W32/Agobot-OZ is a backdoor Trojan and worm which spreads to computers
protected by weak passwords.
When first run, W32/Agobot-OZ copies itself to the Windows system folder as
winrtx.exe and creates the following registry entries to run itself on startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Configurations Loader = winrtx.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Configurations Loader = winrtx.exe
The Trojan runs continuously in the background providing backdoor access to
the computer.
The Trojan attempts to terminate and disable various anti-virus and security-
related programs and modifies the HOSTS file located at
%WINDOWS%\System32\Drivers\etc\HOSTS, mapping selected anti-virus
websites to the loopback address 127.0.0.1 in an attempt to prevent access to these sites. Typically the following mappings will be appended to the HOSTS file:
127.0.0.1
www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1
www.sophos.com
127.0.0.1 sophos.com
127.0.0.1
www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1
www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1
www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1
www.avp.com
127.0.0.1
www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1
www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1
www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1
www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1
www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1
www.trendmicro.com 
Registrovani: 121 ( zlatkoc, GoranYu, boban779, agardasevic, sstanko78, Milos Maglov, wizarded, bacia, laminator, Gameover, Slobodan Milivojevic, stole86, Zogo, jovica016, koko75, vujkev, spartak, Milan Stojanovic, Nikola_BGD, kuljaking, -V-O-Y-A-G-E-R-, BiiigMuzzy, tomazo, mserifov, MilanRS, cobretino, voodoo_, israelli, drgajic12, Backy, yumatubumbo, srki, jonathan, Vitafon, batancev, NShappy, bkrka, sdusan2002, papens, staticInt, gmiza, TOMMY84TS, paki, kojovici, caprioloos, josip galic, Miroslav Jeftić, Chawa, logan t, mmarinso, Stole 84, smars, madamov, Aleksandar Ilić, mexico, igorpet, reiser, miLOSm, zorg, stsung, Miso Kovacevic, Vranac, kelja, dautm, žacko, Dule09, sale2040, DS_Store, tedi97, sheff, red4, kuca8uk3, Kici, jsmith, frenk, Dark_Runger, d02, datscha, alexzr, slamen, barum, Emil Ranc, inodius, feroc1ty, edo_lafina, jesus alejandro, pegasus, kiklop74, Bojan Marinkovic, Dejan Todosijevic, mmm121, svrle, anonimuss, goran9888, Horvat, Pavlovic68, Dejanan, Pravoslavac, arter, stefanpn, Vladokv, SilveRomeo, shut_down, djgorandj, majstorjoe, mimikrimi00, zeljoo, denden78, zlatko-kg, laki-91, stevic, MirosIav, Ercegb, aidopel, stefanlkc, miki78ns, anrxc, barakuda111, emiru, lumyy010, dejan, )
winrtx.exe blokira protok. Cemu on sluzi?
Re: winrtx.exe blokira protok. Cemu on sluzi?