Gaobot.XW is a worm with backdoor characteristics that affects Windows 2003/XP/2000/NT computers only. Gaobot.XW exploits the LSASS and RPC DCOM vulnerabilities to spread to as many computers as possible.
Gaobot.XW also spreads by attempting to copy itself to network shared resources it accesses. In addition, it spreads to those computers already affected by the worms Bagle.A, Mydoom.A, Optix, Kuang, and SubSeven. It also accesses those computers with the application DameWare Mini Remote Control installed or with an SQL Server installed with the administrator account password blank.
Once it is run, Gaobot.XW connects to a specified IRC server and waits for control commands. As a backdoor, it allows to obtain information on the affected computer, run and download files, launch distributed denial of service (DDoS) attacks, upload files by FTP, etc.
Gaobot.XW ends processes belonging to antivirus programs, firewalls and system monitoring tools. This leaves the affected computer vulnerable to the attack of other viruses or worms. It also ends the processes of several variants of Bagle.A, Netsky.A, and Blaster.
If you have a Windows 2003/XP/2000/NT computer, it is highly recommendable to download the security patches for the LSASS and RPC DCOM vulnerabilities from the Microsoft website.