gog.exe - Dangerous
gog.exe
Manual removal instructions:
Antivirus Report of gog.exe:
gog.exe
W32.HLLP.Philis.B is a variant of W32.HLLP.Philis.
It prepends itself to all of the .exe files that it finds. It also tries to steal passwords from the "Legend of Mir 2" online game.
Emails the information that it finds to a predetermined email addresses.
Extracts and launches the infected file as.tmp.
For example, if Notepad.exe is the infected file, when you run Notepad.exe, it runs the file, Notepad.tmp.
Notepad.tmp will be a clean copy of Notepad.exe.
Creates a copy of the virus as %Windir%\Gog.exe.
Adds the value:
"GOG" = "%Windir%\GOG.exe"
to the registry autorun keys:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
Adds the registry key:
HKEY_LOCAL_MACHINE\Software\Classes\legend of mir2
Use RegRun Startup Optimizer to remove this worm.
| gog.exe | Malware |
| gog.exe | Dangerous |
| gog.exe | High Risk |
It prepends itself to all of the .exe files that it finds. It also tries to steal passwords from the "Legend of Mir 2" online game.
Emails the information that it finds to a predetermined email addresses.
Extracts and launches the infected file as
For example, if Notepad.exe is the infected file, when you run Notepad.exe, it runs the file, Notepad.tmp.
Notepad.tmp will be a clean copy of Notepad.exe.
Creates a copy of the virus as %Windir%\Gog.exe.
Adds the value:
"GOG" = "%Windir%\GOG.exe"
to the registry autorun keys:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
Adds the registry key:
HKEY_LOCAL_MACHINE\Software\Classes\legend of mir2
Use RegRun Startup Optimizer to remove this worm.
Dmitry Sokolov:
I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.
Since that time I work every day to fix the issues that antiviruses cannot.
If your antivirus have not helped you solve the problem, you should try UnHackMe.
We are a small company and you can ask me directly, if you have any questions.