W32/Gaobot.worm.gen.e

--Update 06/24/2004
An incorrect identification of some modified ASPacked files as W32/Gaobot.worm.gen.e has been identified in the 4368 DAT files. The 4369 DAT files are being released to resolve this incorrect identification.

The following files have been submitted to AVERT

Dcpp.exe, from securstar.com
Server.exe - access-remote-pc.com
SlingoDeluxe.exe - Shockwave.com
Armadillo.exe - The Silicon Realms Toolworks
GE2001.exe - Xinox Software
MagicInlay.exe, from shockwave.com
SBautoupdate.exe, from javacoolsoftware.com
HotfixManager.exe, from majorgeeks.com
Timesheets.exe, from timesheetsmts.com
--
This is a generic detection for worms in the W32/Gaobot.worm family. Though first introduced in the 4238 DATs.  At the time of this writing, there are more than 900 variants of this virus in existence.  The source code for Gaobot was posted to various websites resulting in many new variants being created each week.  Therefore, this description is merely meant as a guide.

For maximum protection against this threat, users are recommended to:

• use the latest engine/DATs combination
• ensure the scanning of compressed files is enabled
• keep Windows systems patched by using Windows Update
• ensure weak username/passwords are not used
• run a personal desktop firewall application

Recent variants in this family are intended to take advantage of high profile exploits. For example:

• MS03-001  (RPC Locator)
• MS03-026  (Dcom RPC)
• MS03-007  (WebDAV)

Other exploited vectors include:

• The backdoors created by the W32/Bagle and W32/Mydoom viruses
• Weak Windows security (usernames/passwords)

The virus contains lots of remote access functionality, including:

• Create/Remove services
• Denial of service attack
• FTP/HTTP functions (upload, download files, etc)
• IRC functions
• Retrieve system information (RAM, CPU, Disk Space)
• Secure/insecure Windows shares
• Shutdown/reboot/logoff computer
• Sniffer
• Steal CD and product keys for various products
• Terminate running processes

The following details will vary from variant to variant.

When run, this virus copies itself to the %SysDir% directory as explored.exe and creates several registry run keys in order to load itself at system startup.

(Where %SysDir% is the System directory, for example: C:\WINNT\SYSTEM32)  

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
  CurrentVersion\Run\Windows login = explored.exe
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
  CurrentVersion\RunServices\Windows login = explored.exe

The virus also installs itself as a system service named Windows Login . The following registry keys may created:

• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet\Services\Ex
  "C:\WINNT\System32\explored.exe" -service

The virus attempts to run a speed test for Internet connectivity.  The following domains are contacted to check for broadband connections:

• de.yahoo.com
• nitro.ucsc.edu
• verio.fr
• www.1und1.de
• www.above.net
• www.belwue.de
• www.burst.net
• www.cogentco.com
• www.d1asia.com
• www.level3.com
• www.lib.nthu.edu.tw
• www.nifty.com
• www.nocster.com
• www.rit.edu
• www.schlund.net
• www.st.lib.keio.ac.jp
• www.stanford.edu
• www.switch.ch
• www.utwente.nl
• www.verio.com
• www.xo.net
• yahoo.co.jp

The virus attempts to connect to an Internet Relay Chat server (TCP Port 6667) to allow for a remote attack to send commands to the infected system:

• irc.crazycow.org

Infected systems list on TCP ports 14985, and 15318, which are control ports for attackers to exploit.  The worm references the NetScheduleJob API call and may create remote Scheduled Tasks on infected systems.

The local HOSTS file (%SysDir%\drivers\etc\hosts) is overwriten to block access to the following sites:

• avp.com
• ca.com
• customer.symantec.com
• dispatch.mcafee.com
• download.mcafee.com
• f-secure.com
• kaspersky.com
• liveupdate.symantec.com
• liveupdate.symantecliveupdate.com
• mast.mcafee.com
• mcafee.com
• my-etrust.com
• nai.com
• networkassociates.com
• rads.mcafee.com
• secure.nai.com
• securityresponse.symantec.com
• sophos.com
• symantec.com
• trendmicro.com
• update.symantec.com
• updates.symantec.com
• us.mcafee.com
• viruslist.com
• www.avp.com
• www.ca.com
• www.f-secure.com
• www.kaspersky.com
• www.mcafee.com
• www.my-etrust.com
• www.nai.com
• www.networkassociates.com
• www.sophos.com
• www.symantec.com
• www.trendmicro.com
• www.viruslist.com

It also attempts to terminate the following processes:

