUS.EXE
  • INFWIN.EXE
  • INIT.EXE
  • INTDEL.EXE
  • INTREN.EXE
  • IOMON98.EXE
  • IPARMOR.EXE
  • IPBIND.EXE
  • IPCONFIG.EXE
  • IRIS.EXE
  • IROFFER.EXE
  • ISASS.EXE
  • ISRV95.EXE
  • ISTSVC.EXE
  • IXPLORES.EXE
  • JAMMER.EXE
  • JDBGMRG.EXE
  • JEDI.EXE
  • KAVLITE40ENG.EXE
  • KAVPERS40ENG.EXE
  • KAVPF.EXE
  • KAZZA.EXE
  • KEENVALUE.EXE
  • KERIO-PF-213-EN-WIN.EXE
  • KERIO-WRL-421-EN-WIN.EXE
  • KERIO-WRP-421-EN-WIN.EXE
  • KERNEL32.EXE
  • KILLPROCESSSETUP161.EXE
  • LAUNCHER.EXE
  • LDNETMON.EXE
  • LDPRO.EXE
  • LDPROMENU.EXE
  • LDSCAN.EXE
  • LNETINFO.EXE
  • LOADER.EXE
  • LOCALNET.EXE
  • LOCKDOWN.EXE
  • LOCKDOWN2000.EXE
  • LOOKOUT.EXE
  • LORDPE.EXE
  • LSETUP.EXE
  • LUALL.EXE
  • LUAU.EXE
  • LUCOMSERVER.EXE
  • LUINIT.EXE
  • LUSPT.EXE
  • MAPISVC32.EXE
  • MCAGENT.EXE
  • MCMNHDLR.EXE
  • MCSHIELD.EXE
  • MCTOOL.EXE
  • MCUPDATE.EXE
  • MCVSRTE.EXE
  • MCVSSHLD.EXE
  • MD.EXE
  • MEP#####.TMP.EXE
  • METALROCK-IS-GAY.EXE
  • MFIN32.EXE
  • MFW2EN.EXE
  • MFWENG3.02D30.EXE
  • MGAVRTCL.EXE
  • MGAVRTE.EXE
  • MGHTML.EXE
  • MGNWIN32.EXE
  • MGUI.EXE
  • MINILOG.EXE
  • MMOD.EXE
  • MONITOR.EXE
  • MONSVCNT.EXE
  • MOOLIVE.EXE
  • MOSTAT.EXE
  • MPFAGENT.EXE
  • MPFSERVICE.EXE
  • MPFTRAY.EXE
  • MRFLUX.EXE
  • MSAPP.EXE
  • MSBB.EXE
  • MSBLAST.EXE
  • MSCACHE.EXE
  • MSCCN32.EXE
  • MSCMAN.EXE
  • MSCONFIG.EXE
  • MSDM.EXE
  • MSDN.EXE
  • MSDOS.EXE
  • MSGFIX.EXE
  • MSIEXEC16.EXE
  • MSINFO32.EXE
  • MSLAUGH.EXE
  • MSMGT.EXE
  • MSMSGRI32.EXE
  • MSNGER32.EXE
  • MSNGRT.EXE
  • MSSMMC32.EXE
  • MSSYS.EXE
  • MSVB32.EXE
  • MSVD32.EXE
  • MSVXD.EXE
  • MU0311AD.EXE
  • MWATCH.EXE
  • N32SCANW.EXE
  • NAV.EXE
  • NAVAP.NAVAPSVC.EXE
  • NAVAPSVC.EXE
  • NAVAPW32.EXE
  • NAVDX.EXE
  • NAVENGNAVEX15.NAVLU32.EXE
  • NAVLU32.EXE
  • NAVNT.EXE
  • NAVSTUB.EXE
  • NAVW32.EXE
  • NAVWNT.EXE
  • NC2000.EXE
  • NCINST4.EXE
  • NDD32.EXE
  • NEOMONITOR.EXE
  • NEOWATCHLOG.EXE
  • NETARMOR.EXE
  • NETCLIENT.EXE
  • NETD32.EXE
  • NETINFO.EXE
  • NETMON.EXE
  • NETSCANPRO.EXE
  • NETSPYHUNTER-1.2.EXE
  • NETSTAT.EXE
  • NETUTILS.EXE
  • NISSERV.EXE
  • NISUM.EXE
  • NMAIN.EXE
  • NOD32.EXE
  • NORMIST.EXE
  • NORTON_INTERNET_SECU_3.0_407.EXE
  • NOTSTART.EXE
  • NPF40_TW_98_NT_ME_2K.EXE
  • NPFMESSENGER.EXE
  • NPROTECT.EXE
  • NPSCHECK.EXE
  • NPSSVC.EXE
  • NSCHED32.EXE
  • NSSYS32.EXE
  • NSTASK32.EXE
  • NSUPDATE.EXE
  • NT.EXE
  • NTRTSCAN.EXE
