Troj/Gpcode-B

Please follow the instructions for removing Trojans.

Windows NT/2000/XP/2003

In Windows NT/2000/XP/2003 you will also need to edit the following registry entry for each user who ran the virus. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export Range' panel, click 'All', then save your registry as Backup.

Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entry:

HKU\[code number]\Software\Microsoft\Windows\CurrentVersion\Run\
services
<pathname of the Trojan executable>

and delete it if it exists.

Close the registry editor.

Troj/Gpcode-B is a Trojan for the Windows platform which maliciously encrypts data files on the infected computer and local network, and then attempts to extort money in return for an offer of the decoder. Troj/Gpcode-B is a Trojan for the Windows platform which maliciously encrypts data files on the infected computer and local network, and then attempts to extort money in return for an offer of the decoder.

The Trojan gradually scans through each drive accessible from the infected computer, searching for files with the following extensions:

xls
doc
txt
rtf
zip
rar
dbf
htm
html
jpg
db
db1
db2
asc
pgp

Each such file is replaced with an encrypted version, preceeded by the string "PGPcoder 000000000032".

In every folder where files have been encrypted, Troj/Gpcode-B creates a file "ATTENTION!!!.txt" containing the following message:

Some files are coded.
To buy decoder mail: n<6 digit number>@yahoo.com
with subject: PGPcoder 000000000032

The Trojan also creates the file

<Temp>\autosave.sin

in which it constructs a directory listing of the file system as it is scanned.

Troj/Gpcode-B attempts to create the following registry entry so that it is automatically run upon startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
services
<pathname of the Trojan executable>

However, if the pathname contains spaces then an incorrect string is generated for the pathname.

Registry entries are also created under:

HKCU\Software\Microsoft\Sysinf\

Troj/Gpcode-B uses a mutex named "encoder_v1.0" to prevent more than one instance running on the infected computer.

Troj/Gpcode-B deletes itself once it has completed a scan of the whole system.