Threat Explorer

The Threat Explorer is a comprehensive resource consumers can turn to for daily, accurate, up-to-date information on the latest threats, risks and vulnerabilities.

Gamma2.exe Hoax

Gamma2.exe Hoax

Discovered:
June 06, 2001
Updated:
February 13, 2007

This email hoax is designed to appear as a press release from F-Secure Corporation. The subject of the message is "Warning : New Trojan/Worm Spreading Like Wildfire."

F-Secure has confirmed that the press release is fake.

The hoax message is as follows:

Warning : New Trojan/Worm Spreading Like Wildfire

Please forward this WARNING to all of your friends.

F-Secure Corporation (HEX:FSC), a leading provider of centrally-managed, widely distributed security solutions is alerting computer users worldwide about a new, rapidly spreading Trojan/Worm named Gamma2.exe.

The NEW Internet Trojan/Worm Gamma2.exe aka MyNudePic.bmp.vbs, Readme.TXT.shs and RaunchyRita.JPG.pif is rapidly spreading across the Internet. Several hundreds of cases have been reported in just the last few days with more reports pouring in with an astonishing frequency.

"Early propogation reports indicate that this Trojan is spreading faster than many of the biggest viruses we saw last year", comments Mikko Hypponen. "It's already seems to be spreading faster than Anna Kournikova".

This particular specimen once executed also attacks some AntiVirus software and disables it. A full listing of products that are susceptible to this attack has not yet been released. Gamma2.exe not only provides a hacker with total control over your computer but also spreads itself by attaching itself to email, spreading itself by open fileshares and by IRC (Internet Relay Chat) if an an IRC client is detected on the infected computer. Gamma2.exe randomly renames itself and is believed to have polymorphic abilities according to datafellows.com Virus research centre. The Trojan completely hides from Windows once installed on a computer and cannot be manually removed. It allows hackers to download or delete any of your personal files and launch nuking attacks of epic proportions.

The only way to know if you are infected by this Trojan Worm is to scan your computer with a good Trojan and Virus scanner. There is a list below of what are generally considered to be reliable for detection and removal of Gamma2.exe and unaffected by AntiVirus disabling.

F-Protect www.complex.is/f-prot/Download.html
Lockdown www.lockdown2000.com
Norton www.symantec.com
Mcafee www.mcafee.com
Tauscan www.tiklsoft.com/security/3083.html

Thankyou

Steven Casey
Antiviral Research Laboratory Technologist
Please ignore any messages regarding this hoax and do not pass on messages. Passing on messages about the hoax only serves to further propagate it.
Writeup By: Andrew MacMillan