Malware type: Worm

Aliases: W32/Gaobot.worm.gen.e (McAfee), Backdoor.Sdbot (Symantec), BDS/Aebot.N.2 (Avira), Mal/Behav-132 (Sophos),

In the wild: Yes

Destructive: No

Language: English

Platform: Windows NT, 2000, XP

Encrypted: No

Description: 

Upon execution, this memory-resident worm drops a copy of itself as the file DLLSRV32.EXE in the Windows system folder.

This worm spreads via network shares and Internet Relay Chat (IRC).

It terminates several processes, most of which are related to antivirus software and tools.

It also deletes several antivirus and firewall-related registry entry values.

This worm has backdoor capabilities. It acts as a server program controlled by an IRC bot.

Once connected, this IRC bot is capable of sending commands to the server program. These commands are used to control the target system and the behavior of the bot.

The worm runs on Windows 95, 98, ME, NT, 2000, and XP.

For additional information about this threat, see:
Solution
Technical Details

Description created: Jan. 14, 2005 8:49:42 AM GMT -0800
Description updated: Jan. 14, 2005 9:30:33 AM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.