Fagot

**IRC-Worm.Win32.Fagot** or **Fagot** is a worm that runs on Internet Relay Chat (IRC) program with 32-bit Windows operating systems..

## Behavior

This virus would would spread over IRC, however this routine has long since stopped working since the worm originally downloaded this file from a server that has been deleted. This would just be the end result of an infection prior to the worm spamming itself to every IRC channel it could find.

## Payload(s)

When the user runs the program, usually when they receive the file through IRC, it will pop up many errors. Including:

* svchost.exe crashing claiming memory could not be written with the instructions deriving from thread 0x71a64618
* A Windows Protection Error, indicating that multiple critical files have been overwritten
* Finally, an error in memory block #A5487F (This message is a fake error put out by the worm.)

These errors are all caused by the fact that critical processes have been overwritten with irrelevant data (by deleting things like cmd.exe, regedit.exe, and other files and replacing them with the worm.). If the user now checks the file attributes, they will discover that the file sizes have decreased drastically. If the user tries to run programs, the worm will hide the file and not allow you to run said application.

The worm also kills the following processes:

* Ad-watch.exe
* regedit.exe
* taskmgr.exe

After that, Fagot copies itself as Userinit32.exe in the System32 directory. The worm also creates a startup key located in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon and with the name "Userinit", the location is System32\userinit32.exe

Fagot also copies itself as dllhost32.exe in the System32 directory. It then creates a startup key located in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon and with the name "dllhost32", the location is System32\dllhost32.exe

The worm also kills the following processes:

* FSGK32.EXE
* FSM32.EXE
* FSMA32.EXE
* FSMB32.EXE
* FWENC.EXE
* KAVLITE40ENG.EXE
* KAVPERS40ENG.EXE
* NAV Auto-Protect
* NAVAPSVC.EXE
* NMAIN.EXE
* NORMIST.EXE
* NORTON\_INTERNET\_SECU\_3.0\_407.EXE
* NPF40\_TW\_98\_NT\_ME\_2K.EXE
* NPFMESSENGER.EXE
* NPROTECT.EXE
* NPSSVC.EXE
* NSCHED32.EXE
* NTVDM.EXE
* ZAPRO.EXE
* ZAPSETUP3001.EXE
* ZATUTOR.EXE
* ZAUINST.EXE
* ZONALM2601.EXE
* ZONEALARM.EXE
* \_AVP32.EXE
* \_AVPCC.EXE
* \_AVPM.EXE
* ccEvtMgr.exe
* ccSetMgr.exe
* FSAV32.exe
* FSMA32.exe
* FSMB32.exe
* FSSM32.exe
* AVNT.exe
* AVP.exe
* BLACKICE.exe
* FPROT.exe
* FP-WIN.exe
* N32SCANW.EXE
* NAVAPW32.EXE
* PAVCL.EXE
* PAVSCHED.EXE
* WFINDV32.EXE
* NAVW32.EXE
* BlackICE.exe

Then, it changes the Internet Explorer homepage into blacksnake.com (a live sex cam website). The username is changed into a rude phrase "C\*CK\_SUCKING\_F\*GGOT" (virus does not censor username) The worm also deletes system files from Windows, which makes the system completely bricked.

* C:\windows\regedit.exe
* C:\windows\cmd.exe
* C:\windows\system32\taskman.exe
* C:\windows\system32\taskmgr.exe
* C:\windows\system32\regedt32.exe
* C:\windows\system32\regsvr32.exe
* C:\windows\TASKMAN.exe
* C:\windows\system32\autochk.exe
* C:\windows\system32\chkntfs.exe
* C:\windows\system32\chkdsk.exe
* C:\windows\system32\shutdown.exe
* C:\windows\NOTEPAD.exe
* C:\WINDOWS\system32\userinit.exe
* C:\windows\system32\progman.exe
* C:\windows\regedit.exe
* C:\windows\cmd.exe
* C:\windows\system32\taskman.exe
* C:\windows\system32\taskmgr.exe
* C:\windows\system32\regedt32.exe
* C:\windows\system32\regsvr32.exe
* C:\windows\TASKMAN.exe
* C:\windows\system32\autochk.exe
* C:\windows\system32\chkntfs.exe
* C:\windows\system32\chkdsk.exe
* C:\windows\system32\shutdown.exe
* C:\windows\NOTEPAD.exe
* C:\WINDOWS\system32\userinit.exe
* C:\windows\system32\progman.exe
* C:\windows\system32\ntoskrnl.exe
* C:\windows\system32\ntkrnlpa.exe
* C:\windows\system32\alg.exe
* C:\windows\system32\bootok.exe
* C:\windows\system32\chcp.exe
* C:\windows\system32\ctfmon.exe
* C:\windows\system32\dumprep.exe
* C:\windows\system32\recover.exe
* C:\windows\system32\imapi.exe
* C:\windows\system32\logon.exe
* C:\windows\system32\MDM.exe
* C:\windows\system32\services.exe
* C:\windows\system32\systray.exe
* C:\windows\system32\win.exe
* C:\windows\system32\wowexec.exe
* C:\windows\system32\wuauclt.exe

It then copies itself into above files. The virus then deletes the following registry key branches, which is another dangerous payload.

* HKCR\
* HKLM\HARDWARE
* HKLM\SAM
* HKLM\SECURITY
* HKLM\SOFTWARE
* HKLM\SYSTEM
* HKCC\Software
* HKCC\System
* HKCU\Software\Microsoft\Internet Explorer\Desktop\SafeMode
* HKCU\Printers
* HKCU\SessionInformation
* HKLM\SYSTEM\ControlSet001\Control\SafeBoot
* HKLM\SYSTEM\\ControlSet003\\Control\\SafeBoot
* HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot
* HKLM\SYSTEM\MountedDevices
* HKLM\SYSTEM\LastKnownGoodRecovery
* HKLM\SYSTEM\ControlSet001\Control\ContentIndex\Catalogs\System
* HKLM\SYS

The worm then spreads itself through mIRC chat client.

## Upon Restart

As the worm disables the activation of all .exe files, the system will halt upon boot up. It will prompt the user to reinstall Windows. However, reinstalling simply results in multiple errors, and the user will not be able to start, causing multiple Blue Screen of Deaths and damaging the system completely. This will require the user to format and reinstall.