W32.Gaobot.OO

W32.Gaobot.OO is a worm that spreads through open network shares and exploits several Windows vulnerabilities including:

• The DCOM RPC Vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135.
• The WebDav Vulnerability (described in Microsoft Security Bulletin MS03-007) using TCP port 80.
• The Workstation Service Buffer Overrun Vulnerability (described in Microsoft Security Bulletin MS03-049) using TCP port 445. Windows XP users are protected against this vulnerability if Microsoft Security Bulletin MS03-043 has been applied. Windows 2000 users must apply MS03-049.

W32.Gaobot.OO can act as a backdoor server program initiating Denial of Service (DoS) attacks on other systems. This worm stops the processes of many antivirus and security programs, and malware. It also steals the CD keys of many popular games.

Note: Virus definitions released on March 6, 2004 detect this threat as W32.HLLW.Gaobot.gen.

Protection

• Initial Rapid Release version May 27, 2004
• Latest Rapid Release version March 3, 2008 revision 035
• Initial Daily Certified version May 27, 2004
• Latest Daily Certified version March 3, 2008 revision 037
• Initial Weekly Certified release date May 28, 2004

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Medium

Distribution

• Distribution Level: Medium