Gen.Trojan.Heur.Hype.YrWaydRRYli_e626097205 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

GoogleUpdateSetup.exe:1352
%original file name%.exe:1104

The Trojan injects its code into the following process(es):

fGAwoYMM.exe:792
reIEcoQI.exe:644
NesIMIQs.exe:544

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process GoogleUpdateSetup.exe:1352 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\GUM1.tmp\goopdateres_en.dll (37 bytes)
%Program Files%\GUM1.tmp\psuser_64.dll (188 bytes)
%Program Files%\GUM1.tmp\goopdateres_ur.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_ml.dll (41 bytes)
%Program Files%\GUM1.tmp\goopdateres_sl.dll (39 bytes)
%Program Files%\GUM1.tmp\goopdateres_ca.dll (39 bytes)
%Program Files%\GUM1.tmp\goopdateres_ta.dll (40 bytes)
%Program Files%\GUT2.tmp (45823 bytes)
%Program Files%\GUM1.tmp\goopdateres_es-419.dll (39 bytes)
%Program Files%\GUM1.tmp\GoogleUpdateOnDemand.exe (52 bytes)
%Program Files%\GUM1.tmp\goopdateres_sr.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_hi.dll (38 bytes)
%Program Files%\GUM1.tmp\GoogleCrashHandler64.exe (550 bytes)
%Program Files%\GUM1.tmp\goopdateres_en-GB.dll (37 bytes)
%Program Files%\GUM1.tmp\goopdateres_zh-CN.dll (32 bytes)
%Program Files%\GUM1.tmp\goopdateres_ko.dll (34 bytes)
%Program Files%\GUM1.tmp\goopdateres_de.dll (40 bytes)
%Program Files%\GUM1.tmp\goopdateres_pt-PT.dll (39 bytes)
%Program Files%\GUM1.tmp\goopdateres_fa.dll (37 bytes)
%Program Files%\GUM1.tmp\npGoogleUpdate3.dll (1126 bytes)
%Program Files%\GUM1.tmp\psmachine.dll (165 bytes)
%Program Files%\GUM1.tmp\goopdateres_pt-BR.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_id.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_th.dll (37 bytes)
%Program Files%\GUM1.tmp\GoogleUpdateBroker.exe (52 bytes)
%Program Files%\GUM1.tmp\goopdateres_cs.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_uk.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_tr.dll (38 bytes)
%Program Files%\GUM1.tmp\psmachine_64.dll (188 bytes)
%Program Files%\GUM1.tmp\goopdateres_hu.dll (39 bytes)
%Program Files%\GUM1.tmp\goopdateres_es.dll (40 bytes)
%Program Files%\GUM1.tmp\goopdateres_bn.dll (39 bytes)
%Program Files%\GUM1.tmp\goopdateres_el.dll (40 bytes)
%Program Files%\GUM1.tmp\goopdateres_ms.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_ja.dll (35 bytes)
%Program Files%\GUM1.tmp\GoogleUpdate.exe (107 bytes)
%Program Files%\GUM1.tmp\goopdateres_fil.dll (39 bytes)
%Program Files%\GUM1.tmp\goopdateres_nl.dll (39 bytes)
%Program Files%\GUM1.tmp\goopdate.dll (3850 bytes)
%Program Files%\GUM1.tmp\goopdateres_no.dll (38 bytes)
%Program Files%\GUM1.tmp\GoogleUpdateWebPlugin.exe (52 bytes)
%Program Files%\GUM1.tmp\goopdateres_ro.dll (39 bytes)
%Program Files%\GUM1.tmp\goopdateres_mr.dll (39 bytes)
%Program Files%\GUM1.tmp\GoogleCrashHandler.exe (232 bytes)
%Program Files%\GUM1.tmp\goopdateres_bg.dll (39 bytes)
%Program Files%\GUM1.tmp\goopdateres_lv.dll (39 bytes)
%Program Files%\GUM1.tmp\goopdateres_da.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_it.dll (40 bytes)
%Program Files%\GUM1.tmp\goopdateres_te.dll (40 bytes)
%Program Files%\GUM1.tmp\psuser.dll (165 bytes)
%Program Files%\GUM1.tmp\goopdateres_am.dll (37 bytes)
%Program Files%\GUM1.tmp\goopdateres_is.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_fr.dll (40 bytes)
%Program Files%\GUM1.tmp\goopdateres_sw.dll (40 bytes)
%Program Files%\GUM1.tmp\goopdateres_pl.dll (39 bytes)
%Program Files%\GUM1.tmp\goopdateres_et.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_vi.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_lt.dll (38 bytes)
%Program Files%\GUM1.tmp\GoogleUpdateComRegisterShell64.exe (115 bytes)
%Program Files%\GUM1.tmp\goopdateres_sv.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_ar.dll (36 bytes)
%Program Files%\GUM1.tmp\goopdateres_iw.dll (36 bytes)
%Program Files%\GUM1.tmp\GoogleUpdateHelper.msi (28 bytes)
%Program Files%\GUM1.tmp\goopdateres_ru.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_kn.dll (40 bytes)
%Program Files%\GUM1.tmp\goopdateres_gu.dll (40 bytes)
%Program Files%\GUM1.tmp\GoogleUpdateSetup.exe (6841 bytes)
%Program Files%\GUM1.tmp\goopdateres_fi.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_hr.dll (39 bytes)
%Program Files%\GUM1.tmp\goopdateres_zh-TW.dll (32 bytes)
%Program Files%\GUM1.tmp\goopdateres_sk.dll (38 bytes)

