|
|
Detect and remove hidden rootkits using
UnHackMe
RegRun Security Suite = 24 system utilities for protecting your computer. Try now! |
 GigaByte.exe - Dangerous
The backdoor is configured to listen on TCP ports 6351 and 6352. Searches for the files that have the .exe extensions on all the hard drives, starting with drive C. The worm searches all the folders on the hard drive, except those with the following names: Windows; System; System32 It does not infect the files that have the following names: IEXPLORE.EXE; ccApp.exe; ccRegVfy.exe Prepends itself to some of the files that it finds. If the worm is executed on May 5, 2005, the virus will display a message box containing the text: Important !!! Please read this The Next is in Arabic followed by Arabic text. Extracts the original host file to a file with a .ogr extension, and then executes it. For example, if Notepad.exe is infected, the virus will extract the original Notepad program to Notepad.ogr, and then will run it. Attempts to install a backdoor to an infected system by creating the following files: %System%\oobb.exe: An installer detected as Backdoor.Trojan. %System%\Cheatle.exe: A VB application detected as Backdoor.Trojan. %System%\GigaByte.exe: A remote administration tool detected as Remacc.Radmin. %System%\AdmDll.dll: A .dll component of Remacc.Radmin. %Windir%\r_server.exe: Another copy of GigaByte.exe. %Windir%\start.exe: Another copy of Cheatle.exe. If these files are successfully dropped, they will add the following entries "Cheatle"="%System%\GigaByte.exe /port:6351 /pass:hellomine" "GigaByte"="%System%\Cheatle.exe" to the registry key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run Automatic removal: Use RegRun Startuip Optimizer to remove this worm. Removal: GigaByte.exe is removed by RegRun.
Read more... Removal instructions...
Recommended software: RegRun Security Suite - removal and protection. http://www.regrun.com RegRun Reanimator - free removal tool. greatis.com/reanimator
What is hidden in MSDN? Why software developers prefer Win32.FreeTechSecrets.com? All Unix Manuals in Alphabetical Order C# controls for .NET in 3 simple steps. Constantly updated. Last update: May 12 2008
Interesting information about Vista programs... Need consultation? Would you like to add your opinion?
|
|