• _AVP32.EXE
• _AVPCC.EXE
• _AVPM.EXE
• ACKWIN32.EXE
• ADAWARE.EXE
• ADVXDWIN.EXE
• AGENTSVR.EXE
• AGENTW.EXE
• ALERTSVC.EXE
• ALEVIR.EXE
• ALOGSERV.EXE
• AMON9X.EXE
• ANTI-TROJAN.EXE
• ANTIVIRUS.EXE
• ANTS.EXE
• APIMONITOR.EXE
• APLICA32.EXE
• APVXDWIN.EXE
• ARR.EXE
• ATCON.EXE
• ATGUARD.EXE
• ATRO55EN.EXE
• ATUPDATER.EXE
• ATWATCH.EXE
• AU.EXE
• AUPDATE.EXE
• AUTODOWN.EXE
• AUTO-PROTECT.NAV80TRY.EXE
• AUTOTRACE.EXE
• AUTOUPDATE.EXE
• AVCONSOL.EXE
• AVE32.EXE
• AVGCC32.EXE
• AVGCTRL.EXE
• AVGNT.EXE
• AVGSERV.EXE
• AVGSERV9.EXE
• AVGUARD.EXE
• AVGW.EXE
• AVKPOP.EXE
• AVKSERV.EXE
• AVKSERVICE.EXE
• AVKWCTl9.EXE
• AVLTMAIN.EXE
• AVNT.EXE
• AVP.EXE
• AVP32.EXE
• AVPCC.EXE
• AVPDOS32.EXE
• AVPM.EXE
• AVPTC32.EXE
• AVPUPD.EXE
• AVSCHED32.EXE
• AVSYNMGR.EXE
• AVWIN95.EXE
• AVWINNT.EXE
• AVWUPD.EXE
• AVWUPD32.EXE
• AVWUPSRV.EXE
• AVXMONITOR9X.EXE
• AVXMONITORNT.EXE
• AVXQUAR.EXE
• BACKWEB.EXE
• BARGAINS.EXE
• BD_PROFESSIONAL.EXE
• BEAGLE.EXE
• BELT.EXE
• BIDEF.EXE
• BIDSERVER.EXE
• BIPCP.EXE
• BIPCPEVALSETUP.EXE
• BISP.EXE
• BLACKD.EXE
• BLACKICE.EXE
• BLSS.EXE
• BOOTCONF.EXE
• BOOTWARN.EXE
• BORG2.EXE
• BPC.EXE
• BRASIL.EXE
• BS120.EXE
• BUNDLE.EXE
• BVT.EXE
• CCAPP.EXE
• CCEVTMGR.EXE
• CCPXYSVC.EXE
• CDP.EXE
• CFD.EXE
• CFGWIZ.EXE
• CFIADMIN.EXE
• CFIAUDIT.EXE
• CFINET.EXE
• CFINET32.EXE
• Claw95.EXE
• CLAW95CF.EXE
• CLEAN.EXE
• CLEANER.EXE
• CLEANER3.EXE
• CLEANPC.EXE
• CLICK.EXE
• CMD32.EXE
• CMESYS.EXE
• CMGRDIAN.EXE
• CMON016.EXE
• CONNECTIONMONITOR.EXE
• CPD.EXE
• CPF9X206.EXE
• CPFNT206.EXE
• CTRL.EXE
• CV.EXE
• CWNB181.EXE
• CWNTDWMO.EXE
• DATEMANAGER.EXE
• DCOMX.EXE
• DEFALERT.EXE
• DEFSCANGUI.EXE
• DEFWATCH.EXE
• DEPUTY.EXE
• DIVX.EXE
• DLLCACHE.EXE
• DLLREG.EXE
• DOORS.EXE
• DPF.EXE
• DPFSETUP.EXE
• DPPS2.EXE
• DRWATSON.EXE
• DRWEB32.EXE
• DRWEBUPW.EXE
• DSSAGENT.EXE
• DVP95.EXE
• DVP95_0.EXE
• ECENGINE.EXE
• EFPEADM.EXE
• EMSW.EXE
• ENT.EXE
• ESAFE.EXE
• ESCANH95.EXE
• ESCANHNT.EXE
• ESCANV95.EXE
• ESPWATCH.EXE
• ETHEREAL.EXE
• ETRUSTCIPE.EXE
• EVPN.EXE
• EXANTIVIRUS-CNET.EXE
• EXE.AVXW.EXE
• EXPERT.EXE
• EXPLORE.EXE
• F-AGNT95.EXE
• FAMEH32.EXE
• FAST.EXE
• FCH32.EXE
• FIH32.EXE
