WORM_AGOBOT.VX

Malware type: Worm

In the wild: Yes

Destructive: No

Language: English

Platform: Windows NT, 2000, XP

Encrypted: No

Overall risk rating:

Reported infections:

Damage potential:

High

Distribution potential:

High

Description: 
This memory-resident worm is another variant of the AGOBOT family that exploits the vulnerabilities discussed in the following pages:

This worm propagates through network shares, and drops a copy of itself as DLLSVC32.EXE in the Windows system folder. It uses a list of user names and passwords to gain access to shared folders.

It also takes advantage of the backdoor components of certain malware if these malware are present in the infected system.

It acts as a server program controlled by an Internet Relay Chat (IRC) bot, thus capable of certain backdoor activities.

It is also capable of stealing the CD keys of popular Windows-based applications and terminating certain programs.

This worm also modifies the HOSTS file, which prevents the user from accessing certain antivirus and security Web sites, and is capable of launching distributed denial of service (DDoS) attacks..

It runs on Windows NT, 2000 and XP.

For additional information about this threat, see:

Description created: Sep. 4, 2004 12:37:01 AM GMT -0800


TECHNICAL DETAILS


Size of malware: 98,336 Bytes

Initial samples received on: Sep 4, 2004

Payload 1: Steals CD keys of popular games

Payload 2: Compromises system security

Payload 3: Terminates certain programs

Payload 4: Prevents access of certain antivirus websites

Payload 5: Launches distributed denial of service (DDoS) attacks

Details:
Installation

Upon execution, this memory-resident worm drops a copy of itself as DLLSVC32.EXE in the Windows system folder. It then delets its executed copy.

(Note: The Windows system folder is usually C:\WINNT\System32 on Windows 2000 and NT, and C:\Windows\System32 on Windows XP.)

It creates the following registry entry to ensure its execution at every Windows startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\RunServices
DLLService32 = "dllsvc32.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
DLLService32 = "dllsvc32.exe"

Network Propagation

This worm spreads through network shares. It uses NetBEUI functions to get available lists of usernames and passwords. It then lists down the available network shares. It first tries to drop files into network shares using the current user's account, and then tries using the user names and passwords it has gathered.

It also takes advantage of the backdoor component of the following malware variants if these malware are found in compromised system:

It also opens a random port through which it sends a copy of itself upon establishing a connection.

Backdoor Capabilities

This worm has backdoor capabilities. It acts as a server program controlled by an IRC Bot. It attempts to connect to the IRC server omen.kicks-ass.org. It then joins the channel #om3n, where it listens for commands from a remote user.

These commands allow the remote user to perform the following:

  • Control which IRC server the bot connects to
  • Perform IRC operations
  • Quit the bot
  • Enable/delete shares in the host system
  • Enable/disable DCOM in the host system
  • Check the status of bot
  • Change the settings of bot
  • Display the system info of the host system
  • Open a file
  • Execute an .EXE file
  • Resolve the IP/hostname by DNS
  • Display information about the bot
  • List the available commands of the bot
  • Disable/enable shell handler
  • Delete/add a service in the host system
  • Delete/add an autostart entry in the host system
  • Capture network packets
  • Perform FTP operations
  • Perform HTTP operations
  • Log off the current user of the system
  • Shut down the system
  • Reboot the system
  • Lists all processes in the system
  • Kill a process in the system
  • Perform a scan for the following in the network of the host system:
    • systems with weak NetBIOS passwords
    • systems with unpatched Universal Plug and Play vulnerability
    • vulnerable SQL Server 2000 machines
    • system with unpatched WebDav vulnerability
    • system with unpatched RPC Locator vulnerability
    • system with unpatched WebDav vulnerability
    • system with unpatched RPC DCOM vulnerability
    • systems with unpatched MS Workstation Service vulnerability
    • system with unpatched LSASS vulnerability
  • Perform a distributed denial of service (DDoS) attack
  • Perform port redirection
  • Display AOL account names and passwords found in the system
  • Parse the registry for CD keys of the following applications:
    • Battlefield 1942
    • Battlefield 1942: Secret Weapons Of WWII
    • Battlefield 1942: The Road To Rome
    • Battlefield 1942: Vietnam
    • Black and White
    • Command and Conquer: Generals
    • Command and Conquer: Generals: Zero Hour
    • Command and Conquer: Red Alert2
    • Command and Conquer: Tiberian Sun
    • Counter-Strike
    • FIFA 2002
    • FIFA 2003
    • Freedom Force
    • Global Operations
    • Gunman Chronicles
    • Half-Life
    • Hidden and Dangerous 2
    • IGI2: Covert Strike
    • Industry Giant 2
    • James Bond 007: Nightfire
    • Medal of Honor: Allied Assault
    • Medal of Honor: Allied Assault: Breakthrough
    • Medal of Honor: Allied Assault: Spearhead
    • Nascar Racing 2002
    • Nascar Racing 2003
    • Need For Speed: Hot Pursuit 2
    • Need For Speed: Underground
    • Neverwinter Nights
    • NHL 2002
    • NHL 2003
    • Ravenshield
    • Shogun: Total War: Warlord Edition
    • Soldier Of Fortune 2
    • Soldiers Of Anarchy
    • The Gladiators
    • Unreal Tournament 2003
    • Unreal Tournament 2004
    • Windows Product ID
  • Display list of email addresses found in the system
  • Display registry entries of the system

