BackDoor.Agobot.3.gen

病毒名称:

BackDoor.Agobot.3.gen

类别： 后门病毒

病毒资料：

破坏方法：

后门程序，启动后将自己安装到系统目录下，在后台隐藏运行，并在注册表中添加以下的键值以达到自启动的目的。

1

HKEY_LOCAL_MACHINE\Software\Microsoft

\Windows\Currentversion\Run

Windows Update : winupdate.exe

2

HKEY_LOCAL_MACHINE\Software\Microsoft

\Windows\Currentversion\RunServices

Windows Update : winupdate.exe

此病毒还会将自己注册成系统的服务程序，服务显示名为Windows Update

此病毒在后台运行时会恶意结束一下的反病毒软件的进程

zonealarm.EXE

zapro.EXE

vsmon.EXE

vshwin32.EXE

vbcmserv.EXE

sbserv.EXE

rtvscan.EXE

rapapp.EXE

pcscan.EXE

pccwin97.EXE

pccntmon.EXE

pavproxy.EXE

nvsvc32.EXE

ntrtscan.EXE

npscheck.EXE

notstart.EXE

lockdown2000.EXE

iamserv.EXE

iamapp.EXE

gbpoll.EXE

gbmenu.EXE

fsmb32.EXE

fsma32.EXE

fsm32.EXE

fsgk32.EXE

fsav32.EXE

fsaa.EXE

fnrb32.EXE

fih32.EXE

fch32.EXE

fameh32.EXE

f-stopw.EXE

defscangui.EXE

defalert.EXE

cpd.EXE

cleaner3.EXE

cleaner.EXE

ccPxySvc.EXE

ccEvtMgr.EXE

ccApp.EXE

blackd.EXE

avpm.EXE

avkwctl9.EXE

avkservice.EXE

avkpop.EXE

apvxdwin.EXE

agentw.EXE

_AVPM.EXE

_AVPCC.EXE

_AVP32.EXE

ZONEALARM.EXE

ZONALM2601.EXE

ZAUINST.EXE

ZATUTOR.EXE

ZAPSETUP3001.EXE

ZAPRO.EXE

XPF202EN.EXE

WrCtrl.EXE

WrAdmin.EXE

WYVERNWORKSFIREWALL.EXE

WSBGATE.EXE

WRCTRL.EXE

WRADMIN.EXE

WNT.EXE

WINRECON.EXE

WIMMUN32.EXE

WHOSWATCHINGME.EXE

WGFE95.EXE

WFINDV32.EXE

WEBTRAP.EXE

WEBSCANX.EXE

WATCHDOG.EXE

W9X.EXE

W32DSM89.EXE

VetTray.EXE

Vet95.EXE

VbCons.EXE

VSWINPERSE.EXE

VSWINNTSE.EXE

VSWIN9XE.EXE

VSSTAT.EXE

VSMON.EXE

VSMAIN.EXE

VSISETUP.EXE

VSECOMR.EXE

VSCHED.EXE

VSCENU6.02D30.EXE

VSCAN40.EXE

VPTRAY.EXE

VPFW30S.EXE

VPC42.EXE

VPC32.EXE

VNPC3000.EXE

VNLAN300.EXE

VIRUSMDPERSONALFIREWALL.EXE

VIR-HELP.EXE

VFSETUP.EXE

VETTRAY.EXE

VET95.EXE

VET32.EXE

VCSETUP.EXE

VBWINNTW.EXE

VBWIN9X.EXE

VBUST.EXE

VBCONS.EXE

VBCMSERV.EXE

UPDATE.EXE

UNDOBOOT.EXE

TROJANTRAP3.EXE

TRJSETUP.EXE

TRJSCAN.EXE

TRACERT.EXE

TITANINXP.EXE

TITANIN.EXE

TGBOB.EXE

TFAK5.EXE

TFAK.EXE

TDS2-NT.EXE

TDS2-98.EXE

TDS-3.EXE

TCM.EXE

TCA.EXE

TBSCAN.EXE

TAUMON.EXE

TASKMON.EXE

SymProxySvc.EXE

SweepNet.SWEEPSRV.SYS.SWNETSUP.EXE

Sphinx.EXE

SYSEDIT.EXE

SYMTRAY.EXE

SYMPROXYSVC.EXE

SWEEP95.EXE

SUPPORTER5.EXE

SUPFTRL.EXE

ST2.EXE

SS3EDIT.EXE

SPYXX.EXE

SPHINX.EXE

SPF.EXE

SOFI.EXE

SMC.EXE

SHN.EXE

SHELLSPYINSTALL.EXE

SGSSFW32.EXE

SFC.EXE

SETUP_FLOWPROTECTOR_US.EXE

SETUPVAMEEVAL.EXE

SERV95.EXE

SCRSCAN.EXE

SCANPM.EXE

SCAN95.EXE

SCAN32.EXE

SBSERV.EXE

SAFEWEB.EXE

RULAUNCH.EXE

RTVSCN95.EXE

RSHELL.EXE

RRGUARD.EXE

RESCUE32.EXE

RESCUE.EXE

REGEDT32.EXE

REGEDIT.EXE

REALMON.EXE

RAV8WIN32ENG.EXE

RAV7WIN.EXE

RAV7.EXE

QSERVER.EXE

QCONSOLE.EXE

PVIEW95.EXE

PURGE.EXE

PSPF.EXE

PROTECTX.EXE

PROPORT.EXE

PROGRAMAUDITOR.EXE

PROCEXPLORERV1.0.EXE

PROCESSMONITOR.EXE

PPVSTOP.EXE

PPTBC.EXE

PPINUPDT.EXE

PORTMONITOR.EXE

PORTDETECTIVE.EXE

POPSCAN.EXE

POPROXY.EXE

POP3TRAP.EXE

PLATIN.EXE

PINGSCAN.EXE

PFWADMIN.EXE

PF2.EXE

PERSWF.EXE

PERSFW.EXE

PERISCOPE.EXE

PDSETUP.EXE

PCIP10117_0.EXE

PCFWALLICON.EXE

PCDSETUP.EXE

PCCWIN98.EXE

PCCIOMON.EXE

PCC2K_76_1436

病毒的清除法：

使用光华反病毒软件，彻底删除。

病毒演示：

病毒FAQ：

Windows下的PE病毒。

发现日期：

2003-12-8

• ·Backdoor.SdBot.bq.enc
• ·Backdoor.Spyboter.ab.en
• ·Backdoor.Death.27.d.enc
• ·Backdoor.Agobot.3.ac.en
• ·Backdoor.Agobot.3.ab.en
• ·Backdoor.Agobot.3.bc.en
• ·Backdoor.Agobot.3.ad.en
• ·BackDoor.Huigez.u
• ·Backdoor.SdBot.gen.e.en
• ·Backdoor.SdBot.gen.f.en