Skip to main content

Virus.Win32.Sality_55a14e7f3d


Trojan.Win32.Agentb.aanb (Kaspersky), Win32.Sality.3 (B) (Emsisoft), Win32.Sality.3 (AdAware), Trojan.Win32.Swrort.3.FD, Virus.Win32.Sality.FD, Virus.Win32.Sality.2.FD, VirusSality.YR, GenericAutorunWorm.YR, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan, Worm, Virus, WormAutorun

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 55a14e7f3d6b234ac12d063e41524f50

SHA1: 3f5f19b59de704c66433967374096991b9249756

SHA256: e051e5a91be289068b041f0232127f3af00df7ac96b60ad8295aac1dd2a38456

SSDeep: 12288:KTyjXW 48qWywrU4kGFezOAVuJ5PIXww7F5DO3HYffINNxvt1H:gIXW/8yw1ez54lIbF5SXYH6NL1H

Size: 758427 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: UPolyXv05_v6

Company: P i r i f o r m L t d .

Created at: 2011-01-18 16:44:33

Analyzed on: WindowsXP SP3 32-bit

Summary: Virus. A program that recursively replicates a possibly evolved copy of itself.

Dynamic Analysis

Payload

Behaviour Description
WormAutorunA worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.


Process activity

The Virus creates the following process(es):

%original file name%.exe:1664

The Virus injects its code into the following process(es):

rundll32.exe:1784
Explorer.EXE:840

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1664 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Microsoft\Office\rundll32.exe (5441 bytes)
%WinDir%\system.ini (72 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\001A062B_Rar\%original file name%.exe (5441 bytes)

The process rundll32.exe:1784 makes changes in the file system.


The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\uvdnv.exe (741 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\Reader_sl.exe (1336 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\001A1260_Rar\rundll32.exe (5441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\winlkir.exe (15019 bytes)
C:\autorun.inf (272 bytes)
%Program Files%\Common Files\Java\Java Update\jusched.exe (368 bytes)
%System%\drivers\likrhn.sys (5 bytes)
C:\cyypay.pif (103 bytes)

The Virus deletes the following file(s):

%System%\drivers\likrhn.sys (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\001A062B_Rar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\winlkir.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\001A062B_Rar\%original file name%.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uvdnv.exe (0 bytes)

Registry activity

The process %original file name%.exe:1664 makes changes in the system registry.


The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\Aas]
"a1_0" = "383921497"

[HKCU\Software\Aas\695404737]
"35845605" = "419"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Aas\695404737]
"50183847" = "247D32B83D47435F2ED0E33C5DD34E729A41500BEC3D7263C63EA032241876F9CA2AB0B709E472865D6C4A30392434DF4508B4552311855571DEB262EFB3B690133A5F283FE741ABB1DFAAE9E664B81EDE3B4A95232E0898017CACF1EB56D1F98C1AFB26401F8945DB790B927771E8A250144DE11B6B0D0D4F0F193516E9AAD7"
"43014726" = "0B00687474703A2F2F7777772E6572692E6564752E706B2F696D616765732F6C6F676F2E67696600687474703A2F2F666F75726C696E652E636F6D2E74722F696D616765732F6C6F676F2E67696600687474703A2F2F65796C656E6972696B2E62697A2F6C6F676F2E67696600687474703A2F2F666F7462616C6261736B612E79632E637A2F696D616765732F666D61696E2E67696600687474703A2F2F65736B696D6F7669652E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F657374657469636165737061636F62656D65737461722E636F6D2E62722F6C6F676F2E67696600687474703A2F2F666F7263656C696E652E636F6D2E74722F696D616765732F6C6F676F2E67696600687474703A2F2F65736F757263652E636F2E696E2F696D616765732F6C6F676F322E67696600687474703A2F2F6164732E797570706164732E636F6D2F6C6F676F2E67696600687474703A2F2F636172743133332E6F72672F696D616765732F6D61696E2E67696600687474703A2F2F66696E65706561726C2E636F6D2E686B2F696D616765732F6C6F676F2E676966"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"HideFileExt" = "1"

[HKCU\Software\Aas]
"a3_0" = "17001001"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKCU\Software\Aas\695404737]
"14338242" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Msversion" = "2007"

[HKCU\Software\Aas\695404737]
"7169121" = "138"

"21507363" = "0"
"28676484" = "35"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden" = "0"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3A DE 21 84 9E 76 90 B9 42 FB 16 38 DD 78 12 02"

[HKCU\Software\Aas]
"a2_0" = "7269"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"
[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_0" = "0"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"%original file name%.exe" = "c:\%original file name%.exe:*:Enabled:ipsec"

Firewall notifications are disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Windows" = "%Documents and Settings%\%current user%\Application Data\Microsoft\Office\rundll32.exe"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

Task Manager is disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr" = "1"

The process rundll32.exe:1784 makes changes in the system registry.


The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\Aas\695404737]
"35845605" = "419"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Aas\695404737]
"50183847" = "247D32B83D47435F2ED0E33C5DD34E729A41500BEC3D7263C63EA032241876F9CA2AB0B709E472865D6C4A30392434DF4508B4552311855571DEB262EFB3B690133A5F283FE741ABB1DFAAE9E664B81EDE3B4A95232E0898017CACF1EB56D1F98C1AFB26401F8945DB790B927771E8A250144DE11B6B0D0D4F0F193516E9AAD7"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas\695404737]
"43014726" = "0B00687474703A2F2F7777772E6572692E6564752E706B2F696D616765732F6C6F676F2E67696600687474703A2F2F666F75726C696E652E636F6D2E74722F696D616765732F6C6F676F2E67696600687474703A2F2F65796C656E6972696B2E62697A2F6C6F676F2E67696600687474703A2F2F666F7462616C6261736B612E79632E637A2F696D616765732F666D61696E2E67696600687474703A2F2F65736B696D6F7669652E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F657374657469636165737061636F62656D65737461722E636F6D2E62722F6C6F676F2E67696600687474703A2F2F666F7263656C696E652E636F6D2E74722F696D616765732F6C6F676F2E67696600687474703A2F2F65736F757263652E636F2E696E2F696D616765732F6C6F676F322E67696600687474703A2F2F6164732E797570706164732E636F6D2F6C6F676F2E67696600687474703A2F2F636172743133332E6F72672F696D616765732F6D61696E2E67696600687474703A2F2F66696E65706561726C2E636F6D2E686B2F696D616765732F6C6F676F2E676966"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKCU\Software\Aas\695404737]
"14338242" = "0"
"7169121" = "138"

"21507363" = "0"
"28676484" = "35"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden" = "0"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F5 0D 0D EF C4 1E 6D 8D CF 1A 56 33 29 1D 31 5C"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"
[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

Firewall notifications are disabled:

"DisableNotifications" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Application Data\Microsoft\Office]
"Rundll32.exe" = "%Documents and Settings%\%current user%\Application Data\Microsoft\Office\rundll32.exe:*:Enabled:ipsec"

Task Manager is disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr" = "1"

The Virus deletes the following registry key(s):

[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\LanmanWorkstation]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\sermouse.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\termservice]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Netlogon]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\TDI]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\rdpcdd.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Browser]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\SCSI Class]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\sermouse.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Boot Bus Extender]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\NetBT]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\sr.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\{36FC9E60-C465-11CF-8056-444553540000}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\WinMgmt]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\File system]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\DcomLaunch]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dmserver]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\EventLog]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Messenger]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\{4D36E980-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Ndisuio]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Boot Bus Extender]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\CryptSvc]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\SharedAccess]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\NetBIOSGroup]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\RpcSs]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\ipnat.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\SCSI Class]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Filter]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\PlugPlay]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\rdpdd.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Tcpip]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\NDIS Wrapper]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Boot file system]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\PNP Filter]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\NetDDEGroup]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\CryptSvc]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Primary disk]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Netlogon]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\vga.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\HelpSvc]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Primary disk]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\vga.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\WZCSVC]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\System Bus Extender]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\dmserver]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\System Bus Extender]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\vgasave.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\NetMan]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Base]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\File system]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\dmadmin]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\AppMgmt]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\tdtcp.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\PCI Configuration]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\LanmanServer]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\HelpSvc]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\ip6fw.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\AFD]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Streams Drivers]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\DcomLaunch]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\dmboot.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Base]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\DnsCache]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\NtLmSsp]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\{4D36E965-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\WinMgmt]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dmload.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\{4D36E977-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dmboot.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\rdsessmgr]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\{4D36E975-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\PlugPlay]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dmadmin]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\tdpipe.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\NDIS]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\{4D36E97B-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Dhcp]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\dmload.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\{4D36E974-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\SRService]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\nm.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\PNP_TDI]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Boot file system]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\dmio.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\AppMgmt]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\PCI Configuration]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\NetworkProvider]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\RpcSs]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\nm]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\PNP Filter]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\EventLog]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Network]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\LmHosts]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Filter]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\SRService]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\{4D36E973-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\NetBIOS]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dmio.sys]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\{4D36E969-E325-11CE-BFC1-08002BE10318}]
[HKLM\System\CurrentControlSet\Control\SafeBoot\Network\rdpwd.sys]

The Virus deletes the following value(s) in system registry:

[HKLM\System\CurrentControlSet\Control\SafeBoot]
"AlternateShell"

Dropped PE files

MD5 File path
fe9261575638dec5742ddfba5b5fb19cc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\001A1260_Rar\rundll32.exe
951edcadf2363c5b1ff5711264d7748ec:\cyypay.pif

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:1664

  2. Delete the original Virus file.
  3. Delete or disinfect the following files created/modified by the Virus:

    %Documents and Settings%\%current user%\Application Data\Microsoft\Office\rundll32.exe (5441 bytes)
    %WinDir%\system.ini (72 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\001A062B_Rar\%original file name%.exe (5441 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\uvdnv.exe (741 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\Reader_sl.exe (1336 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\001A1260_Rar\rundll32.exe (5441 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\winlkir.exe (15019 bytes)
    C:\autorun.inf (272 bytes)
    %Program Files%\Common Files\Java\Java Update\jusched.exe (368 bytes)
    %System%\drivers\likrhn.sys (5 bytes)
    C:\cyypay.pif (103 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "Microsoft Windows" = "%Documents and Settings%\%current user%\Application Data\Microsoft\Office\rundll32.exe"

  5. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
  6. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text40965698415698564.61284256132fea20837d2e598fb8d4f01d959
.rdata57753658474588803.75497e40dfac2aa919c953afc3e5f529b3350
.data63897636632107522.54749e27b8dce8893e88554c3004d7188b557
.rsrc6758401146881136645.12956bb1991214b9f49c6cb77b45981dbfeec

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:


Total found: 2
d13f99c6b34deee4508a46fb6e697d7b
c73a79c442f40c43136a90a94bc984e5

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Virus connects to the servers at the folowing location(s):

Strings from Dumps

rundll32.exe_1784:

