Symantec

Symantec Security Response
http://securityresponse.symantec.com

W32.Gaobot.gen!poly

Category 2
Discovered on: March 19, 2004
Last Updated on: April 02, 2004 05:34:20 PM

W32.Gaobot.gen!poly is a worm that attempts to spread through network shares with weak passwords and allows attackers to access an infected computer using a predetermined IRC channel.
The worm uses multiple vulnerabilities to spread, including:


Notes:


Also Known As: W32.HLLW.Polybot, Phatbot, W32/Polybot.l!irc [McAfee], WORM_AGOBOT.HM [Trend], Backdoor.Agobot.hm [Kaspersky]
Type: Worm
Infection Length: 278,528 bytes
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
Systems Not Affected: DOS, Linux, Macintosh, OS/2, UNIX

protection
  • Virus Definitions (Intelligent Updater) *
    		•

    March 19, 2004

  • Virus Definitions (LiveUpdate™) **
    		•

    March 24, 2004

    *

    Intelligent Updater definitions are released daily, but require manual download and installation.
    Click here to download manually.

    **

    LiveUpdate virus definitions are usually released every Wednesday.
    Click here for instructions on using LiveUpdate.

    threat assessment

    Wild:

    Threat Metrics
    Low Medium Medium

    Wild:
    Low

    Damage:
    Medium

    Distribution:
    Medium

    Damage

    Distribution

    technical details

    When W32.Gaobot.gen!poly is executed, it performs the following actions:

    1. Copies itself as one of the following files:
      • %System%\soundman.exe
      • %System%\confgldr.exe
      • %System%\spoolsvc.exe

        Note: %System% is a variable. The worm locates the System folder and copies itself to that location. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

    2. Adds one of the following values:

      "^`d}qZxu" = "~`d}qzxu3zYF"

      "Configuration Loader"="confgldr.exe"

      "Video Process"="sysconf.exe" 

      "Service Host Process"      ="spoolsvc.exe"

      to the registry keys:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
      RunServices

      so that W32.Gaobot.gen!poly runs when you start Windows.

    3. Creates a service for the worm with one of the following names and sets it to automatically run on startup:
      • Configuration Loader
      • SoundMan
      • Service Host Process

    4. Hides all the files that contain the word "soun."

    5. May add the following lines to the %System%\drivers\etc\hosts file:

      127.0.0.1 www.symantec.com
      127.0.0.1 securityresponse.symantec.com
      127.0.0.1 symantec.com
      127.0.0.1 www.sophos.com
      127.0.0.1 sophos.com
      127.0.0.1 sophos.com
      127.0.0.1 www.mcafee.com
      127.0.0.1 mcafee.com
      127.0.0.1 liveupdate.symantecliveupdate.com
      127.0.0.1 www.viruslist.com
      127.0.0.1 viruslist.com
      127.0.0.1 viruslist.com
      127.0.0.1 f-secure.com
      127.0.0.1 www.f-secure.com
      127.0.0.1 kaspersky.com
      127.0.0.1 www.avp.com
      127.0.0.1 www.kaspersky.com
      127.0.0.1 avp.com
      127.0.0.1 www.networkassociates.com
      127.0.0.1 networkassociates.com
      127.0.0.1 www.ca.com
      127.0.0.1 ca.com
      127.0.0.1 mast.mcafee.com
      127.0.0.1 my-etrust.com
      127.0.0.1 www.my-etrust.com
      127.0.0.1 download.mcafee.com
      127.0.0.1 dispatch.mcafee.com
      127.0.0.1 secure.nai.com
      127.0.0.1 nai.com
      127.0.0.1 www.nai.com
      127.0.0.1 update.symantec.com
      127.0.0.1 updates.symantec.com
      127.0.0.1 us.mcafee.com
      127.0.0.1 liveupdate.symantec.com
      127.0.0.1 customer.symantec.com
      127.0.0.1 rads.mcafee.com
      127.0.0.1 trendmicro.com
      127.0.0.1 www.trendmicro.com

    6. Connects to a predetermined IRC channel, using its own IRC client, and listens for commands.

    7. Allows an attacker to remotely control a compromised computer and perform any of the following actions:
      • Download and execute files
      • Steal system information
      • Harvest email addresses
      • Steal CD keys for various games

    8. Attempt to spread to other systems by exploiting the following vulnerabilities:
    9. Probes the following shares:
    10. Copies itself to any computers compromised using the above exploits.


    11. Ends the following processes associated with antivirus and firewall software:
    12. Attempts to delete the files and registry values associated with other worms.

    recommendations

    Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":

    removal instructions

    The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

    1. Disable System Restore (Windows Me/XP).
    2. Restart the computer in Safe mode or VGA mode.
    3. Restore the Hosts file.
    4. Reverse the changes made to the registry (removing the service and Run keys that the worm added).
    5. Update the virus definitions.
    6. Run a full system scan and delete all the files detected as W32.Gaobot.gen!poly.
    For details on each of these steps, read the following instructions.

