IT Help Central - Division of Information Technology
Texas Tech University

HELP!!!

IT Help Central

[ Hours of Operation ]
[ Safe Computing ]
[ Customer Survey ]
[ Security Bulletins ]
[ Instructions ]
[ Request Assistance ]
[ Our Team ]
[ Employment ]
[ Strategic Plan ]
[ Site Map ]

Related Sites

[ Texas Tech ]
[ IT Division ]
[ High Tech ]
[ Raiderlink ]
[ Computer Labs ]
[ Training ]
[ TTUHSC Help Desk ]
[ Network Access ]

General Info

[ New Students ]
[ Text-Only Version ]
[ Buying the Right Computer ]

ASC
Room 101
2903 4th Street

W32.HLLW.Gaobot is a family of worms that infects computers through various exploits. It also opens backdoors to the infected computers through IRC.

These worms propagate themselves using multiple vulnerabilities, including:

• The DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135.
• The WebDav vulnerability (described in Microsoft Security Bulletin MS03-007) using TCP port 80.
• The Workstation service buffer overrun vulnerability (described in Microsoft Security Bulletin MS03-049) using TCP port 445. Windows XP users are protected against this vulnerability if Microsoft Security Bulletin MS03-043 has been applied. Windows 2000 users must apply MS03-049.
• The Microsoft Messenger Service Buffer Overrun Vulnerability (described in Microsoft Security Bulletin MS03-043).
• The Locator service vulnerability (described in Microsoft Security Bulletin MS03-001) using TCP port 445. The worm specifically targets Windows 2000 machines using this exploit.
• The UPnP vulnerability (described in Microsoft Security Bulletin MS01-059).
• The vulnerabilities in the Microsoft SQL Server 2000 or MSDE 2000 audit (described in Microsoft Security Bulletin MS02-061), using UDP port 1434.
• Sending itself to the backdoor ports that the Beagle and Mydoom families of worms open.

It is recommended that you view the full articles related to these vulnerabilities:

• W32.HLLW.Gaobot.AG
• W32.HLLW.Gaobot.AO
• W32.Gaobot.SA
• W32.Gaobot.SY
• W32.Gaobot.ZX
• W32.Gaobot.ADX
• W32.Gaobot.AFJ
• W32.Gaobot.AJD
• W32.HLLW.Gaobot.Gen
• W32.Gaobot.BOW
• W32.Gaobot.BUU
• W32.Gaobot.CEZ

Note: W32.HLLW.Gaobot.gen is a generic detection that detects numerous variants of W32.HLLW.Gaobot. The removal tool will remove many but not all variants that are detected as W32.HLLW.Gaobot.gen.

If the removal tool cannot remove the variant of W32.HLLW.Gaobot.gen that has infected your computer, follow the manual removal instructions in the W32.HLLW.Gaobot.Gen write-up.

Quick Fix Instructions

1. Download the FxGaobot.exe file from IT Help Central.

2. Save the file to a convenient location, such as your download folder or the Windows desktop (or removable media that is known to be uninfected, if possible).

3. To check the authenticity of the digital signature, refer to the "Digital signature" section.

4. Close all programs before you run the tool.

5. If you are on a network or have a full-time connection to the Internet, disconnect the computer from the network and the Internet.

6. If you are running Windows Me or XP, disable System Restore. Please refer to the section "System Restore option in Windows Me/XP" for additional details.
   
   NOTE: If you are running Windows Me/XP, we strongly recommend that you do not skip this step.
    

7. Double-click the FxGaobot.exe file to start the removal tool.

8. Click Start to begin the process, and then allow the tool to run.

9. Restart the computer.

10. Run the removal tool again to ensure that the system is clean.

11. If you are running Windows Me or XP, then re-enable System Restore.

12. Run Live Update to make sure that you are using the most current virus definitions.

For details on each of these steps, read the following instructions.

For specific details on each of these steps, please follow this link.