• FINDVIRU.EXE
• FIREWALL.EXE
• FLOWPROTECTOR.EXE
• FNRB32.EXE
• FPROT.EXE
• F-PROT.EXE
• F-PROT95.EXE
• FP-WIN.EXE
• FP-WIN_TRIAL.EXE
• FRW.EXE
• FSAA.EXE
• FSAV.EXE
• FSAV32.EXE
• FSAV530STBYB.EXE
• FSAV530WTBYB.EXE
• FSAV95.EXE
• FSGK32.EXE
• FSM32.EXE
• FSMA32.EXE
• FSMB32.EXE
• F-STOPW.EXE
• GATOR.EXE
• GBMENU.EXE
• GBPOLL.EXE
• GENERICS.EXE
• GMT.EXE
• GUARD.EXE
• GUARDDOG.EXE
• HACKTRACERSETUP.EXE
• HBINST.EXE
• HBSRV.EXE
• HIJACKTHIS.EXE
• HOTACTIO.EXE
• HOTPATCH.EXE
• HTLOG.EXE
• HTPATCH.EXE
• HWPE.EXE
• HXDL.EXE
• HXIUL.EXE
• IAMAPP.EXE
• IAMSERV.EXE
• IAMSTATS.EXE
• IBMASN.EXE
• IBMAVSP.EXE
• ICLOAD95.EXE
• ICLOADNT.EXE
• ICMON.EXE
• ICSUPP95.EXE
• ICSUPPNT.EXE
• IDLE.EXE
• IEDLL.EXE
• IEDRIVER.EXE
• IEXPLORER.EXE
• IFACE.EXE
• IFW2000.EXE
• INETLNFO.EXE
• INFUS.EXE
• INFWIN.EXE
• INIT.EXE
• INTDEL.EXE
• INTREN.EXE
• IOMON98.EXE
• IPARMOR.EXE
• IRIS.EXE
• ISASS.EXE
• ISRV95.EXE
• ISTSVC.EXE
• JAMMER.EXE
• JDBGMRG.EXE
• JEDI.EXE
• KAVLITE40ENG.EXE
• KAVPERS40ENG.EXE
• KAVPF.EXE
• KAZZA.EXE
• KEENVALUE.EXE
• KERIO-PF-213-EN-WIN.EXE
• KERIO-WRL-421-EN-WIN.EXE
• KERIO-WRP-421-EN-WIN.EXE
• KERNEL32.EXE
• KILLPROCESSSETUP161.EXE
• LAUNCHER.EXE
• LDNETMON.EXE
• LDPRO.EXE
• LDPROMENU.EXE
• LDSCAN.EXE
• LNETINFO.EXE
• LOADER.EXE
• LOCALNET.EXE
• LOCKDOWN.EXE
• LOCKDOWN2000.EXE
• LOOKOUT.EXE
• LORDPE.EXE
• LSETUP.EXE
• LUALL.EXE
• LUAU.EXE
• LUCOMSERVER.EXE
• LUINIT.EXE
• LUSPT.EXE
• MAPISVC32.EXE
• MCAGENT.EXE
• MCMNHDLR.EXE
• MCSHIELD.EXE
• MCTOOL.EXE
• MCUPDATE.EXE
• MCVSRTE.EXE
• MCVSSHLD.EXE
• MD.EXE
• MFIN32.EXE
• MFW2EN.EXE
• MFWENG3.02D30.EXE
• MGAVRTCL.EXE
• MGAVRTE.EXE
• MGHTML.EXE
• MGUI.EXE
• MINILOG.EXE
• MMOD.EXE
• MONITOR.EXE
• MOOLIVE.EXE
• MOSTAT.EXE
• MPFAGENT.EXE
• MPFSERVICE.EXE
• MPFTRAY.EXE
• MRFLUX.EXE
• MSAPP.EXE
• MSBB.EXE
• MSBLAST.EXE
• MSCACHE.EXE
• MSCCN32.EXE
• MSCMAN.EXE
• MSCONFIG.EXE
• MSDM.EXE
• MSDOS.EXE
• MSIEXEC16.EXE
• MSINFO32.EXE
• MSLAUGH.EXE
• MSMGT.EXE
• MSMSGRI32.EXE
• MSSMMC32.EXE
• MSSYS.EXE
• MSVXD.EXE
• MU0311AD.EXE
• MWATCH.EXE
• N32SCANW.EXE
• NAV.EXE
• NAVAP.NAVAPSVC.EXE
• NAVAPSVC.EXE
• NAVAPW32.EXE
• NAVDX.EXE
• NAVENGNAVEX15.NAVLU32.EXE
