The Mudcat Café TM
Thread #108023   Message #2244315
Posted By: JohnInKansas
25-Jan-08 - 06:08 AM
Thread Name: BS: Nasty Virus - Hackers.KeyGen
Subject: RE: BS: Nasty Virus - Hackers.KeyGen
See: Wiki on keygen

Stilly -

The list of files you see in the registry keys exchanged at your link are not "all the programs he has installed." They are the log of all the programs that his system has opened since the last boot. The list tells you what's running, but there may be lots of other programs onboard.

A keygen is a program for "generating" a "key" to unlock programs. The only common uses for such a program are to (illegally usually) use programs that require "validation" by a manufacturer – by entering a registration number or "key" – before the program runs.

The keygen is NOT A VIRUS. It's a program that you install.

A keygen could be part of a payload carried by a virus, and anyone who didn't install one on purpose probably would want it removed, along with the virus that may have installed it.

Malicious sources/sites may also include a virus with, or as part of, a phony keygen, with the usual result that the keygen fails to unlock the program for which it is advertised, but installs the virus or other malware when run. Since keygen users usually are involved in questionable, if not illegal, activity, this is a fairly "safe" method of distributing viral or malware components for those inclined to do so, and it's not uncommon.

If a viral component is present, it can of course be passed to other computers, and may take the keygen program, or fragments of one, with it.

The two registry logging keys posted both show evidence of deliberate "file sharing," (from share setups common only for allowing others to access folders and upload/download from them) and people who trade (DRM containing) files are likely to intentionally have keygen programs for "unlocking" DVDs and/or CDs. Evidence is that such persons are also much more likely to use "counterfeit" programs of other kinds.

In essence, your "Googling" for anti-malware help, instead of consulting known and recognized AV and anti malware resources, have shown you a tiny bit of the criminal side of the internet.

It's not surprising that you found a lot of "gobbledygook" as practitioners of the "cracking" avocation are prone to the use of "jargon" that's largely incomprehensible to "real people." A high incidence of foreign language sites is also an expected result, since much of this stuff originates in countries that have no laws against piracy, or who almost never enforce laws they have. Long strings of dissociated words are used to increase search engine hits, since there is some risk to openly advertising the sites most intimately involved in this kind of activity. Some of the "random words" are recognized "jargon" associated with the practices of the sites.

Norton and other AV programs may report a virus name and also the name of an infected file. Rarely a file may be quarantined because it contains a "looks like a virus" content, but no specific virus can be identified, in which case you could get only the filename. A quarantined file is "off the machine" for all practical purposes' but by keeping it in quarantine you have a "diagnostic aid" for identifying what needs to be replaced/restored if a program you want to use is affected. A virus that can be deleted usually is just deleted. A file that contains a virus, but where the viral content can be removed without damage to the normal functions of the file, will be "cleaned" and will not (by most AVs) be quarantined.

Since an infected file (that can't be cleaned) may be a program that you intended to have on your computer, searching for that filename will seldom return anything at AV sites. If a virus is known to be associated with, and to infect particular files, when you search for the virus name instructions for removal are likely to tell you what files are likely to be infected and should be removed. Since keygens, with a variety of names, are "real programs" you will not be likely to find them at AV sites by their file names.

John