The Trojan deletes the following file(s):

%Program Files%\GUM1.tmp (0 bytes)

The process fGAwoYMM.exe:792 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (11518 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (7385 bytes)
C:\totalcmd\TOTALCMD.EXE.exe (35505 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (7385 bytes)
C:\totalcmd\TCMADMIN.EXE.exe (7433 bytes)
C:\totalcmd\TCUNINST.EXE.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\KAAo.txt (55978 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (7385 bytes)
C:\totalcmd\TcUsbRun.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (7433 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (7433 bytes)
C:\totalcmd\TCMDX32.EXE.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (7971 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (10177 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (7385 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp (0 bytes)
C:\totalcmd\TOTALCMD.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp (0 bytes)
C:\totalcmd\TCUNINST.EXE (0 bytes)
C:\totalcmd\TCMDX32.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp (0 bytes)
C:\totalcmd\TCMADMIN.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg (0 bytes)

The process %original file name%.exe:1104 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe (7785 bytes)
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe (7761 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OCEoAcII.bat (4 bytes)
%Documents and Settings%\All Users\JuwEIgUE\reIEcoQI.exe (7737 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GoogleUpdateSetup.exe (6321 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OCEoAcII.bat (0 bytes)

Registry activity

The process GoogleUpdateSetup.exe:1352 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6A 55 E7 9C 8D D6 50 1E 27 2F B2 AF 38 D0 9E 80"

The process fGAwoYMM.exe:792 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0B 26 EA EC F2 A1 4F F8 14 52 9B 8D C7 56 FA 0D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"fGAwoYMM.exe" = "%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe"

The process reIEcoQI.exe:644 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0F EE 7A 55 E7 74 F9 F6 8B 87 91 08 95 DB DD 54"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"

The process NesIMIQs.exe:544 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AA 56 AD 5A 1F 2B B5 13 C4 02 D0 33 83 65 93 AD"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"

The process %original file name%.exe:1104 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "03 06 4E C6 2C 4F 4D 79 B6 74 9A AA A0 45 CD AC"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"fGAwoYMM.exe" = "%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe"

The Trojan adds the reference to itself to be executed when a user logs on:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe,%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe,"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"

