W32/Gbot.worm!901FFF331B6A | Virus Profile & Definition

Virus Profile information details
Risk Assessment:	Home Low \| Corporate Low
Date Discovered:	7/16/2012
Date Added:	7/16/2012
Origin:	Unknown
Length:	116740
Type:	Virus
Subtype:	Win32
DAT Required:	6774
Removal Instructions

Description

Viruses are self-replicating. They are often spread by a network or by transmission to a removable medium such as a removable disk, writable CD, or USB drive. Viruses may also spread by infecting files on a network file system or a file system that is shared by another computer.

Indication of Infection

This symptoms of this detection are the files, registry, and network communication referenced in the characteristics section.

Methods of Infection

Viruses are self-replicating. They are often spread by a network or by transmission to a removable medium such as a removable disk, writable CD, or USB drive. Viruses may also spread by infecting files on a network file system or a file system that is shared by another computer.

Back to Top

View Virus Characteristics

Virus Characteristics

This is a Virus

File Properties	Property Values
McAfee Detection	W32/Gbot.worm
Length	116740 bytes
MD5	901fff331b6aea13e38473fd28d35277
SHA1	72aa5f88d4979369306e557f6cdd8b2fac557fbe

Other Common Detection Aliases

Company Names	Detection Names
EMSI Software	Backdoor.Win32.Gobot!IK
ahnlab	Win32/IRCBot.worm.variant
avast	Win32:Trojan-gen
AVG (GriSoft)	BackDoor.Gobot.M
avira	Worm/Gobot.Y.1
Kaspersky	Backdoor.Win32.Gobot.p
BitDefender	Backdoor.Gobot.A
clamav	PUA.Win32.Packer.Vip
Dr.Web	Win32.HLLW.Ghostbot
F-Prot	W32/Banload.B.gen!Eldorado
FortiNet	W32/GoBot.fam!tr.bdr
Microsoft	Backdoor:Win32/Gobot
Symantec	W32.Gobot.A
Eset	Win32/Gobot.P trojan
norman	W32/Gobot.CZ
panda	Bck/Gotob.AB
rising	BackDoor.Gobot.B
Sophos	W32/Gobot-J
Trend Micro	Mal_Gobot
vba32	Backdoor.Win32.Gobot.p
V-Buster	Backdoor.Gobot!IBnq0MOe+2s (trojan)
Vet (Computer Associates)	Win32/Bosbot!generic

Other brands and names may be claimed as the property of others.

Activities	Risk Levels
Attempts to connect to an IRC server. Can be used by bots to get instructions or send data to a remote server.
Enumerates many system files and directories.
Enumerates process list
Adds or modifies Internet Explorer cookies
No digital signature is present

McAfee Scans	Scan Detections
McAfee Beta	W32/Gbot.worm
McAfee Supported	W32/Gbot.worm

System Changes

Some path values have been replaced with environment variables as the exact location may vary with different configurations.
e.g.
%WINDIR% = \WINDOWS (Windows 9x/ME/XP/Vista/7), \WINNT (Windows NT/2000)
%PROGRAMFILES% = \Program Files

The following files were analyzed:

72aa5f88d4979369306e557f6cdd8b2fac557fbe

	The following files have been added to the system:
	%WINDIR%\setup.txt %WINDIR%\3DeyOWTKxAtus.exe

The following files have been added to the system:

%WINDIR%\setup.txt

%WINDIR%\3DeyOWTKxAtus.exe

	The following registry elements have been changed:
	HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\SFCDISABLE = 4294967197 HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\VSMAIN = %WINDIR%\3DeyOWTKxAtus.exe

The following registry elements have been changed:

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\SFCDISABLE = 4294967197

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\VSMAIN = %WINDIR%\3DeyOWTKxAtus.exe

	The applications attempted the following network connection(s):
	94.[private subnet] 112.175.99.**:139 118.12.199.:3127 96.176.60.*:139 152.193.232.:139 185.144.247.:139 101.116.173.:139 123.17.76.:139 82.128.183.:139 75.229.61.*:3127 31.190.62.:139 11.225.247.:3127 132.234.177.:445 120.229.139.*:445 192.169.2[private subnet] 191.71.70.:445 87.132.245.*:445 2[private subnet]:445 184.3.90.:445 62.180.122.:445 195.253.9.:445 212.96.181.:445 198.158.197.*:445 172.206.12.:445 199.237.231.:445 68.63.80.:3127 137.30.200.:139 147.233.174.*:139 172.16.203.:139 189.132.232.*:139 112.24.172.:3127 [local subnet].27:445 131.17.21.:445 119.90.165.:139 7.81.129.:139 48.49.68.:445 100.142.235.:139 8.187.69.:3127 217.160.108.:6659 30.206.167.:3127 187.90.1.*:3127 50.173.117.:445 82.192.117.:3127 209.193.196.:139 27.164.83.:3127 220.74.203.:445 166.90.38.:139 8.116.219.:3127 87.216.79.:3127 173.47.130.:445 44.11.101.:3127 120.229.139.:139 132.234.177.:139 87.132.245.*:139 191.71.70.:139 2[private subnet]:139 184.3.90.*:139 198.158.197.:139 172.206.12.:139 212.96.181.:139 195.253.9.*:139 62.180.122.:139 199.237.231.:139 22.225.200.:445 189.159.209.*:445 129.36.117.:445 201.151.230.:445 192.169.121.:445 140.237.171.*:445 161.225.244.:445 164.27.123.:445 209.198.14.:445 109.148.223.:445 78.245.242.:445 138.204.2[private subnet] 214.40.177.:445 39.170.124.:3127 [local subnet].27:139 131.17.21.:139 212.23.137.:445 19.1[private subnet] 48.49.68.:139 180.197.161.:445 167.142.193.:3127 85.123.184.:3127 50.173.117.:139 220.74.203.:139 107.36.59.:139 75.95.75.:3127 183.13.155.:139 108.122.127.:139 8.59.70.:3127 173.50.115.:3127 79.28.132.:139 169.97.24.:3127 173.47.130.:139 83.27.109.:445 172.16.49.*:139 20.47.163.:3127 40.212.108.:3127 54.12.143.:3127 104.60.123.:139 135.251.167.:3127 214.107.241.:3127 122.131.42.:445 182.150.17.:139 [local subnet].77:139 189.159.209.:139 22.225.200.:139 201.151.230.*:139 129.36.117.:139 192.169.121.:139 140.237.171.:139 161.225.244.:139 209.198.14.*:139 164.27.123.:139 78.245.242.*:139 109.148.223.:139 214.40.177.:139 45.19.70.:445 [local subnet].69:445 158.129.137.*:445 125.61.77.:445 139.251.48.*:139 84.78.232.:3127 192.169.93.:445 88.55.161.:139 150.11.173.*:445 129.229.112.:445 126.178.225.:445 198.178.67.:445 86.108.32.:3127 97.134.74.:445 122.215.4.:139 104.226.27.:445 223.48.8.:445 82.82.43.:139 42.79.90.:445 50.34.64.:139 140.125.194.:445 88.113.80.:139 11.175.12.:445 58.4.203.:445 89.68.243.:3127 212.23.137.:139 9.241.106.:445 180.197.161.:139 119.27.92.:3127 216.160.80.:445 172.16.80.:139 141.215.234.:139 154.92.181.:445 109.180.86.:139 39.75.239.*:445 186.169.99.:139 117.33.144.*:139 178.99.249.:445 83.27.109.:139 85.18.1.:445 122.131.42.:139 188.47.175.:139 49.136.249.:445 9.144.47.:139 65.214.65.:445 148.84.63.:139 79.225.133.:139 144.116.213.:445 21.182.155.:3127 92.155.243.:139 [local subnet].69:139 34.81.44.:445 158.129.137.:139 125.61.77.:139 75.11.88.:139 122.118.140.:3127 97.134.74.:139 126.178.225.:139 59.184.9.*:139 129.229.112.:139 150.11.173.:139 192.169.93.:139 11.120.201.:3127 187.178.2[private subnet] 58.4.203.:139 42.79.90.:139 223.48.8.:139 104.226.27.:139 97.105.113.:139 11.175.12.:139 63.178.15.:139 140.125.194.:139 5.225.1[private subnet] 89.231.220.:3127 90.52.20.:3127 131.143.55.:139 20.26.100.:3127 192.169.85.:139 188.216.197.:139 141.8.13.*:3127 66.215.118.:445 [local subnet].92:445 107.154.131.:445 77.40.112.:139 120.179.35.