This worm also starts a File Transfer Protocol (FTP) server on a random port, which allows the following commands:

  • BINARY
  • CWD
  • PASS
  • PASV
  • PORT
  • RETR
  • SIZE
  • SYST
  • TYPE
  • USER

Microsoft Windows Exploits

This worm scans the network for remote vulnerable systems and notifies the bot with the remote system's IP address. Using Class B subnet and the target system's IP address, it generates random IP addresses and tests each address for vulnerability. These vulnerabilities are:

  • The Buffer Overfow in Universal Plug and Play, which is a vulnerability that may allow a remote attacker to execute arbitrary code via a NOTIFY directive with a long Location URL when the buffer overflow in Universal Plug and Play (UPnP) on Windows 98, 98SE, ME, and XP is triggered. More information on this vulnerability is found in Microsoft Security Bulletin MS01-059.
  • Buffer Overflow in SQL Server 2000, which is a vulnerability that allows a low-level user to run, delete, insert or update Web tasks. In turn, an attacker who is able to authenticate to a SQL server may do the same actions, and run already created Web tasks in the context of the creator of that task. More information on this vulnerability is found in Microsoft Security Bulletin MS02-061.
  • The RPC/DCOM exploit, which is a vulnerability that allows an attacker to gain full access and execute any code on a target machine by sending a malformed packet to the DCOM service. It uses the RPC TCP port 135. More information on this vulnerability is found in Microsoft Security Bulletin MS03-026.
  • The IIS/WebDAV exploit, which enables arbitrary codes to execute on the WebDAV server by also sending a malformed request packet. This exploit is a service related to the HTTP on port 80. More information about this vulnerability is found in Microsoft Security Bulletin MS03-007.
  • The RPC Locator exploit is a vulnerability that allows an attacker to execute codes on a target machine by sending a malformed packet request to the Locator service. The port related to this exploit is TCP port 445. This vulnerability is discussed in detail in Microsoft Security Bulletin MS03-001.
  • MS Workstation Service Vulnerability, which is a vulnerability that allows an attacker to gain system privileges on an affected system, or cause the Workstation service to fail. This vulnerability is discussed in detail in Microsoft Security Bulletin MS03-049.
  • The Windows LSASS Vulnerability, which is a buffer overrun that allows remote code execution and enables a malicious user to gain full control of the affected system. This vulnerability is discussed in detail in Microsoft Bulletin MS04-011 and Trend Micro's Vulnerability Description for MS04-011.

Program Termination

This worm terminates the following processes associated with antivirus and monitoring applications:

  • _AVP32.EXE
  • _AVPCC.EXE
  • _AVPM.EXE
  • ACKWIN32.EXE
  • ADAWARE.EXE
  • ADVXDWIN.EXE
  • AGENTSVR.EXE
  • AGENTW.EXE
  • ALERTSVC.EXE
  • ALEVIR.EXE
  • ALOGSERV.EXE
  • AMON9X.EXE
  • ANTI-TROJAN.EXE
  • ANTIVIRUS.EXE
  • ANTS.EXE
  • APIMONITOR.EXE
  • APLICA32.EXE
  • APVXDWIN.EXE
  • ARR.EXE
  • ATCON.EXE
  • ATGUARD.EXE
  • ATRO55EN.EXE
  • ATUPDATER.EXE
  • ATWATCH.EXE
  • AU.EXE
  • AUPDATE.EXE
  • AUTODOWN.EXE
  • AUTO-PROTECT.NAV80TRY.EXE
  • AUTOTRACE.EXE
  • AUTOUPDATE.EXE
  • AVCONSOL.EXE
  • AVE32.EXE
  • AVGCC32.EXE
  • AVGCTRL.EXE
  • AVGNT.EXE
  • AVGSERV.EXE
  • AVGSERV9.EXE
  • AVGUARD.EXE
  • AVGW.EXE
  • AVKPOP.EXE
  • AVKSERV.EXE
  • AVKSERVICE.EXE
  • AVKWCTl9.EXE
  • AVLTMAIN.EXE
  • AVNT.EXE
  • AVP.EXE
  • AVP32.EXE
  • AVPCC.EXE
  • AVPDOS32.EXE
  • AVPM.EXE
  • AVPTC32.EXE
  • AVPUPD.EXE
  • AVSCHED32.EXE
  • AVSYNMGR.EXE
  • AVWIN95.EXE
  • AVWINNT.EXE
  • AVWUPD.EXE
  • AVWUPD32.EXE
  • AVWUPSRV.EXE
  • AVXMONITOR9X.EXE
  • AVXMONITORNT.EXE
  • AVXQUAR.EXE
  • BACKWEB.EXE
  • BARGAINS.EXE
  • BD_PROFESSIONAL.EXE
  • BEAGLE.EXE
  • BELT.EXE
  • BIDEF.EXE
  • BIDSERVER.EXE
  • BIPCP.EXE
  • BIPCPEVALSETUP.EXE
  • BISP.EXE
  • BLACKD.EXE
  • BLACKICE.EXE
  • BLSS.EXE
  • BOOTCONF.EXE
  • BOOTWARN.EXE
  • BORG2.EXE
  • BPC.EXE
  • BRASIL.EXE
  • BS120.EXE
  • BUNDLE.EXE
  • BVT.EXE
  • CCAPP.EXE
  • CCEVTMGR.EXE
  • CCPXYSVC.EXE
  • CDP.EXE
  • CFD.EXE
  • CFGWIZ.EXE
  • CFIADMIN.EXE
  • CFIAUDIT.EXE
  • CFINET.EXE
  • CFINET32.EXE
  • Claw95.EXE
  • CLAW95CF.EXE
  • CLEAN.EXE
  • CLEANER.EXE
  • CLEANER3.EXE
  • CLEANPC.EXE
  • CLICK.EXE
  • CMD32.EXE
  • CMESYS.EXE
  • CMGRDIAN.EXE
  • CMON016.EXE
  • CONNECTIONMONITOR.EXE
  • CPD.EXE
  • CPF9X206.EXE
  • CPFNT206.EXE
  • CTRL.EXE
  • CV.EXE
  • CWNB181.EXE
  • CWNTDWMO.EXE
  • DATEMANAGER.EXE
  • DCOMX.EXE
  • DEFALERT.EXE
  • DEFSCANGUI.EXE
  • DEFWATCH.EXE
  • DEPUTY.EXE
  • DIVX.EXE
  • DLLCACHE.EXE
  • DLLREG.EXE
  • DOORS.EXE
  • DPF.EXE
  • DPFSETUP.EXE
  • DPPS2.EXE
  • DRWATSON.EXE
  • DRWEB32.EXE
  • DRWEBUPW.EXE
  • DSSAGENT.EXE
  • DVP95.EXE
  • DVP95_0.EXE
  • ECENGINE.EXE
  • EFPEADM.EXE
  • EMSW.EXE
  • ENT.EXE
  • ESAFE.EXE
  • ESCANH95.EXE
  • ESCANHNT.EXE
  • ESCANV95.EXE
  • ESPWATCH.EXE
  • ETHEREAL.EXE
  • ETRUSTCIPE.EXE
  • EVPN.EXE
  • EXANTIVIRUS-CNET.EXE
  • EXE.AVXW.EXE
  • EXPERT.EXE
  • EXPLORE.EXE
  • F-AGNT95.EXE
  • F-AGOBOT.EXE
  • FAMEH32.EXE
  • FAST.EXE