Dropped PE files

MD5	File path
ac4f8e9ef02b7b4c8f7a20cacdd35011	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
dd71fac606bb622cf80964eec7e697db	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
caae89e7a4c83bf3330c6c66d5455d45	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
341d040f965c67ec6b4aa6d5bc2ea3ac	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
d6c196260d05d8ad077cc32fe0085759	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
2612d82593be1dfb030ef88235b6e51a	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
63750da0ae453ae222e095d108497f6f	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
4253dfe1105fd1d6c13dc6d9441f9df7	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
72bff44229479fca33f8f521c8973a3d	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
9a09cebe3841f95829fe7fa94301826d	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
aa88fb8b7d7d58d1d3d08370c78c5922	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
a1f72e023a10655dddd9321e06be27a1	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
50bb9df91857a2ee608496ba86813c80	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
d4a6bed2c15df281a25ddbde035512a8	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
34139268a3f422cbf3452f748ba1d535	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
2e686a1275d55684b254f2de95a9c44c	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
1c64461b7738f57f6a829fe305a3c086	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
beedebb6b9f65edbc82610f023d6b28a	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
af7632b1131b2f4fdd516d784e832605	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
2a43a5006c66b99bceda9a27e72f741a	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
89c6967fedf55db37fd4d265a091a13c	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
70c7b4d04c863fec7401bcce50608ec2	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
61fcd1a6ad66c348c89f7af7fb4fcee6	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
d7f21bd2c6cd0dc9ec29d3c5b29c78fe	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe
e15f29714601bd3ffb5a343a4705236c	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
baf5081d140d3278c0fe48a617194c2c	c:\Documents and Settings\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
ffd66395092345bef14460297f262c46	c:\Documents and Settings\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
cd25410a2857e8eafe7fcda898030f08	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
7243cda9a22e14d803fe154b8e030e44	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
fe90441d004591eeae365945f8b71a8d	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
82eeb3736fefefa72ee20f3601898453	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
c35d93034b1f2755d4dc1ca583a077f6	c:\Documents and Settings\All Users\JuwEIgUE\reIEcoQI.exe
15cd2c95caec974e437ed9c5a1b06c5c	c:\Documents and Settings\All Users\hcYYccwo\NesIMIQs.exe
7ca00a58aa808f4b9844c91845910377	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GoogleUpdateSetup.exe
a08928e83d45e4ab71f38f7c420fbb8f	c:\Documents and Settings\"%CurrentUserName%"\dUskcAww\fGAwoYMM.exe
9daac0e3e19e85bed2d91b0f7ae25705	c:\Perl\eg\IEExamples\ie_animated.gif.exe
4596d27214eb54eedc16152d3f3eacfa	c:\Perl\eg\IEExamples\psbwlogo.gif.exe
b70a497e8588116a87592e94b5696b47	c:\Perl\eg\aspSamples\ASbanner.gif.exe
5fa9909cecf73d69298d4190381037b1	c:\Perl\eg\aspSamples\Main_Banner.gif.exe
eb72b28366d3fd95a5d0ccbb78bbf242	c:\Perl\eg\aspSamples\psbwlogo.gif.exe
63427d4da5fa98ea6e0efb3fc97f3fed	c:\Perl\html\images\AS_logo.gif.exe
c298f9028f80579cfc6e56b5134af8a9	c:\Perl\html\images\PerlCritic_run.png.exe
ed04ee7dde92fc170b2682b5baff770e	c:\Perl\html\images\aslogo.gif.exe
814125b2f82984406505f1560723ad7f	c:\Perl\html\images\ppm_gui.png.exe
83a1b8c178b6e38e7531e19878d84388	c:\Perl\lib\ActivePerl\PPM\images\gecko.png.exe
57f845abc14bc4eefade81664f215265	c:\Perl\lib\ActivePerl\PPM\images\perl_48x48.png.exe
cf57d19b537451cd9c6780d3218cf9e8	c:\Perl\lib\Devel\NYTProf\js\asc.png.exe
