Backdoor:Win32/Gaobot

When a variant of Backdoor:Win32/Gaobot runs, it copies itself to either %windir% or %System%. It may add a value to one of the following registry keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

This causes the worm to run whenever Windows starts. Some variants may add a Windows service to attain similar results.

 

Backdoor:Win32/Gaobot connects to a remote IRC server and joins a specific channel to receive commands. These commands can include scanning for vulnerable computers on the network, downloading and running remote files, adding and removing local users, retrieving computer configurations, and updating the worm.

 

The worm spreads to remote computers by exploiting one or more of eight vulnerabilities. For example, the worm may create a remote shell on a target computer to copy and run the worm. The worm may also spread by using a fixed list of passwords until it gains access to a remote computer. The worm then copies itself to the remote computer and runs the copy.

 

Some variants of the worm terminate security products based on a fixed list of process names. Later variants employ user-mode stealth, which hides the worm process and file from Task Manager and Windows Explorer. Later variants may also overwrite the Windows host file to block access to various security-related Web sites.