Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

"C:\WINDOWS\system32\Paint.exe" -autocheck

is added to the registry every time its removed. This is like global. All the lab PCs(more than a hundred), personal laptops have this file. I really have no expert help to turn to.. as jotti says this file is clean.

Here's the dropped file [removed]

It seems that we all had this game cheating tool on our PCs called "Garena Maphack". Everytime it was run it would drop paint.exe into the system dir.

Paint.exe is diguised as the real paint.exe from windows. Having the same icon and such.

Check out threat expert's report at

The game cheat that started this huge mess can be obtained from [removed]

What do I do? any experts care to take apart this file?

share|improve this question

migrated from Nov 27 '09 at 4:31

This question came from our site for professional and enthusiast programmers.… – Jeffy Nov 27 '09 at 4:28
Do not post links to infected files. – silky Nov 27 '09 at 4:30
makes me wonder what kind of a lab would need a maphack? :) – Molly7244 Nov 27 '09 at 4:53
Please do not post links to possible malware on Super User. I left the link to the 'game cheat' up as it may be helpful. – Josh Hunt Nov 27 '09 at 4:57
How can anyone analyze the file if the link to it has been removed? – mrduclaw Dec 4 '09 at 4:21

This isn't really much of a finding so far, but I started to disassemble the file you linked. I extracted the files.db, and the main Exe dropper. It looks like it was coded in VB, if that matters, and Garena Universal MH appears to just drop files from the files.db using some of the crypto API to aid in the process.

One of the files is Paint.exe to C:\windows\system32\ as you mentioned. The VirusTotal of that file shows 1/40 as a hit for possible malware. Here's the report for that paint.exe.

While I didn't find anything particularly crazy going on with these files, VirusTotal did think something was funky and well, I only looked for about 15 minutes. I'd say to ere on the side of caution and reformat those boxes. But then, I'm a paranoid freak.

share|improve this answer

did you run MBAM yet? if that fails, give SmitfraudFix a shot (READ the instructions thoroughly!!).

share|improve this answer

Not going to touch the file with a 10-foot pole, however I'd say that a good first step would be to expunge the cheat utility from the affected systems.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.