{"id":161935,"date":"2010-01-09T02:15:00","date_gmt":"2010-01-09T06:15:00","guid":{"rendered":"tag:blogger.com,1999:blog-7196788127833928948.post-1752415853877486963"},"modified":"2010-01-09T02:15:00","modified_gmt":"2010-01-09T06:15:00","slug":"protecting-from-the-ccenter-malware-and-trojan","status":"publish","type":"post","link":"https:\/\/mereja.media\/index\/161935","title":{"rendered":"Protecting from the CCenter Malware and Trojan"},"content":{"rendered":"

A very common method of distributing malware<\/span> is disguising it as a useful program. Most common disguises, apart from games are ‘malware<\/span> removal programs’. This is the approach used by CCenter<\/span> <\/span>a.k.a. Control Center.<\/p>\n

If you find a process with the name ccenter<\/span>.exe<\/span><\/span> running on your pc<\/span> means that your pc<\/span> has possibly been infected with a trojan<\/span> known as infostealer.lemir.h.
<\/span>Infostealer.Lemir.H is a Trojan horse program that attempts to steal passwords for the Legend of Mir 2 online game, but can be modified to steal other information.<\/p>\n

\"\"<\/a><\/p>\n

<\/strong><\/p>\n

Apart from installing a trojan<\/span>, CCenter<\/span> intimidates people into buying the paid version of this program. Once it\u2019s installed CCenter<\/span> loads an imitation of system scan every time a computer is started. It also generates large amounts of counterfeit security alerts. All these alerts are designed only to trick people into taking the program as a legitimate and reputable tool. If clicked upon, the pop-ups demand paying for using CCenter<\/span>. <\/p>\n

CCenter<\/span> has also been seen to redirect the web browser to malicious and fraudulent websites. Depending on version and programmer skill, it may also disable reputable security programs leaving the compromised machine open to future attacks.<\/p>\n

Here are the steps to manually remove CCenter<\/span> <\/span><\/p>\n

    \n
  1. Use “Add or Remove Programs” to remove the installation. However bear in mind that there may be hidden CCenter<\/span> files, running processes and registries in your computer, so CCenter<\/span> may recreate all other files after reboot.<\/li>\n
  2. Stop and remove CCenter<\/span> processes:<\/li>\n
      \n
    • ccagent<\/span>.exe<\/span><\/li>\n
    • ccmain<\/span>.exe<\/span><\/li>\n
    • uninstall<\/span>.exe<\/span><\/li>\n<\/ul>\n
    • Find and delete all CCenter<\/span> files found in %AppData<\/span>%\\CCenter<\/span>\\ccagent<\/span>.exe<\/span><\/li>\n<\/ol>\n

      There are other similar Malware<\/span> programs in the wild. We will cover them in the following articles.<\/p>\n

      Talkback<\/span> and comments are most welcome <\/p>\n

      <\/div>\n

      <\/p>\n","protected":false},"excerpt":{"rendered":"

      A very common method of distributing malware is disguising it as a useful program. Most common disguises, apart from games are ‘malware removal programs’. This is the approach used by CCenter a.k.a. Control Center. If you find a process with the name ccenter.exe running on your pc means that your pc has possibly been infected […]<\/p>\n","protected":false},"author":5679,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"class_list":["post-161935","post","type-post","status-publish","format-standard","hentry","category-news"],"_links":{"self":[{"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/posts\/161935","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/users\/5679"}],"replies":[{"embeddable":true,"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/comments?post=161935"}],"version-history":[{"count":0,"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/posts\/161935\/revisions"}],"wp:attachment":[{"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/media?parent=161935"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/categories?post=161935"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/tags?post=161935"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}