  • FCH32.EXE
  • FIH32.EXE
  • FINDVIRU.EXE
  • FIREWALL.EXE
  • FLOWPROTECTOR.EXE
  • FNRB32.EXE
  • FPROT.EXE
  • F-PROT.EXE
  • F-PROT95.EXE
  • FP-WIN.EXE
  • FP-WIN_TRIAL.EXE
  • FRW.EXE
  • FSAA.EXE
  • FSAV.EXE
  • FSAV32.EXE
  • FSAV530STBYB.EXE
  • FSAV530WTBYB.EXE
  • FSAV95.EXE
  • FSGK32.EXE
  • FSM32.EXE
  • FSMA32.EXE
  • FSMB32.EXE
  • F-STOPW.EXE
  • GATOR.EXE
  • GBMENU.EXE
  • GBPOLL.EXE
  • GENERICS.EXE
  • GMT.EXE
  • GUARD.EXE
  • GUARDDOG.EXE
  • HACKTRACERSETUP.EXE
  • HBINST.EXE
  • HBSRV.EXE
  • HIJACKTHIS.EXE
  • HOTACTIO.EXE
  • HOTPATCH.EXE
  • HTLOG.EXE
  • HTPATCH.EXE
  • HWPE.EXE
  • HXDL.EXE
  • HXIUL.EXE
  • IAMAPP.EXE
  • IAMSERV.EXE
  • IAMSTATS.EXE
  • IBMASN.EXE
  • IBMAVSP.EXE
  • ICLOAD95.EXE
  • ICLOADNT.EXE
  • ICMON.EXE
  • ICSUPP95.EXE
  • ICSUPPNT.EXE
  • IDLE.EXE
  • IEDLL.EXE
  • IEDRIVER.EXE
  • IEXPLORER.EXE
  • IFACE.EXE
  • IFW2000.EXE
  • INETLNFO.EXE
  • INFUS.EXE
  • INFWIN.EXE
  • INIT.EXE
  • INTDEL.EXE
  • INTREN.EXE
  • IOMON98.EXE
  • IPARMOR.EXE
  • IRIS.EXE
  • ISASS.EXE
  • ISRV95.EXE
  • ISTSVC.EXE
  • JAMMER.EXE
  • JDBGMRG.EXE
  • JEDI.EXE
  • KAVLITE40ENG.EXE
  • KAVPERS40ENG.EXE
  • KAVPF.EXE
  • KAZZA.EXE
  • KEENVALUE.EXE
  • KERIO-PF-213-EN-WIN.EXE
  • KERIO-WRL-421-EN-WIN.EXE
  • KERIO-WRP-421-EN-WIN.EXE
  • KERNEL32.EXE
  • KILLPROCESSSETUP161.EXE
  • LAUNCHER.EXE
  • LDNETMON.EXE
  • LDPRO.EXE
  • LDPROMENU.EXE
  • LDSCAN.EXE
  • LNETINFO.EXE
  • LOADER.EXE
  • LOCALNET.EXE
  • LOCKDOWN.EXE
  • LOCKDOWN2000.EXE
  • LOOKOUT.EXE
  • LORDPE.EXE
  • LSETUP.EXE
  • LUALL.EXE
  • LUAU.EXE
  • LUCOMSERVER.EXE
  • LUINIT.EXE
  • LUSPT.EXE
  • MAPISVC32.EXE
  • MCAGENT.EXE
  • MCMNHDLR.EXE
  • MCSHIELD.EXE
  • MCTOOL.EXE
  • MCUPDATE.EXE
  • MCVSRTE.EXE
  • MCVSSHLD.EXE
  • MD.EXE
  • MFIN32.EXE
  • MFW2EN.EXE
  • MFWENG3.02D30.EXE
  • MGAVRTCL.EXE
  • MGAVRTE.EXE
  • MGHTML.EXE
  • MGUI.EXE
  • MINILOG.EXE
  • MMOD.EXE
  • MONITOR.EXE
  • MOOLIVE.EXE
  • MOSTAT.EXE
  • MPFAGENT.EXE
  • MPFSERVICE.EXE
  • MPFTRAY.EXE
  • MRFLUX.EXE
  • MSAPP.EXE
  • MSBB.EXE
  • MSBLAST.EXE
  • MSCACHE.EXE
  • MSCCN32.EXE
  • MSCMAN.EXE
  • MSCONFIG.EXE
  • MSDM.EXE
  • MSDOS.EXE
  • MSIEXEC16.EXE
  • MSINFO32.EXE
  • MSLAUGH.EXE
  • MSMGT.EXE
  • MSMSGRI32.EXE
  • MSSMMC32.EXE
  • MSSYS.EXE
  • MSVXD.EXE
  • MU0311AD.EXE
  • MWATCH.EXE
  • N32SCANW.EXE
  • NAV.EXE
  • NAVAP.NAVAPSVC.EXE
  • NAVAPSVC.EXE
  • NAVAPW32.EXE
  • NAVDX.EXE
