WORM_AGOBOT.ACM

Description: 

This memory-resident worm spreads via network shares. It exploits the following vulnerabilities to propagate across networks:

• IIS5/WEBDAV Buffer Overflow vulnerability
• Remote Procedure Call (RPC) Distributed Component Object Model (DCOM) vulnerability

For more information about these Windows vulnerabilities, please refer to the following Microsoft Web pages:

• Microsoft Security Bulletin MS03-007
• Microsoft Security Bulletin MS02-026

This worm copies itself to the default shares in the network. It also uses a list of user names and passwords in order to gain access to target systems that has restricted access rights.

It has backdoor capabilities that allows it to connect Internet Relay Chat (IRC). Once connected, it acts as an IRC bot that allows a remote user to access the infected system and perform malicious commands.

This worm steals the Windows product ID and CD keys of popular game applications. It also enables a remote user to perform denial of service (DoS) attacks against a target site.

It runs on Windows 95, 98, ME, NT, 2000, and XP.

Details:

Installation and Autostart Technique

Upon execution, this memory-resident worm drops a copy of itself in the Windows system folder as the following file:

FRMWRKS32.EXE

It may add the following registry entries to enable its dropped copy to run at every Windows startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
Windows Frame Works = "frmwrks32.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\RunServices
Windows Frame Works = "frmwrks32.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Windows Frame Works = "frmwrks32.exe"

This worm then launches itself into memory and create threads in order to perform its routines.

Network Propagation and Exploits

This worm takes advantage of the Remote Procedure Call (RPC) Distributed Component Object Model (DCOM) vulnerability present on Windows XP systems, which allows an attacker to gain full access and execute any code on a target machine, leaving it compromised.

Read more on this vulnerability from the following link:

Microsoft Security Bulletin MS03-026

This worm also exploits the IIS5/WEBDAV buffer overrun exploit affecting Windows NT platforms, which enables arbitrary codes to execute on the server.

The following link offers more information from Microsoft about this vulnerability:

Microsoft Security Bulletin MS03-007

When it finds a vulnerable target machine, the worm copies and executes itself on the system. It also attempts to propagate to the following folders in the network:

• ADMIN$
• Print$

If the folders are not readily accessible, this worm attempts force its way into the system by logging on using a list of hardcoded user names and passwords.

Backdoor Capabilities

This worm has backdoor capabilities. It comes with a built-in Internet Relay Chat (IRC) client engine, which enables it to connect to an IRC channel, and wait for commands from a malicious user to process locally on the system.

This IRC client grants the malicious user remote access over the machine to carry out the following commands:

• Obtain system information, such as the following:
  • CPU speed and memory
  • Size of memory
  • Windows platform, build version and product ID
  • Malware uptime
  • User name
• Change the IRC server and channel where it connects to
• Download files including malware updates from a Web site or FTP server
• Scan local network for vulnerable machines
• Scan local network for machines with weak NetBios password
• Redirect connections
• Emulate a Socks4 proxy
• Log off user
• Restart or shut down the machine
• List all running processes
• Terminate a specific process
• Add or remove autostart entries in the registry
• Add or remove services using Service Control Manager
• Remove network shares
• Erase DNS cache

Information Theft

This worm attempts to steal the Microsoft product ID and CD keys of the following game applications:

• Battlefield 1942
• Battlefield 1942 (Road To Rome)
• Battlefield 1942 (Secret Weapons of WWII)
• Battlefield Vietnam
• Black and White
• Chrome
• Command and Conquer: Generals
• Command and Conquer: Generals (Zero Hour)
• Command and Conquer: Red Alert
• Command and Conquer: Red Alert 2
• Command and Conquer: Tiberian Sun
• Counter-Strike (Retail)
• FIFA 2002
• FIFA 2003
• Freedom Force
• Global Operations
• Gunman Chronicles
• Half-Life
• Hidden & Dangerous 2
• IGI 2: Covert Strike
• Industry Giant 2
• James Bond 007: Nightfire
• Legends of Might and Magic
• Medal of Honor: Allied Assault
• Medal of Honor: Allied Assault: Breakthrough
• Medal of Honor: Allied Assault: Spearhead
• NHL 2002
• NHL 2003
• NOX
• Nascar Racing 2002
• Nascar Racing 2003
• Need For Speed Hot Pursuit 2
• Need For Speed: Underground
• Neverwinter Nights
• Neverwinter Nights (Hordes of the Underdark)
• Neverwinter Nights (Shadows of Undrentide)
• Rainbow Six III RavenShield
• Shogun: Total War: Warlord Edition
• Soldier of Fortune II - Double Helix
• Soldiers Of Anarchy
• The Gladiators
• Unreal Tournament 2003
• Unreal Tournament 2004

Denial of Service Attack

This worm also enables the malicious user to perform any of the following flood attacks against a target site:

• ICMP flood
• HTTP flood
• SYN flood
• UDP flood

---

Analysis by: Zarestel Ferrer

Important note: The "Minimum scan engine" refers to the earliest Trend Micro scan engine version guaranteed to detect this threat. However, Trend Micro strongly recommends that you update to the latest version in order to get comprehensive protection. Download the latest scan engine here.

Solution:

Terminating the Malware Program

This procedure terminates the running malware process.

1. Open Windows Task Manager.
   � On Windows 95, 98, and ME, press
   CTRL%20ALT%20DELETE
   � On Windows NT, 2000, and XP, press
   CTRL%20SHIFT%20ESC, then click the Processes tab.
2. In the list of running programs*, locate the process:
   FRMWRKS32.EXE
3. Select the malware process, then press either the End Task or the End Process button, depending on the version of Windows on your system.
4. To check if the malware process has been terminated, close Task Manager, and then open it again.
5. Close Task Manager.

---

*NOTE: On systems running Windows 95, 98, and ME, Windows Task Manager may not show certain processes. You can use a third party process viewer such as Process Explorer to terminate the malware process. Otherwise, continue with the next procedure, noting additional instructions.

Removing Autostart Entries from the Registry

Removing autostart entries from the registry prevents the malware from executing at startup.

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Microsoft>
   Windows>CurrentVersion>Run
3. In the right panel, locate and delete the entry:
   Windows Frame Works = "frmwrks32.exe"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Microsoft>
   Windows>CurrentVersion>RunServices
5. In the right panel, locate and delete the entry:
   Windows Frame Works = "frmwrks32.exe"
6. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>
   Windows>CurrentVersion>Run
7. In the right panel, locate and delete the entry:
   Windows Frame Works = "frmwrks32.exe"
8. Close Registry Editor.

---

NOTE: If you were not able to terminate the malware process as described in the previous procedure, restart your system.

Additional Windows ME/XP Cleaning Instructions

Users running Windows ME and XP must disable System Restore to allow full scanning of infected systems.

Users running other Windows versions can proceed with the succeeding procedure sets.

Running Trend Micro Antivirus

Scan your system with Trend Micro antivirus and delete all files detected as WORM_AGOBOT.ACM. To do this, Trend Micro customers must download the latest pattern file and scan their system. Other Internet users can use HouseCall, Trend Micro�s free online virus scanner.

Applying Patches

This malware exploits known vulnerabilities in Windows. Download and install the fix patch supplied by Microsoft in the following pages:

• Microsoft Security Bulletin MS03-007
• Microsoft Security Bulletin MS03-026

Refrain from using this product until the appropriate patch has been installed. Trend Micro advises users to download critical patches upon release by vendors.

Trend Micro offers best-of-breed antivirus and content-security solutions for your corporate network, small and medium business, mobile device or home PC.