What
is the Gaobot.SA worm?
Gaobot.SA is a worm that attempts to spread
through network shares that have weak passwords
and allows attackers to access an infected
computer using a predetermined IRC channel.
The worm uses multiple vulnerabilities to spread,
including:
Also known as: W32.HLLW.Polybot.B, W32/Gaobot.worm.gen.d,
Phatbot
How
Does Gaobot.SAInfect My System?
When Gaobot.SA runs, it does the following:
- Copies itself as %System%\Hallowelt.exe.
- If the originally executed file is not
%System%\Hallowelt.exe, it will close the file
and execute Hallowelt.exe.
- If the originally executed file was not
%System%\Hallowelt.exe, it deletes the
originally executed file.
- Adds the value:
"yeahdude.exe"="hallowelt.exe"
to the registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
RunServices
so that the worm runs when you start
Windows.
- Adds the following lines to the file
%System%\drivers\etc\hosts, so that attempts
to connect to these Web sites fail:
127.0.0.1 www.trendmicro.com
127.0.0.1 trendmicro.com
127.0.0.1 rads.mcafee.com
127.0.0.1 customer.symantec.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 updates.symantec.com
127.0.0.1 update.symantec.com
127.0.0.1 www.nai.com
127.0.0.1 nai.com
127.0.0.1 secure.nai.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 download.mcafee.com
- Attempts to spread to other computers using
a number of methods, including:
- Sending itself to the backdoor port,
which the Beagle family of worms opens
- Sending itself to the backdoor port,
which the Mydoom family of worms opens
- Using the WebDAV vulnerability
- Using the RPC DCOM vulnerability
- Connects to an IRC channel and awaits
commands. The worm recognizes a large number
of commands and can be instructed to (among
other things):
- Run commands
- Retrieve files via FTP and HTTP
- Restart the computer
- List processes
- Kill a particular process
- Perform HTTP, ICMP, SYN, and UDP floods
- Retrieve email addresses stored on the
computer
- Retrieve a list of email addresses via
HTTP
- Retrieve a given URL
- Measure the speed of its Internet
connection by sending HTTP GET request to
the following hosts:
- de.yahoo.com
- nitro.ucsc.edu
- verio.fr
- www.1und1.de
- www.above.net
- www.belwue.de
- www.burst.net
- www.cogentco.com
- www.d1asia.com
- www.level3.com
- www.lib.nthu.edu.tw
- www.nifty.com
- www.nocster.com
- www.rit.edu
- www.schlund.net
- www.st.lib.keio.ac.jp
- www.stanford.edu
- www.switch.ch
- www.utwente.nl
- www.verio.com
- www.xo.net
- yahoo.co.jp
- Sniff HTTP, FTP, and IRC traffic
- Disable other worms by deleting their
files and associated registry values and
terminating their processes
- Opens a randomly selected TCP port and sends
a copy of itself to any remote process that
connects to that port.
- Starts an FTP server on a randomly selected
TCP port.
- Attempts to terminate any of the following
processes:
- _AVP32.EXE
- _AVPCC.EXE
- _AVPM.EXE
- ACKWIN32.EXE
- ADAWARE.EXE
- ADVXDWIN.EXE
- ......
- Tries to copy itself to other computers
through the following shares:
using the following user names and passwords, as
well as any user names found using NetUserEnum():
User names:
- aaa
- abc
- Admin
- admin
- administrador
- ......
Passwords:
- !@#$
- !@#$%
- !@#$%^
- !@#$%^&
- !@#$%^&*
- ......
How to Remove the Gaobot.SA worm?
Kaspersky Internet Security Can Prevent You From Virus and Intrusion.
If Kaspersky detects Gaobot.SA during the
scan, it will AUTOMATICALLY offer you the option
of deleting it. Do this by following the
program's instructions.
1. Disabling
System Restore (Windows Me/XP)
If you are running Windows Me or Windows XP, we
recommend that you temporarily turn off System
Restore. Windows Me/XP uses this feature, which
is enabled by default, to restore the files on
your computer in case they become damaged. If a
virus, worm, or Trojan infects a computer, System
Restore may back up the virus, worm, or Trojan on
the computer.