.text

.text

.rdata

.rdata

.data

.data

.rsrc

.rsrc

!"#$%%&'())* ,-./0123456789:;<""=>

!"#$%%&'())* ,-./0123456789:;<""=>

T$%UR

T$%UR

RSSh<RI><pre>RSSh@SI</pre><pre>xSSSh</pre><pre>FTPjKS</pre><pre>FtPj;S</pre><pre>C.PjRV</pre><pre>portuguese-brazilian</pre><pre>GetProcessWindowStation</pre><pre>operator</pre><pre>AutoHotkey</pre><pre>AppsKey</pre><pre>ListHotkeys</pre><pre>KeyHistory</pre><pre>DetectHiddenWindows</pre><pre>SetKeyDelay</pre><pre>KeyWait</pre><pre>GetKeyState</pre><pre>URLDownloadToFile</pre><pre>MsgBox</pre><pre>IfMsgBox</pre><pre>Hotkey</pre><pre>AHK Keybd</pre><pre>Warning: The keyboard and/or mouse hook could not be activated; some parts of the script will not function.</pre><pre>Modifiers (Hook's Logical) = %s</pre><pre>Modifiers (Hook's Physical) = %s</pre><pre>Prefix key is down: %s</pre><pre>NOTE: Only the script's own keyboard events are shown</pre><pre>(not the user's), because the keyboard hook isn't installed.</pre><pre>NOTE: To disable the key history shown below, add the line "#KeyHistory 0" anywhere in the script. The same method can be used to change the size of the history buffer. For example: #KeyHistory 100 (Default is 40, Max is 500)</pre><pre>The oldest are listed first. VK=Virtual Key, SC=Scan Code, Elapsed=Seconds since the previous event. Types: h=Hook Hotkey, s=Suppressed (blocked), i=Ignored because it was generated by an AHK script, a=Artificial, #=Disabled via #IfWinActive/Exist, U=Unicode character (SendInput).</pre><pre>E7 X</pre><pre>X X</pre><pre>%u hotkeys have been received in the last %ums.</pre><pre>(see #MaxHotkeysPerInterval in the help file)</pre><pre>Nonexistent hotkey. The current thread will exit.</pre><pre>Nonexistent hotkey variant (IfWin). The current thread will exit.</pre><pre>Max hotkeys.</pre><pre>The AltTab hotkey "%s" must specify which key (L or R).</pre><pre>The AltTab hotkey "%s" must have exactly one modifier/prefix.</pre><pre>"%s" is not allowed as a prefix key.</pre><pre>"%s" is not a valid key name. The current thread will exit.</pre><pre>SCx</pre><pre>%s[%Iu of %Iu]: %-1.60s%s</pre><pre>%s[Object]: 0x%p</pre><pre>HKEY_LOCAL_MACHINE</pre><pre>HKEY_CLASSES_ROOT</pre><pre>HKEY_CURRENT_CONFIG</pre><pre>HKEY_CURRENT_USER</pre><pre>HKEY_USERS</pre><pre>%s\%s</pre><pre>AutoHotkey2</pre><pre>Critical Error: %s</pre><pre><>=/|^,:*&~!()[] -?."'\;`{}</pre><pre>>AUTOHOTKEY SCRIPT<</pre><pre>Could not extract script from EXE.</pre><pre><>=/|^,:</pre><pre><>=/|^,:. -*&!?~</pre><pre>Join</pre><pre>Hotkeys/hotstrings are not allowed inside functions.</pre><pre>Duplicate hotkey.</pre><pre>Note: The hotkey %s will not be active because it does not exist in the current keyboard layout.</pre><pre>*%s::</pre><pre>if not GetKeyState("%s")</pre><pre>{Blind}%s%s{%s DownTemp}</pre><pre>*%s up::</pre><pre>{Blind}{%s Up}</pre><pre>#InstallKeybdHook</pre><pre>#HotkeyModifierTimeout</pre><pre>#HotkeyInterval</pre><pre>#MaxHotkeysPerInterval</pre><pre>#MaxThreadsPerHotkey</pre><pre>#KeyHistory</pre><pre>#MenuMaskKey</pre><pre>: -*/|&^.</pre><pre><>=/|^,:*&~!()[] -?."</pre><pre>Invalid hotkey.</pre><pre>"%s" requires at least %d parameter%s.</pre><pre>"%s" requires that parameter #%u be non-blank.</pre><pre><>=/|^,:*&~!()[]"</pre><pre><>=/|^,:*&~!()[] -?</pre><pre>Unsupported use of "."</pre><pre><>=/|^,:*&~!()[] -?.</pre><pre>Unsupported parameter default.