FOR CUSTOMERS

Close

Library
My library

+ Add to library

Search
Search

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

A query form

Call us

+7 (495) 789-45-86

Forum

Your tickets

New ticket

Call us

+7 (495) 789-45-86

Profile

EN

RU CN DE EN ES FR IT JP KZ UZ PL BY
Close
Support services
Scanners
Dr.Web vxCube
Trial
VCI investigations
Virus library
Knowledge base

Technologies

Terminology

Training and education

Myths

News

Trojan.PWS.Steam.13637

Added to the Dr.Web virus database: 2017-04-14

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Update' = '%HOMEPATH%\Templates\.exe'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
  • Command Prompt (CMD)
  • Windows Task Manager (Taskmgr)
  • Registry Editor (RegEdit)
blocks the following features:
  • System Restore (SR)
  • User Account Control (UAC)
modifies the following system settings:
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewContextMenu' = '00000001'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
Executes the following:
  • '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderInfo /t REG_DWORD /d 1 /f
  • '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f
  • '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPanel /t REG_DWORD /d 1 /f
  • '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
  • '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
  • '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  • '<SYSTEM32>\cmd.exe' /k <SYSTEM32>\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  • '<SYSTEM32>\reg.exe' add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 1 /f
  • '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
Terminates or attempts to terminate
the following user processes:
  • outpost.exe
  • zlclient.exe
  • bdagent.exe
  • AVP.EXE
Searches for registry branches where third party applications store passwords:
  • [<HKLM>\Software\Passware\Windows Key\7\Registration]
  • [<HKLM>\Software\Passware\Encryption Analyzer\1\Registration,License]
  • [<HKLM>\Software\EnTech\PowerStrip]
  • [<HKLM>\Software\Red Storm Entertainment\RAVENSHIELD]
  • [<HKLM>\Software\KONAMI\PES2008]
  • [<HKLM>\Software\PowerQuest\PartitionMagic\8.0\UserInfo]
  • [<HKLM>\Software\Westwood\Nox]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NHL 2005]
  • [<HKLM>\Software\NuMega\SmartCheck]
  • [<HKLM>\Software\O&O\O&O Defrag\8.0\Pro\licenses]
  • [<HKLM>\Software\OnlineTVPlayer\RegInfo]
  • [<HKLM>\Software\Electronic Arts\EA GAMES\Shogun Total War - Warlord Edition]
  • [<HKLM>\Software\LucasArts\Star Wars Battlefront II\1.0]
  • [<HKLM>\Software\GSC Game World\STALKER-SHOC]
  • [<HKLM>\Software\LucasArts\Star Wars Battlefront II\1.1]
  • [<HKLM>\Software\THQ\Gas Powered Games\Supreme Commander]
  • [<HKLM>\Software\Steganos\SIAVPN]
  • [<HKLM>\Software\Silver Style Entertainment\Soldiers Of Anarchy]
  • [<HKLM>\Software\Ubisoft\SILENT HUNTER III\Keys]
  • [<HKLM>\Software\Atari\Sid Meier's Pirates!]
  • [<HKLM>\Software\Electronic Arts\Maxis\ Sim City 4 Deluxe]
  • [<HKLM>\Software\Network Associates, Inc.\Sniffer Pro\4.5\USER]
  • [<HKLM>\Software\Electronic Arts\Maxis\ Sim City 4]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Medal of Honor Allied Assault Breakthrough]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Medal of Honor Allied Assault]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Medal of Honor Allied Assault Spearhead]
  • [<HKLM>\SOFTWARE\mIRC]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\Medal of Honor: Heroes 2]
  • [<HKLM>\SOFTWARE\Electronic Arts\Medal of Honor Airborne]
  • [<HKLM>\SOFTWARE\Macromedia\Fireworks\7\Registration]
