Summary

The Agobot.f variant was reported by several customers in the beginning of September 2003. This backdoor has functionality similar to previous variants. The generic description of Agobot can be found here:

http://www.europe.f-secure.com/v-descs/agobot.shtml

Disinfection

The most important step of disinfection is the installation of security patches for the vulnerabilities exploited by Agobot.

Detailed information and patches are available from the following pages:

RPC/DCOM (MS03-026, fixed by MS03-039):

http://www.microsoft.com/technet/security/bulletin/MS03-039.asp

RPC/Locator (MS03-001):

http://www.microsoft.com/technet/security/bulletin/MS03-001.asp

WebDAV (MS03-007):

http://www.microsoft.com/technet/security/bulletin/MS03-007.asp

The neccessary patches can be downloaded from the pages above under the "Patch availability" section.

F-Secure Anti-Virus with the latest updates can detect and delete the Agobot infected files.

Additional Details

System infection

When Agobot enters a system first it copies itself to the System Directory using the filename 'scvhost.exe'. This file is then added to the registry as

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Config Loader]

and

[HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\Config Loader]

IRC backdoor

After startup Agobot connects to a predefined IRC server on port 9900. On the server it joins a channel and awaits for further commands.

The IRC interface provides the remote attacker with a set of commands to

- control the bot (IRC name it uses, IRC channel, etc.)

- download and execute arbitrary programs on the computer

- scan for vulnerable hosts and install the worm on them

- perform Distributed Denial of Service (DDoS) attacks

- use the infected as a TCP proxy

- steal CD keys of games

Network propagation

Agobot has several different methods to spread through the network.

The RPC/DCOM and RPC/Locator vulnerability based spreading routines are enabled by default. The worm starts to scan for vulnerable hosts with these upon execution.

Using these exploits Agobot scans random IP addresses. If it can successfully penetrate a host it downloads itself there. The download comes from the attacker host from a random port where the worm runs a simple server that responds with the worm as an answer when connected. The worm is copied to a file on the remote host to a file called 'winhlpp32.exe' and started.

Other method of spreading uses the WebDAV (MS03-007) vulnerability to copy the worm to the remote host.

To propagate in local area networks Agobot has a separate routine that connect to Windows computers and tries to copy itself using the Administrator account trying with different trivial passwords. The worm has the translated names for administrator (eg. Administrateur) and a list of insecure passwords like 'password', 'xyz' etc.

Detection

Detection in F-Secure Anti-Virus was published on 9th of September, 2003 in update:

[FSAV_Database_Version]
Version=2003-09-09_04

Technical Details: Gergely Erdelyi; September 9th, 2003;

Description Updated: Alexey Podrezov, October 17th, November 26th, 2003;

F-Secure Corporation