The Web    Google
1/24: Worm_Agobot-AGK Exploits Windows Flaws

1/24: Worm_Agobot-AGK Exploits Windows Flaws
January 24, 2005

Worm_Agobot.AGK takes advantage of Windows vulnerabilities. They are:

  • IIS5/WEBDAV Buffer Overflow vulnerability
  • Remote Procedure Call (RPC) Distributed Component Object Model (DCOM) vulnerability
  • Buffer Overflow in SQL Server 2000 vulnerability

    For more information about these Windows vulnerabilities, please refer to the following Microsoft Web pages:

    Microsoft Security Bulletin MS03-026
    Microsoft Security Bulletin MS03-007
    Microsoft Security Bulletin MS02-061

    It also attempts to log on to systems using a list of user names and passwords. It drops a copy of itself into accessible machines.

    This worm has backdoor capabilities. It executes commands sent in via Internet Relay Chat (IRC) and can be used to launch a Denial of Service (DoS) attack against specified target sites.

    It terminates certain antivirus processes and files dropped by other malware. It steals Microsoft Windows product IDs, AOL passwords and the CD keys of popular game applications.

    It prevents the user from accessing several antivirus and security-related Web sites.

    Technical details can be found at Trend Micro page.

  • 1/25: Sdbot-TW Worm Has Backdoor Functions
  • 3/7: Forbot-ER Worm Contains Backdoor Functions
  • 9/24: JPGDownloader Creates Images
  • House to Create Homeland Security Oversight Committee
  • 1/18: Zar Worm Sends Tsunami Email
  • 4/8: Mytob-AB Worm Comes as Attachment
  • 4/7: Rbot-AAF Worm Hits Network Shares
  • Hackers After Patched WINS Servers
  • WiFi Security Concerns Easing
  • AntiOnline Spotlight: Network Security Made Easy?
  • AntiOnline Spotlight: Trojan Force
  • Compare Security Camera Products