1883830c63fa643f7af4255bc5bb67a9	c:\Perl\lib\Devel\NYTProf\js\bg.png.exe
d2cfea42c5bbc19afca071ccd14df802	c:\Perl\lib\Devel\NYTProf\js\desc.png.exe
f85dd72e7491320e303753c2f4b146d4	c:\Perl\lib\Devel\NYTProf\js\jit\gradient.png.exe
116419669b2eb352a35720371b3bd749	c:\Perl\lib\Devel\NYTProf\js\jit\gradient20.png.exe
7fe99537649092202aa6616fdc050b87	c:\Perl\lib\Devel\NYTProf\js\jit\gradient30.png.exe
25516f88267881cbf3a19cbf7eeef56e	c:\Perl\lib\Devel\NYTProf\js\jit\gradient40.png.exe
93f7fad99efc2f6a3852afac4581e011	c:\Perl\lib\Devel\NYTProf\js\jit\gradient50.png.exe
892390433aa7654bbd63be26a4627791	c:\Perl\lib\Mozilla\CA\cacert.pem.exe
83bb030c71c9727dcfb2737005772c4e	c:\Program Files\GUM1.tmp\GoogleCrashHandler.exe
323cfffdaf253ac65cd194a101be6231	c:\Program Files\GUM1.tmp\GoogleCrashHandler64.exe
e1b44a75947137f4143308d566889837	c:\Program Files\GUM1.tmp\GoogleUpdate.exe
4c02536f4ca35911fb3ea5715f300c57	c:\Program Files\GUM1.tmp\GoogleUpdateBroker.exe
f3b6470da7ce34e559d3ba7365cc909c	c:\Program Files\GUM1.tmp\GoogleUpdateComRegisterShell64.exe
fd98434b6a06fe31a35e4bfbc827b290	c:\Program Files\GUM1.tmp\GoogleUpdateOnDemand.exe
7ca00a58aa808f4b9844c91845910377	c:\Program Files\GUM1.tmp\GoogleUpdateSetup.exe
5f0a3aa68785c49454f56c9f2dda0237	c:\Program Files\GUM1.tmp\GoogleUpdateWebPlugin.exe
5c2593649cf4fe6b9ed6f9a734dbf344	c:\Program Files\GUM1.tmp\goopdate.dll
7d81b54a30e726aaa71aa3623d73b3da	c:\Program Files\GUM1.tmp\goopdateres_am.dll
6038701a5f26f5753e1b8732b2f330bf	c:\Program Files\GUM1.tmp\goopdateres_ar.dll
5cdb279660719f50b5fbbcc02d5960ab	c:\Program Files\GUM1.tmp\goopdateres_bg.dll
971505410e9d0e478819cb0827c29003	c:\Program Files\GUM1.tmp\goopdateres_bn.dll
6c74c327f8a83049694a61ff58e8bef1	c:\Program Files\GUM1.tmp\goopdateres_ca.dll
9eb5998e1281e7ee5d3790ed85dd2f56	c:\Program Files\GUM1.tmp\goopdateres_cs.dll
5dacb582c8460937acec68dfb5b45bfb	c:\Program Files\GUM1.tmp\goopdateres_da.dll
b58a0f9c6101df8ad5cef2676ffd50fd	c:\Program Files\GUM1.tmp\goopdateres_de.dll
276f03206822ef47412678e845ff8767	c:\Program Files\GUM1.tmp\goopdateres_el.dll
18d4bd259cc873e9b3ff4914da172907	c:\Program Files\GUM1.tmp\goopdateres_en-GB.dll
0e16a89d13777ed360969f8064b83864	c:\Program Files\GUM1.tmp\goopdateres_en.dll
249d0dd0b8604b8dc91eca65de5b6561	c:\Program Files\GUM1.tmp\goopdateres_es-419.dll
989eb0563f1ff84edb2bb7f5d0caef3c	c:\Program Files\GUM1.tmp\goopdateres_es.dll
8376de3f4ae6c65fe95329c363c9cdff	c:\Program Files\GUM1.tmp\goopdateres_et.dll
0fc560f4d735c5ebdff0813c31755d60	c:\Program Files\GUM1.tmp\goopdateres_fa.dll
4214765994eea6c441bcf3fbc21d00d7	c:\Program Files\GUM1.tmp\goopdateres_fi.dll
6411443a52288be615738674cfa126ae	c:\Program Files\GUM1.tmp\goopdateres_fil.dll
8e04db132c564e76971aaf8cfb9fce96	c:\Program Files\GUM1.tmp\goopdateres_fr.dll
ce5b672b309103f47af1460f6565883e	c:\Program Files\GUM1.tmp\goopdateres_gu.dll
60b8795924463ade303c092dc02be055	c:\Program Files\GUM1.tmp\goopdateres_hi.dll
6887c86b15606714fa83f2de91d8c11e	c:\Program Files\GUM1.tmp\goopdateres_hr.dll
1de96e0e4b45fc210d7c5b60416e4da4	c:\Program Files\GUM1.tmp\goopdateres_hu.dll
c05c12fa8c0e3bbce8ae3869055f8ca7	c:\Program Files\GUM1.tmp\goopdateres_id.dll
e51a34d003235192c93cc4e44775951a	c:\Program Files\GUM1.tmp\goopdateres_is.dll
77f46c11174c4980789255f099402f51	c:\Program Files\GUM1.tmp\goopdateres_it.dll
ce5c9ac64274aef565162bf1fc9e3242	c:\Program Files\GUM1.tmp\goopdateres_iw.dll
d9f0eb11cb71e0911caf44b4ea0856be	c:\Program Files\GUM1.tmp\goopdateres_ja.dll
ea9c0aa9c317dec2054a3a6dcaad9398	c:\Program Files\GUM1.tmp\goopdateres_kn.dll
a1a1bead7907c3058be9b9ff6fdf80d4	c:\Program Files\GUM1.tmp\goopdateres_ko.dll
0a2b929ffe5e40ade35478f459567130	c:\Program Files\GUM1.tmp\goopdateres_lt.dll
42fc026314618e172ec96195a2cebef8	c:\Program Files\GUM1.tmp\goopdateres_lv.dll
325750335f89997558aac37f039d7dba	c:\Program Files\GUM1.tmp\goopdateres_ml.dll
557b752a331ca5a6e6cca898c2ffe2ad	c:\Program Files\GUM1.tmp\goopdateres_mr.dll
eaf0e2fce930bff40118584566d7ad04	c:\Program Files\GUM1.tmp\goopdateres_ms.dll
8129c53643b8012ae9252122d10f6eb0	c:\Program Files\GUM1.tmp\goopdateres_nl.dll
