W32.Gokar.A@mm нь Microsoft Outlook программийн хаягын жагсаалт дахь бvх хаяг руу єєрийгєє хавсаргаж явуулдаг.
Мєн єєрийгєє тараахын тулд mIRC программийн Script.ini файл болон Microsoft IIS серверийн Default.htm файлуудыг vvсгэдэг.

Тєрєл: Worm
Илэрсэн он сар єдєр: 2001 оны 12 сарын 12
Хэмжээ: 14366 байт
Хор хохирол учруулах зэрэглэл: 3


Захианы subject нь дараахаас аль нэг нь байж болдог:

· If I were God and didn't belive in myself would it be blasphemy
· The A-Team VS KnightRider … who would win ?
· Just one kiss, will make it better. just one kiss, and we will be alright.
· I can't help this longing, comfort me.
· And I miss you most of all, my darling …
· … When autumn leaves start to fall
· It's dark in here, you can feel it all around. The underground.
· I will always be with you sometimes black sometimes white …
· .. and there's no need to be scared, you re always on my mind.
· You just take a giant step, one step higher.
· The air will hold you if you try, trust my wings of desire. Glory, Glorified…….

Захианы хэсэгт дараахаас аль нэг нь байдаг:

· Happy Birthday
· Yeah ok, so it's not yours it's mine 🙂
· The horizons lean forward, offering us space to place new steps of change.
· I like this calm, moments before the storm
· Darling, when did you fall..when was it over ?
· Will you meet me …. and we'll fly away ?!
· You should like this, it could have been made for you
· speak to you later
· They say love is blind … well, the attachment probably proves it.
· Pretty good either way though, isn't it ?
· still cause for a celebration though, check out the details I attached
· This made me laugh
· Got some more stuff to tell you later but I can't stop right now
· so I'll email you later or give you a ring if thats ok ?!
· Speak to you later

Хавсаргасан файлын нэр нь янз бvрийн тоо болон дараах характеруудаас аль нэгийг нь агуулсан байдаг:

tgfdfg jhfxvc cgfd2 trevc t6tr ffdasf glkfh fhjdv qesac kujzv weafs twat rewfd gfdsf hgbv fdsc p0olik
3tgf rf43dr t54refd ut545a r4354gkjw vgrewu xw54re y343rv z3vdf

Захианд хавсаргасан хавсралт доорх єргєтгєлтэй байна.

– .pif
– .scr
– .exe
– .com
– .bat

Worm нь тухайн хэрэглэгчийн нэрийг захианы хамгийн сvvлд нэмж оруулан бvх хаягууд руу илгээдэг.
Мєн \Windows директорт єєрийгєє Karen.exe нэртэйгээр vvсгэдэг.

Registry файлын HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
директорт доорх утгыг нэмснээр Windows эхлэх бvрт вирус идэвхиждэг:
Karen c:\windows\karen.exe

Дараа нь C:\Mirc директорыг хайн хэрвээ байвал Script.ini файлыг vvсгэснээр mIRC ажиллаж байх vеэр
єєрийгєє тараахыг оролддог.
Мєн C:\Inetpub\wwwroot директорыг хайн хэрвээ олдвол єєрийгєє web.exe нэртэйгээр хуулдаг. Microsoft IIS
сервер нь ийм директортой байдаг. Уг директор дахь vндсэн вэб хуудсын файл болох Default.htm файлын нэрийг
Redesi.htm нэрээр єєрчилдєг. Їvний дараа Default.htm файлыг шинээр vvсгэн дараах текстийг гарч ирж байхаар болгодог:

We Are Forever

Дээрх текстийг харсан хэрэглэгчид Web.exe файлыг татаж авахыг санал болгодог.

Хэрхэн арилгах вэ?

W32.Gokar.A@mm илэрсэн бvх файлуудыг устган Registry файлд нэмэгдсэн утгыг устгах шаардлагатай. Мєн
C:\inetpub\Wwwroot\Redesi.htm файлыг Default.htm нэртэй болгож єєрчлєх.

Registry файлыг засах:
Анхаар: Системийн registry файлд ямар нэгэн єєрчлєлт оруулахаасаа ємнє нэг хувийг нь хадгалж авч байна уу.
Буруу бичилт, єєрчлєлт хийснээс шалтгаалан файлууд эвдрэх, устах аюултайгаас гадна систем ажиллахгvй болдог.

1. Start товчыг даран Run командыг сонгоно.
2. Командын мєрєнд regedit гэж бичиж єгєн OK товчыг дарна. Registry Editor гэсэн бичиг бvхий цонх нээгдэнэ.
3. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run гэсэн дарааллаар очно.
4. Баруун талын баганад байрлах дараах утгыг сонгож Del товч дарж устгана.
Karen c:\windows\karen.exe
5. Registry гэсэн цэснээс Exit командыг сонгож гарна.



Date: September 26th, 2007 | Categories: Вирус | By: | Comments: 1,708

1,708 Responses to W32.Gokar.A@mm

    An outstanding share! I have just forwarded this onto a co-worker who has been doing a little homework on this. And he actually bought me breakfast because I found it for him… lol. So let me reword this…. Thank YOU for the meal!! But yeah, thanks for spending some time to talk about this matter here on your internet site.|

    Great post. I was checking continuously this blog and I’m impressed! Extremely useful information specially the last part 🙂 I care for such info much. I was looking for this particular info for a long time. Thank you and good luck.|

    This is a topic that is close to my heart… Many thanks! Where are your contact details though?

    I don’t even know the way I finished up right here, but I believed this post used to be great. I do not recognize who you might be but definitely you’re going to a famous blogger if you aren’t already. Cheers!|

    Oh my goodness! Impressive article dude! Thank you so much, However I am going through difficulties with your RSS. I donít know the reason why I am unable to join it. Is there anybody else having the same RSS problems? Anyone who knows the answer will you kindly respond? Thanks!!

    WOW just what I was searching for. Came here by searching for meta_keyword|

    With thanks, I value this! viagra without doctor visit – coconut oil massage for erectile dysfunction

    Hello there! I know this is kinda off topic but I was wondering if you knew where I could locate a captcha plugin for my comment form? I’m using the same blog platform as yours and I’m having difficulty finding one? Thanks a lot!|

    Way cool! Some very valid points! I appreciate you penning this write-up plus the rest of the website is also really good.

    You’re so awesome! I do not think I’ve read through a single thing like this before. So good to find someone with a few original thoughts on this issue. Really.. many thanks for starting this up. This site is one thing that’s needed on the web, someone with some originality.

    Thank you for the auspicious writeup. It in fact was a amusement account it. Look advanced to far added agreeable from you! However, how can we communicate?|

    After I initially commented I appear to have clicked on the -Notify me when new comments are added- checkbox and from now on every time a comment is added I get 4 emails with the exact same comment. Perhaps there is a way you can remove me from that service? Cheers!|

    After I originally commented I seem to have clicked on the -Notify me when new comments are added- checkbox and now every time a comment is added I receive four emails with the exact same comment. There has to be a way you can remove me from that service? Thank you!

    I do not know whether it’s just me or if everyone else experiencing problems with your website. It appears like some of the text within your content are running off the screen. Can somebody else please provide feedback and let me know if this is happening to them as well? This could be a problem with my web browser because I’ve had this happen previously. Appreciate it

    Spot on with this write-up, I truly think this website needs a great deal more attention. I’ll probably be back again to see more, thanks for the advice.

    I do not even understand how I stopped up right here, however I assumed this submit used to be good. I don’t know who you might be but certainly you are going to a well-known blogger for those who are not already 😉 Cheers!

    You are so interesting! I don’t think I’ve read a single thing like this before. So wonderful to discover someone with a few genuine thoughts on this topic. Really.. many thanks for starting this up. This site is one thing that’s needed on the internet, someone with some originality.

    Simply desire to say your article is as surprising. The clarity for your submit is simply nice and i can assume you’re an expert in this subject. Fine along with your permission let me to clutch your feed to stay updated with impending post. Thanks a million and please carry on the gratifying work.

    Hey very cool website!! Man .. Beautiful .. Wonderful .. I’ll bookmark your blog and take the feeds additionally…I’m glad to find a lot of helpful info here within the put up, we’d like develop extra techniques in this regard, thank you for sharing.

    Greetings! Very useful advice in this particular post! It is the little changes that make the biggest changes. Thanks a lot for sharing!

    This excellent website truly has all of the information I needed concerning this subject and didnít know who to ask.

