arrow_back
search
close

PUA_ADKEYLOGGER.GA

May 17, 2017
 Analysis by: Marvelous Pelin
 ALIASES:

Win64/KeyLogger.Conexant.A potentially unsafe(ESET-NOD32)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Potentially Unwanted Application

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Manually installed by user


This Potentially Unwanted Application may be manually installed by a user.

This is the Trend Micro detection for files that exhibit certain behaviors. It takes advantage of certain vulnerabilities.

  TECHNICAL DETAILS

File Size:

11,289,176 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

12 May 2017

Arrival Details

This Potentially Unwanted Application may be manually installed by a user.

Other Details

This is the Trend Micro detection for:

  • Audio drivers that are capable of logging keystrokes in an affected system. A flaw on the way the application handles inputs may result to capturing of the user input into a log file which may lead to stolen data. These drivers may be initially installed on an affected system.

It takes advantage of the following vulnerabilities:

NOTES:

It saves the logged keystrokes into the following log file:

  • %System Roo%\Users\Public\MicTray.log

    •   SOLUTION

    Minimum Scan Engine:

    9.850

    Step 1

    Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

    Step 2

    Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

    Step 3

    Search and delete these files

    [ Learn More ]
    There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.  
    • %System Roo%\Users\Public\MicTray.log

    Step 4

    Scan your computer with your Trend Micro product to delete files detected as PUA_ADKEYLOGGER.GA. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


    Did this description help? Tell us how we did.