Gen.Variant.Kazy.418708_a8621a5f84 – Adaware

HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Kazy.418708 (AdAware), Backdoor.Win32.PcClient.FD, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan, Backdoor

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: a8621a5f84d3918dbd3a3880809d1d39

SHA1: 324e6ae9c702d376e6640fbda558f5bff861682d

SHA256: 57c21014c3254a69bb4f184b78d9afd670756a9567edeaf9740b0e3e67f999ee

SSDeep: 3072:q7Zns4LFgVrcotGeRMCDzk0aXUkyAPCZxd:qXLgc4GeRMCPk0akkoP

Size: 204800 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2014-05-01 17:55:09

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1340
rundll32.exe:356
attrib.exe:1180
imapi.exe:1620

The Trojan injects its code into the following process(es):

explorer.exe:468

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1340 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\1734625.bat (72 bytes)
%System%\raspprov.exe (1281 bytes)

The process imapi.exe:1620 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%WinDir%\Temp\630f569y.TMP (146970 bytes)

Registry activity

The process %original file name%.exe:1340 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "86 5B 7B 1C F4 7B D2 FE 33 5B 95 1C CA 29 F2 F8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\c:]
"1734625.bat" = "1734625"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"dcomycfg" = "%System%\raspprov.exe"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process rundll32.exe:356 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "89 9E 45 68 9A 7B 9C 8D 91 79 8D 7B 3B E0 C6 DB"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The process attrib.exe:1180 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B6 E1 91 83 30 4C 4D BC E0 95 65 5E 86 2A FC F6"

The process imapi.exe:1620 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E9 E4 8B B9 4C 0A 50 2B 7C ED 3B A9 9C 96 64 32"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi]
"ControlFlags" = "1"
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi\ImapiSvc]
"BitNames" = " ImapiDebugError ImapiDebugWarning ImapiDebugTrace ImapiDebugInfo ImapiDebugX ImapiDebugSort"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi\ImapiSvc]
"Guid" = "8107d8e9-e323-49f5-bba2-abc35c243dca"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	125056	126976	5.50772	073251541b7f4d782dc68412829d2935
.rdata	131072	17578	20480	0.372308	6ebef2f8e08c5cbea006d08c1645e08b
.data	151552	41362	45056	0.058615	a81fcc4a817ef40777cf6b27d3005d29
.rsrc	196608	6164	8192	4.52	8a48a4486207f0e45b29d1cf4990d5c0

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://108.59.13.142/?uid=413&sid=115167&q=day goody valentine&minbid=0.000100
hxxp://108.59.13.142/?uid=413&sid=115167&q=aiken clay hair long&minbid=0.000100
hxxp://blackdoor55.com/?uid=413&sid=115167&q=aiken clay hair long&minbid=0.000100
hxxp://blackdoor55.com/?uid=413&sid=115167&q=day goody valentine&minbid=0.000100

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /?uid=413&sid=115167&q=day goody valentine&minbid=0.000100 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.6) Gecko/20040206 Firefox/0.8

Accept: application/xml,application/xhtml xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5

Host: blackdoor55.com

Connection: Keep-Alive

Accept-Encoding: gzip

Accept-Language: en-US,*

HTTP/1.1 200 OK

Date: Mon, 04 Aug 2014 13:19:02 GMT

Server: Apache

Connection: close

Transfer-Encoding: chunked

Content-Type: text/html; charset=utf8

212a..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://VVV.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">.<html xmlns="http://VVV.w3.org/1999/xhtml">. <head>. <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />. <title>day goody valentine - blackdoor55.com !</title>. </head>. <body class='ui-widget-overlay' style=" opacity:1.0 !important; filter: alpha(opacity=100) !important;">. <table id="globalTableWraper" cellpadding="0" cellspacing="0" style="width: 70%; margin:0px 15%;" class="ui-widget-content">. <tr>. <td style="text-align: left; padding: 15px 30px; height: 50px;">. <h1>SEARCH - BLACKDOOR55.COM</h1>. </td>. </tr>. . <tr>. <td id="headerWraper" align="center">. <form action="" method="GET">... <input type="hidden" name="uid" value="413"/> .. <input type="hidden" name="sid" value="115167"/> .. <input type="hidden" name="minbid" value="0.0001"/> <input type="text" name="q" class="text ui-widget-content ui-corner-all" style="width: 500px; height: 24px; font-size: 14px; font-weight: bold; padding-left: 10px;" value="day goody valentine"/> <input type="submit" value="search"/>. </form>. . </td>.