a8298aec52704ece20c4457670af4d8e	c:\Program Files\GUM1.tmp\goopdateres_no.dll
b65fadc80dad2f6ca1e0c4947e20390b	c:\Program Files\GUM1.tmp\goopdateres_pl.dll
b21a176efe46c16a07e9c146544cc99f	c:\Program Files\GUM1.tmp\goopdateres_pt-BR.dll
c00ac3b8058a4fc2fff4f64dee03532b	c:\Program Files\GUM1.tmp\goopdateres_pt-PT.dll
1c433621eb86b4dee051b0fc25207d02	c:\Program Files\GUM1.tmp\goopdateres_ro.dll
53157ee06503b7204509571fa27a4a84	c:\Program Files\GUM1.tmp\goopdateres_ru.dll
d91d322bb70222be355d8846e66ee940	c:\Program Files\GUM1.tmp\goopdateres_sk.dll
58ab869af216f5e722d37930e4937363	c:\Program Files\GUM1.tmp\goopdateres_sl.dll
00dc6068355939ff8e028a906ef00458	c:\Program Files\GUM1.tmp\goopdateres_sr.dll
73c6820a1943e7965084093f29f8f0e1	c:\Program Files\GUM1.tmp\goopdateres_sv.dll
2ed4747202bd370ed9091297789f8112	c:\Program Files\GUM1.tmp\goopdateres_sw.dll
12aa06d1d43cf2dc4bf9a440c03e9fb0	c:\Program Files\GUM1.tmp\goopdateres_ta.dll
92080b65bea279b768a595cc3f491994	c:\Program Files\GUM1.tmp\goopdateres_te.dll
d6140d394b955117e5a331be3582477e	c:\Program Files\GUM1.tmp\goopdateres_th.dll
21edce3e2260eab2a566b8c0af179457	c:\Program Files\GUM1.tmp\goopdateres_tr.dll
4262e0322f37b3641d4c9d66e4bf12ab	c:\Program Files\GUM1.tmp\goopdateres_uk.dll
199cd4d739119b4339bd7ee0777aa4be	c:\Program Files\GUM1.tmp\goopdateres_ur.dll
89602c37901be0fc0111635742dcee63	c:\Program Files\GUM1.tmp\goopdateres_vi.dll
49118a53f59666aa2f27af738830d767	c:\Program Files\GUM1.tmp\goopdateres_zh-CN.dll
1dc933edeba5dac5e4275d655203a66b	c:\Program Files\GUM1.tmp\goopdateres_zh-TW.dll
98137411b9c632095f919e2ce70b288a	c:\Program Files\GUM1.tmp\npGoogleUpdate3.dll
fff2c9ba6ab0c6f3a290cd3fbcbdf3c0	c:\Program Files\GUM1.tmp\psmachine.dll
c51c9b677c0bf6651b4d0aee60e005a7	c:\Program Files\GUM1.tmp\psmachine_64.dll
580930fd62744f10fcdd5375e201beea	c:\Program Files\GUM1.tmp\psuser.dll
821cc209d61d0ed1f4c86abe0c8a1319	c:\Program Files\GUM1.tmp\psuser_64.dll
c036cb2af5442f3c61d9201a948b18bc	c:\totalcmd\TCMADMIN.EXE.exe
39979b92519e321a086971f25d1e85a5	c:\totalcmd\TCMDX32.EXE.exe
694f9762b6873c14c54c49b165f52e2d	c:\totalcmd\TCUNINST.EXE.exe
f9f011b78e194388986441b903241e67	c:\totalcmd\TOTALCMD.EXE.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
GoogleUpdateSetup.exe:1352
%original file name%.exe:1104
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Program Files%\GUM1.tmp\goopdateres_en.dll (37 bytes)
%Program Files%\GUM1.tmp\psuser_64.dll (188 bytes)
%Program Files%\GUM1.tmp\goopdateres_ur.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_ml.dll (41 bytes)
%Program Files%\GUM1.tmp\goopdateres_sl.dll (39 bytes)
%Program Files%\GUM1.tmp\goopdateres_ca.dll (39 bytes)
%Program Files%\GUM1.tmp\goopdateres_ta.dll (40 bytes)
%Program Files%\GUT2.tmp (45823 bytes)
%Program Files%\GUM1.tmp\goopdateres_es-419.dll (39 bytes)
%Program Files%\GUM1.tmp\GoogleUpdateOnDemand.exe (52 bytes)
%Program Files%\GUM1.tmp\goopdateres_sr.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_hi.dll (38 bytes)
%Program Files%\GUM1.tmp\GoogleCrashHandler64.exe (550 bytes)
%Program Files%\GUM1.tmp\goopdateres_en-GB.dll (37 bytes)
%Program Files%\GUM1.tmp\goopdateres_zh-CN.dll (32 bytes)
%Program Files%\GUM1.tmp\goopdateres_ko.dll (34 bytes)
%Program Files%\GUM1.tmp\goopdateres_de.dll (40 bytes)
%Program Files%\GUM1.tmp\goopdateres_pt-PT.dll (39 bytes)
%Program Files%\GUM1.tmp\goopdateres_fa.dll (37 bytes)
%Program Files%\GUM1.tmp\npGoogleUpdate3.dll (1126 bytes)
%Program Files%\GUM1.tmp\psmachine.dll (165 bytes)
%Program Files%\GUM1.tmp\goopdateres_pt-BR.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_id.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_th.dll (37 bytes)
%Program Files%\GUM1.tmp\GoogleUpdateBroker.exe (52 bytes)
%Program Files%\GUM1.tmp\goopdateres_cs.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_uk.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_tr.dll (38 bytes)
%Program Files%\GUM1.tmp\psmachine_64.dll (188 bytes)
%Program Files%\GUM1.tmp\goopdateres_hu.dll (39 bytes)
%Program Files%\GUM1.tmp\goopdateres_es.dll (40 bytes)
