Threat Database Trojans Trojan:Win32/Grymegat.B

Trojan:Win32/Grymegat.B

By Domesticus in Trojans

Trojan:Win32/Grymegat.B is a Trojan that is not able to circulate by itself. Trojan:Win32/Grymegat.B may fulfill a number of actions selected by a cybercriminal on a targeted PC. When installed on the vulnerable computer system, Trojan:Win32/Grymegat.B makes system changes by downloading malevolent files and modifying the Windows Registry. Trojan:Win32/Grymegat.B makes modifications to the registry entries so that its copy can be initiated automatically whenever Windows is started. Trojan:Win32/Grymegat.B makes modifications to system security settings by disabling the LUA (Least Privileged User Account), otherwise known as the 'administrator in Admin Approval Mode' user type, by changing registry entries. Disabling the LUA permits all programs to start by default with all administrative privileges, without the computer user being encourages for explicit permission. Trojan:Win32/Grymegat.B contacts a remote host to notify about a new infection to its creator, to download and run arbitrary files (incorporating updates or other malware infections), to get configuration or other information, to receive commands from remote cybercrimianls and to upload data received from the affected PC.

SpyHunter Detects & Remove Trojan:Win32/Grymegat.B

File System Details

Trojan:Win32/Grymegat.B may create the following file(s):
# File Name MD5 Detections
1. C:\Documents and Settings\\application data\system\system.exe
2. C:\Documents and Settings\\application data\rt1.jpg
3. C:\Documents and Settings\\start menu\programs\startup\iexplore.lnk
4. file.exe 03b4bbd4b7e6f0403dc6d215d6bdc6b7 0
5. file.exe 58098e72ad3fa4372115cbc15dbcd1ba 0
6. file.exe 0d971da1fd0295eae02638bc5278b94d 0

Registry Details

Trojan:Win32/Grymegat.B may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System "EnableLUA" = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" = "explorer.exe, c:\documents and settings\administrator\application data\system\system.exe" "EnableLUA" = "0"

Trending

Most Viewed

Loading...