  • [<HKLM>\SOFTWARE\Macromedia\Flash\7\Registration]
  • [<HKLM>\SOFTWARE\Macromedia\Dreamweaver\7\Registration]
  • [<HKLM>\SOFTWARE\JSG\Matrix Saver V2]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\Madden NFL 07]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\Nascar Racing 2002]
  • [<HKLM>\Software\Nero\Installation\Families\Nero 7\Info]
  • [<HKLM>\SOFTWARE\Ahead\Nero - Burning Rom\Info]
  • [<HKLM>\SOFTWARE\Nero\Installation\Families\Nero 8\Info]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NHL 2004]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NHL 2003]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NBA Live 08]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NHL 2002]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\Nascar Racing 2003]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NBA LIVE 2003]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NBA LIVE 07]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NBA LIVE 2004]
  • [<HKLM>\SOFTWARE\AHEAD\NERO BURNING ROM ]
  • [<HKLM>\SOFTWARE\Rockstar Games\Bully Scholarship Edition]
  • [<HKLM>\SOFTWARE\AHEAD\INSTALLATION\FAMILIES\NERO 7\INFO]
  • [<HKLM>\SOFTWARE\NERO\SHARED\FAMILIES\NL9]
  • [<HKLM>\SOFTWARE\AHEAD\INSTALLATION\FAMILIES\NERO 8\INFO]
  • [<HKLM>\SOFTWARE\Activision\Transformers2]
  • [<HKLM>\Software\Electronic Arts\EA Sports\FIFA 09\ergc]
  • [<HKLM>\SOFTWARE\Rockstar Games\Grand Theft Auto IV]
  • [<HKLM>\SOFTWARE\KONAMI\PES2009]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\Battlefield 2 Special Forces\ergc]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\Dead Space\ergc]
  • [<HKLM>\SOFTWARE\TechSmith\Camtasia Studio\4.0]
  • [<HKCU>\Software\Microsoft\MSNMessenger]
  • [<HKCU>\Software\mIRC]
  • [<HKCU>\Software\Valve\Steam]
  • [<HKLM>\SOFTWARE\Valve\Steam]
  • [<HKCU>\Software\Valve\Half-Life\Settings]
  • [<HKLM>\Software\Electronic Arts\EA Sports\FIFA 2002\ergc]
  • [<HKLM>\Software\Electronic Arts\EA Sports\FIFA 07\ergc]
  • [<HKLM>\Software\Electronic Arts\EA Sports\FIFA 08\ergc]
  • [<HKLM>\Software\Electronic Arts\EA Sports\FIFA 2005\ergc]
  • [<HKLM>\Software\Electronic Arts\EA Sports\FIFA 2003\ergc]
  • [<HKLM>\Software\Electronic Arts\EA Sports\FIFA 2004\ergc]
  • [<HKLM>\Software\TuneUp\Utilities\8.0]
  • [<HKLM>\Software\TuneUp\Utilities\7.0]
  • [<HKLM>\Software\Nullsoft\Winamp]
  • [<HKLM>\SOFTWARE\Electronic Arts\Sims\The Sims 2\ergc]
  • [<HKLM>\SOFTWARE\Electronic Arts\Sims\The Sims 3\ergc]
  • [<HKLM>\Software\TuneUp\Utilities\6.0]
  • [<HKLM>\Software\TexasCalc\License]
  • [<HKLM>\Software\TechSmith\SnagIt\8]
  • [<HKLM>\Software\Electronic Arts\EA Games\The Battle for Middle-earth]
  • [<HKLM>\Software\Pegasys Inc.\TMPGEnc DVD Author\1.0]
  • [<HKLM>\Software\Electronic Arts\EA Games\The Orange Box]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Family Fun Stuff\erg]
  • [<HKLM>\SOFTWARE\ACTIVISION\Call of Duty4]
  • [<HKLM>\SOFTWARE\ACTIVISION\Call of Duty2]
  • [<HKLM>\SOFTWARE\Valve\Half-Life\Settings]
  • [<HKLM>\SOFTWARE\Valve\CounterStrike\Settings]
  • [<HKLM>\SOFTWARE\Microsoft\Microsoft Games\Halo]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\Mirror's Edge\ergc ]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Nightlife\ergc]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Glamour Life Stuff\ergc]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Open For Business\ergc]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\SPORE(TM)\ergc ]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 University\ergc]
