W32.HLLW.Gaobot.JB is a minor variant of W32.HLLW.Gaobot.BF
that uses a different file name and is repacked with PECompact. It attempts to spread to network shares that have weak passwords and allows attackers to access an infected computer through an IRC channel.
The worm uses multiple vulnerabilities to spread, including:
When W32.HLLW.Gaobot.JB attempts to run on Windows 95/98/Me, it causes the error:
Error Starting Program
The PSAPI.DLL file is linked to missing export NTDLL.DLL:NtCreateProfile
Click for a more detailed description of Rapid Release and Daily Certified virus definitions.