English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

Backdoor.Win32.Agobot.gen

Detected Nov 10 2003 07:50 GMT
Released Jan 22 2010 18:37 GMT
Published Nov 10 2003 07:50 GMT

Technical Details

This is a classical backdoor and allows a 'master' to control the victim machine remotely by sending commands via IRC channels.

Installation

Agobot copies itself into the Windows directory under random names and then registers itself in the system registry auto-run keys:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

Manifestations

Agobot connects to various IRC servers opening channels identified in the body of the worm. It is then ready to receive commands from the 'master', who can now download and launch files on the victim machine, scan other computers for vulnerabilities and install itself on these vulnerable machines.
Bookmark and Share
Share
Backdoor

Backdoors are designed to give malicious users remote control over an infected computer. In terms of functionality, Backdoors are similar to many administration systems designed and distributed by software developers.

These types of malicious programs make it possible to do anything the author wants on the infected computer: send and receive files, launch files or delete them, display messages, delete data, reboot the computer, etc.

The programs in this category are often used in order to unite a group of victim computers and form a botnet or zombie network. This gives malicious users centralized control over an army of infected computers which can then be used for criminal purposes.

There is also a group of Backdoors which are capable of spreading via networks and infecting other computers as Net-Worms do. The difference is that such Backdoors do not spread automatically (as Net-Worms do), but only upon a special “command” from the malicious user that controls them.


Other versions

Aliases

Backdoor.Win32.Agobot.gen (Kaspersky Lab) is also known as:

  • Backdoor.Agobot.gen (Kaspersky Lab)
  • Backdoor.Agobot.3.gen (Kaspersky Lab)
  • Virus: W32/Gaobot.worm.gen.d (McAfee)
  • W32/Agobot-Gen (Sophos)
  • Trojan.Mybot-1485 (ClamAV)
  • W32/Gaobot.gen.worm (Panda)
  • W32/Heuristic-210!Eldorado (FPROT)
  • Trojan:Win32/Gaobot.gen (MS(OneCare))
  • Win32.IRC.Bot.based (DrWeb)
  • Win32/Agobot trojan (Nod32)
  • Generic.Sdbot.A7A0E5C1 (BitDef7)
  • Worm.SdBot.Gen.26 (VirusBuster)
  • Win32:GaoBot-ATY [Wrm] (AVAST)
  • Backdoor.Win32.Agobot (Ikarus)
  • Worm/Agobot.GIH (AVG)
  • TR/Crypt.XPACK.Gen (AVIRA)
  • W32.HLLW.Gaobot.gen (NAV)
  • NseCheckFile2() returned 0x00010018 (Norman)
  • WORM_SDBOT.GEN-1 (TrendMicro)
  • Worm.SdBot.Gen.26 (VirusBusterBeta)