<<< skipped >>>

GET /?uid=413&sid=115167&q=aiken clay hair long&minbid=0.000100 HTTP/1.1

User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.7) Gecko/20040614 Firefox/0.9

Accept: application/xml,application/xhtml xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5

Host: blackdoor55.com

Connection: Keep-Alive

Accept-Encoding: gzip

Accept-Language: en-US,*

HTTP/1.1 200 OK

Date: Mon, 04 Aug 2014 13:19:04 GMT

Server: Apache

Connection: close

Transfer-Encoding: chunked

Content-Type: text/html; charset=utf8

210a..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://VVV.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">.<html xmlns="http://VVV.w3.org/1999/xhtml">. <head>. <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />. <title>aiken clay hair long - blackdoor55.com !</title>. </head>. <body class='ui-widget-overlay' style=" opacity:1.0 !important; filter: alpha(opacity=100) !important;">. <table id="globalTableWraper" cellpadding="0" cellspacing="0" style="width: 70%; margin:0px 15%;" class="ui-widget-content">. <tr>. <td style="text-align: left; padding: 15px 30px; height: 50px;">. <h1>SEARCH - BLACKDOOR55.COM</h1>. </td>. </tr>. . <tr>. <td id="headerWraper" align="center">. <form action="" method="GET">... <input type="hidden" name="uid" value="413"/> .. <input type="hidden" name="sid" value="115167"/> .. <input type="hidden" name="minbid" value="0.0001"/> <input type="text" name="q" class="text ui-widget-content ui-corner-all" style="width: 500px; height: 24px; font-size: 14px; font-weight: bold; padding-left: 10px;" value="aiken clay hair long"/> <input type="submit" value="search"/>. </form>. . </td>.

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

explorer.exe_468:

.text

`.data

.rsrc

@.reloc

ADVAPI32.dll

BROWSEUI.dll

GDI32.dll

KERNEL32.dll

NTDLL.DLL

msvcrt.dll

ole32.dll

OLEAUT32.dll

SHDOCVW.dll

SHELL32.dll

SHLWAPI.dll

USER32.dll

UxTheme.dll

FTSSh

t0SSh

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system

SShwk

98~%SP

ExplorerStartMsgLoop

PSSh;

6SSSSh

SSSSh

SPSSSShL

u%SSh

t.WWWW

xpsp2res.dll

xpsp3res.dll

tbSSh

Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartMenu

Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartPanel

kernel32.dll

GetSystemWindowsDirectoryW

NetGetJoinInformation

WINMM.dll

SETUPAPI.dll

WINSTA.dll

OLEACC.dll

USERENV.dll

ntdll.dll

RegEnumKeyExW

RegNotifyChangeKeyValue

RegOpenKeyExA

RegEnumKeyW

RegCloseKey

RegCreateKeyW

RegQueryInfoKeyW

RegOpenKeyExW

RegCreateKeyExW

OffsetViewportOrgEx

GetViewportOrgEx

SetViewportOrgEx

SetProcessShutdownParameters

GetProcessHeap

GetWindowsDirectoryW

CreateIoCompletionPort

ShellExecuteExW

SHRegCloseUSKey

SHRegCreateUSKeyW

AssocQueryKeyW

SHRegOpenUSKeyW

SHDeleteKeyW

TileWindows

ExitWindowsEx

RegisterHotKey

UnregisterHotKey

EnumChildWindows

GetKeyState

GetAsyncKeyState

CascadeWindows

MsgWaitForMultipleObjects

EnumWindows

explorer.pdb

name="Microsoft.Windows.Shell.explorer"

version="5.1.0.0"

<description>Windows Shell</description>

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

]]"```^]]\

3333333330

3333330

333333334

)@. '5 !*

.DEHHF>?/

2<===@@=

&$%Uooqkezs

['$$#%&(4

3333333333333333333

33333333333330

7''''))

3'')))33.

