Gaobot.PX is a worm with backdoor characteristics that affects Windows 2003/XP/2000/NT computers only. Gaobot.PX exploits the LSASS, RPC DCOM and WebDAV vulnerabilities to spread to as many computers as possible. Gaobot.PX also spreads by attempting to copy itself to network shared resources it accesses. In addition, it takes advantage of the backdoors opened by the worms Bagle.A and Mydoom.A, in order to spread to those computers affected by these worms. Once it is run, Gaobot.PX connects to a specified IRC server and waits for control commands. As a backdoor, it allows to obtain information on the affected computer, run and download files, launch distributed denial of service (DDoS) attacks, upload files by FTP, etc. Gaobot.PX ends processes belonging to antivirus programs, firewalls and system monitoring tools. This leaves the affected computer vulnerable to the attack of other viruses or worms. It also ends the processes of Nachi.A, Autorooter.A, Sobig.F and several variants of Blaster. If you have a Windows 2003/XP/2000/NT computer, it is highly recommendable to download the security patches for the LSASS, RPC DCOM and WebDAV vulnerabilities from the Microsoft website. |