Editing Agobot (section)

==Spreading==
The following propagation methods are sub-modules to the port scanning engine:
* [https://web.archive.org/web/20050225010955/http://www.microsoft.com/technet/security/bulletin/MS03-026.mspx MS03-026] [[Remote procedure call|RPC]] [[Distributed Component Object Model|DCOM]] Remote Buffer Overflow (CVE-2003-0352)
* [http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx MS04-011] [[Local Security Authority Subsystem Service|LSASS]] Remote Buffer Overflow (CVE-2003-0533)
* [http://www.microsoft.com/technet/security/bulletin/MS05-039.mspx MS05-039] [[Plug and Play]] Remote Buffer Overflow (CVE-2005-1983)
* Attempts to hijack common [[Trojan horse (computing)|Trojan horses]] that accept incoming connections via an open port. 
* The ability to spread to systems by brute forcing a login.  A good example is Telnet or Microsoft's [[Server Message Block]]

Generally, it has been observed that every custom modified variant of Agobot features a selection of the above methods as well as some "homebrew" modules, which essentially are released exploits ported to its code.

Names and such can be added via the XML files to produce variable shuffle imports.