Home Malware Programs Worms SONAR.Gammima

SONAR.Gammima

Posted: March 1, 2011

SONAR.Gammima is hostile malware with potential traits of a Trojan and a worm. Infections related to SONAR.Gammima have been the cause of browser hijacks, disabled security programs, lowered security settings and hostile actions by remote attackers. SONAR.Gammima was only recently discovered and may not yet be detectable by all anti-malware scanners, or by scanners that haven't recently been updated for emerging threats. Since this malware has a wide variety of potential attacks and is almost certain to reduce your computer's security, deleting SONAR.Gammima is a prudent course of action.

Why You Might Be Dealing with SONAR.Gammim

The SONAR.Gammima threat has been identified since February of 2010, making SONAR.Gammima sufficiently new. Without the relevant malware definition updates, your anti-virus scanner may allow SONAR.Gammima to walk right in to your system unhindered.
 
SONAR.Gammima is confirmed as malware, which means that SONAR.Gammima will usually try to install itself in a hidden manner and then run without being detected. Common means of infection for stealthier malware include malicious website code, downloads by trojans that are already on the computer in question and infected P2P files such as codec updates. Malware like SONAR.Gammima will usually create entries in the computer's registry to allow the infection to run automatically when Windows starts.

SONAR.Gammima is a Danger to Your Hard Drive in More Ways than One

The possible dangers inherent in a SONAR.Gammima infection are quite varied, but all are serious, as you can see here:

  • SONAR.Gammima may download other malware onto your computer and install these programs without your permission.
  • SONAR.Gammima may abuse proxy server capabilities or other exploits to hijack your browser. A hijacked web browser will redirect towards dangerous sites, and may block sites that are useful (for instance, security-based websites). Common signs of a browser hijacker include unusual 'unsafe website' errors, advertising that block site content, unusual search results and links embedded into text-based content.
  • Removable drive devices are highly likely to be exploited by SONAR.Gammima for propagation; SONAR.Gammima may copy itself to new drives and use Autorun exploits to infect new systems SONAR.Gammima comes into contact with in this fashion.
  • Like most malware, SONAR.Gammima has an excellent chance of disabling your security. This can include crashing security programs and disabling the computer's firewall.
  • Less noticeably but still urgently threatening is SONAR.Gammima's potential to streamline access by remote attackers. Remote third parties may use infections like SONAR.Gammima to take over an entire computer for the purpose of illegal DDoS attacks and similar activities. This capability can also be abused to steal information such as passwords or to harm the computer directly.

Anyone who values their computer should delete SONAR.Gammima with lightning reflexes. The potential routes SONAR.Gammima may take for further damage are sufficiently severe and differentiated that a prolonged delay could easily result in permanent harm to the system that can't easily be repaired.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %temp%[RANDOM CHARACTERS]

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[RANDOM CHARACTERS]"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "[RANDOM CHARACTERS]"
Loading...