    Before you begin:
    If you are running Windows NT/2000/XP, make sure that you do, or have done, the following:


    1. To disable System Restore (Windows Me/XP)
    If you are running Windows Me or Windows XP, we recommend that you temporarily turn off System Restore. Windows Me/XP uses this feature, which is enabled by default, to restore the files on your computer in case they become damaged. If a virus, worm, or Trojan infects a computer, System Restore may back up the virus, worm, or Trojan on the computer.

    Windows prevents outside programs, including antivirus programs, from modifying System Restore. Therefore, antivirus programs or tools cannot remove threats in the System Restore folder. As a result, System Restore has the potential of restoring an infected file on your computer, even after you have cleaned the infected files from all the other locations.

    Also, a virus scan may detect a threat in the System Restore folder even though you have removed the threat.

    For instructions on how to turn off System Restore, read your Windows documentation, or one of the following articles:
    Note: When you are completely finished with the removal procedure and are satisfied that the threat has been removed, re-enable System Restore by following the instructions in the aforementioned documents.

    For additional information, and an alternative to disabling Windows Me System Restore, see the Microsoft Knowledge Base article, "Antivirus Tools Cannot Clean Infected Files in the _Restore Folder," Article ID: Q263455.

    2. To restart the computer in Safe mode or VGA mode

    Shut down the computer and turn off the power. Wait for at least 30 seconds, and then restart the computer in Safe mode or VGA mode.


    3. To restore the Hosts file
    The following instructions discuss how to fix the Windows host file so that the added name resolution entries do not prevent you from visiting the Web sites of antivirus vendors.
    1. Using Windows Explorer, look for a file named "hosts" in the following locations, if they exist:
    2. For each \hosts file that you find, double-click the file.
    3. When the "Open With" dialog box appears, scroll through the list and select Notepad. Do not check the "Always open this program with. . ." box.
    4. Delete the following lines within the file:

      127.0.0.1 www.symantec.com
      127.0.0.1 securityresponse.symantec.com
      127.0.0.1 symantec.com
      127.0.0.1 www.sophos.com
      127.0.0.1 sophos.com
      127.0.0.1 sophos.com
      127.0.0.1 www.mcafee.com
      127.0.0.1 mcafee.com
      127.0.0.1 liveupdate.symantecliveupdate.com
      127.0.0.1 www.viruslist.com
      127.0.0.1 viruslist.com
      127.0.0.1 viruslist.com
      127.0.0.1 f-secure.com
      127.0.0.1 www.f-secure.com
      127.0.0.1 kaspersky.com
      127.0.0.1 www.avp.com
      127.0.0.1 www.kaspersky.com
      127.0.0.1 avp.com
      127.0.0.1 www.networkassociates.com
      127.0.0.1 networkassociates.com
      127.0.0.1 www.ca.com
      127.0.0.1 ca.com
      127.0.0.1 mast.mcafee.com
      127.0.0.1 my-etrust.com
      127.0.0.1 www.my-etrust.com
      127.0.0.1 download.mcafee.com
      127.0.0.1 dispatch.mcafee.com
      127.0.0.1 secure.nai.com
      127.0.0.1 nai.com
      127.0.0.1 www.nai.com
      127.0.0.1 update.symantec.com
      127.0.0.1 updates.symantec.com
      127.0.0.1 us.mcafee.com
      127.0.0.1 liveupdate.symantec.com
      127.0.0.1 customer.symantec.com
      127.0.0.1 rads.mcafee.com
      127.0.0.1 trendmicro.com
      127.0.0.1 www.trendmicro.com


      Do not delete the line:

      127.0.0.1 localhost
    5. Save the hosts file.

    4. To reverse the changes made to the registry

    WARNING: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.
    1. Click Start, and then click Run. (The Run dialog box appears.)
    2. Type regedit

      Then click OK. (The Registry Editor opens.)

    3. Navigate to the key:
    4. In the right pane, delete any of the following values:

      "^`d}qZxu" = "~`d}qzxu3zYF"

      "Configuration Loader"="confgldr.exe"

      "Video Process"="sysconf.exe"  

      "Service Host Process"="spoolsvc.exe"

    5. Navigate to and delete the keys:

      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SoundMan
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\svc32
    6. Exit the Registry Editor.
    7. Restart the computer in Normal mode. For instructions, read the section on returning to Normal mode in the document, "How to start the computer in Safe Mode."

    5. To update the virus definitions

    Symantec Security Response fully tests all the virus definitions for quality assurance before they are posted to our servers. There are two ways to obtain the most recent virus definitions:


    6. To scan for and delete the infected files
    1. Start your Symantec antivirus program and make sure that it is configured to scan all the files.
    2. Run a full system scan.
    3. If any files are detected as W32.Gaobot.gen!poly, click Delete.

    Revision History:


    Write-up by: Asuka Yamamoto