*:445 64.126.88.:445 25.59.125.:445 111.92.170.:445 126.87.213.*:445 223.152.148.:445 54.19.101.:3127 143.144.208.:445 62.185.83.:445 178.141.132.:445 160.113.202.:445 170.108.117.*:445 34.81.44.:139 186.129.176.:445 65.214.65.:139 49.1[private subnet] 9.241.106.:139 85.18.1.:139 192.169.58.*:139 116.173.158.:3127 146.159.123.*:3127 61.164.33.:3127 154.99.59.:3127 48.95.125.:3127 150.77.107.*:3127 85.61.11.:139 192.169.63.*:445 203.112.189.:139 180.96.6.*:139 211.107.72.:139 95.123.253.:445 178.99.249.:139 67.135.129.:139 68.169.128.:445 81.240.57.:139 23.123.52.:3127 49.136.249.*:139 54.[private subnet] 136.170.9.:139 195.87.65.:445 168.16.79.:139 144.116.213.:139 126.46.103.:139 208.205.83.:139 [local subnet].92:139 53.241.254.:445 107.154.131.:139 143.144.208.:139 223.152.148.:139 70.1[private subnet] 126.87.213.:139 202.78.28.:445 25.59.125.:139 120.179.35.:139 213.9.199.:139 94.26.197.:445 186.129.176.:139 94.26.197.:139 170.108.117.:139 160.113.202.:139 178.141.132.*:139 62.185.83.:139 155.189.3.:445 91.154.58.:139 172.16.16.*:445 4.105.248.:139 17.105.31.*:445 26.88.189.:445 75.170.214.*:139 221.250.67.:445 52.36.176.*:445 146.193.34.:445 1[private subnet]:445 167.26.45.:445 41.134.105.:445 79.198.248.:445 115.71.138.:445 8.158.181.:445 12.100.255.:445 183.116.224.*:3127 182.155.35.:3127 153.46.252.:3127 187.118.233.:3127 130.7.79.:3127 162.17.117.:3127 114.81.225.*:139 192.169.63.:139 153.170.167.:139 125.83.129.:445 95.123.253.:139 68.169.128.*:139 30.191.221.:3127 139.189.223.:139 76.37.101.:3127 162.48.[private subnet] 197.42.111.:3127 121.137.80.*:3127 165.182.240.:3127 19.153.116.:139 140.91.59.:3127 168.251.83.:3127 117.160.141.:3127 1[private subnet]:139 199.106.248.*:3127 149.225.105.:3127 179.101.144.*:3127 195.87.65.:139 192.169.236.*:139 192.169.246.:445 223.90.106.:139 166.60.185.:139 49.220.191.:139 155.189.3.:139 206.209.157.:139 212.118.66.:139 172.16.16.*:139 52.36.176.:139 221.250.67.:139 26.88.189.:139 17.105.31.*:139 146.193.34.:139 92.105.152.:139 12.100.255.:139 8.158.181.*:139 115.71.138.:139 79.198.248.:139 41.134.105.:139 167.26.45.:139 162.214.38.:139 172.16.51.*:139 97.105.113.:445 63.178.15.:445 8.233.192.:445 115.159.247.*:445 191.248.62.:3127 162.114.135.:445 188.216.197.:445 36.246.164.:3127 134.240.189.:445 206.16.1.:139 107.194.197.:445 158.34.21.:139 136.159.141.:445 207.151.138.:445 3.214.94.:445 52.152.128.*:3127 184.195.30.:445 172.16.43.*:445 172.2[private subnet] 134.170.251.:3127 36.59.249.*:139 1[private subnet]:3127 107.146.221.:3127 145.87.13.:3127 125.83.129.:139 192.169.230.:139 91.136.183.:139 192.169.246.:139 89.103.147.:139 25.130.75.:139 57.109.78.:139 119.179.21.:139 6.29.90.:139 50.227.239.*:139 208.104.51.:139 95.81.1.:139 23.114.51.:139 161.41.217.:139 66.149.220.:139 165.152.77.:3127 34.115.144.:139 171.105.94.:139 192.169.91.:445 66.247.227.:139 206.216.73.:445 115.159.247.:139 158.63.237.:445 8.233.192.:139 213.165.4.:445 36.159.227.:139 [local subnet].77:445 216.160.80.:139 208.36.136.:445 136.159.141.:139 137.209.209.:445 207.151.138.*:139 97.195.18.:445 3.214.94.:139 199.47.90.:445 107.194.197.:139 174.197.76.:445 136.196.51.*:139 190.106.128.:445 134.240.189.*:139 177.220.76.:445 130.96.84.:139 164.19.106.:445 39.75.239.:139 94.96.44.:445 154.92.181.*:139 59.9.149.:139 162.114.135.:139 185.90.151.:3127 184.195.30.:139 172.16.43.:139 45.19.70.:139 198.178.67.:139 192.169.120.:139 175.184.40.:3127 163.94.162.:3127 177.126.167.