Threat description




Yet another Glieder variant has been spammed. The origin is an email message sent to many people. The message contains an attachment named FOTOS.ZIP. Inside the ZIP archive there is an HTML portion that uses a common exploit to launch an EXE file named CALC.EXE, which is also located inside the archive.


Automatic action

Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

Once the CALC.EXE file is launched it copies itself to the Windows System32 directory under the name DORIOT.EXE and adds Registry keys under:


to ensure the trojan is stared upon reboot. A file named GDQFW.EXE is then dropped onto the Windows System32 directory. This file is then injected into Explorer.exe process space through process memory manipulation. The dropper terminates at this stage.

The injected code from GDQFW.EXE is active while Explorer.exe is active. It performs various tasks which include monitoring various security related update programs and terminating them; checking predefined list of URLs for a particular file and if present - downloading and executing it. It also manipulates with cached URLs on the user's machine.


F-Secure Anti-Virus detects Glieder.I starting from the following update:

Detection Type: PC

Database: 2004-09-01_01

Submit a Sample

Suspect a file or URL was wrongly detected? Send it to our Labs for further analysis

Submit a Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

More Info