Agent.AGW is a backdoor program that allows contol over a victim's computers remotely by sending specific commands via IRC channels. This backdoor can also steal data, spread to a local network, and to computers vulnerable to exploits.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Agent.AGW is a backdoor program that allows control over a victim's computers remotely by sending specific commands via IRC channels. This backdoor can also steal data, spread to a local network, and to computers vulnerable to exploits.
Upon execution, it drops the following files:
Note: %WinDir%" represents the Windows root directory and "%SysDir%" represents the Windows System directory.
It installs itself as a service by creating the following registry keys:
It installs itself as a service by creating the following registry keys:
It creates the following registry entries to lower the system's security settings:
It creates the following registry entries to disable Administrative Shares in NT4.0 Server and Workstation:
Agent.AGW also modifies the following registry entries to disable and restrict anonymous access and DCOM network binding:
Note: the default value is EnableDCOM = "Y".
Note: The default value for restrictanonymous is user dependent.
Agent.AGW also disables automatic update of Service Pack 2 in Windows XP by changing the following registry entry:
Note: The default value for DoNotAllowXPSP2 = "0".
It modifies the following regsitry entry to shorten the waiting time for services to stop after service notification of system Shutdown:
Note: This is equivalent to 7 seconds. The default value is WaitToKillServiceTimeout= "20000", which is equivalent to 20 seconds.
It also disables the Messenger, Remote Registry, Security Center, and Telnet services respectively by modifiying the following regsitry entries:
Note: Default value is Start = "dword:00000002".
Note: Default value for Start = "dword:00000002".
Note: Default value is Start = "dword:00000002".
Note: Default value is Start = "dword:00000003".
Agent.AGW attempts to connect to the following IRC server:
It attempts to join the following IRC channels:
Once successfully connected, a hacker can send commands to the bots on the IRC channel to control the infected computer. It has the ability to do the following:
When spreading, the bot can exploit the following vulnerabilities:
It uses the following user accounts:
- to connect to the target machine's hidden shares:
- by using the following list of weak passwords:
It also tries to steal usernames and passwords from the following known applications: