AUTORUN.WP (gg.exe) u disk Trojan Removal method _ virus killing

File name: Gg.exe


File size: 65607 byte


AV name:


Worm.Win32.AutoRun.wp Kaspersky

worm.delf.65607 Jinshan Poison PA

win32.hllw.autoruner.548 Dr.Web


Shell way: not


Writing language: Microsoft Visual C + + 6.0


File md5:33d493af096ef2fa6e1885a08ab201e6


Behavioral Analysis:


1, release the virus file:


C:\WINDOWS\gg.exe 65607 bytes


2. Add Startup items:


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

(registry value) Ctfmon.exe = REG_SZ, "C:\windows\gg.exe"


3, find available disks, generate: Autorun.inf and Gg.exe, to achieve U disk infection.


4, Connection 121.206.1.2xx download Trojan, but not realized.


5, direct access to the system memory, hide itself, to prevent the end.


Workaround:


1, download Ice blade and Sreng (all can download to down.45it.com).

2, open the ice blade, end the virus process. (Gg.exe)

3, open Sreng, delete the startup item:


(registry value) Ctfmon.exe, pointing to the C:\windows\gg.exe.


Be careful not to delete the wrong.

4, delete virus files:


C:\WINDOWS\gg.exe 65607 bytes


5, with WinRAR delete the files under the disk, pay attention not to double-click into the disk, do not virus and resurrection.


6, if unable to clear, please send the virus sample to 526170722@qq.com