ArcadeGiant

Posted: February 23, 2015

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	2/10
Infected PCs:	24,639

First Seen:	July 11, 2014
Last Seen:	April 23, 2024
OS(es) Affected:	Windows

ArcadeGiant is an adware program that displays additional advertisement content forcibly injected into your browser. Although most adware programs are minor threats, at best, ArcadeGiant also has connections to Komodia-based code, including a potentially significant security vulnerability related to generic certificate usage. Because remote attackers could use this vulnerability to gain access to general or encrypted information, malware experts highly encourage the immediate, wholesale deletion of ArcadeGiant, including all files and settings changes related to ArcadeGiant.

The Giant Security Hole that's Attached to Your Browser

ArcadeGiant is one of a range of adware products recently confirmed to use a Komodia product referred to by its company as an 'SSL hijacker.' SSL (or Secure Sockets Layer) is a form of private data encryption used for online financial transactions, password protection and other, similarly sensitive information transferral. However, ArcadeGiant and other Komodia-derived adware may install generic, self-signed certificates that intercept SLL communications. Rather than using this feature to collect information (a common facet of browser-based spyware with similar functionality), ArcadeGiant uses it to inject advertisements into your browser via comparative image analysis.

The password for most Komodia certificates, including ones in use by ArcadeGiant, is pre-defined as 'komodia,' rather than being personalized for individual systems or software. Third parties could exploit this vulnerability by launching more harmful man-in-the-middle attacks than simple advertisements, including various attacks that could phish for and successfully collect information. Although most adware programs either inject advertisements through your browser or load additional offers via new windows, it's relatively notable for ArcadeGiant and related adware to include such a significant security vulnerability.

ArcadeGiant may install itself in any Windows browser, including Firefox, IE or Chrome. Meanwhile, improper installations or uninstalls of ArcadeGiant may generate a range of different DLL errors, some of which may reoccur routinely within seconds of their last occurrence.

Sending ArcadeGiant Crashing to Earth

ArcadeGiant is one of a handful of Komodia-based PUPs that include this SSL vulnerability, along with varied programs like SecureTeen, OptimizerMonitor, Superfish VisualDiscovery and System Alerts. Some of these products come pre-installed on Lenovo-brand machines, and even may reinstall themselves from factory reset conditions. Finally, although ArcadeGiant has no especial features meant to barricade its deletion, malware researchers note that deleting ArcadeGiant by standard methods does not guarantee the elimination of its certificate vulnerability.

Some PC security vendors have offered specialized tools for removing Komodia certificates from your PC. Whether or not you choose to use such software, you should use extensive anti-adware and anti-malware products to remove ArcadeGiant from your hard drive. Some ArcadeGiant components have been recorded using randomized file names and inappropriate locations (such as your OS directory), thus hindering their straightforward deletion. Although visiting ArcadeGiant's website will not harm your computer and ArcadeGiant isn't a deliberate threat, you should treat ArcadeGiant's potential for enabling future attacks as equivalent to other similar threats.

Both Microsoft and Lenovo are in progress of taking additional steps to protect their customers from ArcadeGiant and other Komodia products, such as updating their AV threat databases to detect these programs.

Aliases

WS.Reputation.1 [Symantec]

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%WINDIR%\System32\0fec54b10ce802a782c389d485480ad8\c68652b7dab3c17d731cc25e8bc0a42c

File name: c68652b7dab3c17d731cc25e8bc0a42c
Size: 1.48 MB (1489984 bytes)
MD5: e76f64e9d6e114c0feba5777227af870
Detection count: 1,522
Path: %WINDIR%\System32\0fec54b10ce802a782c389d485480ad8\c68652b7dab3c17d731cc25e8bc0a42c
Group: Malware file
Last Updated: October 10, 2021

%SYSTEMDRIVE%\System Recovery\Repair\Backup\A5FB3AD95E439DB8234B4E9D68C1B8F4C533926F.sys

File name: A5FB3AD95E439DB8234B4E9D68C1B8F4C533926F.sys
Size: 42.39 KB (42392 bytes)
MD5: 10ef50a5b530c113add8f23c76e00771
Detection count: 1,185
File type: System file
Mime Type: unknown/sys
Path: %SYSTEMDRIVE%\System Recovery\Repair\Backup\A5FB3AD95E439DB8234B4E9D68C1B8F4C533926F.sys
Group: Malware file
Last Updated: October 20, 2021

%LOCALAPPDATA%\CrushArcade\cat\CatWSPrx.exe

File name: CatWSPrx.exe
Size: 1.46 MB (1464056 bytes)
MD5: 63ccae8364bd04e0bb333286bd2618bd
Detection count: 49
File type: Executable File
Mime Type: unknown/exe
Path: %LOCALAPPDATA%\CrushArcade\cat
Group: Malware file
Last Updated: March 19, 2016

C:\Users\<username>\Music\OS\AdwCleaner\Quarantine\C\Users\<username>\AppData\Local\ArcadeTwist\cat\CatWSPrx.exe.vir

File name: CatWSPrx.exe.vir
Size: 1.37 MB (1379608 bytes)
MD5: 96c7ba20330235f5d96bf413a51e4722
Detection count: 44
Mime Type: unknown/vir
Path: C:\Users\<username>\Music\OS\AdwCleaner\Quarantine\C\Users\<username>\AppData\Local\ArcadeTwist\cat\CatWSPrx.exe.vir
Group: Malware file
Last Updated: February 19, 2021

More files

Registry Modifications

The following newly produced Registry Values are:

CLSID{41829420-151B-4920-B8A5-16BE4601B42A}{4FD3B33A-372C-439E-BB87-017365EC693C}{62970E2F-A895-4848-B46C-FBD071192995}{B3B723CD-7242-4775-B10E-74DB7F4CB5A1}Regexp file mask%WINDIR%\System32\Tasks\ArcadeGiant Updater%WINDIR%\Tasks\ArcadeGiant Updater.jobHKEY..\..\..\..{RegistryKeys}Software\Microsoft\Internet Explorer\Approved Extensions\{4FD3B33A-372C-439E-BB87-017365EC693C}Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1CEB3066-9D5D-42B8-B4C0-0A791297F419}Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{41829420-151B-4920-B8A5-16BE4601B42A}HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}{BEC0B5A9-4CE8-4873-90E5-345E66A944DB}

Additional Information

The following directories were created:

%APPDATA%\Microsoft\Windows\Start Menu\Programs\ArcadeGiant%LOCALAPPDATA%\ArcadeGiant%PROGRAMFILES%\ArcadeGiant%PROGRAMFILES(x86)%\ArcadeGiant%USERPROFILE%\Local Settings\Application Data\ArcadeGiant