WORM_SPYBOT.ABO

Malware type: Worm

Aliases: Backdoor.Win32.Rbot.bu (Kaspersky), W32/Gaobot.worm.gen.e (McAfee), W32.Spybot.Worm (Symantec), Worm/Rbot.MP (Avira),

In the wild: Yes

Destructive: No

Language: English

Platform: Windows 98, ME, NT, 2000, XP

Encrypted: No

Overall risk rating:

Reported infections:

Damage potential:

High

Distribution potential:

Medium

Description: 

This worm drops a copy of itself in the Windows system folder as GCM.EXE. It also creates registry entries to ensure its execution every system startup.

It propagates by dropping copies of itself in the mapped drives.

Its backdoor capabilities comprises of launching certain DoS (denial of service) flood attacks.

This worm also steals the CD keys of the several popular applications if they are installed on the infected system.

For additional information about this threat, see:

Description created: Apr. 12, 2005 8:34:35 AM GMT -0800
Description updated: Apr. 12, 2005 8:35:42 AM GMT -0800


TECHNICAL DETAILS


File type: PE

Memory resident:  Yes

Size of malware: 124653 Bytes

Ports used: Vary

Initial samples received on: Apr 10, 2005

Compression type: Yoda�s Protector

Details:

Installation and Autostart Techniques

This worm drops a copy of itself in the Windows system folder as GCM.EXE. It creates the following registry entries to ensure its execution every system startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run
Microsoft Update Machine = gcm.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\RunServices
Microsoft Update Machine = gcm.exe

HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run
Microsoft Update Machine = gcm.exe

It also modifies the following registry as part of its installaion routine:

HKEY_LOCAL_MACHINE\Software\Microsoft\OLE
From EnableDCOM = "N"
To EnableDCOM = "Y"

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Control\Lsa
From Restrictanonymous = "dword(00000001)"
To Restrictanonymous = "dword(00000000)"

It propagates by dropping copies of itself in the mapped drives.

Information Theft

This worm also steals the CD keys of the following popular applications if they are installed on the infected system:

  • Battlefield 1942
  • Battlefield 1942 (Road To Rome)
  • Battlefield 1942 (Secret Weapons of WWII)
  • Battlefield Vietnam
  • Black and White
  • Chrome
  • Command and Conquer: Generals
  • Command and Conquer: Generals (Zero Hour)
  • Command and Conquer: Red Alert
  • Command and Conquer: Red Alert 2
  • Command and Conquer: Tiberian Sun
  • FIFA 2002
  • FIFA 2003
  • Freedom Force
  • Global Operations
  • Gunman Chronicles
  • Half-Life
  • Hidden & Dangerous 2
  • IGI 2: Covert Strike
  • Industry Giant 2
  • James Bond 007: Nightfire
  • Legends of Might and Magic
  • Medal of Honor: Allied Assault
  • Medal of Honor: Allied Assault: Breakthrough
  • Medal of Honor: Allied Assault: Spearhead
  • Microsoft Windows Product ID
  • Nascar Racing 2002
  • Nascar Racing 2003
  • Need For Speed Hot Pursuit 2
  • Need For Speed: Underground
  • Neverwinter Nights (Hordes of the Underdark)
  • Neverwinter Nights (Shadows of Undrentide)
  • NHL 2002
  • NHL 2003
  • ProductId
  • Rainbow Six III RavenShield
  • Shogun: Total War: Warlord Edition
  • Soldier of Fortune II - Double Helix
  • Soldiers Of Anarchy
  • The Gladiators
  • Unreal Tournament 2003
  • Unreal Tournament 2004

Denial of Service Attack

This wor launches the following DoS (denial of service) flood attacks:

  • HTTP
  • FTP
  • SYN

Other Details

This worm runs on Windows 98, ME, NT, 2000, and XP.

Analysis By: Donne Celadi�a


SOLUTION


Minimum scan engine version needed: 6.810

Pattern file needed: 2.554.00

Pattern release date: Apr 10, 2005


Important note: The "Minimum scan engine" refers to the earliest Trend Micro scan engine version guaranteed to detect this threat. However, Trend Micro strongly recommends that you update to the latest version in order to get comprehensive protection. Download the latest scan engine here.

Solution:

Terminating the Malware Program

This procedure terminates the running malware process.

  1. Open Windows Task Manager.
    � On Windows 95, 98, and ME, press
    CTRL%20ALT%20DELETE
    � On Windows NT, 2000, and XP, press
    CTRL%20SHIFT%20ESC, then click the Processes tab.
  2. In the list of running programs*, locate the process:
    gcm.exe
  3. Select the malware process, then press either the End Task or the End Process button, depending on the version of Windows on your system.
  4. To check if the malware process has been terminated, close Task Manager, and then open it again.
  5. Close Task Manager.

*NOTE: On systems running Windows 95, 98, and ME, Windows Task Manager may not show certain processes. You can use a third party process viewer such as Process Explorer to terminate the malware process. Otherwise, continue with the next procedure, noting additional instructions.

Removing Autostart Entries from the Registry

Removing autostart entries from the registry prevents the malware from executing at startup.

  1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
  2. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>
    Windows>CurrentVersion>Run
  3. In the right panel, locate and delete the entry:
    Microsoft Update Machine = gcm.exe
  4. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>
    Windows>CurrentVersion>RunServices
  5. In the right panel, locate and delete the entry:
    Microsoft Update Machine = gcm.exe
  6. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>
    Windows>CurrentVersion>Run
  7. In the right panel, locate and delete the entry:
    Microsoft Update Machine = gcm.exe

NOTE:If you were not able to terminate the malware process as described in the previous procedure, restart your system.

Restoring Registry Default Values

  1. Still in the Registry Editor, in the left panel, locate the key:
    HKEY_LOCAL_MACHINE>Software>Microsoft>OLE
  2. In the right panel, locate the entry:
    EnableDCOM = "N"
  3. Right-click on this registry entry and choose Modify. Change the value of this entry to the following:
    EnableDCOM = "Y"
  4. In the left panel, locate the key:
    HKEY_LOCAL_MACHINE>System>CurrentControlSet>
    Control>Lsa
  5. Close Registry Editor.

NOTE:If you were not able to terminate the malware process as described in the previous procedure, restart your system.

Restoring EnableDCOM and RestrictAnonymous registry entries

This malware modifies EnableDCOM and RestrictAnonymous registry entries to a certain value. To know more about restoring these registries to their original values, please refer to these articles:

  1. COM security frequently asked questions
  2. How to disable DCOM support in Windows
  3. How to Use the RestrictAnonymous Registry Value in Windows 2000
  4. The "RestrictAnonymous" Registry Value May Break the Trust to a Windows 2000 Domain

Additional Windows ME/XP Cleaning Instructions

Users running Windows ME and XP must disable System Restore to allow full scanning of infected systems.

Users running other Windows versions can proceed with the succeeding procedure set(s).

Running Trend Micro Antivirus

Scan your system with Trend Micro antivirus and delete files detected as WORM_SPYBOT.ABO. To do this, Trend Micro customers must download the latest pattern file and scan their system. Other Internet users can use HouseCall, Trend Micro's online virus scanner.




Trend Micro offers best-of-breed antivirus and content-security solutions for your corporate network, small and medium business, mobile device or home PC.