Home Malware Programs Worms Worm.Gokar

Worm.Gokar

Posted: February 20, 2007

Threat Metric

Ranking: 16,591
Threat Level: 9/10
Infected PCs: 185
First Seen: July 24, 2009
Last Seen: October 4, 2023
OS(es) Affected: Windows

Gokar is a mass mailing worm that is designed to spread by e-mail in messages with infected attachments and through IRC channels. Gokar may also spread itself by creating a default page in the Microsoft IIS web server folder. If a user visits this page, they will be asked to download the worm. Once it is installed, Gokar will terminate some running antivirus processes and collect any emails that it can find in your Outlook address book. Then Gokar will send its copies to all these addresses that it collected on your machine.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



karen.exe File name: karen.exe
Size: 14.33 KB (14336 bytes)
MD5: 54af0e958e5d3ca68864c818da2f120b
Detection count: 46
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: January 10, 2022
malware.exe File name: malware.exe
Size: 17.96 KB (17962 bytes)
MD5: d61f20bb954dc211f02251a96133c478
Detection count: 40
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: December 11, 2009
malware.exe File name: malware.exe
Size: 585B (585 bytes)
MD5: ca40410687813674d26b35aa5a76abf0
Detection count: 34
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: December 11, 2009

Registry Modifications

The following newly produced Registry Values are:

Run keysKaren
Loading...