Gfg.exe: Difference between revisions
mNo edit summary |
recovered this screamer, no longer lost media, will upload a showcase and the virus itself in a sec. |
||
| Line 1: | Line 1: | ||
{{Infobox | {{Infobox | ||
|title = gfg.exe | |title = gfg.exe | ||
| Line 10: | Line 9: | ||
'''Gfg.exe''', also known as '''Troj/GhostGirl''', or simply '''GhostGirl''', is a Chinese [[screamer]] application created by an unknown user on September 11th, 2002. It was written in the [[wikipedia:Visual_Basic_(classic)|Visual Basic]] 6.0 programming language for [[Wikipedia:Windows|Microsoft Windows]]. | '''Gfg.exe''', also known as '''Troj/GhostGirl''', or simply '''GhostGirl''', is a Chinese [[screamer]] application created by an unknown user on September 11th, 2002. It was written in the [[wikipedia:Visual_Basic_(classic)|Visual Basic]] 6.0 programming language for [[Wikipedia:Windows|Microsoft Windows]]. | ||
The icon is a low-resolution image of a yellow smiley face. When the user starts up the application, it will begin to run in the background with no indication. After | The icon is either a low-resolution image of a yellow smiley face or a folder icon with a skull next to it. When the user starts up the application, it will begin to run in the background with no indication. After around ~7 minutes of inactivity, the application will suddenly display a full-screened picture of [[Crazy Ghost]], accompanied by two Windows dings. | ||
The application will then begin to show the screamer at random intervals and repeatedly open and close the disk tray to annoy the user, and will also run every time the computer finishes its start-up process by creating entries in the '''"HKLM\Software\Microsoft\Windows\CurrentVersion\Run"''' and '''"HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices"''' registry keys. The application will even turn the computer on automatically at midnight hours while it is shut down, so that the screamer can appear while the user is most likely sleeping so that they can get scared either way. | The application will then begin to show the screamer at random intervals and repeatedly open and close the disk tray to annoy the user, and will also run every time the computer finishes its start-up process by creating entries in the '''"HKLM\Software\Microsoft\Windows\CurrentVersion\Run"''' and '''"HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices"''' registry keys. The application will even turn the computer on automatically at midnight hours while it is shut down, so that the screamer can appear while the user is most likely sleeping so that they can get scared either way. | ||
Revision as of 22:37, 14 June 2026
Gfg.exe, also known as Troj/GhostGirl, or simply GhostGirl, is a Chinese screamer application created by an unknown user on September 11th, 2002. It was written in the Visual Basic 6.0 programming language for Microsoft Windows.
The icon is either a low-resolution image of a yellow smiley face or a folder icon with a skull next to it. When the user starts up the application, it will begin to run in the background with no indication. After around ~7 minutes of inactivity, the application will suddenly display a full-screened picture of Crazy Ghost, accompanied by two Windows dings.
The application will then begin to show the screamer at random intervals and repeatedly open and close the disk tray to annoy the user, and will also run every time the computer finishes its start-up process by creating entries in the "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" and "HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices" registry keys. The application will even turn the computer on automatically at midnight hours while it is shut down, so that the screamer can appear while the user is most likely sleeping so that they can get scared either way.
Links
NOTE: The following links contain a screamer image!
- Virus info: hybrid-analysis.com/sample/82d26220eeb8b13d253de579f604e7d7ac8abd03a2b98a924c5b14cfa4040cea/5723068caac2ed112bfd9d9d
- Removal (contains the screamer image): vsantivirus.com/ghostgirl.htm