Gen.Trojan.Heur.Qq0ZVoGVdi_70573d0edc – Adaware

Gen:Trojan.Heur.Qq0@!ZVoGVdi (BitDefender), TrojanSpy:Win32/Usteal.D (Microsoft), HEUR:Trojan.Win32.Generic (Kaspersky), Trojan-Spy.Win32.Usteal.d (v) (VIPRE), Trojan.PWS.UFR.3470 (DrWeb), Gen:Trojan.Heur.Qq0@!ZVoGVdi (B) (Emsisoft), Artemis!70573D0EDC6C (McAfee), Infostealer.Ldpinch!g1 (Symantec), Trojan-Spy.Win32.Usteal (Ikarus), Gen:Trojan.Heur.Qq0@!ZVoGVdi (FSecure), Win32/DH{eWkgIn18Bg} (AVG), Win32:Usteal [Spy] (Avast), TROJ_GEN.R047C0DAO14 (TrendMicro), Gen:Trojan.Heur.Qq0@!ZVoGVdi (AdAware), Trojan.Win32.Swrort.3.FD (Lavasoft MAS)Behaviour: Trojan-Spy, Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 70573d0edc6cd47d4bfa956a6137d924

SHA1: 5de88a0ff66f935e62c1cee2fb4b8398f8f2e5c5

SHA256: 87e84a6931a37914447d3184bf2069c23974cfde7b61a3a60a6d90a37fbf2765

SSDeep: 12288:l7Whw/yo79FPj6v2MljPD8eQZbk0oxhhEZROSXct7r/jR421:l7W6/T95jU2MHQZbk02hOoSUrLh1

Size: 703488 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2023-03-09 05:21:21

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan-Spy. Spy program intended for stealing user's confidential data.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

EasyAntiCheat_Setup.exe:260
%original file name%.exe:816
EasyAntiCheat.exe:976

The Trojan injects its code into the following process(es):

EasyAntiCheat.exe:932

File activity

The process EasyAntiCheat_Setup.exe:260 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\EasyAntiCheat\EasyAntiCheat.exe (89944 bytes)

The process %original file name%.exe:816 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (8192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EasyAntiCheat.exe (1115992 bytes)
C:\ufr_reports\NO_PWDS_report_26-01-2014_12-32-01-21212B90-MIAB.bin (1620 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NO_PWDS_report_26-01-2014_12-32-01-21212B90-MIAB.bin (4706 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\report_26-01-2014_12-32-01-21212B90-MIAB.bin (3033 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\NO_PWDS_report_26-01-2014_12-32-01-21212B90-MIAB.bin (0 bytes)

The process EasyAntiCheat.exe:976 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eac\cplgames.bmp (13614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\gamelaunch.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\meayln (46068 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\skillz_lv.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\speedgaming.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cybergamer.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\xifion.bmp (13616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\dataproof.ico (3262 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\xifion.ico (1886 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\oyunadresi_network.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\gvhbr.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\allserver.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\mtxserv.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\ingato.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cfgserv_net.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\onmoon_ru.bmp (13616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\teamkill_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cobra.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\h4u_ro.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\krond_solutions.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\games4u.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\goservers.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\elwixj (85157 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\megakill_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac_gui_images.zip (136749 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\1game_ua.ico (2462 bytes)
%System%\drivers\etc\hosts (1242 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\multigamer_no.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\onmoon_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\myarena_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\teamserver_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\goldenserv_kz.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\gather_network.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\fragarena.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\maxigames.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\ingaming.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\mundihost.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\levelup_cl.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\leetway_com.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\playnation.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\fpsgaming_gr.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EasyAntiCheat_Setup.exe (89944 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cybergamer_.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\goservers.bmp (13614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cplgames.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\onworks_cl.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\siegnet.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\gamerzband_cl.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\games4u.bmp (13614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\playnation.bmp (13614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\maxigames.bmp (13616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\specas.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\gamehost_ee.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\back.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\mundihost.bmp (13614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\apofig_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\zgsport.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\arena.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\prooyun_network.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\CS.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\phqghu (76744 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\ingaming.bmp (13614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\playmakers.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\forteam_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\csserv_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\imbaserver_net.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\siegnet.bmp (13616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cs68_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\frag.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\xzn_hu_hosting.ico (2462 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\EasyAntiCheat_Setup.exe (0 bytes)

The process EasyAntiCheat.exe:932 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\EasyAntiCheat.sys (285400 bytes)

Registry activity

The process EasyAntiCheat_Setup.exe:260 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "08 07 1C 67 6E 4C 0F 7B D4 6E 94 7A 9E CA 84 45"

