DeadEye
DeadEye or Dead Eye is a rogue application that uses scare tactics to coerce users into purchasing its "full version". DeadEye can be put into a victim's computer by a Trojan and then it will run if a Java Runtime Environment is present on the computer. If such an environment is not present then DeadEye will download a file called JRE.EXE from a remote server. Detect and remove DeadEye from an infected PC with a reliable anti-spyware application.
File System Details
DeadEye may create the following file(s):
| # | File Name |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|
| 1. | %SystemDir%\multiply.exe | |
| 2. | %SystemDir%\jre.exe | |
| 3. | %UserProfile%\Desktop\reg.exe | |
| 4. | %UserProfile%\Desktop\taskkill.exe | |
| 5. | %UserProfile%\Desktop\sc.exe | |
| 6. | %\Adobe\Brick\jre.exe | |
| 7. | %CommonProgramFiles%\Java\Update\jre.exe | |
| 8. | %ProgramFiles%\Adobe\Brick\jre.exe | |
| 9. | %SystemDir%\xseed.exe | |
| 10. | %SystemDir%\jreew.exe | |
| 11. | %UserProfile%\Desktop\pulist.exe | |
| 12. | %UserProfile%\Desktop\multiply.exe | |
| 13. | %UserProfile%\Desktop\svcagent.exe | |
| 14. | %UserProfile%\Desktop\jreew.exe | |
| 15. | %CommonProgramFiles%\Adobe\Brick\open.exe | |
| 16. | %CommonProgramFiles%\Java\Update\open.exe | |
| 17. | %UserProfile%\Start Menu\Programs\Startup\j.exe | |
| 18. | %SystemDir%\svcagent.exe | |
| 19. | %WinDir%\jreew.exe | |
| 20. | %UserProfile%\Desktop\install-jre.exe | |
| 21. | %UserProfile%\Desktop\open.exe | |
| 22. | %UserProfile%\Desktop\tasklist.exe | |
| 23. | %CommonProgramFiles%\Adobe\Brick\svcagent.exe | |
| 24. | %CommonProgramFiles%\Java\Update\multiply.exe | |
| 25. | %ProgramFiles%\Adobe\Brick\svchost.exe | |
| 26. | %WinDir%\Tasks\At2.job | |
| 27. | %UserProfile%\Desktop\set.cmd | |
| 28. | %UserProfile%\Desktop\autorun.inf | |
| 29. | %CommonProgramFiles%\Adobe\Brick\cp.cmd | |
| 30. | %CommonProgramFiles%”\Adobe\Brick\x.cmd | |
| 31. | %CommonProgramFiles%\Adobe\Brick\A.log | |
| 32. | %CommonProgramFiles%\Java\Update\ver.cmd | |
| 33. | %WinDir%\Tasks\At1.job | |
| 34. | %UserProfile%\Desktop\cp.cmd | |
| 35. | %UserProfile%\Desktop\x.cmd | |
| 36. | %CommonProgramFiles%\Adobe\Brick\x.jar | |
| 37. | %CommonProgramFiles%\Adobe\Brick\ver.cmd | |
| 38. | %CommonProgramFiles%\Adobe\Brick\service.log | |
| 39. | %CommonProgramFiles%\Java\Update\set.cmd | |
| 40. | %CommonProgramFiles%\Java\Update\autorun.inf | |
| 41. | %SystemDir%\xs | |
| 42. | %WinDir%\Tasks\At3.job | |
| 43. | %UserProfile%\Desktop\ver.cmd | |
| 44. | %CommonProgramFiles | |
| 45. | %CommonProgramFiles%\Adobe\Brick\set.cmd | |
| 46. | %CommonProgramFiles%”\Adobe\Brick\autorun.inf | |
| 47. | %CommonProgramFiles%\Java\Update\cp.cmd | |
| 48. | %CommonProgramFiles%\Java\Update\x.cmd |
Registry Details
DeadEye may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\svcagent\Enum
HKEY_USERS\S-1-5-21-1004336348-1326574676-839522115-1003\Software\JavaSoft\Java2D
HKEY_USERS\S-1-5-21-1004336348-1326574676-839522115-1003\Software\JavaSoft\Java2D\1.6.0_06\Drivers\.DISPLAY1 VMware SVGA II
Xseed = "xseed.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\svcagent\Security
HKEY_USERS\S-1-5-21-1004336348-1326574676-839522115-1003\Software\JavaSoft
HKEY_USERS\S-1-5-21-1004336348-1326574676-839522115-1003\Software\JavaSoft\Java2D\1.6.0_06\Drivers
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\svcagent
HKEY_USERS\S-1-5-21-1004336348-1326574676-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKEY_USERS\S-1-5-21-1004336348-1326574676-839522115-1003\Software\JavaSoft\Java2D\1.6.0_06
HKEY_USERS\S-1-5-21-1004336348-1326574676-839522115-1003\Software\JavaSoft\Java2D\1.6.0_06\Drivers\.DISPLAY1 VMware SVGA II\32
Xseed = "xseed.exe" Multiply= "%CommonProgramFiles%\Java\Update\multiply.exe"