  • NAVENGNAVEX15.NAVLU32.EXE
  • NAVLU32.EXE
  • NAVNT.EXE
  • NAVSTUB.EXE
  • NAVW32.EXE
  • NAVWNT.EXE
  • NC2000.EXE
  • NCINST4.EXE
  • NDD32.EXE
  • NEOMONITOR.EXE
  • NEOWATCHLOG.EXE
  • NETARMOR.EXE
  • NETD32.EXE
  • NETINFO.EXE
  • NETMON.EXE
  • NETSCANPRO.EXE
  • NETSPYHUNTER-1.2.EXE
  • NETSTAT.EXE
  • NETUTILS.EXE
  • NISSERV.EXE
  • NISUM.EXE
  • NMAIN.EXE
  • NOD32.EXE
  • NORMIST.EXE
  • NORTON_INTERNET_SECU_3.0_407.EXE
  • NOTSTART.EXE
  • NPF40_TW_98_NT_ME_2K.EXE
  • NPFMESSENGER.EXE
  • NPROTECT.EXE
  • NPSCHECK.EXE
  • NPSSVC.EXE
  • NSCHED32.EXE
  • NSSYS32.EXE
  • NSTASK32.EXE
  • NSUPDATE.EXE
  • NT.EXE
  • NTRTSCAN.EXE
  • NTVDM.EXE
  • NTXconfig.EXE
  • NUI.EXE
  • NUPGRADE.EXE
  • NVARCH16.EXE
  • NVC95.EXE
  • NVSVC32.EXE
  • NWINST4.EXE
  • NWSERVICE.EXE
  • NWTOOL16.EXE
  • OLLYDBG.EXE
  • ONSRVR.EXE
  • OPTIMIZE.EXE
  • OSTRONET.EXE
  • OTFIX.EXE
  • OUTPOST.EXE
  • OUTPOSTINSTALL.EXE
  • OUTPOSTPROINSTALL.EXE
  • PADMIN.EXE
  • PANIXK.EXE
  • PATCH.EXE
  • PAVCL.EXE
  • PAVPROXY.EXE
  • PAVSCHED.EXE
  • PAVW.EXE
  • PCC2002S902.EXE
  • PCC2K_76_1436.EXE
  • PCCIOMON.EXE
  • PCCNTMON.EXE
  • PCCWIN97.EXE
  • PCCWIN98.EXE
  • PCDSETUP.EXE
  • PCFWALLICON.EXE
  • PCIP10117_0.EXE
  • PCSCAN.EXE
  • PDSETUP.EXE
  • PENIS.EXE
  • PERISCOPE.EXE
  • PERSFW.EXE
  • PERSWF.EXE
  • PF2.EXE
  • PFWADMIN.EXE
  • PGMONITR.EXE
  • PINGSCAN.EXE
  • PLATIN.EXE
  • POP3TRAP.EXE
  • POPROXY.EXE
  • POPSCAN.EXE
  • PORTDETECTIVE.EXE
  • PORTMONITOR.EXE
  • POWERSCAN.EXE
  • PPINUPDT.EXE
  • PPTBC.EXE
  • PPVSTOP.EXE
  • PRIZESURFER.EXE
  • PRMT.EXE
  • PRMVR.EXE
  • PROCDUMP.EXE
  • PROCESSMONITOR.EXE
  • PROCEXPLORERV1.0.EXE
  • PROGRAMAUDITOR.EXE
  • PROPORT.EXE
  • PROTECTX.EXE
  • PSPF.EXE
  • PURGE.EXE
  • PUSSY.EXE
  • PVIEW95.EXE
  • QCONSOLE.EXE
  • QSERVER.EXE
  • RAPAPP.EXE
  • RAV7.EXE
  • RAV7WIN.EXE
  • RAV8WIN32ENG.EXE
  • RAY.EXE
  • RB32.EXE
  • RCSYNC.EXE
  • REALMON.EXE
  • REGED.EXE
  • REGEDIT.EXE
  • REGEDT32.EXE
  • RESCUE.EXE
  • RESCUE32.EXE
  • RRGUARD.EXE
  • RSHELL.EXE
  • RTVSCAN.EXE
  • RTVSCN95.EXE
  • RULAUNCH.EXE
  • RUN32DLL.EXE
  • RUNDLL.EXE
  • RUNDLL16.EXE
  • RUXDLL32.EXE
  • SAFEWEB.EXE
  • SAHAGENT.EXE
  • SAVE.EXE
  • SAVENOW.EXE
  • SBSERV.EXE
  • SC.EXE
  • SCAM32.EXE
  • SCAN32.EXE
  • SCAN95.EXE
  • SCANPM.EXE
  • SCRSCAN.EXE
  • SCRSVR.EXE
  • SCVHOST.EXE
  • SD.EXE
  • SERV95.EXE
  • SERVICE.EXE
  • SERVLCE.EXE