  • NTSERVICE.EXE
  • NTSYSKRNL.EXE
  • NTVDM.EXE
  • NTXconfig.EXE
  • NUI.EXE
  • NUPGRADE.EXE
  • NVARCH16.EXE
  • NVC95.EXE
  • NVSVC32.EXE
  • NWINST4.EXE
  • NWSERVICE.EXE
  • NWTOOL16.EXE
  • OLEHELP.EXE
  • OLLYDBG.EXE
  • ONSRVR.EXE
  • OPTIMIZE.EXE
  • OSTRONET.EXE
  • OTFIX.EXE
  • OUTPOST.EXE
  • OUTPOSTINSTALL.EXE
  • OUTPOSTPROINSTALL.EXE
  • PADMIN.EXE
  • PANIXK.EXE
  • PATCH.EXE
  • PAVCL.EXE
  • PAVPROXY.EXE
  • PAVSCHED.EXE
  • PAVW.EXE
  • PCC2002S902.EXE
  • PCC2K_76_1436.EXE
  • PCCIOMON.EXE
  • PCCNTMON.EXE
  • PCCWIN97.EXE
  • PCCWIN98.EXE
  • PCDSETUP.EXE
  • PCFWALLICON.EXE
  • PCIP10117_0.EXE
  • PCSCAN.EXE
  • PDSETUP.EXE
  • PEERER32.EXE
  • PENIS.EXE
  • PERISCOPE.EXE
  • PERSFW.EXE
  • PERSWF.EXE
  • PF2.EXE
  • PFWADMIN.EXE
  • PGMONITR.EXE
  • PINGSCAN.EXE
  • PLATIN.EXE
  • POP3TRAP.EXE
  • POPROXY.EXE
  • POPSCAN.EXE
  • PORTDETECTIVE.EXE
  • PORTMONITOR.EXE
  • POWERSCAN.EXE
  • PPINUPDT.EXE
  • PPTBC.EXE
  • PPVSTOP.EXE
  • PRIZESURFER.EXE
  • PRMT.EXE
  • PRMVR.EXE
  • PROCDUMP.EXE
  • PROCESSMONITOR.EXE
  • PROCEXPLORERV1.0.EXE
  • PROGRAMAUDITOR.EXE
  • PROPORT.EXE
  • PROTECTX.EXE
  • PSPF.EXE
  • PURGE.EXE
  • PUSSY.EXE
  • PVIEW95.EXE
  • QCONSOLE.EXE
  • QSERVER.EXE
  • RAPAPP.EXE
  • RAV7.EXE
  • RAV7WIN.EXE
  • RAV8WIN32ENG.EXE
  • RAY.EXE
  • RB32.EXE
  • RCSYNC.EXE
  • REALMON.EXE
  • REGED.EXE
  • REGEDIT.EXE
  • REGEDT32.EXE
  • RESCUE.EXE
  • RESCUE32.EXE
  • RRGUARD.EXE
  • RSHELL.EXE
  • RTVSCAN.EXE
  • RTVSCN95.EXE
  • RULAUNCH.EXE
  • RUN32DLL.EXE
  • RUNDLL.EXE
  • RUNDLL16.EXE
  • RUXDLL32.EXE
  • SAFEWEB.EXE
  • SAHAGENT.EXE
  • SAVE.EXE
  • SAVENOW.EXE
  • SBSERV.EXE
  • SC.EXE
  • SCAM32.EXE
  • SCAN32.EXE
  • SCAN95.EXE
  • SCANPM.EXE
  • SCCHOSTC.EXE
  • SCRSCAN.EXE
  • SCRSVR.EXE
  • SCVHOST.EXE
  • SD.EXE
  • SERV95.EXE
  • SERVICE.EXE
  • SERVLCE.EXE
  • SERVLCES.EXE
  • SERVUDAEMON.EXE
  • SETUP_FLOWPROTECTOR_US.EXE
  • SETUPVAMEEVAL.EXE
  • SFC.EXE
  • SGSSFW32.EXE
  • SH.EXE
  • SHELLSPYINSTALL.EXE
  • SHN.EXE
  • SHOWBEHIND.EXE
  • SKYSRV.EXE
  • SMC.EXE
  • SMS.EXE
  • SMSS32.EXE
  • SMSSNT.EXE
  • SMSSV.EXE
  • SNDLOADER.EXE
  • SOAP.EXE
  • SOFI.EXE
  • SPERM.EXE
  • SPF.EXE
  • SPHINX.EXE
  • SPOLER.EXE
  • SPOOLCV.EXE
  • SPOOLSV32.EXE
  • SPYXX.EXE
  • SREXE.EXE
  • SRNG.EXE
  • SRVHOST.EXE
  • SS3EDIT.EXE
  • SSG_4104.EXE
  • SSGRATE.EXE
  • ST2.EXE
  • START.EXE
  • STCLOADER.EXE