  • [<HKLM>\SOFTWARE\3d0\Status Legends of Might and Magic]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\Burnout Paradise]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\Boulder Dash Rocks]
  • [<HKLM>\SOFTWARE\Sunflowers\Anno 1701]
  • [<HKLM>\SOFTWARE\@stake\LC5\Registration]
  • [<HKLM>\SOFTWARE\ashampoo\Ashampoo WinOptimizer Platinum 3]
  • [<HKLM>\Software\Electronic Arts\Black and White 2]
  • [<HKLM>\SOFTWARE\Elcom\Advanced PDF Password Recovery Pro\Registration]
  • [<HKLM>\SOFTWARE\Elcom\Advanced PDF Password Recovery\Registration]
  • [<HKLM>\SOFTWARE\Elcom\Advanced ZIP Password Recovery\Registration]
  • [<HKLM>\Software\Electronic Arts\EA GAMES\Black and White]
  • [<HKLM>\Software\Electronic Arts\EA GAMES\Battlefield Vietnam]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 1942]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Command and Conquer Generals Zero Hour]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Generals]
  • [<HKLM>\SOFTWARE\Westwood\Red Alert 2]
  • [<HKLM>\SOFTWARE\Westwood\Tiberian Sun]
  • [<HKLM>\SOFTWARE\Westwood\Red Alert]
  • [<HKLM>\SOFTWARE\Codec Tweak Tool]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 1942 The Road to Rome]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 1942 Secret Weapons of WWII]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\Battlefield 2]
  • [<HKLM>\SOFTWARE\Techland\Chrome]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 2142]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Need For Speed Underground]
  • [<HKLM>\SOFTWARE\Electronic Arts\Electronic Arts\Need for Speed ProStreet]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\Need for Speed Underground 2]
  • [<HKLM>\SOFTWARE\Adobe\Golive\5.0\Registration]
  • [<HKLM>\SOFTWARE\SEGA\Medieval II Total War]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Need for Speed Most Wanted]
  • [<HKCU>\Software\IMVU\password]
  • [<HKCU>\Software\IMVU\username]
  • [<HKCU>\Software\FTPWare\COREFTP\Sites]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Need For Speed Hot Pursuit 2]
  • [<HKLM>\SOFTWARE\Electronic Arts\Electronic Arts\Need for Speed Carbon]
  • [<HKLM>\SOFTWARE\ahead\Installation\BAK\Nero 7\Info]
  • [<HKLM>\SOFTWARE\THQ\Dawn of War]
  • [<HKLM>\SOFTWARE\Activision\Call of Duty WAW]
  • [<HKLM>\SOFTWARE\THQ\Dawn of War - Dark Crusade]
  • [<HKLM>\SOFTWARE\Adobe\Photoshop\7.0\Registration]
  • [<HKLM>\SOFTWARE\ACD Systems\PicaView]
  • [<HKLM>\SOFTWARE\Activision\Call of Duty 4]
  • [<HKLM>\SOFTWARE\Ubisoft\Splinter Cell Chaos Theory\Keys]
  • [<HKLM>\SOFTWARE\Ubisoft\Splinter Cell Pandora Tomorrow]
  • [<HKLM>\SOFTWARE\Activision\Call of Duty]
  • [<HKLM>\SOFTWARE\Activision\Call of Duty 2]
  • [<HKLM>\SOFTWARE\Activision\Call of Duty United Offensive]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\FIFA 07]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2005]
  • [<HKLM>\SOFTWARE\Electronic Arts\Electronic Arts\FIFA 08]
  • [<HKLM>\SOFTWARE\THQ\Frontlines: Fuel of War Beta]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Distribution\Freedom Force]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2004]
  • [<HKLM>\SOFTWARE\CRYTEK\FARCRY\UBI.COM]
  • [<HKLM>\SOFTWARE\F-Secure\BackWeb\iLauncher]
  • [<HKLM>\SOFTWARE\CRYTEK\FARCRY2\UBI.COM]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2003]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2002]
  • [<HKLM>\SOFTWARE\THQ\Frontlines: Fuel of War]
  • [<HKLM>\SOFTWARE\Ahead\InCD]
  • [<HKLM>\SOFTWARE\IGI 2 Retail\CDKey]
  • [<HKLM>\SOFTWARE\JoWooD\InstalledGames\IG2]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\James Bond 007 Nightfire]
  • [<HKLM>\SOFTWARE\AVConverter\iPod Converter]
