Forbot/Agobot/Gaobot Variant

I have observed a new variant of the Forbot virus, but cannot identify which version. Computer Associates InoculateIT is detecting it but cannot clean it, and the current removal tools provided by Symantec and Sophos do not detect it.

Manual removal is also proving difficult.

This Forbot variant is adding Windows JavaScript Daemon winjsd.exe and WSA Configuration wmon32.exe to the Run/RunOnce/RunServices registry keys. There is also a faulty service installed for Windows JavaScriptDaemon. It is Disabled, but the Recovery option is enabled to Restart the Service upon failure. This service is also marked for deletion, denying the administrator from changing these settings.

I will update this article with more info as I get it.

Update:

This virus was nearly impossible to identify. After a few days InoculateIT and Symantec were able to detect it as Agobot but still had trouble identifying the version. It seems that this Agobot variant drops other trojans.
If you want more information about Agobot and the many exploits it uses, visit:

CA Win32.Agobot Description

Suspect arrested in Phatbot, Agobot malware case

Alarm growing over bot software

Your best defense against Agobot is to keep Windows updated with the latest critical patches and run a personal firewall program that incorporates IDS signatures. Make sure your network passwords are not weak, since some Agobot variants use brute force attacks against network accounts.