Re: New Worm Discovery - Potential Korgo Variant

["Helmut Hauser" <helmut.hauser () intraplan de>]

In my opinion
this is an unknown Agobot variant [as told from NAI]

TrendMicro calls it:
http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=DOS_AGOBOT%2EGEN
(it changes the host file)
It is packed with one of the latest PECompact.

Put itself in the usual suspect run keys + services as Display Driver
VDisp.exe

Run autoruns from www.sysinternals.com, there are the entries for startup

Would it never stop ?

The author of agobot was (thankfully) arrested, but the source is in the
wild
and some script kiddies are still there :(

Helmut Hauser

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html