Editing Agobot (section)

==Technical details==
New versions, or variants, of the worm appeared so rapidly that the Agobot family quickly grew larger than other bot families.  Other bots in the Agobot family include Phatbot and Forbot.  Agobot now has several thousand known variants.  The majority of these target the [[Microsoft Windows]] platform; as a result the vast majority of the variants are not [[Linux]] compatible. Modern Agobot strains were most likely built with [[Visual Studio]] due to their reliance on Visual Studio's SDK and Processor Pack. An infectious Agobot can vary in size but is typically around 12 to 500 [[kilobytes]] depending on features, compiler optimizations, and binary modifications. 

A module written for one member in the Agobot family can usually be ported with ease to another bot. This mix-matching of modules to suit the owner's needs has inspired many of the worm's variants. 

Most Agobots have the following features:
* Password Protected IRC Client control interface 
* Remotely update and remove the installed bot 
* Execute programs and commands
* [[Port scanner]] used to find and infect other hosts
* [[DDoS]] attacks used to takedown networks

The Agobot may contain other features such as:
* [[Packet sniffer]]
* [[Keylogger]]
* [[Polymorphic code]]
* [[Rootkit]] installer
* Information harvest
** Email Addresses
** Software Product Keys
** Passwords
* [[SMTP]] Client
** Spam
** Spreading copies of itself
* [[HTTP]] client 
** Click Fraud
**DDoS Attacks