For instructions on how to turn off System
Restore, read your Windows documentation, or one
of the following articles: How
to Disable System Restore in Windows ME or
Windows XP.
2. Restarting the computer in Safe mode or
VGA mode
Shut down the computer and turn off the power.
Wait for at least 30 seconds, and then restart
the computer in Safe mode or VGA mode.
- For Windows 95, 98, Me, 2000, or XP users,
restart the computer in Safe mode.
- For Windows NT 4 users, restart the computer
in VGA mode.
3. Restoring the Windows Hosts file
Follow the instructions for your operating
system:
- Windows 98/Me/2000
- Click Start, point to Find or Search,
and then click Files or Folders.
- Make sure that "Look in" is
set to (C:) and that "Include
subfolders" is checked.
- In the "Named" or "Search
for..." box, type:
hosts
- Click Find Now or Search Now.
- For each one that you find, right-click
it, and then click "Open With."
- Deselect the "Always use this
program to open this program" check
box.
- Scroll through the list of programs and
double-click Notepad.
- Delete all of these lines:
127.0.0.1 www.trendmicro.com
127.0.0.1 trendmicro.com
127.0.0.1 rads.mcafee.com
127.0.0.1 customer.symantec.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 updates.symantec.com
127.0.0.1 update.symantec.com
127.0.0.1 www.nai.com
127.0.0.1 nai.com
127.0.0.1 secure.nai.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 download.mcafee.com
Do not delete the line:
127.0.0.1 localhost
- Close Notepad and save your changes when
prompted.
- Windows XP
- Click Start, and then click Search.
- Click All files and folders.
- In the "All or part of the file
name" box, type:
hosts
- Verify that "Look in" is set
to "Local Hard Drives" or to
(C:).
- Click "More advanced options."
- Check "Search system folders."
- Check "Search subfolders."
- Click Search.
- Click Find Now or Search Now.
- For each one that you find, right-click
it, and then click "Open With."
- Deselect the "Always use this
program to open this program" check
box.
- Scroll through the list of programs and
double-click Notepad.
- Delete all of these lines:
127.0.0.1 www.trendmicro.com
127.0.0.1 trendmicro.com
127.0.0.1 rads.mcafee.com
127.0.0.1 customer.symantec.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 updates.symantec.com
127.0.0.1 update.symantec.com
127.0.0.1 www.nai.com
127.0.0.1 nai.com
127.0.0.1 secure.nai.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 download.mcafee.com
Do not delete the line:
127.0.0.1 localhost
- Close Notepad and save your changes when
prompted.
4. Reversing the changes made to the registry
- Click Start, and then click Run. (The Run
dialog box appears.)
- Type regedit
Then click OK. (The Registry Editor opens.)
- Navigate to the key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
- In the right pane, delete the value:
"yeahdude.exe"="hallowelt.exe"
- Follow the instructions for your operating
system:
- Windows NT/2000/XP. Skip to step h.
- Windows 95/98/Me. Proceed to step f.
- Navigate to the key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
RunServices
- In the right pane, delete the value:
"yeahdude.exe"="hallowelt.exe"
- Exit the Registry Editor.
- Restart the computer in Normal mode.
5. Updating the virus definitions
If you do not know which anti-virus software
can provide strong protection for you, Kaspersky Internet Security is recommended.
6. Scanning for and deleting the infected
files
- Start your Kaspersky Internet Security and make sure that it is
configured to scan all the files.
- Run a full system scan.
- If any files are detected as infected with Gaobot.SA, click Delete.
How to Disinfect My Computer from Worms?
In order to keep your computer protected, bear
the following tips in mind:
- If you have filtering tools installed,
configure them to reject messages with the
characteristics described above. If, in spite
of doing this, you receive the message that
contains the virus: do not open it, do not run
the attached file and delete it, making sure
that you also delete it from the Deleted
Items folder.
- Install a good antivirus in your computer.
Select Kaspersky Internet Security to get the Kaspersky antivirus solution that best suits your needs.
- Keep your antivirus updated. If automatic
updates are available, configure your
antivirus to use them.
- Keep your permanent antivirus protection
enabled at all times.
Detect and Removal Instruction for Other
Variants:
|
