Welcome to the Virus Encyclopedia of Panda Security.
It plays a song with the Windows Media Player and closes the Internet Explorer browser when it detects the word Search in the address bar. It spreads via mapped drives.
|First detected on:||June 25, 2007|
|Detection updated on:||June 25, 2007|
|Yes, using TruPrevent Technologies
Gronev.A is a worm that closes the Internet Explorer browser whenever it detects the word Search in the address bar.
Additionally, when it is run, the Windows Media Player is opened and a song called Lagu is played. Moreover, when the CMD shell is accessed, a window is displayed and a username with a pasword is created. This way, it could remotely control the affected computer.
Gronev.A spreads via mapped drives. In order to do so, it checks if the infected computer is connected to a network. And if so, it makes an inventory of all mapped drives and creates a copy of itself in each of them.
Gronev.A is easy to recognize, as when it is run, the Windows Media Player is run and a song called Lagu is played.
Additionally, when the CMD shell is run, a window like the following is displayed: