Gaobot.S is a worm with backdoor characteristics that infects only Windows XP/2000/NT computers. Gaobot.S exploits the RPC DCOM and WebDAV vulnerabilities to spread to as many computers as possible.
Gaobot.S also spreads by attempting to copy itself to network shared resources. It gains access to these shared resources by using passwords that are typical or easy to guess.
Once it is run, Gaobot.S connects to a specified IRC server through the port 6667 and waits for control commands. As a backdoor, it allows to obtain information on the affected computer, run files, launch distributed denial of service (DDoS) attacks, upload files by FTP, etc.
Gaobot.S ends processes belonging to antivirus programs, firewalls and system monitoring tools. This leaves the affected computer vulnerable to the attack of other viruses or worms. It also ends the processes of Nachi.A, Autorooter.A, Sobig.F and several variants of Blaster.
If you have a Windows XP/2000/NT computer, it is highly recommendable to download the security patches for the RPC DCOM and WebDAV vulnerabilities from the Microsoft website.