Hacktool.Amac

SUMMARY

Behavior

Hacktool.Amac is a program that scans all the IP addresses on a given network and returns the MAC address of the computer associated with that IP address. It can also change the MAC address of the computer it is installed on.

Protection

• Initial Rapid Release version February 22, 2006
• Latest Rapid Release version pending
• Initial Daily Certified version February 22, 2006
• Latest Daily Certified version February 22, 2006
• Initial Weekly Certified release date February 22, 2006

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

TECHNICAL DETAILS

Hacktool.Amac is a program that scans all the IP addresses on a given network and returns the MAC address of the computer associated with that IP address. It can also change the MAC address of the computer it is installed on.

When the program is installed, it creates the following files:
%ProgramFiles%\PaqTool\amac\afaq.htm
%ProgramFiles%\PaqTool\amac\amac.exe
%ProgramFiles%\PaqTool\amac\faq.htm
%ProgramFiles%\PaqTool\amac\pamq.dll
%ProgramFiles%\PaqTool\amac\PaqBonus.exe
%ProgramFiles%\PaqTool\amac\unins000.dat
%ProgramFiles%\PaqTool\amac\unins000.exe
%ProgramFiles%\PaqTool\amac\wakeup.exe
%ProgramFiles%\PaqTool\amac\winping.exe
%System%\hdvirffo.dll
%UserProfile%\Desktop\a-Mac Address Change.lnk
%UserProfile%All Users\Start Menu\Programs\Amac Address Change\a-Mac Address Change.lnk
%UserProfile%All Users\Start Menu\Programs\Amac Address Change\Uninstall a-Mac Address Change.lnk

The program then creates the following registry subkeys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\A-Mac Address Change_is1
HKEY_LOCAL_MACHINE\SOFTWARE\dapcama

The program can modify the current computers MAC address and scan all IP addresses on the network and return their associated MAC addresses.