Gen.Trojan.Heur.Qq0ZVoGVdi_70573d0edc
Gen:Trojan.Heur.Qq0@!ZVoGVdi (BitDefender), TrojanSpy:Win32/Usteal.D (Microsoft), HEUR:Trojan.Win32.Generic (Kaspersky), Trojan-Spy.Win32.Usteal.d (v) (VIPRE), Trojan.PWS.UFR.3470 (DrWeb), Gen:Trojan.Heur.Qq0@!ZVoGVdi (B) (Emsisoft), Artemis!70573D0EDC6C (McAfee), Infostealer.Ldpinch!g1 (Symantec), Trojan-Spy.Win32.Usteal (Ikarus), Gen:Trojan.Heur.Qq0@!ZVoGVdi (FSecure), Win32/DH{eWkgIn18Bg} (AVG), Win32:Usteal [Spy] (Avast), TROJ_GEN.R047C0DAO14 (TrendMicro), Gen:Trojan.Heur.Qq0@!ZVoGVdi (AdAware), Trojan.Win32.Swrort.3.FD (Lavasoft MAS)
Behaviour: Trojan-Spy, Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
MD5: 70573d0edc6cd47d4bfa956a6137d924
SHA1: 5de88a0ff66f935e62c1cee2fb4b8398f8f2e5c5
SHA256: 87e84a6931a37914447d3184bf2069c23974cfde7b61a3a60a6d90a37fbf2765
SSDeep: 12288:l7Whw/yo79FPj6v2MljPD8eQZbk0oxhhEZROSXct7r/jR421:l7W6/T95jU2MHQZbk02hOoSUrLh1
Size: 703488 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2023-03-09 05:21:21
Analyzed on: WindowsXP SP3 32-bit
Summary:
Trojan-Spy. Spy program intended for stealing user's confidential data.
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
EasyAntiCheat_Setup.exe:260
%original file name%.exe:816
EasyAntiCheat.exe:976
The Trojan injects its code into the following process(es):
EasyAntiCheat.exe:932
File activity
The process EasyAntiCheat_Setup.exe:260 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Program Files%\EasyAntiCheat\EasyAntiCheat.exe (89944 bytes)
The process %original file name%.exe:816 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (8192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EasyAntiCheat.exe (1115992 bytes)
C:\ufr_reports\NO_PWDS_report_26-01-2014_12-32-01-21212B90-MIAB.bin (1620 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NO_PWDS_report_26-01-2014_12-32-01-21212B90-MIAB.bin (4706 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\report_26-01-2014_12-32-01-21212B90-MIAB.bin (3033 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\NO_PWDS_report_26-01-2014_12-32-01-21212B90-MIAB.bin (0 bytes)
The process EasyAntiCheat.exe:976 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cplgames.bmp (13614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\gamelaunch.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\meayln (46068 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\skillz_lv.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\speedgaming.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cybergamer.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\xifion.bmp (13616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\dataproof.ico (3262 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\xifion.ico (1886 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\oyunadresi_network.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\gvhbr.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\allserver.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\mtxserv.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\ingato.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cfgserv_net.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\onmoon_ru.bmp (13616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\teamkill_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cobra.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\h4u_ro.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\krond_solutions.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\games4u.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\goservers.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\elwixj (85157 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\megakill_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac_gui_images.zip (136749 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\1game_ua.ico (2462 bytes)
%System%\drivers\etc\hosts (1242 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\multigamer_no.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\onmoon_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\myarena_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\teamserver_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\goldenserv_kz.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\gather_network.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\fragarena.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\maxigames.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\ingaming.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\mundihost.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\levelup_cl.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\leetway_com.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\playnation.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\fpsgaming_gr.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EasyAntiCheat_Setup.exe (89944 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cybergamer_.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\goservers.bmp (13614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cplgames.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\onworks_cl.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\siegnet.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\gamerzband_cl.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\games4u.bmp (13614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\playnation.bmp (13614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\maxigames.bmp (13616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\specas.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\gamehost_ee.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\back.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\mundihost.bmp (13614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\apofig_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\zgsport.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\arena.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\prooyun_network.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\CS.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\phqghu (76744 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\ingaming.bmp (13614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\playmakers.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\forteam_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\csserv_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\imbaserver_net.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\siegnet.bmp (13616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cs68_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\frag.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\xzn_hu_hosting.ico (2462 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\EasyAntiCheat_Setup.exe (0 bytes)
The process EasyAntiCheat.exe:932 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%System%\EasyAntiCheat.sys (285400 bytes)
Registry activity
The process EasyAntiCheat_Setup.exe:260 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "08 07 1C 67 6E 4C 0F 7B D4 6E 94 7A 9E CA 84 45"
The process %original file name%.exe:816 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65324"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 2F 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\Мои документы"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\test\LOCALS~1\Temp]
"EasyAntiCheat.exe" = "EasyAntiCheat Client"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d45-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d42-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Рабочий Ñтол"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Документы"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65324"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65324"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Главное меню\Программы\Ðвтозагрузка"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F9 9F 1C AF E1 E2 91 63 EE 7C 4D 7A DC B7 CA 04"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Рабочий Ñтол"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65324"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d8c0d8da-77bd-11e0-bb02-000c293bc0fd}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ebcf8d94-66db-11de-b228-806d6172696f}]
