Posted: July 20, 2012

Grum Description

Grum, also known as TROJ_BUZUS.BKM, Infostealer.Banker.C, Spammer:Win32/Tedroo.A, Trojan.Win32.Buzus.cqit and Win32/Injector.AJF, is a spambot Trojan that was used to distribute mass-mailed e-mail messages. Until recently, Grum was capable of exploiting an infected PC's resources to distribute itself, other PC threats and links to various sites, but action by law enforcement agencies and ISPs have deactivated Grum's servers as of July 18th. Although Grum doesn't have the ability to switch servers and, as such, is neutered by this server shutdown, you should still consider removing a disabled Grum infection to make sure that your machine continues to run efficiently. Prior to its effective hamstringing, Grum displayed no overt symptoms of its attacks other than, of course, warnings from appropriate anti-malware programs.

Grum: the Spammer That Shall Spam No More

In its original and fully-functional form, Grum was a spambot that exploited the resources of infected PC's to create a fully-functioning botnet for the purposes of sending spam e-mail to random addresses. Grum's distribution and potency were so significant that, while Grum was functioning, Grum accounted for almost twenty percent of the world's total e-mail-based spam count. In some cases, Grum infections can cause poor system performance due to the resource usage they take up to send their mass-mailed e-mails, although, for many Grum victims, there are no symptoms whatsoever.

What separates Grum from still-operational spambots is the fact that authorities in the Netherlands, Ukraine, Russia and Panama have all taken action to seize Grum's Command & Control servers. Since Grum isn't designed to adapt to different C&C servers once its primary ones are unavailable, this action has made Grum infections essentially harmless (as well as preventing a huge part of the world's e-mail spam).

Cleaning Up After Grum's Mess

Even though Grum is no longer capable of recruiting your PC into the ranks of the world's third-greatest botnet, Grum's attempts to contact external servers can still take up your PC's resources, and Grum's changes to your Registry and other OS components can cause undesirable side effects. To delete all aspects of a Grum infection safely, malware experts suggest that you use anti-malware programs to diagnose and disinfect your PC; particularly since Grum may be installed along with additional PC threats.

Spam e-mails like the messages that are sent by Grum infections remain extremely prolific infection vectors for other types of PC threats, including Troj/JSAgent-CK, Troj/Agent-WXL, Troj/Agent-WMO, Win32/Cbeplay.P, BredoZp Trojans and Mal/Zbot-FV. If you believe that an e-mail may be sent by a Grum Trojan, you should scan any file attachments with appropriate anti-malware utilities prior to download and avoid interaction with suspicious links contained in the message's body.

Use SpyHunter to Detect and Remove PC Threats

If you are concerned that malware or PC threats similar to Grum may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.

Download SpyHunter's Malware Scanner

Note: SpyHunter's free version is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware tool to remove the malware threats. Learn more on SpyHunter. If you would like to uninstall SpyHunter for any reason, please follow these uninstall instructions. To learn more about our policies and practices, visit our EULA, Privacy Policy and Threat Assessment Criteria.

Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.

Related Posts

Leave a Reply

Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter. If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.