Name :	Agent.AGW
Size:	1,012,736 bytes
Category:	Trojan
Type:	Backdoor
Platform:	Win32
Date of Discovery:	September 04, 2006

Agent.AGW is a backdoor program that allows contol over a victim's computers remotely by sending specific commands via IRC channels. This backdoor can also steal data, spread to a local network, and to computers vulnerable to exploits.

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.

Agent.AGW is a backdoor program that allows control over a victim's computers remotely by sending specific commands via IRC channels. This backdoor can also steal data, spread to a local network, and to computers vulnerable to exploits.

Upon execution, it drops the following files:


Note: %WinDir%" represents the Windows root directory and "%SysDir%" represents the Windows System directory.

It installs itself as a service by creating the following registry keys:



It installs itself as a service by creating the following registry keys:



It creates the following registry entries to lower the system's security settings:



It creates the following registry entries to disable Administrative Shares in NT4.0 Server and Workstation:



Agent.AGW also modifies the following registry entries to disable and restrict anonymous access and DCOM network binding:


Note: the default value is EnableDCOM = "Y".


Note: The default value for restrictanonymous is user dependent.

Agent.AGW also disables automatic update of Service Pack 2 in Windows XP by changing the following registry entry:


Note: The default value for DoNotAllowXPSP2 = "0".

It modifies the following regsitry entry to shorten the waiting time for services to stop after service notification of system Shutdown:


Note: This is equivalent to 7 seconds. The default value is WaitToKillServiceTimeout= "20000", which is equivalent to 20 seconds.

It also disables the Messenger, Remote Registry, Security Center, and Telnet services respectively by modifiying the following regsitry entries:


Note: Default value is Start = "dword:00000002".


Note: Default value for Start = "dword:00000002".


Note: Default value is Start = "dword:00000002".


Note: Default value is Start = "dword:00000003".

Agent.AGW attempts to connect to the following IRC server:



It attempts to join the following IRC channels:



Once successfully connected, a hacker can send commands to the bots on the IRC channel to control the infected computer. It has the ability to do the following:



When spreading, the bot can exploit the following vulnerabilities:



It uses the following user accounts:


- to connect to the target machine's hidden shares:


- by using the following list of weak passwords:



It also tries to steal usernames and passwords from the following known applications: