Remove W32.HLLW.Gaobot. Description and removal instructions

Title: W32.HLLW.Gaobot
Type: Worms	Severity scale: (60 / 100)

W32.HLLW.Gaobot is a worm that copies itself as %system%Sysldr32.exe.
It then connects to an IRC server and listens for commands. By default, the worm will connect on ports 6,667 and 9,900. Some of the commands that it supports include commands to spread itself, using popular file sharing programs such as Kazaa, Bearshare, and Grokster. It shares itself as some of the following file names:
Kylie Minogue is very horny atm - XXX.exe
Cameron Diaz's webcam - cracked access - no cost - XXX.exe
Hoyle Card Games 2003 crack (all versions).exe
Warcraft 3 - Cable Modem Playfix.exe
Delta Force Black Hawk Down - Item Hack.exe

The worm also attempts to spread to all computers on the network, using a utility that connects to a remote computer on port 445, it copies the Woinggg.exe file across the network, and then executes it.

FORUM:
Discuss W32.HLLW.Gaobot in
spyware removal forum

W32.HLLW.Gaobot properties:
• Allows remote user connection
• Hides from the user
• Stays resident in background

Automatic W32.HLLW.Gaobot removal:

remover for W32.HLLW.Gaobot

W32.HLLW.Gaobot manual removal:

Delete registry values:
Browse to the key:
'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
Delete the value 'Config Loader %sysdir%\sysldr32.exe'
Browse to the key:
'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'
Delete the value 'Config Loader %sysdir%\sysldr32.exe'
Browse to the key:
'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices'
Delete the value 'Config Loader %sysdir%\sysldr32.exe'

HELP:
how to remove registry entries

Other programs to remove W32.HLLW.Gaobot:

• SUPERAntiSpyware - Review - Download
• CounterSpy - Review - Download
• Windows Defender - Review - Download

Information added: 19/03/04
Information updated: 09/09/04

Additional resources related to W32.HLLW.Gaobot:

Attention: If you know or you have a website or page about W32.HLLW.Gaobot removal, feel free to add a link to this list: add url

more resources

Post Comment:

Attention: Use this form only if you have additional information about W32.HLLW.Gaobot parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.