*:139 186.176.151.:139 177.127.252.:3127 134.145.109.:3127 33.41.119.:3127 7.29.234.*:3127 192.169.91.:139 196.174.108.:3127 59.1.102.:3127 213.165.4.:139 217.80.237.:3127 158.63.237.:139 204.190.157.:3127 208.36.136.*:139 197.116.237.:3127 97.195.18.:139 23.250.108.:3127 137.209.209.:139 6.248.218.:3127 206.216.73.:139 26.179.31.:3127 199.47.90.:139 104.228.247.:3127 63.18.34.:139 109.212.202.:3127 164.19.106.:139 8.187.27.:3127 177.220.76.:139 155.221.107.:3127 190.106.128.:139 34.235.168.:139 174.197.76.:139 159.144.79.*:139 121.136.22.:139 128.64.240.:139 192.169.160.:139 189.104.209.*:139 94.96.44.:139 84.189.129.*:139 68.15.19.:139 153.148.169.:139 [local subnet].72:445 136.8.74.:139 41.151.81.:139 11.24.163.:139 51.53.200.:445 129.104.87.:139 170.94.213.:445 24.35.72.:139 60.3.160.:445 42.90.244.:139 121.187.203.:445 1.137.99.:139 130.176.138.:445 24.9.227.:139 54.25.222.*:445 182.159.21.:445 208.146.180.:139 204.[private subnet] 173.127.71.:445 120.129.52.*:445 138.113.7.:139 172.16.55.*:139 192.169.109.:445 170.216.86.:139 221.112.244.:139 92.142.180.*:445 132.216.187.:3127 143.8.214.:3127 215.13.140.:139 128.100.175.:445 208.34.182.:3127 66.215.118.:139 5.218.165.:445 52.152.111.:139 64.126.88.:139 111.92.170.:139 105.250.213.*:445 196.171.220.:445 89.178.229.:445 16.98.127.:3127 34.84.29.:3127 119.103.222.:3127 88.47.1[private subnet] 79.66.126.:3127 [local subnet].72:139 60.3.160.*:139 130.176.138.:139 121.187.203.:139 170.94.213.:139 51.53.200.:139 54.25.222.*:139 182.159.21.:139 53.241.254.:139 202.78.28.:139 120.129.52.*:139 173.127.71.:139 192.169.109.*:139 172.16.81.:445 207.133.122.:445 84.231.56.:445 21.230.134.:445 160.63.173.:445 206.145.199.:445 167.21.253.:445 85.236.162.*:445 86.109.127.:445 218.181.223.:445 7.222.53.:445 186.142.127.**:445 192.169.227.:445 92.142.180.*:139 197.114.111.:3127 64.13.166.*:3127 154.226.176.:3127 166.88.184.:445 128.100.175.:139 113.14.236.:3127 184.166.104.:139 35.[private subnet] 5.218.165.*:139 105.250.213.:139 196.171.220.*:139 123.221.178.:445 89.178.229.:139 94.66.119.:3127 90.113.60.*:139 66.174.245.:3127 94.106.75.*:139 188.78.1[private subnet] 133.164.189.:139 217.160.108.*:6659 (irc) : NICK Administrator20 217.160.108.:6659 (irc) : USER Administrator20 Ghost BOT :Ghost-BOT 192.91.216.:445 71.222.229.*:139 32.84.49.:3127 58.181.234.:3127 138.137.68.:445 140.93.11.:3127 201.102.154.:3127 181.26.130.:3127 20.69.198.:139 153.224.252.:445 172.16.81.:139 84.231.56.:139 206.145.199.:139 207.133.122.:139 160.63.173.:139 167.21.253.:139 21.230.134.*:139 85.236.162.:139 86.109.127.*:139 192.169.227.:139 186.142.127.*:139 7.222.53.:139 218.181.223.*:139 89.62.98.:139 213.43.91.:445 19.215.90.:445 85.61.11.:445 [local subnet].253:445 113.187.122.*:445 99.211.171.:445 24.122.131.:139 12.217.13.:445 104.142.231.:139 43.192.159.:3127 120.172.70.:445 68.142.240.:445 192.169.101.:445 161.202.127.*:445 5.116.46.:445 112.175.99.:445 142.24.185.:3127 166.88.184.*:139 201.220.175.:3127 137.30.200.:445 119.90.165.*:445 123.221.178.:139 100.142.235.**:445 192.91.216.:139 209.193.196.*:445 138.137.68.:139 136.196.51.:445 166.90.38.:445 149.8.59.*:3127 160.136.128.:3127 113.164.160.*:3127 153.224.252.:139 99.211.171.:139 113.187.122.:139 [local subnet].253:139 213.74.44.:3127 19.215.90.:139 213.43.91.:139 12.217.13.*:139 95.201.17.:139 73.123.99.:139 120.172.70.:139 11.51.26.:3127 5.116.46.:139 161.202.127.:139 68.142.240.:139 192.169.101.*:139

