Home Malware Programs Trojans Ragnarok

Ragnarok

Posted: March 28, 2006

Ragnarok is a backdoor Trojan that steals private information that's related to the online mmorpg Ragnarok Online. However, SpywareRemove.com malware experts have also found some instances where Ragnarok detections are false positives that are caused by the Ragnarok game itself. Use your own judgment and the assistance of appropriate anti-malware programs to determine whether you have a genuine spyware or a false alarm, before taking action against any file that's deemed to be infected by Ragnarok. Since the potential consequences of being infected with a real Ragnarok Trojan can include identity theft, fraudulent expense bills, account break-ins and other high-level privacy and security threats, it's strongly encouraged to take any possible Ragnarok outbreak seriously. Since spyware like Ragnarok will launch themselves automatically and show no real symptoms, don't expect to be able to remove Ragnarok, unless you have a security software designed for such tasks or the assistance of a PC security expert.

When You Can Relax About a Supposed Ragnarok Infection

Although fake infection warnings are common for certain types of anti-malware programs, the Ragnarok Trojan's false alarm is particularly simple to define and avoid. All Ragnarok false positives that SpywareRemove.com malware research team has seen, so far have been caused by .exe files that are linked to Ragnarok Online itself, particularly when the game is attempting to update itself.

This simple mistake is based on heuristic or behavioral similarities between the harmless functions of Ragnarok Online and a Ragnarok-targeted Trojan and you can safely disregard it. In most cases, patching your anti-malware programs will remove these fake errors. If you've updated your security software for the latest threat databases and the Ragnarok fake alert is still being triggered, setting the relevant file to be an exception that your PC security ignores is a secondary solution.

When Ragnarok is Something to Be Scared About

Unfortunately, SpywareRemove.com malware researchers have also found many cases where Ragnarok alerts were genuine Trojans and spyware infections, similar to TrojanSpy:Win32/Maran.gen!A, PWS:Win32/OnLineGames.BX, TrojanSpy:Win32/Maran.AT, Wowcraft.e or Trojan.GameThief.WOW.bht. Just like these other examples of spyware, Ragnarok will leverage standard information-gathering techniques for a very specific purpose.

Ragnarok Trojans (also known by their aliases - backdoor.Ragnarok and Trojan.PWS.Ragnarok) will use keylogger functions to record all keyboard input while they search specifically for your Ragnarok Online user information, such as login names and passwords. Variants of Ragnarok may also use other tactics and can potentially record your monitor output with screenshots or even monitor your webcam and microphone.

Despite the narrow focus of Ragnarok's attacks, which are aimed at allowing Ragnarok to steal Ragnarok Online game accounts and related financial accounts, Ragnarok's tactics can also be used to steal many different types of confidential information. Until you've removed Ragnarok from your PC, you should consider all data to be at risk. Symptoms of a Ragnarok attack are minor and may not be evident at all, save for the possibility of the presence of unfamiliar files or memory processes.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 rodll.dll
    2 rundll132.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunegro=%Windir%undll132.exe

Related Posts

Loading...