What is “Backdoor:Win32/Gaobot”?

The Backdoor:Win32/Gaobot is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Backdoor:Win32/Gaobot virus can do?

Possible date expiration check, exits too soon after checking local time
Authenticode signature is invalid

How to determine Backdoor:Win32/Gaobot?


File Info:
name: 5F4D46FB3FD4C66346B5.mlw
path: /opt/CAPEv2/storage/binaries/cfeaaef35a828ab7dc9e512a76ba0a474906215976604c5418a62ca26203c916
crc32: 2D5FCF10
md5: 5f4d46fb3fd4c66346b505433f76fd89
sha1: c17ce55963d75a21098c43d264ff5f6543336fd6
sha256: cfeaaef35a828ab7dc9e512a76ba0a474906215976604c5418a62ca26203c916
sha512: 1b142928e5d3f28234a5af2e4fd3fd1420b937cbf35d3c0e319182980c3ed1758104c4770abf3991b776788d7f87e3197932a4febd06ca80d7a0e4f2031738ab
ssdeep: 768:XthuQO6qktDv9tEvm4qR78nXPeuzYiX8dlM:XtAeB9tEvmZ7m/eu6lM
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T13A137D23BCE18533C9D351B101F08F2AAF7FB5621672A4539720AD4A2D719E19E3B357
sha3_384: dfc4cc90c986173729913feb853f2b416888d62db94db53846fc94dd8f324c1d01246774ed8251de0a65ee19d3dc5b06
ep_bytes: 558bec6aff680071400068502c400064
timestamp: 2003-10-24 18:27:28

Version Info:
0: [No Data]

Backdoor:Win32/Gaobot also known as:

DrWeb	Win32.HLLW.Agobot.3
MicroWorld-eScan	Backdoor.Agobot.3.z
FireEye	Backdoor.Agobot.3.z
McAfee	W32/Gaobot.d.gen
Cylance	Unsafe
Zillya	Backdoor.Agobot.Win32.743
Sangfor	Worm.Win32.Agobot.45056
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Backdoor:Win32/Agobot.f6f3c507
K7GW	Backdoor ( 000009b31 )
K7AntiVirus	Backdoor ( 000009b31 )
Cyren	W32/Agobot.OKEZ-8176
Symantec	Backdoor.Gaobot
ESET-NOD32	Win32/Agobot.3.BJ
TrendMicro-HouseCall	BKDR_GAOBOT.B
ClamAV	Win.Worm.Gaobot-120
Kaspersky	Backdoor.Win32.Agobot.z
BitDefender	Backdoor.Agobot.3.z
NANO-Antivirus	Trojan.Win32.Agobot.daya
Avast	Win32:GaoBot-WB [Wrm]
Tencent	Trojan.Win32.BitCoinMiner.la
Ad-Aware	Backdoor.Agobot.3.z
Sophos	Mal/Generic-R + W32/Agobot-DT
Comodo	Backdoor.Win32.Agobot.3.BJ@390z
VIPRE	Backdoor.Gaobot
TrendMicro	BKDR_GAOBOT.B
McAfee-GW-Edition	W32/Gaobot.d.gen
Emsisoft	Backdoor.Agobot.3.z (B)
Ikarus	Backdoor.Win32.Agobot
Jiangmin	Backdoor/Agobot.3.z
Avira	WORM/AgoBot.45056
Antiy-AVL	Trojan/Generic.ASMalwS.1F50C
Kingsoft	Win32.Troj.Generic.a.(kcloud)
Microsoft	Backdoor:Win32/Gaobot
ViRobot	Backdoor.Win32.S.Agobot.45056
GData	Backdoor.Agobot.3.z
AhnLab-V3	Worm/Win32.IRCBot.R122142
VBA32	Backdoor.Agobot
ALYac	Backdoor.Agobot.3.z
TACHYON	Backdoor/W32.AgoBot.45056
Malwarebytes	Malware.AI.4154456298
Rising	Backdoor.Agobot.3.c (CLASSIC)
Yandex	Backdoor.Agobot.Gen.12
MAX	malware (ai score=100)
MaxSecure	Trojan.Malware.158173.susgen
Fortinet	W32/Agobot.Z!tr
Webroot	W32.Trojan.Agobot
AVG	Win32:GaoBot-WB [Wrm]
Panda	Bck/Sdbot.BPA

How to remove Backdoor:Win32/Gaobot?

Backdoor:Win32/Gaobot removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X