No replies to this topic

[Metallica]

Content is republished with permission from Malwarebytes.

What is Ardamax?

The Malwarebytes research team has determined that Ardamax is a keylogger. These so-called "keyloggers" send information about the actions on your computer to a third party or they can be read by another user of the system.
This one can record keystrokes and make screenshots. It is offered as a commercial product here.

How do I know if I am infected with Ardamax?

Your computer will have slowed down considerably and you may find a folder with this type of files:



There may be screenshots in the same folder. These will have the jpg extension.

How did Ardamax get on my computer?

Keyloggers use different methods for spreading themselves. This particular one was downloaded from a "cracks and keygens" site.

How do I remove Ardamax?

Our program Malwarebytes Anti-Malware can detect and remove this keylogger.

• Please download Malwarebytes Anti-Malware to your desktop.
• Double-click mbam-setup-{version}.exe and follow the prompts to install the program.
• At the end, be sure a check-mark is placed next to:
  Launch Malwarebytes Anti-Malware
• Then click Finish.
• Once the program has loaded, select Scan Now. Or select the Threat Scan from the Scan menu.
• If an update is available, it will be implemented before the rest of the scanning procedure.
• When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
• Restart your computer when prompted to do so.

Is there anything else I need to do to get rid of Ardamax?

• No, Malwarebytes' Anti-Malware removes Ardamax completely.

How would the full version of Malwarebytes Anti-Malware help protect me?

We hope our application has helped you eradicate this potentially unwanted software. If your current security solution let this infection through, you might please consider purchasing the FULL version of Malwarebytes Anti-Malware for additional protection.

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Ardamax keylogger. It would have warned you before the keylogger could install itself, giving you a chance to stop it before it became too late.

Technical details for experts

Please note in the logs below that file and foldernames are randomized.

Possible signs in FRST logs:

 HKLM-x32\...\Run: [WGG Start] => C:\ProgramData\GTLACI\WGG.exe [2751488 2016-11-04] ()
 C:\ProgramData\XKQ
 C:\ProgramData\GTLACI

() C:\ProgramData\GTLACI\WGG.exe
() C:\ProgramData\GTLACI\WGG.01

Alterations made by the installer:

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\ProgramData\GTLACI
       Adds the file WGG.00"="11/4/2016 12:09 PM, 2199 bytes, A
       Adds the file WGG.01"="11/4/2016 12:09 PM, 80896 bytes, A
       Adds the file WGG.02"="11/4/2016 12:09 PM, 55296 bytes, A
       Adds the file WGG.exe"="11/4/2016 12:09 PM, 2751488 bytes, A
    Adds the folder C:\ProgramData\XKQ
       Adds the file WGG.004"="11/4/2016 12:17 PM, 797675 bytes, A
       Adds the file WGG.005"="11/4/2016 12:17 PM, 542973 bytes, A


Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
       "WGG Start"="REG_SZ", "C:\ProgramData\GTLACI\WGG.exe"

Malwarebytes Anti-Malware log:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 11/4/2016
Scan Time: 1:03 PM
Logfile: mbamArdamax.txt
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.11.04.05
Rootkit Database: v2016.10.31.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Enabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {username}

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 327331
Time Elapsed: 9 min, 33 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 1
PUP.Optional.ArdamaxKeyLogger, C:\ProgramData\GTLACI\WGG.exe, 1848, Delete-on-Reboot, [0243c5f7edadb4820471a5ef29d8837d]

Modules: 1
PUP.Optional.ArdamaxKeyLogger, C:\ProgramData\GTLACI\WGG.01, Delete-on-Reboot, [86bf55673268d264e92c712a29d8fc04], 

Registry Keys: 0
(No malicious items detected)

Registry Values: 2
PUP.Optional.ArdamaxKeyLogger, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|WGG Start, C:\ProgramData\GTLACI\WGG.exe, Quarantined, [0243c5f7edadb4820471a5ef29d8837d]
PUP.Optional.ArdamaxKeyLogger, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|WGG Start, C:\ProgramData\GTLACI\WGG.exe, Quarantined, [0243c5f7edadb4820471a5ef29d8837d]

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 4
PUP.Optional.ArdamaxKeyLogger, C:\ProgramData\GTLACI\WGG.exe, Delete-on-Reboot, [0243c5f7edadb4820471a5ef29d8837d], 
PUP.Optional.ArdamaxKeyLogger, C:\ProgramData\GTLACI\WGG.01, Delete-on-Reboot, [86bf55673268d264e92c712a29d8fc04], 
PUP.Optional.ArdamaxKeyLogger, C:\ProgramData\GTLACI\WGG.02, Quarantined, [81c44a72e1b952e492e2cbc9e8190ff1], 
PUP.Optional.ArdamaxKeyLogger, C:\Users\{username}\Desktop\Bandicam Universal Crack.exe, Quarantined, [8bbaceee7d1db87e543a31daaf56639d], 

Physical Sectors: 0
(No malicious items detected)


(end)

As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.
We use different ways of protecting your computer(s):

• Dynamically Blocks Malware Sites & Servers
• Malware Execution Prevention

Save yourself the hassle and get protected.