"BaseClass" = "Drive"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process EasyAntiCheat.exe:976 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "34 97 71 29 1A 40 83 B5 5B 06 A0 44 F5 54 2A FF"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d42-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"
[HKCR\easyanticheat]
"(Default)" = "URL:EasyAntiCheat Client"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Документы"
[HKCR\easyanticheat\DefaultIcon]
"(Default)" = "C:\DOCUME~1\test\LOCALS~1\Temp\EasyAntiCheat.exe"
[HKCU\Software\EasyAntiCheat]
"Language" = "EN"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d45-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Рабочий Ñтол"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d8c0d8da-77bd-11e0-bb02-000c293bc0fd}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"EnableBalloonTips" = "1"
[HKCR\easyanticheat\shell\open\command]
"(Default)" = "C:\DOCUME~1\test\LOCALS~1\Temp\EasyAntiCheat.exe -server %1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Рабочий Ñтол"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Personal" = "%Documents and Settings%\%current user%\Мои документы"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ebcf8d94-66db-11de-b228-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\test\LOCALS~1\Temp]
"EasyAntiCheat_Setup.exe" = "Anti-Cheat for online multiplayer games"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process EasyAntiCheat.exe:932 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "05 F9 83 99 66 84 BB 8F 47 26 32 7A 6C FB 31 37"
Network activity (URLs)
| URL | IP |
|---|---|
| client.easyanticheat.net |  54.194.46.144 |
| password.wallst.ru |  212.46.196.141 |
| cindy.easyanticheat.net |  78.46.198.78 |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
Using the driver "%System%\EasyAntiCheat.sys" the Trojan controls creation and closing of processes by installing the process notifier.
Using the driver "%System%\EasyAntiCheat.sys" the Trojan controls creation and closing of threads by installing the thread notifier.
Using the driver "%System%\EasyAntiCheat.sys" the Trojan controls loading executable images into a memory by installing the Load image notifier.
Propagation
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
EasyAntiCheat_Setup.exe:260
%original file name%.exe:816
EasyAntiCheat.exe:976 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Program Files%\EasyAntiCheat\EasyAntiCheat.exe (89944 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EasyAntiCheat.exe (1115992 bytes)
C:\ufr_reports\NO_PWDS_report_26-01-2014_12-32-01-21212B90-MIAB.bin (1620 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NO_PWDS_report_26-01-2014_12-32-01-21212B90-MIAB.bin (4706 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\report_26-01-2014_12-32-01-21212B90-MIAB.bin (3033 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cplgames.bmp (13614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\gamelaunch.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\meayln (46068 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\skillz_lv.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\speedgaming.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cybergamer.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\xifion.bmp (13616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\dataproof.ico (3262 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\xifion.ico (1886 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\oyunadresi_network.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\gvhbr.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\allserver.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\mtxserv.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\ingato.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cfgserv_net.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\onmoon_ru.bmp (13616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\teamkill_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cobra.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\h4u_ro.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\krond_solutions.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\games4u.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\goservers.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\elwixj (85157 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\megakill_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac_gui_images.zip (136749 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\1game_ua.ico (2462 bytes)
%System%\drivers\etc\hosts (1242 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\multigamer_no.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\onmoon_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\myarena_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\teamserver_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\goldenserv_kz.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\gather_network.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\fragarena.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\maxigames.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\ingaming.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\mundihost.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\levelup_cl.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\leetway_com.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\playnation.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\fpsgaming_gr.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EasyAntiCheat_Setup.exe (89944 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cybergamer_.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\goservers.bmp (13614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cplgames.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\onworks_cl.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\siegnet.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\gamerzband_cl.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\games4u.bmp (13614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\playnation.bmp (13614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\maxigames.bmp (13616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\specas.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\gamehost_ee.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\back.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\mundihost.bmp (13614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\apofig_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\zgsport.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\arena.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\prooyun_network.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\CS.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\phqghu (76744 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\ingaming.bmp (13614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\playmakers.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\forteam_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\csserv_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\imbaserver_net.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\siegnet.bmp (13616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\cs68_ru.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\frag.ico (2462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eac\xzn_hu_hosting.ico (2462 bytes)
%System%\EasyAntiCheat.sys (285400 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