    I’m amazed, I must say. Rarely do I encounter a blog that’s both equally educative and engaging, and without a doubt, you’ve hit the nail on the head. The problem is something not enough folks are speaking intelligently about. I’m very happy that I came across this in my hunt for something relating to this.

    Hello this is kind of of off topic but I was wanting to know if blogs use WYSIWYG editors or if you have to manually code with HTML. I’m starting a blog soon but have no coding know-how so I wanted to get advice from someone with experience. Any help would be greatly appreciated!|

    I cling on to listening to the news bulletin speak about receiving free online grant applications so I have been looking around for the most excellent site to get one. Could you tell me please, where could i find some?

    Wow! Finally I got a webpage from where I know how to genuinely take valuable information concerning my study and knowledge.|

    Greetings from Florida! I’m bored to tears at work so I decided to check out your website on my iphone during lunch break. I enjoy the info you provide here and can’t wait to take a look when I get home. I’m amazed at how quick your blog loaded on my phone .. I’m not even using WIFI, just 3G .. Anyways, superb blog!|

    A fascinating discussion is definitely worth comment. There’s no doubt that that you ought to write more on this topic, it may not be a taboo matter but typically folks don’t talk about such topics. To the next! All the best!!


    tadalafil 40: http://tadalafilonline20.com/ tadalafil tablets

    Simply wish to say your article is as amazing. The clearness in your put up is just nice and that i can assume you are an expert in this subject. Fine with your permission let me to take hold of your RSS feed to stay up to date with imminent post. Thank you one million and please keep up the gratifying work.

    wonderful post, very informative. I wonder why the other experts of this sector don’t realize this. You must continue your writing. I’m sure, you have a great readers’ base already!|

    Nice read, I just passed this onto a colleague who was doing a little research on that. And he just bought me lunch because I found it for him smile So let me rephrase that: Thanks for lunch!

    We are a group of volunteers and opening a new scheme in our community. Your website provided us with valuable information to work on. You have done an impressive job and our whole community will be thankful to you.

    Amazing issues here. I am very glad to peer your post. Thanks so much and I’m having a look ahead to touch you. Will you kindly drop me a mail?|

    Good info. Lucky me I recently found your website by accident (stumbleupon). I’ve book-marked it for later!

    My brother recommended I might like this web site. He used to be totally right. This post truly made my day. You can not consider just how much time I had spent for this information! Thank you!|

    faultless article

    hello!,I like your writing so so much! proportion we communicate more about your post on AOL? I require an expert on this house to resolve my problem. Maybe that is you! Having a look ahead to peer you. |

    I don’t know whether it’s just me or if perhaps everybody else experiencing problems with your blog. It appears as though some of the written text within your content are running off the screen. Can somebody else please provide feedback and let me know if this is happening to them as well? This may be a issue with my web browser because I’ve had this happen before. Appreciate it

    Thanks for another fantastic article. The place else could anyone get that type of info in such a perfect approach of writing? I have a presentation subsequent week, and I’m on the look for such information.|

    Valuable info. Fortunate me I discovered your website accidentally, and I’m surprised why this twist of fate did not took place earlier! I bookmarked it.|

    Write more, thats all I have to say. Literally, it seems as though you relied on the video to make your point. You definitely know what youre talking about, why waste your intelligence on just posting videos to your site when you could be giving us something informative to read?

    What’s up, yeah this article is truly fastidious and I have learned lot of things from it about blogging. thanks.|

    What’s Taking place i am new to this, I stumbled upon this I’ve discovered It positively useful and it has helped me out loads. I am hoping to give a contribution & aid other users like its aided me. Great job.|

    An impressive share! I have just forwarded this onto a colleague who was conducting a little research on this. And he in fact ordered me breakfast due to the fact that I found it for him… lol. So allow me to reword this…. Thanks for the meal!! But yeah, thanks for spending the time to discuss this matter here on your web site.

    It’s going to be finish of mine day, however before ending I am reading this fantastic piece of writing to increase my know-how.|

    Good blog post. I certainly appreciate this site. Keep writing!|

    Very nice post. I just stumbled upon your blog and wished to say that I’ve truly enjoyed surfing around your blog posts. In any case I’ll be subscribing to your rss feed and I hope you write again soon!

    Good post. I learn something new and challenging on blogs I stumbleupon everyday. It’s always interesting to read through articles from other writers and practice something from their sites.

Leave a Reply