%Program Files%\GUM1.tmp\goopdateres_bn.dll (39 bytes)
%Program Files%\GUM1.tmp\goopdateres_el.dll (40 bytes)
%Program Files%\GUM1.tmp\goopdateres_ms.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_ja.dll (35 bytes)
%Program Files%\GUM1.tmp\GoogleUpdate.exe (107 bytes)
%Program Files%\GUM1.tmp\goopdateres_fil.dll (39 bytes)
%Program Files%\GUM1.tmp\goopdateres_nl.dll (39 bytes)
%Program Files%\GUM1.tmp\goopdate.dll (3850 bytes)
%Program Files%\GUM1.tmp\goopdateres_no.dll (38 bytes)
%Program Files%\GUM1.tmp\GoogleUpdateWebPlugin.exe (52 bytes)
%Program Files%\GUM1.tmp\goopdateres_ro.dll (39 bytes)
%Program Files%\GUM1.tmp\goopdateres_mr.dll (39 bytes)
%Program Files%\GUM1.tmp\GoogleCrashHandler.exe (232 bytes)
%Program Files%\GUM1.tmp\goopdateres_bg.dll (39 bytes)
%Program Files%\GUM1.tmp\goopdateres_lv.dll (39 bytes)
%Program Files%\GUM1.tmp\goopdateres_da.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_it.dll (40 bytes)
%Program Files%\GUM1.tmp\goopdateres_te.dll (40 bytes)
%Program Files%\GUM1.tmp\psuser.dll (165 bytes)
%Program Files%\GUM1.tmp\goopdateres_am.dll (37 bytes)
%Program Files%\GUM1.tmp\goopdateres_is.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_fr.dll (40 bytes)
%Program Files%\GUM1.tmp\goopdateres_sw.dll (40 bytes)
%Program Files%\GUM1.tmp\goopdateres_pl.dll (39 bytes)
%Program Files%\GUM1.tmp\goopdateres_et.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_vi.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_lt.dll (38 bytes)
%Program Files%\GUM1.tmp\GoogleUpdateComRegisterShell64.exe (115 bytes)
%Program Files%\GUM1.tmp\goopdateres_sv.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_ar.dll (36 bytes)
%Program Files%\GUM1.tmp\goopdateres_iw.dll (36 bytes)
%Program Files%\GUM1.tmp\GoogleUpdateHelper.msi (28 bytes)
%Program Files%\GUM1.tmp\goopdateres_ru.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_kn.dll (40 bytes)
%Program Files%\GUM1.tmp\goopdateres_gu.dll (40 bytes)
%Program Files%\GUM1.tmp\GoogleUpdateSetup.exe (6841 bytes)
%Program Files%\GUM1.tmp\goopdateres_fi.dll (38 bytes)
%Program Files%\GUM1.tmp\goopdateres_hr.dll (39 bytes)
%Program Files%\GUM1.tmp\goopdateres_zh-TW.dll (32 bytes)
%Program Files%\GUM1.tmp\goopdateres_sk.dll (38 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (11518 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (7385 bytes)
C:\totalcmd\TOTALCMD.EXE.exe (35505 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (7385 bytes)
C:\totalcmd\TCMADMIN.EXE.exe (7433 bytes)
C:\totalcmd\TCUNINST.EXE.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\KAAo.txt (55978 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (7385 bytes)
C:\totalcmd\TcUsbRun.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (7433 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (7433 bytes)
C:\totalcmd\TCMDX32.EXE.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (7971 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (10177 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (7385 bytes)
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe (7785 bytes)
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe (7761 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OCEoAcII.bat (4 bytes)
%Documents and Settings%\All Users\JuwEIgUE\reIEcoQI.exe (7737 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GoogleUpdateSetup.exe (6321 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"fGAwoYMM.exe" = "%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NesIMIQs.exe" = "%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe"
Remove the references to the Trojan by modifying the following registry value(s) (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe,%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe,"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	1871872	1869312	5.50987	f55546d664b6f60e318a59b3427e5e5c
.rdata	1875968	4096	512	1.63708	43eb247e82b73073fbec75c704515bee
.data	1880064	5	512	0.070639	b22fcadf373356c5b1e3c3102a15b089
.rsrc	1884160	1372	1536	2.35898	f9a0eb89b017401ee99c18ea2923a3a7