222`444(555

%%%{///-

000000000

00000000

`[66...00

0000000

`]66./.000

/./././././././.

66///0000

0000000000000

0000000000

6666,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,0.010.010.010.010.010.010.010.010.010.010.001

4366666666K,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6.010.010.010.010.010.010.010.010.010.010.000

:;<;:;<;:;<;:;<;:;<0><pre>) ) ) ) )</pre><pre>|2222'2'2'2'2'2'2'2'2'2'2'2'2'2'2'2',),),),),),),),),),),),),),),),),),),),),),, </pre><pre>22222222222</pre><pre>3333333</pre><pre>.SB99;;;99twv}ut{oxt~</pre><pre>.SB;;;:::2:w}{{qddgghg</pre><pre>" """ """ """ """ "" #</pre><pre>""" """ """ "#</pre><pre>.SG>''';;9::p</pre><pre>:5:5:5:5:5:5:5:5:5:5#"</pre><pre># # # # # # # # # # # # # # # # # # # # # ##$</pre><pre>( # # # # # # # # # # # # # # # # # # # # ###</pre><pre>1232123212321232123</pre><pre>(&(((&(((&(((&(((&((&&)</pre><pre>&(((&(((&(((&()</pre><pre>`,''')))</pre><pre>'4,4'4,4'4,4'4,4'4,4)(</pre><pre>55///0000</pre><pre>5555-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-0</pre><pre>555555555</pre><pre>55555555</pre><pre>5555555</pre><pre>14441444144414441</pre><pre>4343434343434343</pre><pre>5555555555555</pre><pre>5555555555</pre><pre>-,-,-,-,-,-,-,-,-,-,-*.</pre><pre>..............................JFJFJFJFJFJFJFJFJFJFJ.-</pre><pre>{22*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-../</pre><pre>|ujjjjuhF..BBBBBBBBBBBBT</pre><pre>~j|F.BB*BBB*BBB*Bwop</pre><pre>&!!!&!!!&</pre><pre>44466666</pre><pre>44444444416</pre><pre>4446666</pre><pre>66666666</pre><pre>|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= </pre><pre>|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= </pre><pre>DDDDE%CTDD@</pre><pre>A%US$</pre><pre>%UUUU</pre><pre>%%UUU</pre><pre>33U</pre><pre>""2222!!</pre><pre>!"!"%UUR""</pre><pre>!""!"#2"""</pre><pre>"!!"#3"!"</pre><pre>dnnnnn:n.nfCnmddddd</pre><pre>////;/;;88</pre><pre>;888;;!/</pre><pre>!//!!;;^</pre><pre>:;:!::!!!</pre><pre>.88.88.8</pre><pre>.N.NN.M</pre><pre>::8.8...</pre><pre>:::!;;:!</pre><pre>//!!;888</pre><pre>.8.8.88...</pre><pre>:;!::!!;!//!;</pre><pre>!!;:!!::</pre><pre>.88..8..</pre><pre>!!:::/^!</pre><pre>!;/;!;;;!!!:</pre><pre>.8:!!!!^</pre><pre>!!:;:::..</pre><pre>/:!^^!;{8{../</pre><pre>...:::.-</pre><pre>**6***66*6**6566*5666 ,</pre><pre>6*6666*6*6 655*65</pre><pre>6*65 56*5 55 555 *5 6</pre><pre>555( 55 (5 5( </pre><pre>76 5 66 555*677</pre><pre>6*6 5 5(5 (55( '5((5 (556 ('5</pre><pre>665**6(('S((((((S(((]('((@('SS((S(((((((6C-.NEC66S5sU</pre><pre>555(555(5((5(5(5(</pre><pre>5 5 5 5555 (555(555'(((5(5('55(((</pre><pre>((''('5'5(5('('('('('((''('(((@(((('&(((&</pre><pre>%&&%&&&&3>&3&3&33&3&3333&&3>3333</pre><pre>'(3&'&3&</pre><pre>3&33&&((</pre><pre>3323>33>%>3%>3>33>3%3&%</pre><pre>*5'(('((&@3(</pre><pre>,63%3>323>3%>&>33323>>%></pre><pre>3(3'(((@@'5('@(@(&('(</pre><pre>>2>323%>3</pre><pre>75((((@3&333&3&&&%&3&&3&33>33%3>23%>3</pre><pre>>2%$32%>2>%>2$3></pre><pre>3&%&&3&33>3>33</pre><pre>3>%>3%&3$23>23$2>2%$>2></pre><pre>)4433((&(&('*</pre><pre>('((((''(**6(('' *</pre><pre>32323>3></pre><pre>2$%>22%>%3' (</pre><pre>&(&''((5(5 *</pre><pre>'(&(&((&('''</pre><pre>&&%&3&&%3%</pre><pre>2%>22>22</pre><pre>5''3(((3(('&(&'&</pre><pre>3%%3%3%2#$</pre><pre>22$22$2%$22$2%2%$2%$2$222%$22</pre><pre>&>2$2$2$222$22$%%</pre><pre>:7'((('(3('(3(&(&</pre><pre>222222222222</pre><pre>22222222222222</pre><pre>222222222222222</pre><pre>22$22$22$22$</pre><pre>&(%3%&&&&3&&&3%3</pre><pre>222222222222222222</pre><pre>&&(&3(&(&'('((3'(&&</pre><pre>2222222</pre><pre>22$<$$2$22$%</pre><pre>&&(3(3('(&'</pre><pre>222"2212</pre><pre>22<2><pre>(&(3(3((</pre><pre>((565 ((( 6</pre><pre>333&33(&&</pre><pre>'(('('(('( </pre><pre> '&%%"$</pre><pre>2"2"22"2</pre><pre>2222<2><pre>2%('(3'32222?&'</pre><pre>2"2"2"121212<</pre><pre>2"2"2$"?</pre><pre>%%22%2</pre><pre>&3(3(3((&</pre><pre>"2"<"2<2<</pre><pre><2<"<"<"<</pre><pre>1"?((&21</pre><pre><?php<?22<$2</pre><pre>2%""22&&</pre><pre>2<2$$2222</pre><pre>'&('(3(''</pre><pre>((%%%"</pre><pre>5(3%"%</pre><pre>"2%5*67</pre><pre>))) ))))</pre><pre>""**<****"""</pre><pre>"*<<<<*"</pre><pre>#2#---2222-222442-</pre><pre>--&#-(-%</pre><pre>$/222(--444222!</pre><pre>#&-221269924999;</pre><pre>&$-22-($2%</pre><pre>#(2---222622212-</pre><pre>#2221299629968</pre><pre>#&--%#(2##!</pre><pre>-222422422426662-%</pre><pre>"2-##&</pre><pre>!##-#&#-&&#%---#---#&-219662%</pre><pre>$&-(151,44.9</pre><pre>&1242662-</pre><pre>-(..19.19</pre><pre>,4492.12</pre><pre>12-$-,-,</pre><pre>-, $$----</pre><pre>#%#-15/-&</pre><pre>-,(,,(,(,</pre><pre>$$11651566/,$&&</pre><pre>,2592&&&-</pre><pre>2466/!$$</pre><pre>""*<*"****""</pre><pre>) '????[</pre><pre>&&&$-556>>61,,5994511-</pre><pre>$(//$$$(6>6/,$,-$</pre><pre>#$-22692/,,$,-&</pre><pre>-266661..4514#</pre><pre>&,2-&&##</pre><pre>&-222,22--#</pre><pre>#&&---2-,-&$&(,,291.566..BNNNTNNNNNAABIAA88</pre><pre>&!#&!-##</pre><pre>&#--//11468>885882&</pre><pre>$266961$&--$&%</pre><pre>,1661,!-((#</pre><pre>&$,4255$,92</pre><pre>&$,44..&</pre><pre>""**""***""</pre><pre>"****<*<<**"</pre><pre>"**""""*""""</pre><pre>&-569./-,16522$</pre><pre>.BAA=86546888=AAAEAAEMNRMQQSWZZ\]gk__m__\</pre><pre>bTRHHHHHQQHQJQWJSSSSSSSSSSSSSSSSWWSSSS\\V]VZW8,.FW]\\]\]\]\\ZZ\\WFR>38(</pre><pre>.BTTkgn]ktvgmvvvvvmvvvsvzzzyzyzyzyyyzmkkkkkZSRA816;F87</pre><pre>yzyzyzym^Z]WN3 $&$.Wt\</pre><pre>""*"""****""""</pre><pre>"***"**""**<**"</pre><pre>$5612,.2,</pre><pre>&$$,,,5]</pre><pre>$]t.Ft</pre><pre>7%8U8</pre><pre>3 303<3]3</pre><pre>2<3</pre><pre>8 8$8(8,8084888<8}8</pre><pre>5%5,575{6</pre><pre><,<0<4<8<</pre><pre>7 7$7(7,70747</pre><pre>rundll32.exe</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced</pre><pre>::{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}</pre><pre>::{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}</pre><pre>::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}</pre><pre>::{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}</pre><pre>::{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}</pre><pre>::{D20EA4E1-3957-11d2-A40B-0C5020524153}</pre><pre>::{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}</pre><pre>{208D2C60-3AEA-1069-A2D7-08002B30309D}</pre><pre>{20D04FE0-3AEA-1069-A2D8-08002B30309D}</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites</pre><pre>{450D8FBA-AD25-11D0-98A8-0800361B1103}</pre><pre>CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}</pre><pre>Software\Microsoft\Windows\CurrentVersion\RunOnce</pre><pre>Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\DontShowMeThisDialogAgain</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\CleanupWiz</pre><pre>\\.\WMIDataDevice</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run</pre><pre>Software\Microsoft\Windows NT\CurrentVersion\Windows</pre><pre>ExplorerIsShellMutex</pre><pre>desk.cpl</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer</pre><pre>tourstart.exe</pre><pre>tourstart.exe,0</pre><pre>Microsoft.OfferTour</pre><pre>WINWORD.EXE</pre><pre>Software\Microsoft\Windows\CurrentVersion\Applets</pre><pre>Software\Microsoft\Windows\CurrentVersion\Applets\Tour</pre><pre>explorer.exe,9</pre><pre>Microsoft.FixScreenResolution</pre><pre>shell:::{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation</pre><pre>Software\Microsoft\Windows NT\CurrentVersion</pre><pre>shell:::{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</pre><pre>DDEEXECUTESHORTCIRCUIT</pre><pre>http\shell</pre><pre>IEXPLORE.EXE</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop</pre><pre>Software\Microsoft\Windows\CurrentVersion\RunOnceEx</pre><pre>comctl32.dll</pre><pre>Software\Microsoft\Windows\Internet Settings</pre><pre>AutoConfigURL</pre><pre>system.ini</pre><pre>AppEvents\Schemes\Apps\.Default\%s\.current</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\TrayNotify</pre><pre>MSShellRunDlgReady</pre><pre>res://mys.dll/mys.hta /explorer</pre><pre>mshta.exe</pre><pre>SOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\Welcome</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\Tips</pre><pre>SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\MYS</pre><pre>cys.exe</pre><pre>SOFTWARE\Microsoft\Windows NT\CurrentVersion\srvWiz</pre><pre>install.exe</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel</pre><pre>OUTLOOK.EXE</pre><pre>explorer.exe,16</pre><pre>iernonce.dll</pre><pre>WININET.DLL</pre><pre>UpdateURL</pre><pre>WindowsUpdate</pre><pre>HWND%x</pre><pre>Software\Microsoft\Windows\CurrentVersion\OemStartMenuData</pre><pre>fldrclnr.dll,Wizard_RunDLL</pre><pre>iexplore.exe</pre><pre>winbrand.dll</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\Remote\%d</pre><pre>shell32.dll</pre><pre>nusrmgr.cpl ,initialTask=ChangePicture</pre><pre>NewExeName</pre><pre>Windows</pre><pre>ediskeer.dll</pre><pre>timedate.cpl</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\LastVisitedMRU</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\OpenSaveMRU</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU</pre><pre>Software\Microsoft\Internet Explorer\TypedURLs</pre><pre>%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Calculator.lnk</pre><pre>%ALLUSERSPROFILE%\Start Menu\Programs\Games\Solitaire.lnk</pre><pre>%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Paint.lnk</pre><pre>%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\WordPad.lnk</pre><pre>%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Files and Settings Transfer Wizard.lnk</pre><pre>%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Windows Movie Maker.lnk</pre><pre>%USERPROFILE%\Start