• NAVLU32.EXE
• NAVNT.EXE
• NAVSTUB.EXE
• NAVW32.EXE
• NAVWNT.EXE
• NC2000.EXE
• NCINST4.EXE
• NDD32.EXE
• NEOMONITOR.EXE
• NEOWATCHLOG.EXE
• NETARMOR.EXE
• NETD32.EXE
• NETINFO.EXE
• NETMON.EXE
• NETSCANPRO.EXE
• NETSPYHUNTER-1.2.EXE
• NETSTAT.EXE
• NETUTILS.EXE
• NISSERV.EXE
• NISUM.EXE
• NMAIN.EXE
• NOD32.EXE
• NORMIST.EXE
• NORTON_INTERNET_SECU_3.0_407.EXE
• NOTSTART.EXE
• NPF40_TW_98_NT_ME_2K.EXE
• NPFMESSENGER.EXE
• NPROTECT.EXE
• NPSCHECK.EXE
• NPSSVC.EXE
• NSCHED32.EXE
• NSSYS32.EXE
• NSTASK32.EXE
• NSUPDATE.EXE
• NT.EXE
• NTRTSCAN.EXE
• NTVDM.EXE
• NTXconfig.EXE
• NUI.EXE
• NUPGRADE.EXE
• NVARCH16.EXE
• NVC95.EXE
• NVSVC32.EXE
• NWINST4.EXE
• NWSERVICE.EXE
• NWTOOL16.EXE
• OLLYDBG.EXE
• ONSRVR.EXE
• OPTIMIZE.EXE
• OSTRONET.EXE
• OTFIX.EXE
• OUTPOST.EXE
• OUTPOSTINSTALL.EXE
• OUTPOSTPROINSTALL.EXE
• PADMIN.EXE
• PANIXK.EXE
• PATCH.EXE
• PAVCL.EXE
• PAVPROXY.EXE
• PAVSCHED.EXE
• PAVW.EXE
• PCC2002S902.EXE
• PCC2K_76_1436.EXE
• PCCIOMON.EXE
• PCCNTMON.EXE
• PCCWIN97.EXE
• PCCWIN98.EXE
• PCDSETUP.EXE
• PCFWALLICON.EXE
• PCIP10117_0.EXE
• PCSCAN.EXE
• PDSETUP.EXE
• PENIS.EXE
• PERISCOPE.EXE
• PERSFW.EXE
• PERSWF.EXE
• PF2.EXE
• PFWADMIN.EXE
• PGMONITR.EXE
• PINGSCAN.EXE
• PLATIN.EXE
• POP3TRAP.EXE
• POPROXY.EXE
• POPSCAN.EXE
• PORTDETECTIVE.EXE
• PORTMONITOR.EXE
• POWERSCAN.EXE
• PPINUPDT.EXE
• PPTBC.EXE
• PPVSTOP.EXE
• PRIZESURFER.EXE
• PRMT.EXE
• PRMVR.EXE
• PROCDUMP.EXE
• PROCESSMONITOR.EXE
• PROCEXPLORERV1.0.EXE
• PROGRAMAUDITOR.EXE
• PROPORT.EXE
• PROTECTX.EXE
• PSPF.EXE
• PURGE.EXE
• PUSSY.EXE
• PVIEW95.EXE
• QCONSOLE.EXE
• QSERVER.EXE
• RAPAPP.EXE
• RAV7.EXE
• RAV7WIN.EXE
• RAV8WIN32ENG.EXE
• RAY.EXE
• RB32.EXE
• RCSYNC.EXE
• REALMON.EXE
• REGED.EXE
• REGEDIT.EXE
• REGEDT32.EXE
• RESCUE.EXE
• RESCUE32.EXE
• RRGUARD.EXE
• RSHELL.EXE
• RTVSCAN.EXE
• RTVSCN95.EXE
• RULAUNCH.EXE
• RUN32DLL.EXE
• RUNDLL.EXE
• RUNDLL16.EXE
• RUXDLL32.EXE
• SAFEWEB.EXE
• SAHAGENT.EXE
• SAVE.EXE
• SAVENOW.EXE
• SBSERV.EXE
• SC.EXE
• SCAM32.EXE
• SCAN32.EXE
• SCAN95.EXE
• SCANPM.EXE
• SCRSCAN.EXE
• SCRSVR.EXE
• SCVHOST.EXE
• SD.EXE
• SERV95.EXE
• SERVICE.EXE
• SERVLCE.EXE
• SERVLCES.EXE
