[Warning] Detected malicious file disguised as a "ALYAC" file

1. Introduction

Emerging malicious file disguised as "ALYAC", free Anti-Virus software, from ESTsoft make user special attention for whom especially using this "ALYAC".
Since this malicious file has similar icon and description, general user can be easily infected.

To prevent from those malicious files, spend some times to maintain about your PC's availability.

In case of being found malicious file disguised as "ALYAC" at 3.3 DDoS, it doesn't have DDoS function, however, lately found malicious file contains DDoS function.

2. Spreading path and symptoms of infection

First of all, recently found malicious file, known as spreading from following URL, can also be spread as an attachment of e-mail.

* Malicious file disguised "ALYAC" spreading path(Currently not available.)

- http://(~~).info/(~~)/100.exe

Actually first distributed URL is found from United Kingdom. But with some reasons including manual written in Korean, we can expect that the developer chose UK as a first distribute place.

After downloading and installation, it removes itself, makes clone to this following path, and configures always running while Internet Explorer is being run.

* Generated file
- C:\Documents and Settings\explorerere.exe (52,224 bytes)

* Registers registry value
- [HKLM\SYSTEM\CurrentControlSet\Services\zvwerqt]
- Name : ImagePath
- Data : "C:\Documents and Settings\explorerere.exe

Generated copy continuously tries to access this following URL, and can download additional malicious file. In addition, we expect that generated malicious file can perform as a Backdoor and Bot on registered service level. Currently additional analysis is on the way.

It forged not only the icon but description of "ALYAC". To inspect it deeply, however, you can distinguish between normal and forged description.

                     <Malicious file>                                                      <Normal file>

You can find this difference between malicious and normal file on looking up that red box above.

* Difference

- Normal file : Describes modules' function in "ALYAC"
- Malicious file : Describes function in "ALYAC"

In addition, it can send GET Packet to certain destination continuously with using "GET Flooding" technique, one of DDoS attacking methods.

3. How to prevent

General user can download without doubt. If infected, it can make a lot of zombie PC. Therefore, to use PC safely from security threats of these malicious attachments, we recommend following "Security management tips" for general users.

Security management tips

1. Maintain the latest security update on OS and applications
2. Use anti-virus SW from believable security company and keep updating the latest engine and using real time detecting function
3. Do not see and download attached file from suspicious e-mail.
4. Keep caution to link from instant messenger and SNS.

INCA Internet (Security Response Center / Emergency Response Team) provides diagnosis/treatment function with nProtect Mobile for Android for mobile such as malicious file stated above and runs responding system against various security threats.


  1. Some of the best apps for college you will definitely write the best looking essay in the world or at least in the class. This could save you in the future

  2. I am looking some reviews about ALYAC anyone can tell me how is ALYAC free Anti-Virus software? I have to Do My Dissertation For Me and I have to describe about Anti-Virus which is the best Anti-Virus in 2019.

  3. Excellent information on your blog, thank you for taking the time to share with us. Amazing insight you have on this, it's nice to find a website that details so much information about different artists.
    visit here:- dissertation help service

  4. Was really a great part of information about detected malicious file disguised as a "ALYAC" file but more can be found on ebizzing with much more relevant topics to this are explained in short.

  5. This comment has been removed by the author.

  6. Pretty! This has been a really wonderful article. Thank you for supplying this information.