Malware type: Worm

Aliases: Backdoor.Win32.VanBot.fg (Kaspersky), Generic.dx (McAfee), Worm/Gaobot.OOB.1 (Avira),

In the wild: Yes

Destructive: No

Language: English

Platform: Windows 2000, XP

Encrypted: No

Description: 

This worm exploits certain vulnerabilities to propagate. It takes advantage of the following Windows vulnerabilities:

• Remote Procedure Call (RPC) Distributed Component Object Model (DCOM) vulnerability
• IIS5/WEBDAV Buffer Overflow vulnerability
• RPC Locator Vulnerability

For more information about these Windows vulnerabilities, please refer to the following Microsoft Web pages:

• Microsoft Security Bulletin MS03-026
• Microsoft Security Bulletin MS03-001
• Microsoft Security Bulletin MS03-007

It also attempts to log on to systems using a list of user names and passwords. It drops a copy of itself into accessible machines.

This worm has backdoor capabilities. It executes commands sent in via Internet Relay Chat (IRC) and can be used to launch as denial of service attack against specified target sites.

It terminates certain antivirus processes and files dropped by other malware. It steals the CD keys of popular game applications.

It runs on Windows 95, 98, ME, NT, 2000 and XP.

For additional information about this threat, see:
Solution
Technical Details

Description created: Mar. 31, 2004 12:52:57 PM GMT -0800
Description updated: Jun. 29, 2004 11:40:59 PM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.