• SETUP_FLOWPROTECTOR_US.EXE
• SETUPVAMEEVAL.EXE
• SFC.EXE
• SGSSFW32.EXE
• SH.EXE
• SHELLSPYINSTALL.EXE
• SHN.EXE
• SHOWBEHIND.EXE
• SMC.EXE
• SMS.EXE
• SMSS32.EXE
• SOAP.EXE
• SOFI.EXE
• SPERM.EXE
• SPF.EXE
• SPHINX.EXE
• SPOLER.EXE
• SPOOLCV.EXE
• SPOOLSV32.EXE
• SPYXX.EXE
• SREXE.EXE
• SRNG.EXE
• SS3EDIT.EXE
• SSG_4104.EXE
• SSGRATE.EXE
• ST2.EXE
• START.EXE
• STCLOADER.EXE
• SUPFTRL.EXE
• SUPPORT.EXE
• SUPPORTER5.EXE
• SVC.EXE
• SVCHOSTC.EXE
• SVCHOSTS.EXE
• SVSHOST.EXE
• SWEEP95.EXE
• SWEEPNET.SWEEPSRV.SYS.SWNETSUP.EXE
• SYMPROXYSVC.EXE
• SYMTRAY.EXE
• SYSEDIT.EXE
• SYSTEM.EXE
• SYSTEM32.EXE
• SYSUPD.EXE
• TASKMG.EXE
• TASKMO.EXE
• TASKMON.EXE
• TAUMON.EXE
• TBSCAN.EXE
• TC.EXE
• TCA.EXE
• TCM.EXE
• TDS2-98.EXE
• TDS2-NT.EXE
• TDS-3.EXE
• TEEKIDS.EXE
• TFAK.EXE
• TFAK5.EXE
• TGBOB.EXE
• TITANIN.EXE
• TITANINXP.EXE
• TRACERT.EXE
• TRICKLER.EXE
• TRJSCAN.EXE
• TRJSETUP.EXE
• TROJANTRAP3.EXE
• TSADBOT.EXE
• TVMD.EXE
• TVTMD.EXE
• UNDOBOOT.EXE
• UPDAT.EXE
• UPDATE.EXE
• UPGRAD.EXE
• UTPOST.EXE
• VBCMSERV.EXE
• VBCONS.EXE
• VBUST.EXE
• VBWIN9X.EXE
• VBWINNTW.EXE
• VCSETUP.EXE
• VET32.EXE
• VET95.EXE
• VETTRAY.EXE
• VFSETUP.EXE
• VIR-HELP.EXE
• VIRUSMDPERSONALFIREWALL.EXE
• VNLAN300.EXE
• VNPC3000.EXE
• VPC32.EXE
• VPC42.EXE
• VPFW30S.EXE
• VPTRAY.EXE
• VSCAN40.EXE
• VSCENU6.02D30.EXE
• VSCHED.EXE
• VSECOMR.EXE
• VSHWIN32.EXE
• VSISETUP.EXE
• VSMAIN.EXE
• VSMON.EXE
• VSSTAT.EXE
• VSWIN9XE.EXE
• VSWINNTSE.EXE
• VSWINPERSE.EXE
• W32DSM89.EXE
• W9X.EXE
• WATCHDOG.EXE
• WEBDAV.EXE
• WEBSCANX.EXE
• WEBTRAP.EXE
• WFINDV32.EXE
• WGFE95.EXE
• WHOSWATCHINGME.EXE
• WIMMUN32.EXE
• WIN32.EXE
• WIN32US.EXE
• WINACTIVE.EXE
• WIN-BUGSFIX.EXE
• WINDOW.EXE
• WINDOWS.EXE
• WININETD.EXE
• WININIT.EXE
• WININITX.EXE
• WINLOGIN.EXE
• WINMAIN.EXE
• WINNET.EXE
• WINPPR32.EXE
• WINRECON.EXE
• WINSERVN.EXE
• WINSSK32.EXE
• WINSTART.EXE
• WINSTART001.EXE
• WINTSK32.EXE
• WINUPDATE.EXE
• WKUFIND.EXE
• WNAD.EXE
• WNT.EXE
• WRADMIN.EXE
• WRCTRL.EXE
• WSBGATE.EXE
• WUPDATER.EXE
• WUPDT.EXE
• WYVERNWORKSFIREWALL.EXE
• XPF202EN.EXE
• ZAPRO.EXE
• ZAPSETUP3001.EXE
• ZATUTOR.EXE
• ZONALM2601.EXE
• ZONEALARM.EXE
• F-AGOBOT.EXE

