W32.Gammima.AG

W32.Gammima.AG Description

W32.Gammima.AG is a spyware-themed worm that distributes itself via removable media (USB thumb drives and similar devices) and steals passwords from popular online games. Recent updates to W32.Gammima.AG have added to its capabilities and made W32.Gammima.AG compatible for attacks against Diablo 3 accounts, and W32.Gammima.AG is capable of running on most versions of Windows. As long as you enact proper precautions when in contact with removable devices and have updated anti-malware software for protection, SpywareRemove.com malware researchers note that successful attacks by W32.Gammima.AG should be minimal to nonexistent. However, unprotected PCs are still in danger of W32.Gammima.AG’s attacks, which don’t show readily-apparent symptoms for visual detection.

W32.Gammima.AG: Stealing Your Evening’s Entertainment without a Trace of Evidence

Because none of W32.Gammima.AG’s functions leave behind overt symptoms that affect your PC’s behavior or display in obvious ways, you should never try to detect W32.Gammima.AG without any assistance from anti-malware software or PC security professionals. Depending on the software that’s used to detect it, W32.Gammima.AG may also be identified by one of its other aliases, which include Worm.Win32.AutoRun.bhx, PWS:Win32/Frethog.V, Trojan-PSW.Win32.OnLineGames.sxa and Trojan-PSW.Win32.OnLineGames.rlh. Lack of symptoms for W32.Gammima.AG also includes a lack of independent memory processes, since W32.Gammima.AG injects its code into normal processes, including the games that W32.Gammima.AG intends to target for account theft, as part of its routine behavior.

Although SpywareRemove.com malware experts have spied recent updates to W32.Gammima.AG that have enabled extra compatibility for stealing account information from Blizzard’s hit Diablo 3, W32.Gammima.AG is also capable of stealing passwords and related information from other prominent games, such as:

MapleStory
Talesweaver
ROHAN
Seal Online
Arad
World of Warcraft
Kingdom of the Winds
Lineage
Facebook applications (or ‘apps’)

Naturally, information that’s stolen is promptly sent out to a remote server, presumably for usage in account-hijacking attacks and theft of digital currency or items.

SpywareRemove.com malware researchers also note that many of the games noted above also include optional security features that are specifically designed to block attacks like those that are enabled by W32.Gammima.AG, such as additional account authentication measures.

Scrambling to Keep W32.Gammima.AG Off Your Hard Drives

W32.Gammima.AG copies itself to all drives during its installation. Since this includes removable drives, keeping a close eye on USB thumb drives and similar devices is crucial to preventing W32.Gammima.AG from spreading to other PCs. SpywareRemove.com malware researchers recommend that you keep anti-malware software on hand to detect PC threats whenever you use a removable device that’s been in contact with another computer.

Although W32.Gammima.AG has been identified since 2007, W32.Gammima.AG has also seen regular updates for enhancing its features. Identifying and removing W32.Gammima.AG should always be done by completely up-to-date anti-malware software, particularly since W32.Gammima.AG creates multiple copies of itself and can include several distinct components.

W32.Gammima.AG Automatic Detection Tool (Recommended)

Is your PC infected with W32.Gammima.AG? To safely & quickly detect W32.Gammima.AG, we highly recommend you run the malware scanner listed below.

Download SpyHunter's* Malware Scanner to detect W32.Gammima.AG What happens if W32.Gammima.AG does not let you open SpyHunter or blocks the Internet?

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

#	File Name	Detection Count
1	file.exe	564
2	file.dll	555
3	eeaf9e0f61d3625e42c309836d07a27c.dll	548
4	%System%\kavo0.dll	N/A
5	%System%\kavo.exe	N/A
6	%Temp%\[RANDOM FILE NAME].dll	N/A
7	[DRIVE LETTER]:\ntdelect.com	N/A
8	[DRIVE LETTER]:\autorun.inf	N/A

Registry Modifications

Tutorial: To edit and delete registry entries manually, read the tutorial on how to remove malicious registry entries.

Tip & Warning: Editing and removing the wrong registry keys can severely damage your PC, so remember to backup your Windows Registry! To optimize your Windows Registry and speed up your PC, download RegHunter's registry cleaner.

The following newly produced Registry Values are:
HKEY..\..\{Value}HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\"Hidden" = "2"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\"ShowSuperHidden" = "0"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Pocilies\Explorer\"NoDriveTypeAutoRun" = "0x91"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"kava" = "%System%\kavo.exe"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\"CheckedValue" = "0"

Posted: July 4, 2012 | By SpywareRemove