Malicious Software Encyclopedia: Win32/Gaobot
Published:
December 29, 2004
The Win32/Gaobot worm family spreads using different methods, depending on the variant. Some variants spread to machines with weak passwords. Others exploit vulnerabilities to infect machines. Once a machine is infected, the worm connects to an IRC server to receive commands.
On This Page
Threat Overview
| Class/type | Worm - Network
Trojan - Backdoor
|
| Discovered | November 21, 2003 |
| Circulating | Yes |
| Affected operating systems | Windows NT 4.0
Windows 95
Windows 2000
Windows XP
Windows Server 2003
|
| Affected software |
Not specified
|
| Infection rating | Medium |
| Recovery difficulty | Difficult |
| Damage rating | Medium |
| Transmission rating | Medium |
Aliases (Also Known As)
Different antivirus vendors may be using different names to refer to this malicious software. Here are some of the names currently in use by antivirus software vendors participating in the Microsoft Virus Information Alliance (VIA):
McAfee:
W32/Gaobot.wormSymantec:
W32.HLLW.GaobotTrend Micro:
WORM_AGOBOT
Learn more about the
Microsoft Virus Information Alliance.
Related Security Bulletins
The following Microsoft Security bulletins are related to this issue:
MS01-059 - Unchecked Buffer in Universal Plug and Play Can Lead to System CompromiseMS02-061 - Elevation of Privilege in SQL Server Web Tasks (Q316333)MS03-001 - Unchecked Buffer in Locator Service Could Lead to Code Execution (810833)MS03-007 - Unchecked Buffer In Windows Component Could Cause Server Compromise (815021)MS03-026 - Buffer Overrun In RPC Interface Could Allow Code Execution (823980)MS03-043 - Buffer Overrun in Messenger Service Could Allow Code Execution (828035)MS03-049 - Buffer Overrun in the Workstation Service Could Allow Code Execution (828749)MS04-011 - Security Update for Microsoft Windows (835732)Technical Analysis
When Win32/Gaobot is run, it copies itself to either the Windows or System directories. In many cases, it adds a value to the registry keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
or
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
This value causes the worm to start when Windows is started. Some variants may also add a Windows Service to attain similar results.
Win32/Gaobot connects to a remote IRC server and joins a specific channel to receive commands. These commands can include actions such as scanning for unpatched machines on the network, downloading and executing remote files, adding and removing local users, retrieving the machine configuration, and updating the worm.
The worm spreads to remote machines by exploiting one or more of eight vulnerabilities. For example, the worm exploits the MS03-026 vulnerability to create a remote shell on the target machine. The worm uses the remote shell to copy and run the worm on a remote machine. The worm uses the eight different vulnerabilities in different ways, but the goal of the worm is consistent: it always attempts to copy and run on the remote machine.
Win32/Gaobot may also spread to machines with weak passwords by enumerating through a hard-coded list of passwords until it gains access. Once access is achieved, the worm copies itself and creates a task on the target machine to run the copy.
Some variants of the worm terminate security products, based on a hard-coded list of process names.
Later variants of the worm include user-mode stealth, which hides the worm's process and file from Task Manager and Windows Explorer.
Later variants of the worm overwrite the Windows host file to block access to different security Web sites.
How to Prevent Infection
Take the following steps to help prevent infection on your system:
Enable a firewall on your computer
Get the latest computer updates
Use up-to-date antivirus software
Use strong passwords
Enable a firewall on your computer
Use a third-party firewall product or turn on the Microsoft® Windows® XP Internet Connection Firewall.
To turn on the Internet Connection Firewall in Windows XP
Click Start, and click Control Panel.
Click Network and Internet Connections, and click Network Connections. If you do not see Network and Internet Connections, click Switch to Category View.
Highlight a connection that you want to help protect, and click Change settings of this connection.
Click Advanced, and select Protect my computer and network by limiting or preventing access to this computer from the Internet.
Click OK.
Get the latest computer updates
Updates help protect your computer from viruses, worms, and other threats as they are discovered. You can use the Automatic Updates feature in Microsoft Windows® XP to automatically download future Microsoft security updates while your computer is on and connected to the Internet.
To turn on Automatic Updates
Click Start, and click Control Panel.
Click Performance and Maintenance. If you do not see Performance and Maintenance , click Switch to Category View.
Click System.
Click Automatic Updates, and select Keep my computer up to date.
Select a setting. Microsoft recommends selecting Automatically download the updates, and install them on the schedule that I specify and setting a regular update time.
If you choose to have Automatic Updates notify you in step 5, you will see a notification balloon when new downloads are available to install. Click the notification balloon to review and install updates.
Use up-to-date antivirus software
Most antivirus software can detect and prevent infection by known malicious software. You should always run antivirus software on your computer that is updated with the latest signature files to automatically help protect you from infection.
Use strong passwords
A strong password is one that is at least eight characters, includes a combination of letters, numbers, and symbols and is easy for you to remember, but difficult for others to guess. Weak passwords include any words in the dictionary, names, dates, consecutive letters or numbers, common words with symbol substitutions (for example, p@ssw0rd), and so on.
How to Tell If Your Computer Is Infected
Your computer may be infected with a Win32/Gaobot worm variant if you experience one or more of the following symptoms:
- The operating system shuts down after displaying the following dialog box:
- You see an LSA Shell error report dialog box:
- Your computer reboots without user interaction. You may see a system shutdown dialog box:
How to Recover from Infection
Automatic Recovery
To attempt to automatically remove this threat, run one of the following removal tools:
Transmission Methods
| Method | Description |
|---|
| Exploits Vulnerability | May exploit one of eight different vulnerabilities to spread to a target machine |
| Network Shares | May spread to network shares with weak passwords |
