Space Station Computers Infected by Worm
The laptops taken on to the International Space Station (ISS) last month carried the W32.Gammima.AG worm. A worm is a self-replicating computer program.Unlike a virus, it has the capability to travel without any help from a person. This was confirmed by NASA. The worm steals the login details for online games popular in the Far East, such as "Maple Story" and "Talesweaver."
W32.Gammima.AG first appeared a year ago. W32.Gammima.AG propagates by copying itself to removable media. It also steals passwords information related to various online games. It sends the personal data it collects back to a central server. The virus is not thought to be a threat to the control and command system, or to any ISS operations.
NASA spokeman Kelly Humphries said in a statement that this was not the first time that the ISS had been affected by malware, merely calling it a “nuisance.”
The laptops did not have any anti-virus protection or detection systems loaded, she said. They were being used to run nutrition experiment programs and gave astronauts email access. NASA believes that the worm was either loaded with software or transferred via a personal compact flash card.
NASA is investigating the problem with its Russian counterparts to see where it stemmed from and to learn what measures can be taken to prevent a repeat of the situation.
HOW TO REMOVE W32.Gammima.AG:
1. Temporarily Disable System Restore (Windows Me/XP).
|
In Windows XP: 1. On the Desktop, Right Click on My Computer In Windows ME: 1. On the Desktop, Right Click on My Computer 3. On Performance Tab, Click File System in Advanced Settings at the bottom. |
|
2. Update the virus definitions of your antivirus software. If you do not have an antivirus software installed, you can download a FREE antivirus software from AVAST.com or download from
3. Reboot computer in SafeMode.
|
1. During BootUp process Press F8 continuously until selection appears 3. Hit Enter to proceed. |
|
4. Run a full system scan and clean/delete all infected file.
5. Delete/Modify any values added to the registry.
|
1. Click Start > Run 3. Click OK. |
|
Navigate to and delete the following registry entry:
|
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run \"kava" = "%System%\kavo.exe" |
|
Restore the following registry entries to their previous values, if required:
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced \Folder\Hidden\SHOWALL\"CheckedValue" = "0" \"Hidden" = "2" \"ShowSuperHidden" = "0" \"NoDriveTypeAutoRun" = "0×91" |
|
6. Exit registry editor and restart the computer.
7. In order to make sure that threat is completely eliminated from your computer, carry out a full scan of your computer using AntiVirus and Antispyware Software. Another way to delete the virus using various Antivirus Program without the need to install can be done with an Online Virus Scanner like the Trend Micro Online Virus Scan .



















[...] news by admin This entry is filed under The best free software reviews. You can follow any responses to this [...]
[...] unknown wrote an interesting post today onHere’s a quick excerptA worm is a self-replicating computer program.Unlike a virus, it has the capability to travel without any help from a person. This was confirmed by NASA. The worm steals the login details for online games popular in the Far East, … [...]
Leave your response!