  • SERVLCES.EXE
  • SETUP_FLOWPROTECTOR_US.EXE
  • SETUPVAMEEVAL.EXE
  • SFC.EXE
  • SGSSFW32.EXE
  • SH.EXE
  • SHELLSPYINSTALL.EXE
  • SHN.EXE
  • SHOWBEHIND.EXE
  • SMC.EXE
  • SMS.EXE
  • SMSS32.EXE
  • SOAP.EXE
  • SOFI.EXE
  • SPERM.EXE
  • SPF.EXE
  • SPHINX.EXE
  • SPOLER.EXE
  • SPOOLCV.EXE
  • SPOOLSV32.EXE
  • SPYXX.EXE
  • SREXE.EXE
  • SRNG.EXE
  • SS3EDIT.EXE
  • SSG_4104.EXE
  • SSGRATE.EXE
  • ST2.EXE
  • START.EXE
  • STCLOADER.EXE
  • SUPFTRL.EXE
  • SUPPORT.EXE
  • SUPPORTER5.EXE
  • SVC.EXE
  • SVCHOSTC.EXE
  • SVCHOSTS.EXE
  • SVSHOST.EXE
  • SWEEP95.EXE
  • SWEEPNET.SWEEPSRV.SYS.SWNETSUP.EXE
  • SYMPROXYSVC.EXE
  • SYMTRAY.EXE
  • SYSEDIT.EXE
  • SYSTEM.EXE
  • SYSTEM32.EXE
  • SYSUPD.EXE
  • TASKMG.EXE
  • TASKMO.EXE
  • TASKMON.EXE
  • TAUMON.EXE
  • TBSCAN.EXE
  • TC.EXE
  • TCA.EXE
  • TCM.EXE
  • TDS2-98.EXE
  • TDS2-NT.EXE
  • TDS-3.EXE
  • TEEKIDS.EXE
  • TFAK.EXE
  • TFAK5.EXE
  • TGBOB.EXE
  • TITANIN.EXE
  • TITANINXP.EXE
  • TRACERT.EXE
  • TRICKLER.EXE
  • TRJSCAN.EXE
  • TRJSETUP.EXE
  • TROJANTRAP3.EXE
  • TSADBOT.EXE
  • TVMD.EXE
  • TVTMD.EXE
  • UNDOBOOT.EXE
  • UPDAT.EXE
  • UPDATE.EXE
  • UPGRAD.EXE
  • UTPOST.EXE
  • VBCMSERV.EXE
  • VBCONS.EXE
  • VBUST.EXE
  • VBWIN9X.EXE
  • VBWINNTW.EXE
  • VCSETUP.EXE
  • VET32.EXE
  • VET95.EXE
  • VETTRAY.EXE
  • VFSETUP.EXE
  • VIR-HELP.EXE
  • VIRUSMDPERSONALFIREWALL.EXE
  • VNLAN300.EXE
  • VNPC3000.EXE
  • VPC32.EXE
  • VPC42.EXE
  • VPFW30S.EXE
  • VPTRAY.EXE
  • VSCAN40.EXE
  • VSCENU6.02D30.EXE
  • VSCHED.EXE
  • VSECOMR.EXE
  • VSHWIN32.EXE
  • VSISETUP.EXE
  • VSMAIN.EXE
  • VSMON.EXE
  • VSSTAT.EXE
  • VSWIN9XE.EXE
  • VSWINNTSE.EXE
  • VSWINPERSE.EXE
  • W32DSM89.EXE
  • W9X.EXE
  • WATCHDOG.EXE
  • WEBDAV.EXE
  • WEBSCANX.EXE
  • WEBTRAP.EXE
  • WFINDV32.EXE
  • WGFE95.EXE
  • WHOSWATCHINGME.EXE
  • WIMMUN32.EXE
  • WIN32.EXE
  • WIN32US.EXE
  • WINACTIVE.EXE
  • WIN-BUGSFIX.EXE
  • WINDOW.EXE
  • WINDOWS.EXE
  • WININETD.EXE
  • WININIT.EXE
  • WININITX.EXE
  • WINLOGIN.EXE
  • WINMAIN.EXE
  • WINNET.EXE
  • WINPPR32.EXE
  • WINRECON.EXE
  • WINSERVN.EXE
  • WINSSK32.EXE
  • WINSTART.EXE
  • WINSTART001.EXE
  • WINTSK32.EXE
  • WINUPDATE.EXE
  • WKUFIND.EXE
  • WNAD.EXE
  • WNT.EXE
  • WRADMIN.EXE
  • WRCTRL.EXE
  • WSBGATE.EXE
  • WUPDATER.EXE
  • WUPDT.EXE
  • WYVERNWORKSFIREWALL.EXE
  • XPF202EN.EXE
  • ZAPRO.EXE
  • ZAPSETUP3001.EXE
  • ZATUTOR.EXE
  • ZONALM2601.EXE
  • ZONEALARM.EXE