This worm propagates via accessible or poorly secured network shares, and is intended to take advantage of high profile exploits:

• MS03-001  (RPC Locator)
• MS03-026  (Dcom RPC)
• MS03-007  (WebDAV)

When it attempts to spread through default administrative shares:

• c
• c$
• d$
• e$
• admin$ 
• print$

The worm contains a list of common user-names and passwords. This list contains typical poor username/password combinations. Users should avoid securing shares with passwords containing key sequences such as:

• !@#$
• !@#$%
• !@#$%^
• !@#$%^&
• !@#$%^&*
• 000000
• 00000000
• 007
• 110
• 111
• 111111
• 11111111
• 12
• 121212
• 123
• 123123
• 1234
• 12345
• 123456
• 1234567
• 12345678
• 123456789
• 1234qwer
• 123abc
• 123asd
• 123qwe
• 1776
• 1778
• 2002
• 2004
• 23
• 2525
• 2600
• 42
• 54321
• 654321
• 666
• 69
• 88888888
• aaa
• abc
• abc123
• abcd
• ACCESS
• Admin
• admin
• admin123
• administrador
• Administrador
• Administrateur
• ADMINISTRATOR
• administrator
• Administrator
• admins
• alpha
• ami
• amie
• asdf
• asdfgh
• asdfghjkl
• askaban
• ASP
• athlon
• azerty
• azkaban
• baby
• backdoor
• BACKUP
• beer
• biere
• bill
• bong
• box
• Box
• BOX
• buckbeak
• carte
• cauldron
• cederom
• changeme
• CNN
• colin
• computer
• Convidado
• Coordinatore
• copin
• copine
• crash
• database
• Default
• Dell
• dementor
• devil
• dick
• dope
• drugs
• dude
• dumbledore
• ecran
• enable
• erik
• fanny
• feds
• fish
• foobar
• fool
• freak
• fucked
• Gast
• gay
• george
• god
• godblessyou
• gryffindor
• Guest
• hagrid
• harry
• hax
• hermine
• hermione
• hogwarts
• home
• homework
• idiot
• ihavenopass
• imprimeur
• Internet
• Inviter
• iraq
• jackdaniels
• jim
• kanri
• kanri-sha
• karl
• kate
• kids
• kt
• leet
• linux
• LOCAL
• Login
• lol
• love
• madre
• mark
• mary
• merde
• metal
• mgmt
• mike
• mince
• moonshine
• mouse
• mybaby
• mybox
• mypass
• mypc
• mysql
• newfie
• newfy
• noob
• OEM
• oil
• opteron
• oracle
• ordinateur
• Ospite
• own
• owned
• OWNER
• owner
• Owner
• pass
• PASSWD
• passwd
• Password
• password
• password123
• pat
• patrick
• pc
• penis
• peter
• PHP
• poiut
• poiuytrewq
• porn
• potter
• private
• pussy
• pw
• pwd
• pwned
• quidditch
• qwer
• qwerty
• qwertyuiop
• r00t
• red123
• reseau
• ROOT
• root
• rooted
• school
• secret
• secrets
• SERVER
• server
• sex
• share
• souris
• sql
• stacey
• stacy
• Standard
• stefan
• steve
• steven
• student
• super
• superman
• supersecret
• switch
• sybase
• SYSTEM
• teacher
• TEMP
• temp
• tennessee
• Tennessee
• TEST
• Test
• test123
• Texas
• texas
• tim
• tom
• UNIX
• user
• User
• vagina
• Verwalter
• washington
• Washington
• werty
• west
• West
• wh0re
• whiskey
• whisky
• whore
• win
• windows2k
• windows98
• windowsME
• WindowsXP
• windoze
• wmd
• work
• wwwadmin
• x
• xp
• xxx
• xxyyzz
• xyz
• yxcv
• z
• zxcv
• zxcvbnm

The worm also tries to steal information from the system, such as:

• game software product keys
• Windows product keys
• Windows address book email addresses
• .NET Messenger contact list names
• AOL Instant Messenger screen names

All Users :

• Restart Windows in Safe Mode
• Use current engine and DAT files for detection and removal.
• Restart the computer

Additional Windows ME/XP removal considerations