|
|
Worm.Win32.Grexo Viruses Information
| Name: |
Worm.Win32.Grexo |
| Category: |
Viruses |
| Description:
|
Details
Worm.Win32.Grexon
Grexon is local area network (LAN) worm. In copies itself to logical drives (local and network), as well as encodes network resources where it copies itself. The worm file size is about 7KB.
When the worm is run it copies itself to the Windows temporary directory under the name "grex.exe" and registers this file in the system registry auto-run key:
HKLMSoftwareMicrosoftWindowsCurrentVersionRun
Grex = %TempDir%grex.exe
While infecting drives (logical and network) the worm copies itself to them under the following names:
NOPE.EXE : to Windows Startup directory (if exists)
REGEDIT.EXE : to Windows directory (if exists)
While infecting network drives the worm affects their following resources:
C$
D$
IPC$
In case the victim resource is not open for full access the worm tries to connect to it with a password:
user name
the strings "123", "111", "12345", "00"
cached Windows passwords
strgins found in registry keys:
HKLMSOFTWAREMicrosoftWindowsCurrentVersionNetworkLanMan
Payload
When this worm is run from the REGEDIT.EXE file it displays the message:
LOADER ERROR
File corrupted !
Depending on a random counter the worm either:
exits Windows
displays the message:
ERROR
Kernel data corrupted ! |
Top Viruses Visited Pages:
Invader. - 239 visits
not-a-virus:RiskWare.Tool.RegPatch. - 72 visits
Worm.P2P.Harex. - 66 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win16.Klon.1177 - 42 visits
Win32.Hidra - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
Trojan.BAT.MkDirs.
Backdoor.Win32.Breplibot.
Freddy.227
KeyPress.93
Bug.92
I-Worm.Sysno
Crue
Worm.P2P.Relmony.
Face.284
Worm.P2P.Spear.
|
|
