Alert level

Win32/Gaobot


Encyclopedia entry
Updated: Mar 22, 2007  |  Published: Nov 11, 2004

Aliases
  • W32.HLLW.Gaobot (Symantec)
  • W32/Gaobot.worm (McAfee)
  • WORM_AGOBOT (Trend Micro)

Alert Level (?)
High

Antimalware protection details
Microsoft recommends that you download the latest definitions to get protected.

Summary

The Win32/Gaobot worm family spreads using different methods, depending on the variant. Some variants spread to machines with weak passwords. Others exploit vulnerabilities to infect machines. Once a machine is infected, the worm connects to an IRC server to receive commands.

Top

Symptoms

Your computer may be infected with a Win32/Gaobot worm variant if you experience one or more of the following symptoms:
  • The operating system shuts down after displaying the following dialog box:
    System Shutdown
  • You see an LSA Shell error report dialog box:
  • Your computer reboots without user interaction. You may see a system shutdown dialog box:

Top

Technical Information (Analysis)

When Win32/Gaobot is run, it copies itself to either the Windows or System directories. In many cases, it adds a value to the registry keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
or
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
This value causes the worm to start when Windows is started. Some variants may also add a Windows Service to attain similar results.
 
Win32/Gaobot connects to a remote IRC server and joins a specific channel to receive commands. These commands can include actions such as scanning for unpatched machines on the network, downloading and executing remote files, adding and removing local users, retrieving the machine configuration, and updating the worm.
 
The worm spreads to remote machines by exploiting one or more of eight vulnerabilities. For example, the worm exploits the MS03-026 vulnerability to create a remote shell on the target machine. The worm uses the remote shell to copy and run the worm on a remote machine. The worm uses the eight different vulnerabilities in different ways, but the goal of the worm is consistent: it always attempts to copy and run on the remote machine.
 
Win32/Gaobot may also spread to machines with weak passwords by enumerating through a hard-coded list of passwords until it gains access. Once access is achieved, the worm copies itself and creates a task on the target machine to run the copy.
 
Some variants of the worm terminate security products, based on a hard-coded list of process names.
 
Later variants of the worm include user-mode stealth, which hides the worm's process and file from Task Manager and Windows Explorer.
 
Later variants of the worm overwrite the Windows host file to block access to different security Web sites.

Top

Prevention

Take the following steps to help prevent infection on your system:
  • Enable a firewall on your computer
  • Get the latest computer updates
  • Use up-to-date antivirus software
  • Use strong passwords

Enable a firewall on your computer

Use a third-party firewall product or turn on the Microsoft® Windows® XP Internet Connection Firewall.
To turn on the Internet Connection Firewall in Windows XP
  1. Click Start, and click Control Panel.
  2. Click Network and Internet Connections, and click Network Connections. If you do not see Network and Internet Connections, click Switch to Category View.
  3. Highlight a connection that you want to help protect, and click Change settings of this connection.
  4. Click Advanced, and select Protect my computer and network by limiting or preventing access to this computer from the Internet.
  5. Click OK.

Get the latest computer updates

Updates help protect your computer from viruses, worms, and other threats as they are discovered. You can use the Automatic Updates feature in Microsoft Windows® XP to automatically download future Microsoft security updates while your computer is on and connected to the Internet.
To turn on Automatic Updates
  1. Click Start, and click Control Panel. 
  2. Click Performance and Maintenance. If you do not see Performance and Maintenance , click Switch to Category View.
  3. Click System.
  4. Click Automatic Updates, and select Keep my computer up to date.
  5. Select a setting. Microsoft recommends selecting Automatically download the updates, and install them on the schedule that I specify and setting a regular update time.
  6. If you choose to have Automatic Updates notify you in step 5, you will see a notification balloon when new downloads are available to install. Click the notification balloon to review and install updates.

Use up-to-date antivirus software

Most antivirus software can detect and prevent infection by known malicious software. You should always run antivirus software on your computer that is updated with the latest signature files to automatically help protect you from infection.

Use strong passwords

A strong password is one that is at least eight characters, includes a combination of letters, numbers, and symbols and is easy for you to remember, but difficult for others to guess. Weak passwords include any words in the dictionary, names, dates, consecutive letters or numbers, common words with symbol substitutions (for example, p@ssw0rd), and so on. 

Top