SWEEP95.EXE, BLACKICE.EXE and ZONEALARM.EXE). W32/Agobot-BT attempts to terminate various processes related to anti-virus and security software (e.g. HKLMSoftwareMicrosoftWindowsCurrentVersionRunServicesĮach time W32/Agobot-BT is run it attempts to connect to a remote IRC server and join a specific channel. HKLMSoftwareMicrosoftWindowsCurrentVersionRun W32/Agobot-BT copies itself to the Windows system folder as sysinfo.exe and creates the following registry entries to run itself on system restart: MS03-026 has been superseded by Microsoft security bulletin MS03-039. For further information on these vulnerabilities and for details on how to protect/patch the computer against such attacks please see Microsoft security bulletins MS03-001 and MS03-026. These vulnerabilities allow the worm to execute its code on target computers with System level privileges. W32/Agobot-BT copies itself to network shares with weak passwords and attempts to spread to computers using the DCOM RPC and the RPC locator vulnerabilities. W32/Agobot-BT is a network worm which also allows unauthorised remote access to the computer via IRC channels.
They terminate any virus processes and reset any registry keys that the virus changed.Įxisting infections can be cleaned up quickly and easily, both on individual workstations and over networks with large numbers of computers. Resolve is the name for a set of small, downloadable Sophos utilities designed to remove and undo the changes made by certain viruses, Trojans and worms.
0 kommentar(er)
