Home Malware Programs Worms Net-Worm.Agobot

Net-Worm.Agobot

Posted: March 24, 2011

Net-Worm.Agobot is a worm with variations that sometimes possess Trojan or virus-like properties. These functions allow Net-Worm.Agobot to damage files by infecting them and downloading other malware onto your PC. As a worm, Net-Worm.Agobot can spread to new computers through networks and removable drives. Net-Worm.Agobot has also been documented to hijack the user's email accounts and use them for spamming itself and other malware to contacts. You should be careful with any email from an unknown contact if it contains a file that isn't immediately verified as trustworthy, since this file can just as easily be Net-Worm.Agobot or another worm as it can be a genuine file sent by a friend.

Net-Worm.Agobot is a Worm and So Much More

Net-Worm.Agobot has the ability to infect computers through network-shared folders, particularly write-accessible ones that allow the worm to copy itself over directly. Even in non-write-accessible networked computers, Net-Worm.Agobot can use Autorun-based exploits to infect a computer as soon as the shared folder is accessed.

These same tactics also translate over well into infecting removable drives. Any user of a Net-Worm.Agobot-infected computer should take care not to let their removable drive devices, like USB thumb drives, come into contact with other computers. All these files have the Hidden attribute to avoid detection, and Net-Worm.Agobot itself will run as a background process by changing the Windows Registry, so the activity isn't easy to catch.

Net-Worm.Agobot's potential non-worm functions, which differ between versions of this malware, can include:

  • Downloading other malware onto your PC. Malware can take the form of spyware that steal online banking information or other sensitive data, rogue anti-virus applications that fake the appearance of legitimate security products or backdoor Trojans that attack your firewall and other security.
  • Net-Worm.Agobot may also append Net-Worm.Agobo's own body of code onto other files. This can potentially damage the original files and infects them so that Net-Worm.Agobot is difficult to delete and can spread when the infected files are shared.
  • Some sources report that Net-Worm.Agobot is able to hijack email accounts. This allows Net-Worm.Agobot to harvest your own contacts to for spamming while making it appear that the messages originate from you. Compromised contacts and accounts may also be sent to criminals to use for other kinds of spam and illegal activities.
  • Net-Worm.Agobot infections have also been reported to contact remote IRC servers. Contact with remote IRC servers can let Net-Worm.Agobot download other malware or allow Net-Worm.Agobot to enslave your machine into a botnet.

Spring Cleaning the Net-Worm.Agobot's Vermin Out

Deleting Net-Worm.Agobot by removing the relevant files one by one is extremely inefficient – the variant of this worm on your PC might be able to infect innocent files or hide copies of itself in troublesome locations. An anti-malware application that's designed to clean up Net-Worm.Agobot infections without damaging your system files is the preferable solution.

Keep your anti-malware scanners updated with the latest available malware threat definitions, since new versions of Net-Worm.Agobot may beat security products equipped with outdated references. There are known solutions for the Net-Worm.Agobot infection, but you should resort to them quickly, lest the system damage grow to a situation where it's impossible to take the right steps to end this worm threat once and for all.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %System%\wincrt32.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BFHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BF\0000HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\bFHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\bF\SecurityHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

Related Posts

Loading...