Menu\Programs\Accessories\Tour Windows XP.lnk</pre><pre>%ALLUSERSPROFILE%\Start Menu\Programs\Windows Messenger.lnk</pre><pre>%USERPROFILE%\Start Menu\Programs\Windows Media Player.lnk</pre><pre>%ALLUSERSPROFILE%\Start Menu\Programs\MSN.lnk</pre><pre>%ALLUSERSPROFILE%\Start Menu\Programs\Get Online with MSN.lnk</pre><pre>%ALLUSERSPROFILE%\Start Menu\Programs\Get Going with Tablet PC.lnk</pre><pre>%ALLUSERSPROFILE%\Start Menu\Set Program Access and Defaults.lnk</pre><pre>%ALLUSERSPROFILE%\Start Menu\Programs\Windows Journal.lnk</pre><pre>%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Media Center\Media Center.lnk</pre><pre>%USERPROFILE%\Start Menu\Programs\Internet Explorer.lnk</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel</pre><pre>TSAppCMP.DLL</pre><pre>netapi32.dll</pre><pre>%SystemRoot%\system32\restore\rstrui.exe</pre><pre>RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL ?0x%X?%s</pre><pre>RunDLL32.EXE</pre><pre>%s%d%s</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\System</pre><pre>settings.dll</pre><pre>explorer.exe "</pre><pre>explorer.exe /e, "</pre><pre>WindowsLogon</pre><pre>WindowsLogoff</pre><pre>%s %s</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count</pre><pre>uAppWiz.Cpl</pre><pre>\explorer.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu</pre><pre>::{20D04FE0-3AEA-1069-A2D8-08002B30309D}</pre><pre>taskmgr.exe</pre><pre>ShellExecute</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\AppKey\%d</pre><pre>\WindowsShell.Manifest</pre><pre>Get Online with MSN.lnk</pre><pre>Set Program Access and Defaults.lnk</pre><pre>Link%d</pre><pre>OEM%d</pre><pre>Software\Microsoft\Windows\CurrentVersion\SMDEn</pre><pre>::{D20EA4E1-3957-11d2-A40B-0C5020524152}</pre><pre>%WinDir%\explorer.exe</pre><pre>There is a file or folder on your computer called "%s" which could cause certain applications to not function correctly. Renaming it to "%s" would solve this problem. Would you like to rename it now?</pre><pre>Ca&scade Windows</pre><pre>Tile Windows &Horizontally</pre><pre>Tile Windows V&ertically</pre><pre>&Windows Security...</pre><pre>&Help and Support</pre><pre>&Log Off %s...</pre><pre>Windows Explorer</pre><pre>6.00.2900.5512 (xpsp.080413-2105)</pre><pre>EXPLORER.EXE</pre><pre>Windows</pre><pre>Operating System</pre><pre>6.00.2900.5512</pre><pre>Keep the &taskbar on top of other windows</pre><pre>To remove records of recently accessed documents, programs, and Web sites, click Clear.</pre><pre>Windows displays icons for active and urgent notifications, and hides inactive ones. You can change this behavior for items in the list below.</pre><pre>Select this option to use the menu style from earlier versions of Windows.</pre><pre>6There is not enough memory to complete this operation.8Unable to run command.</pre><pre>The folder '%1' has been removed.WMy Computer or Windows Explorer has not been properly initialized yet. Try again later.</pre><pre>&Undo %s</pre><pre>Windows is running in safe mode.</pre><pre>This special diagnostic mode of Windows enables you to fix a problem which may be caused by your network or hardware settings. Make sure these settings are correct in Control Panel, and then try starting Windows again. While in safe mode, some of your devices may not be available.