I just updated my Spybot defs and included was an update for the PaulCollins Startup list, so I thought I’d run that function just to see what it would say.
One of the entries it found was an HK_LM:RunOnceEx with no value or command line. The extra info box on the side says it’s added by the Agobot-ku worm which is supposed to have added the filename “system32.exe”
A search on Google didn’t really give me much that doesn’t originate with Syphos, although viruslist.com gives one of its variant’s aliases as “Win32:Gaobot-268” for Alwil.
A search here and on the homepage for either that or for agobot doesn’t give any hits.
I remember getting false positives from this Spybot startup list in the past on win98 so don’t really trust it, but obviously I’m a bit worried that I may have an infection.
CodeStuff Starter lists it under start up but just ignores me when I try to look at its properties. Starter also shows “System” running as a process, with no corresponding executable, and again won’t list any properties for this entry.
Avast is telling me I have no problems (I’ve done a regular scan and also a boot scan).
Does anybody else get this same message, or know anything helpful about whether this is a real virus or not?
:-\
Here’s my HJT log in normal mode. I’ll have to get another one in safe mode in a few minutes after shutting down.
Logfile of HijackThis v1.99.0
Scan saved at 4:55:28 PM, on 2/1/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
I’ve checked this at Eddy’s online analyzer and nothing particularly dangerous seems to show up. Another thing is that if I do have the system32.exe on my system I can’t find it in search.
I’ve never had a virus on this machine afaik so I doubt it’s a leftover from something else… ???
I remember having a similar experience a year or two ago with Spybot’s Startup list and something connected with a supposed infection of the Norton I was using at the time. A search on Google and the Wilders forum revealed it to be a false alarm.
In this case though, nobody seems to be writing about it.
Does anyone else have Spybot who could check on their machine for this problem? (It’s in Spybot’s Tools section, under System Startup)?
I have just checked my S&D and nothing with blank details and in the RunOnce.
It seems a bit sus to me, since S&D has the Restore function, I would un-tick it and see what happens or rather what doesn’t happen. The RunOnce shouldn’t really have any system stuff, so it should be ok, tongue firmly in cheek.
I got this same issue. Blank startup entry being identified as AGOBOT KU by Spybot. Adware, spybot, Microsoft’s antispy and AVG (as well as a few others) do not detect anything.
Then it may be a false positive by Spybot, however, the blank entry should be able to be removed in the same way as ‘garyb’ if it is truely the same HK_LM:RunOnceEx key.
Wanted to add a note this thread. My machine also comes up with this entry in Spybot. My guess is that it’s a false positive -but unchecking it is definately a precaution to take. I do not seem to have any problems-also my Zone Alarm logs don’t note any unusual activity.
Hope this helps for all.
Mike
That is the weird thing-nothing connected with this shows up! I was looking at the U of Kansas security site this morning, and there is a lengthy discourse on the Agobot family-extremely virulent, and almost impossible to rid yourself of, but did not see anything abount a “ku” version (I need to check again-was getting scooted out the door to church Will post the link once I go back there.
I have the same problem with the agobot-ku worm showing up in spybot… but nothing appears to be on my system when i manually check everything there is to check. all XP service packs and norton has been running since day 1, i have run trend micro, mcafee, plus other online virus scans yet nothing has shown up.
I unchecked it from the startup using SD, however a few days later and … oh look… another one had started up… i am guessing there is something on our machines that’s not been discovered yet (long shot) or its a tech hitch somewhere either way its getting really annoying. any ideas…???
nope, i have norton on one - my work machine, and avast on the other. they are both on my home network and both have my usuall security stuff, however it’s only my work machine that has the problem! i have even taken out the main hard drive at put it in a caddy and run scans, yet nothing shows up…
i have the same problem, however i have defender pro software in adition to spybot. their antivirus is supposed to find this, (i have the start up entries disabled) but does not, however, the firewall does pick it up when it tries to connect which is also blocked, i have all of the behaviors listed for this on the defender pro site (which also gives the names for this other antivirus software use
Backdoor.Win32.Agobot.ku
Other versions: .a
Aliases
Backdoor.Win32.Agobot.ku (Kaspersky Lab) is also known as: Backdoor.Agobot.ku (Kaspersky Lab), W32/Gaobot.worm.gen.d (McAfee), W32.HLLW.Gaobot.gen (Symantec), Win32.HLLW.ForBot.based (Doctor Web), W32/Agobot-Gen (Sophos), Win32/Gaobot.gen! (RAV), WORM_AGOBOT.GEN (Trend Micro), Win32:Trojan-gen. (ALWIL), Worm/Agobot.16.BC (Grisoft), Backdoor.Agobot.3.63E55EB4 (SOFTWIN), W32/Gaobot.gen.worm (Panda), Win32/Agobot.3.RF (Eset)
i do have files that were not there before which my antispy/antivirus programs cannot access nor can they be deleted. i also cannot do a complete defrag, because of these locked files. but with these items blocked my system does run ok and is not as slow as it used to be. if i find any other info i will let you know.
