SpamChoke Antispam Software Subscribe to Virus Alert Mailing List Enter your Email (Ex : john@company.com)

W32/Gpcoder.H Trojan  Information about the W32/Gpcoder.H Trojan: W32/Gpcoder.H is a Trojan. The Trojan will infect Windows systems. Upon execution, the trojan searches for the files with following extensions. If found the files will be encrypted and a text file named read_me.txt will be placed in the directory. .12m .3ds .3dx .4ge .4gl .7z .a .a86 .abc .acd .ace .act .ada .adi .aex .af3 .afd .ag4 .ai .aif .aifc .aiff .ain .aio .ais .akf .alv .amp .ans .ap .apa .apo .app .arc .arh .arj .arx .asc .asm .ask .au .bak .bas .bb .bcb .bcp .bdb .bh .bib .bpr .bsa .btr .bup .bwb .bz .bz2 .c .c86 .cac .cbl .cc .cdb .cdr .cgi .cmd .cnt .cob .col .cpp .cpt .crp .cru .csc .css .csv .ctx .cvs .cwb .cwk .cxe .cxx .cyp .d .db .db0 .db1 .db2 .db3 .db4 .dba .dbb .dbc .dbd .dbe .dbf .dbk .dbm .dbo .dbq .dbt .dbx .dfm .djvu .dic .dif .dm .dmd .doc .dok .dot .dox .dsc .dwg .dxf .dxr .eps .exp .f .fas .fax .fdb .fla .flb .frm .fm .fox .frm .frt .frx .fsl .gtd .gif .gz .gzip .h .ha .hh .hjt .hog .hpp .htm .html .htx .ice .icf .inc .ish .iso .jar .jad .java .jpg .jpeg .js .jsp .key .kwm .lst .lwp .lzh .lzs .lzw .ma .mak .man .maq .mar .mbx .mdb .mdf .mid .mo .myd .obj .old .p12 .pak .pas .pdf .pem .pfx .php .php3 .php4 .pgp .pkr .pl .pm3 .pm4 .pm5 .pm6 .png .ppt .pps .prf .prx .ps .psd .pst .pw .pwa .pwl .pwm .pwp .pxl .py .rar .res .rle .rmr .rnd .rtf .safe .sar .skr .sln .swf .sql .tar .tbb .tex .tga .tgz .tif .tiff .txt .vb .vp .wps .xcr .xls .xml and .zip The said read_me.txt file contains the following text. Hello,    your   files   are   encrypted   with   RSA-4096   algorithm (http://en.wikipedia.org/wiki/RSA). You  will  need  at least few years to decrypt these files without our software.  All  your  private  information  for  last  3  months  were collected and sent to us. To decrypt your files you need to buy our software. The price is $300. To  buy  our software please contact us at: %s and provide us your  personal code %d. After successful purchase we will send your  decrypting  tool,  and  your private information will be deleted from our system. If  you  will not contact us until 07/15/2007 your private information will be shared and you will lost all your data. Glamorous team It modifies the registry at the following location to load itself during each startup. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\winlogon\userinit This Trojan first appeared on July 16, 2007.  Other names of W32/Gpcoder.H Trojan: This Trojan is also known as GPCoder.h, Win32/Kollah.D, Win32.Gpcode.ai. Download the FREE Evaluation copy of Protector Plus antivirus software

 About Protector Plus Antivirus Software Packages:

Proland Software is the developer of Protector Plus range of antivirus software packages. Protector Plus 2007 is available for Windows Vista, Windows 95/98/Me, Windows XP, Windows NT/2000/2003 servers and workstations, MS-Exchange 2000/2003, MS-DOS and NetWare servers.

Protector Plus range of antivirus products offer on-line virus detection and removal. All the packages have the ability to detect and isolate all types of viruses, trojans, worms and other types of malware.

These products are updated on a continuous basis and the latest upgrades for all the platforms are made available for downloading from this site.

Click here to order Protector Plus anti virus software