Gaobot Description

Gaobot is a worm that spreads through several methods such as open network shares, backdoors in which the Beagle and Mydoom worms install, and the following Windows vulnerabilities:

DCOM RPC Vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135.

Workstation Service Buffer Overrun Vulnerability (described in Microsoft Security Bulletin MS03-049) using TCP port 445. Windows XP users are protected against this vulnerability if Microsoft Security Bulletin MS03-043 has been applied. Windows 2000 users must apply MS03-049.

Exploitation of Microsoft Windows Local Security Authority Service Remote Buffer Overflow (described in Microsoft Security Bulletin MS04-011).

The Gaobot worm maliciously attempts to block security programs on the users PC. Gaobot also has the ability to attack other systems by acting as a backdoor server program.

Type: Worms

Automatic Detection of Gaobot

Gaobot Technical Report

As new Gaobot details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following Gaobot files with its MD5s were created in the system:

Important Article Disclaimer