  • [<HKLM>\SOFTWARE\Illusion Softworks\Hidden & Dangerous 2]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Global Operations]
  • [<HKLM>\SOFTWARE\Headlight\GetRight]
  • [<HKLM>\SOFTWARE\Valve\Gunman]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\Hellgate: London]
  • [<HKLM>\SOFTWARE\Valve\Half-Life\Setting]
  • [<HKLM>\SOFTWARE\CyberLink\PowerProducer\3.0\UserReg]
  • [<HKLM>\SOFTWARE\Cyberlink\PowerBar]
  • [<HKLM>\SOFTWARE\Valve\Day of Defeat\Settings]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2]
  • [<HKLM>\SOFTWARE\Electronic Arts\Electronic Arts\The Battle for Middle-earth II]
  • [<HKLM>\SOFTWARE\Cyberlink\PowerDVD]
  • [<HKLM>\SOFTWARE\Electronic Arts\Electronic Arts\Command and Conquer 3]
  • [<HKLM>\SOFTWARE\Electronic Arts\Command and Conquer 3]
  • [<HKLM>\SOFTWARE\THQ\Company of Heroes]
  • [<HKLM>\SOFTWARE\Electronic Arts\Electronic Arts\Crysis]
  • [<HKLM>\SOFTWARE\Valve\Counter-Strike\Settings]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 University]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Family Fun Stuff]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 H M Fashion Stuff]
  • [<HKLM>\SOFTWARE\DVD Audio Extractor\Settings]
  • [<HKLM>\SOFTWARE\Sierra\CDKey]
  • [<HKLM>\SOFTWARE\Sierra\Empire Earth II]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Celebration Stuff]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Open For Business]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Nightlife]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Pets]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Glamour Life Stuff]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Seasons]
Modifies file system:
Creates the following files:
  • %HOMEPATH%\My Documents\Downloads\NetMeeting-crack.exe
  • %HOMEPATH%\My Documents\Downloads\Online Services-crack.exe
  • %HOMEPATH%\My Documents\Downloads\Outlook Express-crack.exe
  • %HOMEPATH%\My Documents\Downloads\MSBuild-crack.exe
  • %HOMEPATH%\My Documents\Downloads\MSN-crack.exe
  • %HOMEPATH%\My Documents\Downloads\MSN Gaming Zone-crack.exe
  • %HOMEPATH%\My Documents\Downloads\Windows NT-crack.exe
  • %HOMEPATH%\My Documents\Downloads\WindowsUpdate-crack.exe
  • %HOMEPATH%\My Documents\Downloads\xerox-crack.exe
  • %HOMEPATH%\My Documents\Downloads\Reference Assemblies-crack.exe
  • %HOMEPATH%\My Documents\Downloads\Uninstall Information-crack.exe
  • %HOMEPATH%\My Documents\Downloads\Windows Media Player-crack.exe
  • C:\Program Settings\winadmin-setup.exe
  • %HOMEPATH%\My Documents\Downloads\Common Files-crack.exe
  • %HOMEPATH%\My Documents\Downloads\ComPlus Applications-crack.exe
  • %HOMEPATH%\Templates\.exe
  • %HOMEPATH%\Templates\cdkeys.txt
  • \Device\LanmanRedirector\CRNJEUFU\Program Settings\winadmin-setup.exe
  • %HOMEPATH%\My Documents\Downloads\microsoft frontpage-crack.exe
  • %HOMEPATH%\My Documents\Downloads\Microsoft.NET-crack.exe
  • %HOMEPATH%\My Documents\Downloads\Movie Maker-crack.exe
  • %HOMEPATH%\My Documents\Downloads\FireFox-crack.exe
  • %HOMEPATH%\My Documents\Downloads\Internet Explorer-crack.exe
  • %HOMEPATH%\My Documents\Downloads\Messenger-crack.exe
Network activity:
Connects to:
  • 'localhost':445
Miscellaneous:
Searches for the following windows:
  • ClassName: 'VMDragDetectWndClass' WindowName: ''

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Free trial

 

Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

Free trial

 

Download Dr.Web

Download by serial number

Download on App Store

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

 

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

Free trial

14 days

Download now
Get it on Google Play