W32.HLLW.Gaobot.gen

W32.HLLW.Gaobot.gen is a detection for a large family of worms, which propagate themselves using multiple vulnerabilities including:

• Weak passwords on network shares.
• The DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135.
• The WebDav vulnerability (described in Microsoft Security Bulletin MS03-007) using TCP port 80.
• The Workstation service buffer overrun vulnerability (described in Microsoft Security Bulletin MS03-049) using TCP port 445. Windows XP users are protected against this vulnerability if Microsoft Security Bulletin MS03-043 has been applied. Windows 2000 users must apply MS03-049.
• The Microsoft Messenger Service Buffer Overrun Vulnerability (described in Microsoft Security Bulletin MS03-043).
• The Locator service vulnerability (described in Microsoft Security Bulletin MS03-001) using TCP port 445. The worm specifically targets Windows 2000 machines using this exploit.
• The UPnP vulnerability (described in Microsoft Security Bulletin MS01-059).
• The vulnerabilities in the Microsoft SQL Server 2000 or MSDE 2000 audit (described in Microsoft Security Bulletin MS02-061), using UDP port 1434.
• The LSASS vulnerability (described in Microsoft Security Bulletin MS04-011) using TCP ports 139 and 445.
• The backdoor ports that the Beagle and Mydoom families of worms open.

Most variants are packed with a run-time packer, such as UPX.

The W32.HLLW.Gaobot.gen removal tool will remove many but not all the variants that are detected as W32.HLLW.Gaobot.gen.

---

Note: Virus definitions, version 60227t (extended version 2/27/2004 rev. 20) and later, detect the threat known as Phatbot as W32.HLLW.Gaobot.gen.

---

Protection

• Initial Rapid Release version November 24, 2003
• Latest Rapid Release version November 23, 2009 revision 033
• Initial Daily Certified version November 24, 2003 revision 036
• Latest Daily Certified version November 22, 2009 revision 020
• Initial Weekly Certified release date November 26, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Medium
• Number of Infections: More than 1000
• Number of Sites: More than 10
• Geographical Distribution: Medium
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Medium

Distribution

• Distribution Level: Medium