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://google.com/	173.194.113.193

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1

Host: google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=crcIVe3BOOik8weI3YCgCg

Content-Length: 262

Date: Tue, 17 Mar 2015 23:23:30 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.5

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=crcIVe3BOOik8weI3YCgCg">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=crcIVe3BOOik8weI3YCgCg..Content-Length: 262..Date: Tue, 17 Mar 2015 23:23:30 GMT..Server: GFE/2.0..Alternate-Protocol: 80:quic,p=0.5..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://www.google.com.ua/?gfe_rd=cr&ei=crcIVe3BOOik8weI3YCgCg">here</A>...</BODY></HTML>....

GET / HTTP/1.1

Host: google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=cbcIVa-OH-ek8we8zIFQ

Content-Length: 260

Date: Tue, 17 Mar 2015 23:23:29 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.5

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=cbcIVa-OH-ek8we8zIFQ">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=cbcIVa-OH-ek8we8zIFQ..Content-Length: 260..Date: Tue, 17 Mar 2015 23:23:29 GMT..Server: GFE/2.0..Alternate-Protocol: 80:quic,p=0.5..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=cbcIVa-OH-ek8we8zIFQ">here</A>...</BODY></HTML>....

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

fGAwoYMM.exe_792:

.text

.rdata

@.data

7.qU6

TNcMdI

vND.LOrg

.eH^\

w|.LV

QfC%d

dW0WaZ@%di

O%%Sg

[%dZr

l}9fT{

E!.Lg:

\D.vY

m.TpM

.WYky?

?%sn6

.wbK3

Am%foEW

%d[k#

k[w[.dx

Ho%sd^

.pgVM

.XU\:

.TU:67Y[

mre%s

Rx.AF{-F

.dA}R

9zE46}GF{-A}d8

Rx.AMb

Rx.AJ

Vy-A}y1

]~]{:&]{>

Mr.0M8.wM

F@%uF

5@.FJ

r|M-

9Q2.QD

s]{>EkAC.AZ?

]mYS_;-h}_/

%s>Ab

GcMd

7FZZZZ%

&aTF{-A}d8

Rx.AZu`\Vb)

Rx.AN~2

Rx.AF z

x.ASs)

Rx.AF{-6s z

]sc.Pu

).KQ>6V

yT%FZ

d?%x1

u2S.cp

~%m"%U

R.BFX7

.Cd"w

/1:,*-.1

#k%U,

:EW.yY

%cMV=

hC%x}7

.Gl^z

>fAd:%U

.cW a

]{.iA8

8=d0,.eJ

KV.eb

.CYf?a8

=Btcp

Microsoft Windows

.Ns9/O

3.Ik4

SetNamedPipeHandleState

kernel32.dll

user32.dll

Microsoft Windows eine Wiederherstellung in einem Moment beginnen.

