Gruel (computer worm)

Source: Wikipedia, the free encyclopedia.
Gruel
Windows ME, Windows 2000 and Windows XP
Size102,400 bytes

Gruel, also referred to by

Windows ME, Windows 2000 and Windows XP. It spread via email and file sharing networks.[1][2]

Symptoms

Arrival and initial launch

The worm arrived as an attachment with various names in emails claiming to be a security update from either

CD/DVD drive, open many Control Panel
options, and then display a dialogue box that cannot be closed, which contains two buttons, "Retry" and "Cancel".

The text of the error message, riddled with grammatical errors, is as follows:

Your computer now is mine, Why? Because I didn't had nothing to do and I thought, why not make the evil? Remember NOW YOUR PC IS IN MY POWER! Windows Sucks! I can't stand it anymore! Windows has always sucked. Wake up people! It's a scam! You don't need a faster computer. You need a better operating system. Microsoft continuingly makes money by selling you the latest and greatest Windows. The latest Windows version is always the most inefficient yet, slowing down your fast computer. Also, now you have to upgrade all your other software too because different Windows versions are not compatible with each other! A hidden cost not mentioned at all. It's part of the scam. Capitalism Sucks!, Communism Sucks. KILLERGUATE.[5]

Secondary payload

After carrying out the above payload, the virus hangs the operating system, requiring users to perform a

Hard boot
by forcibly shutting the machine down by cutting the power, then turning the machine back on. Afterwards, the PC is completely unusable, as all .bat, .com, .exe, .ht, .hta, .pif and .scr files have been hooked to the virus itself – by attempting to run any of the programs, the worm is simply activated again and will release its primary payload once more.

See also

References

  1. ^ "Fakerr Description - F-Secure Labs". www.f-secure.com.
  2. ^ "W32.Gruel@mm". Symantec. Archived from the original on February 5, 2007. Retrieved 10 December 2013.
  3. ^ "'Gruel' worm poses as Microsoft patch and Symantec tool". ComputerWeekly.com. 17 July 2003. Retrieved 10 December 2013.
  4. ^ "Virus Alert: Several Variants of Gruel Worm Reported". eSecurityPlanet. 18 July 2003. Retrieved 10 December 2013.
  5. ^ "W32/Gruel-D". Sophos. Retrieved 16 December 2013.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Gruel_(computer_worm)&oldid=1221433540"