The applications attempted the following network connection(s):

94.[private subnet]

112.175.99.***:139

118.12.199.*:3127

96.176.60.***:139

152.193.232.***:139

185.144.247.***:139

101.116.173.**:139

123.17.76.**:139

82.128.183.**:139

75.229.61.***:3127

31.190.62.***:139

11.225.247.***:3127

132.234.177.**:445

120.229.139.***:445

192.169.2[private subnet]

191.71.70.**:445

87.132.245.***:445

2[private subnet]:445

184.3.90.***:445

62.180.122.**:445

195.253.9.***:445

212.96.181.**:445

198.158.197.***:445

172.206.12.***:445

199.237.231.**:445

68.63.80.***:3127

137.30.200.**:139

147.233.174.***:139

172.16.203.**:139

189.132.232.***:139

112.24.172.**:3127

[local subnet].27:445

131.17.21.**:445

119.90.165.***:139

7.81.129.**:139

48.49.68.***:445

100.142.235.***:139

8.187.69.**:3127

217.160.108.***:6659

30.206.167.**:3127

187.90.1.***:3127

50.173.117.***:445

82.192.117.***:3127

209.193.196.***:139

27.164.83.***:3127

220.74.203.**:445

166.90.38.**:139

8.116.219.***:3127

87.216.79.***:3127

173.47.130.***:445

44.11.101.**:3127

120.229.139.***:139

132.234.177.**:139

87.132.245.***:139

191.71.70.**:139

2[private subnet]:139

184.3.90.***:139

198.158.197.***:139

172.206.12.***:139

212.96.181.**:139

195.253.9.***:139

62.180.122.**:139

199.237.231.**:139

22.225.200.**:445

189.159.209.***:445

129.36.117.***:445

201.151.230.***:445

192.169.121.**:445

140.237.171.***:445

161.225.244.**:445

164.27.123.**:445

209.198.14.***:445

109.148.223.***:445

78.245.242.***:445

138.204.2[private subnet]

214.40.177.***:445

39.170.124.***:3127

[local subnet].27:139

131.17.21.**:139

212.23.137.***:445

19.1[private subnet]

