WORM_GAOBOT.DF

This worm spreads via network shares, and takes advantage of the Windows vulnerabilities whose descriptions are found in the following Microsoft Web pages:

• Microsoft Security Bulletin MS03-039
• Microsoft Security Bulletin MS04-011

It spreads by attempting to drop a copy of itself in the target addresses' default shares. If the said shares is password-protected, it uses NetBEUI functions to gather a list of user names and passwords, as well as a list of hardcoded user names and passwords as its login credentials.

Using a random port, it connects to an Internet Relay Chat (IRC) server and joins a specific channel, where it listens for commands from a remote malicious user. The said commands are executed locally on affected machines. This routine compromises system security and opens the affected machine to further attacks.

It performs denial of service (DoS) attacks against target sites using different flood methods. It terminates certain processes found running in memory.

This worm is also capable of gathering and stealing Microsoft product keys and CD keys from popular gaming applications installed on affected machines.

Related Items