Gangbot is an Internet worm that spreads to remote computers through instant messages, by exploiting known security vulnerabilities and connecting to SQL servers protected by weak passwords. Once executed, the parasite secretly installs itself to the system and runs a payload. It opens a back door providing the attacker with unauthorized remote access to the compromised computer. Gangbot also downloads and executes malicious files, terminates running antiviruses, firewalls, anti-spyware and other security-related programs. Furthermore, it steals user passwords for web sites and FTP servers and account details used in installed instant messaging software. The worm can run hidden web and FTP servers, which can be used to spread the infection. Gangbot runs as a service on every Windows startup.