The process %original file name%.exe:816 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65324"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 2F 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\ÃÅ“ÃÂ¾ÃÂ¸ ÃÂ´ÃÂ¾ÃÂºÃ‘Æ’ÃÂ¼ÃÂµÃÂ½Ã‘â€šÃ‘â€¹"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\test\LOCALS~1\Temp]
"EasyAntiCheat.exe" = "EasyAntiCheat Client"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d45-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d42-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\ÃÂ ÃÂ°ÃÂ±ÃÂ¾Ã‘â€¡ÃÂ¸ÃÂ¹ Ã‘ÂÃ‘â€šÃÂ¾ÃÂ»"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Ãâ€ÃÂ¾ÃÂºÃ‘Æ’ÃÂ¼ÃÂµÃÂ½Ã‘â€šÃ‘â€¹"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65324"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65324"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Ãâ€œÃÂ»ÃÂ°ÃÂ²ÃÂ½ÃÂ¾ÃÂµ ÃÂ¼ÃÂµÃÂ½Ã‘Å½\ÃÅ¸Ã‘â‚¬ÃÂ¾ÃÂ³Ã‘â‚¬ÃÂ°ÃÂ¼ÃÂ¼Ã‘â€¹\ÃÂÃÂ²Ã‘â€šÃÂ¾ÃÂ·ÃÂ°ÃÂ³Ã‘â‚¬Ã‘Æ’ÃÂ·ÃÂºÃÂ°"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F9 9F 1C AF E1 E2 91 63 EE 7C 4D 7A DC B7 CA 04"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\ÃÂ ÃÂ°ÃÂ±ÃÂ¾Ã‘â€¡ÃÂ¸ÃÂ¹ Ã‘ÂÃ‘â€šÃÂ¾ÃÂ»"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65324"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d8c0d8da-77bd-11e0-bb02-000c293bc0fd}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ebcf8d94-66db-11de-b228-806d6172696f}]
"BaseClass" = "Drive"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process EasyAntiCheat.exe:976 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "34 97 71 29 1A 40 83 B5 5B 06 A0 44 F5 54 2A FF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d42-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\easyanticheat]
"(Default)" = "URL:EasyAntiCheat Client"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Ãâ€ÃÂ¾ÃÂºÃ‘Æ’ÃÂ¼ÃÂµÃÂ½Ã‘â€šÃ‘â€¹"

[HKCR\easyanticheat\DefaultIcon]
"(Default)" = "C:\DOCUME~1\test\LOCALS~1\Temp\EasyAntiCheat.exe"

[HKCU\Software\EasyAntiCheat]
"Language" = "EN"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d45-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\ÃÂ ÃÂ°ÃÂ±ÃÂ¾Ã‘â€¡ÃÂ¸ÃÂ¹ Ã‘ÂÃ‘â€šÃÂ¾ÃÂ»"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d8c0d8da-77bd-11e0-bb02-000c293bc0fd}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"EnableBalloonTips" = "1"

[HKCR\easyanticheat\shell\open\command]
"(Default)" = "C:\DOCUME~1\test\LOCALS~1\Temp\EasyAntiCheat.exe -server %1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\ÃÂ ÃÂ°ÃÂ±ÃÂ¾Ã‘â€¡ÃÂ¸ÃÂ¹ Ã‘ÂÃ‘â€šÃÂ¾ÃÂ»"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Personal" = "%Documents and Settings%\%current user%\ÃÅ“ÃÂ¾ÃÂ¸ ÃÂ´ÃÂ¾ÃÂºÃ‘Æ’ÃÂ¼ÃÂµÃÂ½Ã‘â€šÃ‘â€¹"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ebcf8d94-66db-11de-b228-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\test\LOCALS~1\Temp]
"EasyAntiCheat_Setup.exe" = "Anti-Cheat for online multiplayer games"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process EasyAntiCheat.exe:932 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "05 F9 83 99 66 84 BB 8F 47 26 32 7A 6C FB 31 37"

Network activity (URLs)

URL	IP
client.easyanticheat.net	54.194.46.144
password.wallst.ru	212.46.196.141
cindy.easyanticheat.net	78.46.198.78

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "%System%\EasyAntiCheat.sys" the Trojan controls creation and closing of processes by installing the process notifier.

Using the driver "%System%\EasyAntiCheat.sys" the Trojan controls creation and closing of threads by installing the thread notifier.

Using the driver "%System%\EasyAntiCheat.sys" the Trojan controls loading executable images into a memory by installing the Load image notifier.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):
EasyAntiCheat_Setup.exe:260
%original file name%.exe:816
EasyAntiCheat.exe:976
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Program Files%\EasyAntiCheat\EasyAntiCheat.exe (89944 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EasyAntiCheat.exe (1115992 bytes)
C:\ufr_reports\NO_PWDS_report_26-01-2014_12-32-01-21212B90-MIAB.bin (1620 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NO_PWDS_report_26-01-2014_12-32-01-21212B90-MIAB.bin (4706 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\report_26-01-2014_12-32-01-21212B90-MIAB.bin (3033 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cplgames.bmp (13614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\gamelaunch.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\meayln (46068 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\skillz_lv.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\speedgaming.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cybergamer.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\xifion.bmp (13616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\dataproof.ico (3262 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\xifion.ico (1886 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\oyunadresi_network.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\gvhbr.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\allserver.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\mtxserv.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\ingato.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cfgserv_net.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\onmoon_ru.bmp (13616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\teamkill_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cobra.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\h4u_ro.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\krond_solutions.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\games4u.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\goservers.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\elwixj (85157 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\megakill_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac_gui_images.zip (136749 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\1game_ua.ico (2462 bytes)
%System%\drivers\etc\hosts (1242 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\multigamer_no.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\onmoon_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\myarena_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\teamserver_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\goldenserv_kz.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\gather_network.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\fragarena.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\maxigames.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\ingaming.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\mundihost.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\levelup_cl.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\leetway_com.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\playnation.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\fpsgaming_gr.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EasyAntiCheat_Setup.exe (89944 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cybergamer_.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\goservers.bmp (13614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cplgames.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\onworks_cl.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\siegnet.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\gamerzband_cl.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\games4u.bmp (13614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\playnation.bmp (13614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\maxigames.bmp (13616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\specas.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\gamehost_ee.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\back.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\mundihost.bmp (13614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\apofig_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\zgsport.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\arena.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\prooyun_network.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\CS.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\phqghu (76744 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\ingaming.bmp (13614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\playmakers.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\forteam_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\csserv_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\imbaserver_net.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\siegnet.bmp (13616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cs68_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\frag.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\xzn_hu_hosting.ico (2462 bytes)
%System%\EasyAntiCheat.sys (285400 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

Network Activity

Map

Strings from Dumps