Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

W32.Gaobot.SA

by Marianna Schmudlach Mar 23, 2004 9:57AM PST

Discovered on: March 23, 2004
Last Updated on: March 23, 2004 03:58:45 PM

W32.Gaobot.SA is a worm that attempts to spread through network shares that have weak passwords and allows attackers to access an infected computer using a predetermined IRC channel.

The worm uses multiple vulnerabilities to spread, including:

The DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135.
The WebDav vulnerability (described in Microsoft Security Bulletin MS03-007) using TCP port 80.

Also Known As: W32.HLLW.Polybot.B, W32/Gaobot.worm.gen.d [McAfee], Phatbot

Type: Worm

http://securityresponse.symantec.com/avcenter/venc/data/w32.gaobot.sa.html