  • SUPFTRL.EXE
  • SUPPORT.EXE
  • SUPPORTER5.EXE
  • SVC.EXE
  • SVCHOSTC.EXE
  • SVCHOSTS.EXE
  • SVRHOST.EXE
  • SVSHOST.EXE
  • SWEEP95.EXE
  • SWEEPNET.SWEEPSRV.SYS.SWNETSUP.EXE
  • SYMPROXYSVC.EXE
  • SYMTRAY.EXE
  • SYSATSITE.EXE
  • SYSEDIT.EXE
  • SYSEXECHK.EXE
  • SYSEXPLR.EXE
  • SYSPOOL.EXE
  • SYSTEM.EXE
  • SYSTEM32.EXE
  • SYSUPD.EXE
  • TASKMG.EXE
  • TASKMO.EXE
  • TASKMON.EXE
  • TAUMON.EXE
  • TBSCAN.EXE
  • TC.EXE
  • TCA.EXE
  • TCM.EXE
  • TDS2-98.EXE
  • TDS2-NT.EXE
  • TDS-3.EXE
  • TEEKIDS.EXE
  • TFAK.EXE
  • TFAK5.EXE
  • TGBOB.EXE
  • TITANIN.EXE
  • TITANINXP.EXE
  • TPWRTRAY.EXE
  • TRACERT.EXE
  • TRICKLER.EXE
  • TRJSCAN.EXE
  • TRJSETUP.EXE
  • TROJANTRAP3.EXE
  • TSADBOT.EXE
  • TVFTPSRV.EXE
  • TVMD.EXE
  • TVMGR.EXE
  • TVTMD.EXE
  • UNDOBOOT.EXE
  • UPDAT.EXE
  • UPDATE.EXE
  • UPGRAD.EXE
  • UTPOST.EXE
  • VBCMSERV.EXE
  • VBCONS.EXE
  • VBUST.EXE
  • VBWIN9X.EXE
  • VBWINNTW.EXE
  • VCSETUP.EXE
  • VET32.EXE
  • VET95.EXE
  • VETTRAY.EXE
  • VFSETUP.EXE
  • VIR-HELP.EXE
  • VIRUSMDPERSONALFIREWALL.EXE
  • VNLAN300.EXE
  • VNPC3000.EXE
  • VPC32.EXE
  • VPC42.EXE
  • VPFW30S.EXE
  • VPTRAY.EXE
  • VSCAN40.EXE
  • VSCENU6.02D30.EXE
  • VSCHED.EXE
  • VSECOMR.EXE
  • VSHWIN32.EXE
  • VSISETUP.EXE
  • VSMAIN.EXE
  • VSMON.EXE
  • VSSTAT.EXE
  • VSWIN9XE.EXE
  • VSWINNTSE.EXE
  • VSWINPERSE.EXE
  • W32DSM89.EXE
  • W9X.EXE
  • WATCHDOG.EXE
  • WC11STA.EXE
  • WCMDMGR.EXE
  • WEBANTIVIRUSUPDATE.EXE
  • WEBDAV.EXE
  • WEBSCANX.EXE
  • WEBTRAP.EXE
  • WFINDV32.EXE
  • WGFE95.EXE
  • WHOSWATCHINGME.EXE
  • WIMMUN32.EXE
  • WIN32.EXE
  • WIN32US.EXE
  • WIN932.EXE
  • WINACTIVE.EXE
  • WINBOOT32.EXE
  • WIN-BUGSFIX.EXE
  • WINCE.EXE
  • WINCRT32.EXE
  • WINDOW.EXE
  • WINDOWS.EXE
  • WINFIX3.EXE
  • WININETD.EXE
  • WININIT.EXE
  • WININITX.EXE
  • WINLOGIN.EXE
  • WINMAIN.EXE
  • WINNET.EXE
  • WINNT32.EXE
  • WINPPR32.EXE
  • WINRECON.EXE
  • WINSECURE.EXE
  • WINSERVN.EXE
  • WINSRV.EXE
  • WINSSK32.EXE
  • WINSTART.EXE
  • WINSTART001.EXE
  • WINTSK32.EXE
  • WINUPDATE.EXE
  • WINUPDATER.EXE
  • WINUSER32.EXE
  • WINVNC.EXE
  • WIUPDATMGR.EXE
  • WKUFIND.EXE
  • WNAD.EXE
  • WNT.EXE
  • WRADMIN.EXE
  • WRCTRL.EXE
  • WSBGATE.EXE
  • WUAMGRD.EXE
  • WUAMGRD2.EXE
  • WUAPDP.EXE
  • WUPDATER.EXE
  • WUPDT.EXE
  • WYVERNWORKSFIREWALL.EXE
  • XPF202EN.EXE
  • ZAPRO.EXE
  • ZAPSETUP3001.EXE
  • ZATUTOR.EXE
  • ZONALM2601.EXE
  • ZONEALARM.EXE