Modifying the HOSTS file

This worm modifies the HOSTS file, which contains the host name to IP address mappings. This file is usually located in the following folder:

    %System%\drivers\etc

(Note: %System% is the Windows system folder.)

It appends data to this file, which prevents the user from accessing any of the following antivirus and security-related Web sites:

  • www.symantec.com
  • securityresponse.symantec.com
  • symantec.com
  • www.sophos.com
  • sophos.com
  • www.mcafee.com
  • mcafee.com
  • liveupdate.symantecliveupdate.com
  • www.viruslist.com
  • viruslist.com
  • viruslist.com
  • f-secure.com
  • www.f-secure.com
  • kaspersky.com
  • www.avp.com
  • www.kaspersky.com
  • avp.com
  • www.networkassociates.com
  • networkassociates.com
  • www.ca.com
  • ca.com
  • mast.mcafee.com
  • my-etrust.com
  • www.my-etrust.com
  • download.mcafee.com
  • dispatch.mcafee.com
  • secure.nai.com
  • nai.com
  • www.nai.com
  • update.symantec.com
  • updates.symantec.com
  • us.mcafee.com
  • liveupdate.symantec.com
  • customer.symantec.com
  • rads.mcafee.com
  • trendmicro.com
  • www.trendmicro.com

Distributed Denial of Service Attacks

This worm also tries to post a large amount of data on the following URLs as if performing a distributed denial of service (DDoS) attack:

  • de.yahoo.com
  • nitro.ucsc.edu
  • verio.fr
  • www.1und1.de
  • www.above.net
  • www.belwue.de
  • www.burst.net
  • www.cogentco.com
  • www.d1asia.com
  • www.level3.com
  • www.lib.nthu.edu.tw
  • www.nifty.com
  • www.nocster.com
  • www.rit.edu
  • www.schlund.net
  • www.st.lib.keio.ac.jp
  • www.stanford.edu
  • www.switch.ch
  • www.utwente.nl
  • www.verio.com
  • www.xo.net
  • yahoo.co.jp

Other Details

This worm is compressed using Morphine, and is compiled in C%20%20.




