Hacktool.Ghostmail

SUMMARY

Behavior

Hacktool.Ghostmagic is a security risk that is used to send large amounts of email.

Protection

• Initial Rapid Release version March 9, 2006
• Latest Rapid Release version March 9, 2006
• Initial Daily Certified version March 9, 2006
• Latest Daily Certified version January 17, 2008 revision 039
• Initial Weekly Certified release date March 15, 2006

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

TECHNICAL DETAILS

It has been reported that the hacktool may have the following file name:
gm41.exe

When Hacktool.Ghostmagic is executed, it presents its main dialog interface from which the user can set the following parameters of the email:

• From Address
• To addresses
• Subject
• Message Body
• Email Headers
• Servers
• Attachments

The hacktool allows the user to send spam or attack a single mailbox flooding it with many messages.

REMOVAL

The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

1. Update the virus definitions.
2. Run a full system scan.

For specific details on each of these steps, read the following instructions.

1. To update the virus definitions
Symantec Security Response fully tests all the virus definitions for quality assurance before they are posted to our servers. There are two ways to obtain the most recent virus definitions:

• Running LiveUpdate, which is the easiest way to obtain virus definitions.
  If you use Norton AntiVirus 2006, Symantec AntiVirus Corporate Edition 10.0, or newer products, LiveUpdate definitions are updated daily. These products include newer technology.
  
  If you use Norton AntiVirus 2005, Symantec AntiVirus Corporate Edition 9.0, or earlier products, LiveUpdate definitions are updated weekly. The exception is major outbreaks, when definitions are updated more often.
  
• Downloading the definitions using the Intelligent Updater: The Intelligent Updater virus definitions are posted daily. You should download the definitions from the Symantec Security Response Web site and manually install them.

The latest Intelligent Updater virus definitions can be obtained here: Intelligent Updater virus definitions. For detailed instructions read the document: How to update virus definition files using the Intelligent Updater.

2. To run a full system scan

1. Start your Symantec antivirus program and make sure that it is configured to scan all the files.
   For Norton AntiVirus consumer products: Read the document: How to configure Norton AntiVirus to scan all files.
   
   For Symantec AntiVirus Enterprise products: Read the document: How to verify that a Symantec Corporate antivirus product is set to scan all files.
   
2. Run a full system scan.
3. If any files are detected, follow the instructions displayed by your antivirus program.

Important: If you are unable to start your Symantec antivirus product or the product reports that it cannot delete a detected file, you may need to stop the risk from running in order to remove it. To do this, run the scan in Safe mode. For instructions, read the document, How to start the computer in Safe Mode. Once you have restarted in Safe mode, run the scan again.
After the files are deleted, restart the computer in Normal mode.