W32.Gaobot.GL

W32.Gaobot.GL is a variant of W32.Gaobot.ADW that attempts to spread to network shares and allows access to an infected computer through an IRC channel.

The worm uses multiple vulnerabilities to spread, including the WebDav vulnerability described in Microsoft Security Bulletin MS03-007. It also uses TCP port 80 when doing this.

W32.Gaobot.GL is compressed with ASPack and UPX.

---

Note: Virus definitions released on January 22, 2004 detect this threat as W32.HLLW.Gaobot.gen.

---

Protection

• Initial Rapid Release version May 27, 2004
• Latest Rapid Release version May 27, 2004
• Initial Daily Certified version May 27, 2004
• Latest Daily Certified version May 27, 2004
• Initial Weekly Certified release date May 28, 2004

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 50 - 999
• Number of Sites: More than 10
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Medium

Distribution

• Distribution Level: Medium