48.49.68.***:139

180.197.161.***:445

167.142.193.**:3127

85.123.184.**:3127

50.173.117.***:139

220.74.203.**:139

107.36.59.**:139

75.95.75.***:3127

183.13.155.***:139

108.122.127.***:139

8.59.70.***:3127

173.50.115.***:3127

79.28.132.**:139

169.97.24.**:3127

173.47.130.***:139

83.27.109.**:445

172.16.49.***:139

20.47.163.*:3127

40.212.108.**:3127

54.12.143.***:3127

104.60.123.***:139

135.251.167.***:3127

214.107.241.**:3127

122.131.42.**:445

182.150.17.**:139

[local subnet].77:139

189.159.209.***:139

22.225.200.**:139

201.151.230.***:139

129.36.117.***:139

192.169.121.**:139

140.237.171.***:139

161.225.244.**:139

209.198.14.***:139

164.27.123.**:139

78.245.242.***:139

109.148.223.***:139

214.40.177.***:139

45.19.70.**:445

[local subnet].69:445

158.129.137.***:445

125.61.77.**:445

139.251.48.***:139

84.78.232.**:3127

192.169.93.**:445

88.55.161.**:139

150.11.173.***:445

129.229.112.***:445

126.178.225.**:445

198.178.67.***:445

86.108.32.***:3127

97.134.74.***:445

122.215.4.**:139

104.226.27.**:445

223.48.8.***:445

82.82.43.**:139

42.79.90.**:445

50.34.64.***:139

140.125.194.***:445

88.113.80.**:139

11.175.12.***:445

58.4.203.***:445

89.68.243.**:3127

212.23.137.***:139

9.241.106.***:445

180.197.161.***:139

119.27.92.***:3127

216.160.80.***:445

172.16.80.***:139

141.215.234.***:139

154.92.181.***:445

109.180.86.**:139

39.75.239.***:445

186.169.99.*:139

117.33.144.***:139

178.99.249.***:445

83.27.109.**:139

85.18.1.**:445

122.131.42.**:139

188.47.175.***:139

49.136.249.***:445

9.144.47.***:139

65.214.65.***:445

148.84.63.***:139

79.225.133.***:139

144.116.213.***:445

21.182.155.**:3127

92.155.243.**:139

[local subnet].69:139

34.81.44.***:445

158.129.137.***:139

125.61.77.**:139

75.11.88.**:139

122.118.140.***:3127

97.134.74.***:139

126.178.225.**:139

59.184.9.***:139

129.229.112.***:139

150.11.173.***:139

192.169.93.**:139

11.120.201.**:3127

187.178.2[private subnet]

58.4.203.***:139

42.79.90.**:139

223.48.8.***:139

104.226.27.**:139

97.105.113.**:139

11.175.12.***:139

63.178.15.**:139

140.125.194.***:139

5.225.1[private subnet]

89.231.220.***:3127

90.52.20.**:3127

131.143.55.***:139

20.26.100.***:3127

192.169.85.***:139

188.216.197.**:139

141.8.13.***:3127

66.215.118.***:445

[local subnet].92:445

107.154.131.**:445

77.40.112.*:139

120.179.35.***:445

64.126.88.***:445

25.59.125.***:445

111.92.170.**:445

126.87.213.***:445

223.152.148.***:445

54.19.101.***:3127

143.144.208.***:445

62.185.83.**:445

178.141.132.***:445

160.113.202.**:445

170.108.117.***:445

34.81.44.***:139

186.129.176.***:445

65.214.65.***:139

49.1[private subnet]

9.241.106.***:139

85.18.1.**:139

192.169.58.***:139

116.173.158.**:3127

146.159.123.***:3127

61.164.33.***:3127

154.99.59.***:3127

48.95.125.**:3127

150.77.107.***:3127

85.61.11.**:139

192.169.63.***:445

203.112.189.**:139

180.96.6.***:139

211.107.72.**:139

95.123.253.**:445

178.99.249.***:139

67.135.129.***:139

68.169.128.***:445

81.240.57.***:139

23.123.52.**:3127

49.136.249.***:139

54.[private subnet]

136.170.9.**:139

195.87.65.**:445

168.16.79.***:139

144.116.213.***:139

126.46.103.***:139

208.205.83.***:139

[local subnet].92:139

53.241.254.**:445

107.154.131.**:139

143.144.208.***:139

223.152.148.***:139

70.1[private subnet]

126.87.213.***:139

202.78.28.**:445

25.59.125.***:139

120.179.35.***:139

213.9.199.***:139

94.26.197.***:445

186.129.176.***:139

94.26.197.***:139

170.108.117.***:139

160.113.202.**:139

178.141.132.***:139

62.185.83.**:139

155.189.3.**:445

91.154.58.**:139

172.16.16.***:445

4.105.248.***:139

17.105.31.***:445

26.88.189.*:445

75.170.214.***:139

221.250.67.**:445

52.36.176.***:445

146.193.34.***:445

1[private subnet]:445

167.26.45.***:445

41.134.105.***:445

79.198.248.***:445

115.71.138.***:445

8.158.181.***:445

12.100.255.**:445

183.116.224.***:3127

182.155.35.***:3127

153.46.252.**:3127

187.118.233.**:3127

130.7.79.***:3127

162.17.117.**:3127

114.81.225.***:139

192.169.63.***:139

153.170.167.**:139

125.83.129.***:445

95.123.253.**:139

68.169.128.***:139

30.191.221.***:3127

139.189.223.**:139

76.37.101.***:3127

162.48.[private subnet]

