Name :	Virus:W32/Gnil.A
Size:	80,384 bytes
Category:	Malware
Type:	Virus
Platform:	W32
Date of Discovery:	March 08, 2007

Gnil.A has the ability to infect remote computers over a local network and attempts to download and install other malware to the system.

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.

Gnil.A may arrive in the system as an executable with an icon that depicts an alien.

Sample screenshot:

Once the execution of Gnil.A has been initiated, it will drop the following files into the Windows System directory:

It will delete the executed copy of itself with the help of a batch file created in the temporary folder:

Gnil.A injects its .DLL component to the following processes:

It terminates the following processes related to Viking and Fujacks variants:

Note: String comparison is case sensitive.

It infects binary files of the following extension:

Moreover Gnil.A also infects script files with the following extension:

It avoids infecting folders with the following strings:

Note: String comparison is case sensitive. This is why most system files are still infected.

Gnil.A will append a code at the end of the script file to point to a malicious website:

Note: As of this writing the site is no longer available

Gnil.A may also use Internet Explorer to download from the said site. It gets the location of Internet Explorer by querying the following registry entry:

Or it may use the following hard coded path:

Aside from infecting binary and script files as a way to propagate, it can also spread via network shares using a combination of the following strings as username and passwords: