Home Malware Programs Trojans Trojan-GameThief.Win32.Magania.ecvw

Trojan-GameThief.Win32.Magania.ecvw

Posted: October 13, 2011

Threat Metric

Threat Level: 5/10
Infected PCs: 67
First Seen: October 13, 2011
Last Seen: December 7, 2018
OS(es) Affected: Windows

Trojan-GameThief.Win32.Magania.ecvw is a hazardous Trojan which was generated to enable attackers get remote access to the affected computer system. GameThief.Win32.Magania.ecvw can be installed on the infected computer system stealthily without a PC user's permission and knowledge. Trojan-GameThief.Win32.Magania.ecvw can take over precious PC system resources and track your browser activities to record and/or steal your confidential information. Trojan-GameThief.Win32.Magania.ecvw can set the drive to autoplay by generating autorun.inf file in the root directory. Delete Trojan-GameThief.Win32.Magania.ecvw before it damages your machine.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



c:\autorun.inf File name: c:\autorun.inf
Mime Type: unknown/inf
Group: Malware file
c:\yveqsh93.exe File name: c:\yveqsh93.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%System%\mgking0.dll File name: %System%\mgking0.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
%System%\arking.exe File name: %System%\arking.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%System%\arking0.dll File name: %System%\arking0.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
%System%\mgking.exe File name: %System%\mgking.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\MADOWN urlinfo = "ghvudq.s"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run king_mg = "%System%\mgking.exe" King_ar = "%System%\arking.exe"
Loading...