197.42.111.**:3127

121.137.80.***:3127

165.182.240.**:3127

19.153.116.**:139

140.91.59.***:3127

168.251.83.***:3127

117.160.141.**:3127

1[private subnet]:139

199.106.248.***:3127

149.225.105.**:3127

179.101.144.***:3127

195.87.65.**:139

192.169.236.***:139

192.169.246.***:445

223.90.106.***:139

166.60.185.***:139

49.220.191.**:139

155.189.3.**:139

206.209.157.***:139

212.118.66.**:139

172.16.16.***:139

52.36.176.***:139

221.250.67.**:139

26.88.189.*:139

17.105.31.***:139

146.193.34.***:139

92.105.152.***:139

12.100.255.**:139

8.158.181.***:139

115.71.138.***:139

79.198.248.***:139

41.134.105.***:139

167.26.45.***:139

162.214.38.**:139

172.16.51.***:139

97.105.113.**:445

63.178.15.**:445

8.233.192.**:445

115.159.247.***:445

191.248.62.***:3127

162.114.135.***:445

188.216.197.**:445

36.246.164.**:3127

134.240.189.***:445

206.16.1.***:139

107.194.197.***:445

158.34.21.***:139

136.159.141.***:445

207.151.138.***:445

3.214.94.**:445

52.152.128.***:3127

184.195.30.**:445

172.16.43.***:445

172.2[private subnet]

134.170.251.**:3127

36.59.249.***:139

1[private subnet]:3127

107.146.221.***:3127

145.87.13.**:3127

125.83.129.***:139

192.169.230.***:139

91.136.183.**:139

192.169.246.***:139

89.103.147.**:139

25.130.75.**:139

57.109.78.**:139

119.179.21.**:139

6.29.90.**:139

50.227.239.***:139

208.104.51.***:139

95.81.1.***:139

23.114.51.**:139

161.41.217.*:139

66.149.220.***:139

165.152.77.***:3127

34.115.144.***:139

171.105.94.***:139

192.169.91.**:445

66.247.227.***:139

206.216.73.***:445

115.159.247.***:139

158.63.237.***:445

8.233.192.**:139

213.165.4.***:445

36.159.227.***:139

[local subnet].77:445

216.160.80.***:139

208.36.136.***:445

136.159.141.***:139

137.209.209.**:445

207.151.138.***:139

97.195.18.***:445

3.214.94.**:139

199.47.90.**:445

107.194.197.***:139

174.197.76.**:445

136.196.51.***:139

190.106.128.**:445

134.240.189.***:139

177.220.76.***:445

130.96.84.***:139

164.19.106.***:445

39.75.239.***:139

94.96.44.**:445

154.92.181.***:139

59.9.149.***:139

162.114.135.***:139

185.90.151.**:3127

184.195.30.**:139

172.16.43.***:139

45.19.70.**:139

198.178.67.***:139

192.169.120.***:139

175.184.40.***:3127

163.94.162.**:3127

177.126.167.***:139

186.176.151.***:139

177.127.252.**:3127

134.145.109.***:3127

33.41.119.**:3127

7.29.234.***:3127

192.169.91.**:139

196.174.108.**:3127

59.1.102.***:3127

213.165.4.***:139

217.80.237.***:3127

158.63.237.***:139

204.190.157.**:3127

208.36.136.***:139

197.116.237.***:3127

97.195.18.***:139

23.250.108.***:3127

137.209.209.**:139

6.248.218.**:3127

206.216.73.***:139

26.179.31.***:3127

199.47.90.**:139

104.228.247.**:3127

63.18.34.***:139

109.212.202.***:3127

164.19.106.***:139

8.187.27.***:3127

177.220.76.***:139

155.221.107.***:3127

190.106.128.**:139

34.235.168.***:139

174.197.76.**:139

159.144.79.***:139

121.136.22.***:139

128.64.240.***:139

192.169.160.**:139

189.104.209.***:139

94.96.44.**:139

84.189.129.***:139

68.15.19.***:139

153.148.169.**:139

[local subnet].72:445

136.8.74.**:139

41.151.81.***:139

11.24.163.***:139

51.53.200.**:445

129.104.87.***:139

170.94.213.***:445

24.35.72.**:139

60.3.160.***:445

42.90.244.**:139

121.187.203.**:445

1.137.99.***:139

130.176.138.***:445

24.9.227.**:139

54.25.222.***:445

182.159.21.**:445

208.146.180.**:139

204.[private subnet]

173.127.71.**:445

120.129.52.***:445

138.113.7.**:139

172.16.55.***:139

192.169.109.***:445

170.216.86.***:139

221.112.244.**:139

92.142.180.***:445

132.216.187.***:3127

143.8.214.***:3127

215.13.140.***:139

128.100.175.**:445

208.34.182.***:3127

66.215.118.***:139

5.218.165.***:445

52.152.111.***:139

64.126.88.***:139

111.92.170.**:139

105.250.213.***:445

196.171.220.***:445

89.178.229.**:445

16.98.127.***:3127

34.84.29.***:3127

119.103.222.***:3127

88.47.1[private subnet]