.klicken, um zu kopieren

Strafe zahlen. Jeder Versuch, diese Nachricht zu entfernen werden die Dateien, Hardware und Windows-Installation unwiederbringlich besch

ffnen Sie den Internet-Browser. An die Adresse gehen: blockchain.info/wallet und klicken Sie auf 'Erstellen Sie ein neues Wallet'.,

Geben Sie Ihre E-Mail-Adresse (optional) und Ihr Passwort ein. Achten Sie darauf, Ihr Passwort sicher ist.-

Sparen Sie Ihr Passwort sicher, vorzugsweise offline (klicken Notepad)..

Folgen Sie den Anweisungen auf der Website aufgefordert werden, und achten Sie genau auf die Sicherheitsempfehlungen.1

.Machen BitCoin Zahlung:2

|Anmeldung zu Ihrem Bitcoin Wallet blockchain.info/wallet/login5

DKlicken Sie auf "Import / Export".6

- und Kleinschreibung) indem Sie es und klicken Sie auf 'Add Private Key'.7

8Klicken Sie auf "Sweep Key".9

.Internationale Anbieter=

WebbrowserD

&de.bitcoin.it/wiki/G

Kennen Sie die Gefahren der Verletzung des Urheberrechts. Besuchen copyright.gov/help/faq/faq-infringement.html f

~Microsoft Windows will begin a restoration process in a moment.

Operation Global 3 is a coordinated effort by U.S., Canadian and European law enforcement agencies targeting computers with pirated content.$

Open Internet Browser. Go to the address: blockchain.info/wallet and click 'Start A New Wallet'.,

Enter your e-mail address(optional) and password. Make sure your password is secure.-

zSave your password safely, preferably offline(click Notepad)..

Follow the steps prompted on the website and pay close attention to the security recommendations.1

tLogin to your Bitcoin wallet blockchain.info/wallet/login 5

4Click on Import / Export. 6

Enter the paper wallet's private key by typing it manually (case sensitive) and click on 'Add Private Key'.7

$Click 'Sweep Key'.9

.International Exchanges=

&en.bitcoin.it/wiki/G

Know the dangers of copyright infringement. Visit copyright.gov/help/faq/faq-infringement.html for more information.J

un reato federale che porta pene fino a cinque anni di prigione federale, 250.000 dollari di multa, confisca e la restituzione (17 USC s.506, 18 USC s.2319)

un crimine federale che comporta pene fino a quindici anni di prigione federale, 250.000 dollari di multa, confisca e la restituzione (18 USC s.2339A)

Microsoft Windows inizier

Importo:

Qualsiasi tentativo di rimuovere questo messaggio potrebbe danneggiare il vostro file, hardware e di installazione di Windows oltre il recupero."

Operazione globale III dagli Stati Uniti, Canada, Europa, Australia, Nuova Zelanda e altre forze dell'ordine di tutto il mondo

\Registrazione di un nuovo portafoglio BitCoin:

Aprire Internet Browser. Vai all'indirizzo: blockchain.info/wallet e cliccare su 'Crea un nuovo Portafoglio'.,

Inserisci il tuo indirizzo e-mail (opzionale) e la password. Assicurati che il tuo password

Salvare la password in modo sicuro, preferibilmente non in linea (fare clic su Notepad)..

Seguire i passaggi spinto sul sito e prestare la massima attenzione alle raccomandazioni di sicurezza.1

|Accedi al tuo portafoglio Bitcoin blockchain.info/wallet/login5

Inserire la chiave privata 'Paper Wallet' digitando manualmente (maiuscole e minuscole) e fare clic su 'Add Private Key'.7

2Fare clic su 'Sweep Key'.9

&it.bitcoin.it/wiki/G

Conoscere i pericoli di violazione del copyright. Visita copyright.gov/help/faq/faq-infringement.html per maggiori informazioni.J

Microsoft Windows se iniciar

Fine Importe:

n de Windows sin posibilidad de recuperaci

Operaci

n: blockchain.info/wallet y haga clic en 'Crear un nuevo monedero'.,

gina web y prestar mucha atenci

pAcceda a su cartera blockchain.info/wallet/login Bitcoin5

FHaga clic en "Importar / Exportar".6

sculas) y haga clic en" Add Private Key ".7

2Haga clic en 'Sweep Key'.9

Navegador WebD

&es.bitcoin.it/wiki/G

n de copyright. Visita copyright.gov/help/faq/faq-infringement.html para m

fGAwoYMM.exe_792_rwx_00401000_000EA000: