Home Malware Programs Viruses Gammiy

Gammiy

Posted: June 22, 2011

Gammiy is a virus that infects executable files to proliferate as widely as possible through networks. Most Gammiy viruses will also install backdoor Trojans that can attack your computer's security. Backdoor Trojans allow computers to be controlled by remote criminals for the purpose of DDoS attacks, fraud or other illegal activities. Any Gammiy infection is a serious threat to your PC despite the lack of visible symptoms, and you should delete Gammiy and related threats from your computer by using good security software as soon as possible.

Gammiy: One More Reason to Take Network Security Seriously

Gammiy is a virus that hails from 2006 but Gammiy infections are still a danger to any computer that runs all but the most modern version of Windows. Gammiy viruses have been confirmed to attack Windows 2000, 98, 95, Me, XP and NT operating systems.

The Gammiy virus has a unique method of infecting new computers: Gammiy attempts to locate network-shared folders and resources by connecting to hosts at random IP addresses. Once Gammiy has infiltrated a computer all .exe files inside network-shared resources will be infected with the Gammiy virus.

You may be able to detect a Gammiy-infected file by checking the file size or the last modified date. Other than this, a general use of system resources like memory, and the possible presence of Gammiy memory processes, there may be no clues that Gammiy is on your computer. Gammiy will run on startup, as well whenever you open a .txt file.

Why Gammiy is a Top Security Threat

Despite Gammiy's advanced age, a Gammiy virus can still be a very dangerous assailant for your PC security. Gammiy infections are strongly linked to backdoor Trojans, which may be downloaded and installed by Gammiy without your permission. Like Gammiy itself, backdoor Trojans are designed to hide from you view and may be responsible for some or all of the following:

  • The presence of other malicious programs on your PC, including password-stealing keyloggers or rogue security programs that create fake infection alerts. Backdoor Trojans can download and install these programs without your consent, just like Gammiy may do for backdoor Trojans.
  • Forcing your PC to engage in self-destructive or illegal acts. Backdoor Trojans or Gammiy itself may use your computer for Distributed Denial of Service attacks or other actions that use up system resources and can potentially harm your PC.
  • Disabled security programs, especially anti-virus software or your firewall. Exceptions may also be created for malicious programs; this lets your firewall remain active but useless.
  • Remote attacks that Gammiy can enable may also let remote criminals steal private information, including passwords and account login information.

The high probability of a Gammiy-infected computer having multiple threats means that your anti-virus software is preferable for removing Gammiy. Any scans should be performed in Safe Mode to reduce the likelihood of deleting Gammiy.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 dbst32nt.log
    2 dntboot.bin
    3 smss.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKEY_CLASS_ROOTtxtfileShellOpenCommand(Default)=%System%dbst32nt.log notepad.exe %1HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonShell=explorer.exe %Windows%smss.exeHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonUserinit=%System%userinit.exe,%Windows%smss.exe
Loading...