79.66.126.**:3127

[local subnet].72:139

60.3.160.***:139

130.176.138.***:139

121.187.203.**:139

170.94.213.***:139

51.53.200.**:139

54.25.222.***:139

182.159.21.**:139

53.241.254.**:139

202.78.28.**:139

120.129.52.***:139

173.127.71.**:139

192.169.109.***:139

172.16.81.***:445

207.133.122.**:445

84.231.56.**:445

21.230.134.***:445

160.63.173.**:445

206.145.199.**:445

167.21.253.**:445

85.236.162.***:445

86.109.127.***:445

218.181.223.***:445

7.222.53.**:445

186.142.127.***:445

192.169.227.*:445

92.142.180.***:139

197.114.111.**:3127

64.13.166.***:3127

154.226.176.***:3127

166.88.184.***:445

128.100.175.**:139

113.14.236.**:3127

184.166.104.**:139

35.[private subnet]

5.218.165.***:139

105.250.213.***:139

196.171.220.***:139

123.221.178.*:445

89.178.229.**:139

94.66.119.**:3127

90.113.60.***:139

66.174.245.**:3127

94.106.75.***:139

188.78.1[private subnet]

133.164.189.**:139

217.160.108.***:6659 (irc) : NICK Administrator20

217.160.108.***:6659 (irc) : USER Administrator20 Ghost BOT :Ghost-BOT

192.91.216.*:445

71.222.229.***:139

32.84.49.***:3127

58.181.234.***:3127

138.137.68.***:445

140.93.11.**:3127

201.102.154.***:3127

181.26.130.**:3127

20.69.198.**:139

153.224.252.***:445

172.16.81.***:139

84.231.56.**:139

206.145.199.**:139

207.133.122.**:139

160.63.173.**:139

167.21.253.**:139

21.230.134.***:139

85.236.162.***:139

86.109.127.***:139

192.169.227.*:139

186.142.127.***:139

7.222.53.**:139

218.181.223.***:139

89.62.98.***:139

213.43.91.**:445

19.215.90.***:445

85.61.11.**:445

[local subnet].253:445

113.187.122.***:445

99.211.171.***:445

24.122.131.**:139

12.217.13.***:445

104.142.231.***:139

43.192.159.***:3127

120.172.70.***:445

68.142.240.***:445

192.169.101.**:445

161.202.127.***:445

5.116.46.***:445

112.175.99.***:445

142.24.185.**:3127

166.88.184.***:139

201.220.175.***:3127

137.30.200.**:445

119.90.165.***:445

123.221.178.*:139

100.142.235.***:445

192.91.216.*:139

209.193.196.***:445

138.137.68.***:139

136.196.51.***:445

166.90.38.**:445

149.8.59.***:3127

160.136.128.**:3127

113.164.160.***:3127

153.224.252.***:139

99.211.171.***:139

113.187.122.***:139

[local subnet].253:139

213.74.44.**:3127

19.215.90.***:139

213.43.91.**:139

12.217.13.***:139

95.201.17.***:139

73.123.99.***:139

120.172.70.***:139

11.51.26.***:3127

5.116.46.***:139

161.202.127.***:139

68.142.240.***:139

192.169.101.**:139

Back to Top

Back To Overview View Removal Instructions

All Users:

Please use the following instructions for all supported versions of Windows to remove threats and other potential risks:

1.Disable System Restore .

2.Update to current engine and DAT files for detection and removal.

3.Run a complete system scan.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

1. Please go to the Microsoft Recovery Console and restore a clean MBR.

On windows XP:

Insert the Windows XP CD into the CD-ROM drive and restart the computer.
When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
Select the Windows installation that is compromised and provide the administrator password
Issue 'fixmbr' command to restore the Master Boot Record
Follow onscreen instructions
Reset and remove the CD from CD-ROM drive.

On Windows Vista and 7:

Insert the Windows CD into the CD-ROM drive and restart the computer.
Click on "Repair Your Computer"
When the System Recovery Options dialog comes up, choose the Command Prompt.
Issue 'bootrec /fixmbr' command to restore the Master Boot Record
Follow onscreen instructions
Reset and remove the CD from CD-ROM drive.

Back to Top

View Virus Characteristics

Virus Profile: W32/Gbot.worm!901FFF331B6A

Description

Indication of Infection

Methods of Infection

Virus Characteristics

Virus Information

Indications of Infection:

PRODUCTS

VIRUS SECURITY

SUPPORT

SOCIALIZE WITH US ON

SIGN UP FOR SECURITY NEWS

WE ACCEPT THE FOLLOWING