</pre><pre>startRThere was an internal error and one of the windows you were using has been closed.</pre><pre>Restrictions{This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.</pre><pre>&Show Open Windows</pre><pre>Windows was unable to change the display settings for the new configuration. Return the computer to the previous state, shut down Windows, and restart the computer in the desired configuration.</pre><pre>There may be a problem with your display settings if you continue. To safely change to a new configuration, you should shut down Windows and restart the computer in the desired configuration. Do you want to continue anyway?</pre><pre>This pre-release version of "Internet Explorer 4.0" Desktop/Explorer has expired. Please update to the latest release of "Internet Explorer 4.0" from WWW.MICROSOFT.COM</pre><pre>helpctr.exe>-FromStartHelp</pre><pre>Take a tour of Windows XP</pre><pre>NOpens a window where you can pick search options and work with search results.aOpens a central location for Help topics, tutorials, troubleshooting, and other support services.</pre><pre>/Opens a program, folder, document, or Web site.</pre><pre>Provides options for closing your programs and logging off, or for leaving your programs running and switching to another user.lProvides options for turning off or restarting your computer, or for activating Stand By or Hibernate modes.RDisconnects your session. You can reconnect to the session when you log on again.</pre><pre>&Windows Security</pre><pre>iOpens the My Documents folder, where you can store letters, reports, notes, and other kinds of documents./Displays recently opened documents and folders.KOpens the My Music folder, where you can store music and other audio files.]Opens the My Pictures folder, where you can store digital photos, images, and graphics files.zGives access to, and information about, the disk drives, cameras, scanners, and other hardware connected to your computer.MGives access to, and information about, folders and files on other computers.8Connects to other computers, networks, and the Internet.</pre><b>explorer.exe_468_rwx_00974000_00012000:</b><pre>FTPQ</pre><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.reloc</pre><pre>WININET.dll</pre><pre>SHLWAPI.dll</pre><pre>USER32.dll</pre><pre>ADVAPI32.dll</pre><pre>SHELL32.dll</pre><pre>ole32.dll</pre><pre>WS2_32.dll</pre><pre>/t%s.php?%s=</pre><pre>dissolutionsand.tk</pre><pre>/d%s.php?%s=</pre><pre>%s=%s&</pre><pre>DeleteUrlCacheEntry</pre><pre>FindCloseUrlCache</pre><pre>FindFirstUrlCacheEntryA</pre><pre>FindNextUrlCacheEntryA</pre><pre>HttpAddRequestHeadersA</pre><pre>HttpSendRequestA</pre><pre>HttpOpenRequestA</pre><pre>InternetCanonicalizeUrlA</pre><pre>HttpQueryInfoA</pre><pre>ExitWindowsEx</pre><pre>CryptGetUserKey</pre><pre>RegCreateKeyA</pre><pre>RegCloseKey</pre><pre>RegOpenKeyA</pre><pre>ShellExecuteA</pre><pre>ntdll.dll</pre><pre>DisconnectNamedPipe</pre><pre>CreateNamedPipeA</pre><pre>CallNamedPipeA</pre><pre>WaitNamedPipeA</pre><pre>ConnectNamedPipe</pre><pre>KERNEL32.dll</pre><pre>client.dll</pre><b>rundll32.exe_356:</b><pre>.text</pre><pre>`.data</pre><pre>.rsrc</pre><pre>msvcrt.dll</pre><pre>KERNEL32.dll</pre><pre>NTDLL.DLL</pre><pre>GDI32.dll</pre><pre>USER32.dll</pre><pre>IMAGEHLP.dll</pre><pre>rundll32.pdb</pre><pre>.....eZXnnnnnnnnnnnn3</pre><pre>....eDXnnnnnnnnnnnn3</pre><pre>...eDXnnnnnnnnnnnn,</pre><pre>.eDXnnnnnnnnnnnn,</pre><pre>%Xnnnnnnnnnnnnnnn1</pre><pre>O3$dS7"%U9</pre><pre>.manifest</pre><pre>5.1.2600.5512 (xpsp.080413-2105)</pre><pre>RUNDLL.EXE</pre><pre>Windows</pre><pre>Operating System</pre><pre>5.1.2600.5512</pre><pre>YThere is not enough memory to run the file %s.</pre><pre>Please close other windows and try again.</pre><pre>9The file %s or one of its components could not be opened.</pre><pre>0The file %s or one of its components cannot run.</pre><pre>MThe file %s or one of its components requires a different version of Windows.</pre><pre>UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"</pre><pre>Error in %s</pre><pre>Missing entry:%s</pre><pre>Error loading %s</pre></div><div class="blog_tab" id="tab3"><p><strong class="font_20"><span style="font-size:medium;">Remove it with Ad-Aware</span></strong></p><ol><li>Click (<a href="http://lavasoft.com/thankyou.php?internal=true&inter=encyclopedia"><span style="color: #0000ff;">here</span></a>) to download and install Ad-Aware Free Antivirus.</li><li>Update the definition files.</li><li>Run a full scan of your computer.</li></ol><p><strong class="font_20"><span style="font-size:medium;">Manual removal*</span></strong></p><ol><li>Terminate malicious process(es) (<a href="http://www.lavasoft.com/mylavasoft/malware-removal-support/blog/how-to-end-a-process-with-the-task-manager"><span style="color: #0000ff;">How to End a Process With the Task Manager</span></a>):<p style="padding-left: 30px; font-size: x-small; color: #ff0000;">%original file name%.exe:1340<br>rundll32.exe:356<br>attrib.exe:1180<br>imapi.exe:1620<br></p></li><li>Delete the original Trojan file.<br></li><li>Delete or disinfect the following files created/modified by the Trojan:<p style="padding-left: 30px; font-size: x-small; color: #ff0000;">C:\1734625.bat (72 bytes)<br>%System%\raspprov.exe (1281 bytes)<br>%WinDir%\Temp\630f569y.TMP (146970 bytes)</p></li><li>Delete the following value(s) in the autorun key (<a href="http://www.lavasoft.com/mylavasoft/malware-removal-support/blog/how-to-work-with-the-system-registry"><span style="color: #0000ff;">How to Work with System Registry</span></a>):<p style="padding-left: 30px; font-size: x-small; color: #ff0000;">[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]<br>"dcomycfg" = "%System%\raspprov.exe"</p></li><li>Clean the Temporary Internet Files folder, which may contain infected files (<a href="http://www.lavasoft.com/mylavasoft/malware-removal-support/blog/how-to-clean-the-temporary-internet-files-folder"><span style="color: #0000ff;">How to clean Temporary Internet Files folder</span></a>).<br></li><li>Reboot the computer.<br></li></ol>*Manual removal may cause unexpected system behaviour and should be performed at your own risk.</div></di?></pre></pre></pre></2></pre></2></pre></0>