Backdoor.Gaertob.A

An old nuisance, Backdoor_Win32/Gaertob.A, has returned, and is leaving PC users shaking their heads and tightening their Internet security defenses.

Backdoor_Win32/Gaertob.A is a nasty, deceitful Trojan first detected in January, 2009, and goes by the aliases Trojan.Win32.Buzus.ctwu, W32/Obfuscated.A!genr, and Win32/Buzus.CTTV. Infamous for exploiting vulnerabilities of IE and other software, Backdoor_Win32/Gaertob.A may have been cloaked inside an infectious download of freeware, shareware, or a codec.

Once inside your PC, Backdoor_Win32/Gaertob.A will waste no time and will modify security settings to disarm your anti-malware, and add itself to your Windows firewall applications to avoid detection and removal.

Do not be surprised if you are forcibly and repeatedly routed to a malicious or undesired website. Backdoor_Win32/Gaertob.A has intelligently modified your hosts files, and may also block you from downloading helpful programs such as a legitimate anti-malware tool to remove it.

Another dirty trick used by Backdoor_Win32/Gaertob.A is to modify your browser settings and change your home page settings to gllod.com, an accomplice in Backdoor_Win32/Gaertob.A dirty scheme and malicious attack. Therefore, do not trust or believe gllod.com's attempt to look like a legitimate Google search page, it is fake! Gllod.com and its infectious gllod.exe file are part of the scam of Backdoor_Win32/Gaertob.A, and you should have both removed immediately. Be certain to keep an up-to-date anti-malware loaded on your system in case you trip over a dubious link or unintentionally land on a malicious website like gllod.com.

Two Additional and Important Tips:

1. Once backdoor_Win32/Gaertob.A is on your machine, a remote attacker can order a check of P2P folders under the program files directory and can drop copies of backdoor_Win32/Gaertob.A into each. You need to know that you may become the 'spreader' of this nasty disease to your friends and family.
2. To ensure you do not 'trip' or mistakenly visit gllod.com, you may want to block it from your browser by doing the following:
1. Go to the start menu and open your host file
2. To bypass the restriction, right click on the 'notepad' application and opt to 'run as administrator'.
3. Open your host file (it is usually found here: C:\windows\system32\drivers\etc)
4. List the sites you want blocked underneath the line that identifies your local host (example below)

#127.0.0.1 localhost

#127.0.0.1 *xyz.com (substitute 'xyz' for the name of actual site to be blocked)

Note: The asterisk should block all variations, i.e. www.xyz.com, xyz.com, http:www.xyz.com). If it doesn't, list them individually.

Table of Contents

1

Aliases

15 security vendors flagged this file as malicious.

Anti-Virus Software	Detection
Panda	Generic Backdoor
AVG	Dropper.Generic6.ABR
Fortinet	W32/Injector.QVE!tr
Ikarus	Backdoor.Win32.Gaertob
AhnLab-V3	Win32/Palevo.worm.139264.UL
Antiy-AVL	Worm/Win32.Palevo.gen
AntiVir	BDS/Gaertob.A.90
DrWeb	Trojan.DownLoader6.5307
Comodo	UnclassifiedMalware
Kaspersky	P2P-Worm.Win32.Palevo.eqzx
Avast	Win32:Malware-gen
Symantec	WS.Reputation.1
K7AntiVirus	P2PWorm
McAfee	PWS-Zbot.gen.acn
CAT-QuickHeal	I-Worm.Palevo.eqzx

SpyHunter Detects & Remove Backdoor.Gaertob.A



File System Details

Backdoor.Gaertob.A may create the following file(s):

Expand All | Collapse All

#	File Name	MD5	Detections i Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	winsrvd.exe	e0d7bbc2d389462e83cfa03d234653ce	17 +
Name: winsrvd.exe MD5: e0d7bbc2d389462e83cfa03d234653ce Size: 139.26 KB (139264 bytes) Detections: 17 Type: Executable File Path: %USERPROFILE%\M-15-7327-473783-3695 Group: Malware file Last Updated: December 20, 2012
2.	winlogon.exe	3389c851a2457a7e3978404fcd02bea2	7 +
Name: winlogon.exe MD5: 3389c851a2457a7e3978404fcd02bea2 Size: 303.1 KB (303104 bytes) Detections: 7 Type: Executable File Path: %PROGRAMFILES% Group: Malware file Last Updated: November 30, 2010
3.	winlogon.exe	4b63cf0d28d932c3aab062220bebb045	2 +
Name: winlogon.exe MD5: 4b63cf0d28d932c3aab062220bebb045 Size: 45.05 KB (45056 bytes) Detections: 2 Type: Executable File Path: %PROGRAMFILES% Group: Malware file Last Updated: October 22, 2012
4.	ie.exe	7f17cbeffc648f2efaa547ab2206dc63	1 +
Name: ie.exe MD5: 7f17cbeffc648f2efaa547ab2206dc63 Size: 93.23 KB (93234 bytes) Detections: 1 Type: Executable File Path: %WINDIR% Group: Malware file Last Updated: December 15, 2010
5.	klass.exe	27e26578db37b4d7218b7bf6b454f02c	1 +
Name: klass.exe MD5: 27e26578db37b4d7218b7bf6b454f02c Size: 85.5 KB (85504 bytes) Detections: 1 Type: Executable File Path: %COMMONPROGRAMFILES%\System Group: Malware file Last Updated: November 21, 2011