W32.HLLW.Gaobot.AO

W32.HLLW.Gaobot.AO is a minor variant of W32.HLLW.Gaobot.AF. It attempts to spread to network shares that have weak passwords and allows hackers to access an infected computer through IRC.

The worm uses multiple vulnerabilities to spread, including:

• The DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026), using TCP ports 135 and 445.
• The WebDav vulnerability (described in Microsoft Security Bulletin MS03-007), using TCP port 80.
  

W32.HLLW.Gaobot.AO is compressed with UPX.

---

Note: Virus definitions dated prior to October 1, 2003 may detect this worm as a hack tool.

---

---

Note: Virus definitions dated November 19, 2003 and later contain a modified W32.HLLW.Gaobot.AO signature to account for the discovery of a minor variant.

---

Protection

• Initial Rapid Release version October 1, 2003
• Latest Rapid Release version January 19, 2009 revision 039
• Initial Daily Certified version October 1, 2003
• Latest Daily Certified version January 20, 2009 revision 048
• Initial Weekly Certified release date October 1, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: More than 1000
• Number of Sites: More than 10
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Medium

Distribution

• Distribution Level: Medium