0

"C:\WINDOWS\system32\Paint.exe" -autocheck

is added to the registry every time its removed. This is like global. All the lab PCs(more than a hundred), personal laptops have this file. I really have no expert help to turn to.. as jotti says this file is clean.

Here's the dropped file [removed]

It seems that we all had this game cheating tool on our PCs called "Garena Maphack". Everytime it was run it would drop paint.exe into the system dir.

Paint.exe is diguised as the real paint.exe from windows. Having the same icon and such.

Check out threat expert's report at threatexpert.com/report.aspx?md5=176288f6f22a80c76329853f8535d45b

The game cheat that started this huge mess can be obtained from [removed]

What do I do? any experts care to take apart this file?

6
  • superuser.com/questions/75798/…
    – Jeffy
    Nov 27, 2009 at 4:28
  • Do not post links to infected files.
    – silky
    Nov 27, 2009 at 4:30
  • makes me wonder what kind of a lab would need a maphack? :)
    – Molly7244
    Nov 27, 2009 at 4:53
  • Please do not post links to possible malware on Super User. I left the link to the 'game cheat' up as it may be helpful.
    – Josh Hunt
    Nov 27, 2009 at 4:57
  • How can anyone analyze the file if the link to it has been removed?
    – mrduclaw
    Dec 4, 2009 at 4:21

3 Answers 3

2

This isn't really much of a finding so far, but I started to disassemble the file you linked. I extracted the files.db, and the main Exe dropper. It looks like it was coded in VB, if that matters, and Garena Universal MH appears to just drop files from the files.db using some of the crypto API to aid in the process.

One of the files is Paint.exe to C:\windows\system32\ as you mentioned. The VirusTotal of that file shows 1/40 as a hit for possible malware. Here's the report for that paint.exe.

While I didn't find anything particularly crazy going on with these files, VirusTotal did think something was funky and well, I only looked for about 15 minutes. I'd say to ere on the side of caution and reformat those boxes. But then, I'm a paranoid freak.

0

did you run MBAM yet? if that fails, give SmitfraudFix a shot (READ the instructions thoroughly!!).

0

Not going to touch the file with a 10-foot pole, however I'd say that a good first step would be to expunge the cheat utility from the affected systems.

You must log in to answer this question.