Other Details

This worm is compressed using FSG version 1.31.




Analysis by: Christine Bejerasco


SOLUTION


Minimum scan engine version needed: 6.810

Pattern file needed: 2.268.03

Pattern release date: Nov 29, 2004


Important note: The "Minimum scan engine" refers to the earliest Trend Micro scan engine version guaranteed to detect this threat. However, Trend Micro strongly recommends that you update to the latest version in order to get comprehensive protection. Download the latest scan engine here.

Solution:

Restarting in Safe Mode

On Windows 2000

  1. Restart your computer.
  2. Press the F8 key, when you see the Starting Windows bar at the bottom of the screen.
  3. Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.

On Windows XP

  1. Restart your computer.
  2. Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
  3. Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.

Note: After performing all the solutions for the removal of this malware, please restart your system normally, and run your Trend Micro antivirus product.

Removing Autostart Entries from the Registry

Removing autostart entries from the registry prevents the malware from executing at startup.

  1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
  2. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>
    Windows>CurrentVersion>Run
  3. In the right panel, locate and delete the entry:
    WinWorks = "vstmgr.exe"
  4. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>
    Windows>CurrentVersion>RunServices
  5. In the right panel, locate and delete the entry:
    WinWorks = "vstmgr.exe"
  6. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>System>CurrentControlSet>Services
  7. Still in the left panel, delete the subkey:
    tsvt
  8. Close Registry Editor.

Deleting Entries in the HOSTS File

Deleting entries in the HOSTS file prevents the redirection of Antivirus Web sites to the local machine.

  1. Click Start>Search. Search for the file named HOSTS (this is usually located in %System%\drivers\etc\).
  2. Open the file in NOTEPAD.
  3. Delete the following entries:
    • 127.0.0.1 www.symantec.com
    • 127.0.0.1 securityresponse.symantec.com
    • 127.0.0.1 symantec.com
    • 127.0.0.1 www.sophos.com
    • 127.0.0.1 sophos.com
    • 127.0.0.1 www.mcafee.com
    • 127.0.0.1 mcafee.com
    • 127.0.0.1 liveupdate.symantecliveupdate.com
    • 127.0.0.1 www.viruslist.com
    • 127.0.0.1 viruslist.com
    • 127.0.0.1 viruslist.com
    • 127.0.0.1 f-secure.com
    • 127.0.0.1 www.f-secure.com
    • 127.0.0.1 kaspersky.com
    • 127.0.0.1 kaspersky-labs.com
    • 127.0.0.1 www.avp.com
    • 127.0.0.1 www.kaspersky.com
    • 127.0.0.1 avp.com
    • 127.0.0.1 www.networkassociates.com
    • 127.0.0.1 networkassociates.com
    • 127.0.0.1 www.ca.com
    • 127.0.0.1 ca.com
    • 127.0.0.1 mast.mcafee.com
    • 127.0.0.1 my-etrust.com
    • 127.0.0.1 www.my-etrust.com
    • 127.0.0.1 download.mcafee.com
    • 127.0.0.1 dispatch.mcafee.com
    • 127.0.0.1 secure.nai.com
    • 127.0.0.1 nai.com
    • 127.0.0.1 www.nai.com
    • 127.0.0.1 update.symantec.com
    • 127.0.0.1 updates.symantec.com
    • 127.0.0.1 us.mcafee.com
    • 127.0.0.1 liveupdate.symantec.com
    • 127.0.0.1 customer.symantec.com
    • 127.0.0.1 rads.mcafee.com
    • 127.0.0.1 trendmicro.com
    • 127.0.0.1 www.trendmicro.com
  4. Save the file and Close it.

Additional Windows XP Cleaning Instructions

Users running Windows XP must disable System Restore to allow full scanning of infected systems.

Users running other Windows versions can proceed with the succeeding procedure sets.

Running Trend Micro Antivirus

Scan your system with Trend Micro antivirus and delete all files detected as WORM_AGOBOT.ACJ. To do this, Trend Micro customers must download the latest pattern file and scan their system. Other Internet users can use HouseCall, Trend Micro�s free online virus scanner.

Applying Patches

This malware exploits known vulnerabilities affecting the Windows NT platforms. Refer to the following Microsoft pages to download and install the the needed files to patch your system.

Refrain from using the affected software until the appropriate patch has been installed.


Trend Micro offers best-of-breed antivirus and content-security solutions for your corporate network, small and medium business, mobile device or home PC.