Agobot

Agobot, also frequently known as Gaobot, is a family of computer worms that infects the Microsoft Windows operating system. Based on the success of the Spybot worm, the authors of this family chose to make Agobot "open source". New versions, or variants, of the worm appeared so rapidly that the Agobot family quickly grew larger than the Spybot family. It is now known that Agobot numbers several thousand variants in size.

Although Agobot variants vary widely in behavior, earlier variants had a few base similarities:

• The ability to spread via the popular P2P programs KaZaA, Grokster, and BearShare.
• The ability to spread via at least vulnerability in the Microsoft Windows operating system. Earlier versions mostly used the RPC DCOM buffer overflow, although now some use the LSASS buffer overflow.
• The ability to spread via various common backdoor Trojan horses.
• The ability to spread to systems with weak administrative passwords.
• Use of a hidden IRC server for backdoor access.

Because there is no standard of detection nor classification for the Agobot family, there is also no standard naming convention. Most antivirus programs detect variants generically (e.g. W32/Agobot.worm), and identifying what specific Agobot variant is indicated is next to impossible except with the earliest or most common versions.