Analysis by: Broderick Aquilino


SOLUTION


Minimum scan engine version needed: 6.810

Pattern file needed: 2.169.24

Pattern release date: Sep 4, 2004


Important note: The "Minimum scan engine" refers to the earliest Trend Micro scan engine version guaranteed to detect this threat. However, Trend Micro strongly recommends that you update to the latest version in order to get comprehensive protection. Download the latest scan engine here.

Solution:

Terminating the Malware Program

This procedure terminates the running malware process.

  1. Open Windows Task Manager.
    � On Windows NT, 2000, and XP, press
    CTRL%20SHIFT%20ESC, then click the Processes tab.
  2. In the list of running programs, locate the process:
    DLLSVC32.EXE
  3. Select the malware process, then press either the End Task or the End Process button, depending on the version of Windows on your system.
  4. To check if the malware process has been terminated, close Task Manager, and then open it again.
  5. Close Task Manager.

Removing Autostart Entries from the Registry

Removing autostart entries from the registry prevents the malware from executing at startup.

  1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
  2. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>
    Windows>CurrentVersion>Run>
  3. In the right panel, locate and delete the entry or entries:
    DLLService32 = "dllsvc32.exe"
  4. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>
    Windows>CurrentVersion>RunServices
  5. In the right panel, locate and delete the entry or entries:
    DLLService32 = "dllsvc32.exe"
  6. Close the Registry Editor.

NOTE: If you were not able to terminate the malware process as described in the previous procedure, restart your system.

Removing Malware Entries from the HOSTS file

Deleting malware entries from the HOSTS file prevents the redirection of antivirus Web sites to the local machine.

  1. Open the following file using a text editor (such as NOTEPAD):
    %System%\drivers\etc\HOSTS
    (Note: %System% is the Windows system folder, which is usually C:\WINNT\System32 on Windows NT and 2000, and C:\Windows\System32 on Windows XP.)
  2. Delete the following entries:
    • 127.0.0.1 avp.com
    • 127.0.0.1 ca.com
    • 127.0.0.1 customer.symantec.com
    • 127.0.0.1 dispatch.mcafee.com
    • 127.0.0.1 download.mcafee.com
    • 127.0.0.1 f-secure.com
    • 127.0.0.1 kaspersky.com
    • 127.0.0.1 liveupdate.symantec.com
    • 127.0.0.1 liveupdate.symantecliveupdate.com
    • 127.0.0.1 mast.mcafee.com
    • 127.0.0.1 mcafee.com
    • 127.0.0.1 my-etrust.com
    • 127.0.0.1 nai.com
    • 127.0.0.1 networkassociates.com
    • 127.0.0.1 rads.mcafee.com
    • 127.0.0.1 secure.nai.com
    • 127.0.0.1 securityresponse.symantec.com
    • 127.0.0.1 sophos.com
    • 127.0.0.1 symantec.com
    • 127.0.0.1 trendmicro.com
    • 127.0.0.1 update.symantec.com
    • 127.0.0.1 updates.symantec.com
    • 127.0.0.1 us.mcafee.com
    • 127.0.0.1 viruslist.com
    • 127.0.0.1 www.avp.com
    • 127.0.0.1 www.ca.com
    • 127.0.0.1 www.f-secure.com
    • 127.0.0.1 www.kaspersky.com
    • 127.0.0.1 www.mcafee.com
    • 127.0.0.1 www.my-etrust.com
    • 127.0.0.1 www.nai.com
    • 127.0.0.1 www.networkassociates.com
    • 127.0.0.1 www.sophos.com
    • 127.0.0.1 www.symantec.com
    • 127.0.0.1 www.trendmicro.com
    • 127.0.0.1 www.viruslist.com
  3. Save the file and close the text editor.

Additional Windows ME/XP Cleaning Instructions

Running Trend Micro Antivirus

Scan your system with Trend Micro antivirus and delete all files detected as WORM_AGOBOT.VX. To do this, Trend Micro customers must download the latest pattern file and scan their system. Other Internet users can use HouseCall, Trend Micro's free online virus scanner.

RECOMMENDATIONS

Applying Patches

This malware exploits known vulnerabilities affecting the Windows NT platforms. Download and install the following patches to secure your system:

Refrain from using your Microsoft product until the appropriate patch has been installed. Trend Micro advises users to download critical patches upon release by vendors.


Trend Micro offers best-of-breed antivirus and content-security solutions for your corporate network, small and medium business, mobile device or home PC.