Home Malware Programs Worms Guapim

Guapim

Posted: March 28, 2006

Guapim is a dangerous and widely spread Internet worm that propagates through AOL Instant Messenger and MSN Messenger by sending messages with certain links to all the contacts. Clicking on such a link downloads and installs the spyware. Guapim can also distribute itself in file sharing networks. The threat compromises overall computer security and blocks access to reputable security-related web sites. It also secretly downloads and installs the even more dangerous Spybot worm. Guapim runs on every Windows startup.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 pkguard32.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunPKGuardHKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunServicesPKGuardHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunPKGuardHKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessStart=4HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServiceswuauservStart=4
Loading...