</pre><pre>HasKey</pre><pre>detecthiddenwindows</pre><pre>keydelay</pre><pre>subkey</pre><pre>thishotkey</pre><pre>priorhotkey</pre><pre>timesincethishotkey</pre><pre>timesincepriorhotkey</pre><pre>Unsupported use of "["</pre><pre>Too many parameters passed to function.</pre><pre>Too few parameters passed to function.</pre><pre>%s%s%s</pre><pre>%%%s%s%s</pre><pre>Script lines most recently executed (oldest first). Press [F5] to refresh. The seconds elapsed between a line and the one after it is in parentheses to the right (if not 0). The bottommost line's elapsed time is the number of seconds since it executed.</pre><pre>u:</pre><pre>if %s %s %s and %s</pre><pre>%s%s %s %s</pre><pre>For %s,%s in %s</pre><pre>%s (%d) : ==> %s</pre><pre>Specifically: %s</pre><pre>in #include file "%s"</pre><pre>%s%s:%s %-1.500s</pre><pre>Specifically: %-1.100s%s</pre><pre>Error at line %u</pre><pre>Line Text: %-1.100s%s</pre><pre>Local Variables for %s()%s</pre><pre>%sGlobal Variables (alphabetical)%s</pre><pre>Window: %s</pre><pre>Keybd hook: %s</pre><pre>Mouse hook: %s</pre><pre>Enabled Timers: %u of %u (%s)</pre><pre>Interrupted threads: %d%s</pre><pre>Paused threads: %d of %d (%d layers)</pre><pre>Modifiers (GetKeyState() now) = %s</pre><pre>Key History has been disabled via #KeyHistory 0.</pre><pre>System verbs unsupported with RunAs. The current thread will exit.</pre><pre>%s %s</pre><pre>.exe.bat.com.cmd.hta</pre><pre>Verb: <%s></pre><pre>Action: <%-0.400s%s>%s</pre><pre>Params: <%-0.400s%s></pre><pre>EndKey:</pre><pre>0xX</pre><pre>0xX</pre><pre>%sLeft</pre><pre>%sTop</pre><pre>%sRight</pre><pre>%sBottom</pre><pre>\AU3_Spy.exe"</pre><pre>%sAU3_Spy.exe"</pre><pre>\AutoHotkey.chm"</pre><pre>%sAutoHotkey.chm"</pre><pre>hh.exe</pre><pre>http://www.autohotkey.com</pre><pre>Could not open URL http://www.autohotkey.com in default browser.</pre><pre>SOFTWARE\AutoHotkey</pre><pre>AutoHotkey v1.0.92.02</pre><pre>set cdaudio door %s wait</pre><pre>open %s type cdaudio alias cd wait shareable</pre><pre>set cd door %s wait</pre><pre>\\.\%c:</pre><pre>Mixer Doesn't Support This Component Type</pre><pre>Component Doesn't Support This Control Type</pre><pre>open "%s" alias AHK_PlayMe</pre><pre>Select File - %s</pre><pre>%s%c%sÊll Files (*.*)%c*.*%c</pre><pre>All Files (*.*)</pre><pre>Text Documents (*.txt)</pre><pre>*.txt</pre><pre>1.0.92.02</pre><pre>\AutoHotkey.exe</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</pre><pre>Pos%s</pre><pre>Len%s</pre><pre>Pos%d</pre><pre>Len%d</pre><pre>Compile error %d at offset %d: %s</pre><pre>RunAs: Missing advapi32.dll. The current thread will exit.</pre><pre>0.0.0.0</pre><pre>InternetOpenUrlA</pre><pre>Select Folder - %s</pre><pre>%u.%u.%u.%u</pre><pre>0xX -</pre><pre>%s%ws</pre><pre>AutoHotkeyGUI</pre><pre>%dGui</pre><pre>Button%s</pre><pre>msctls_hotkey32</pre><pre>Report</pre><pre>Password</pre><pre>vkX</pre><pre>Supported only for the tray menu The current thread will exit.</pre><pre>&Suspend Hotkeys</pre><pre>dd</pre><pre>dddddd</pre><pre>GdiplusShutdown</pre><pre>The following %s name contains an illegal character:</pre><pre>"%-1.300s"%s</pre><pre>The maximum number of MsgBoxes has been reached.</pre><pre>operand of unlimited repeat could match the empty string</pre><pre>POSIX named classes are supported only within a class</pre><pre>erroffset passed as NULL</pre><pre>POSIX collating elements are not supported</pre><pre>this version of PCRE is not compiled with PCRE_UTF8 support</pre><pre>PCRE does not support \L, \l, \N{name}, \U, or \u</pre><pre>support for \P, \p, and \X has not been compiled</pre><pre>this version of PCRE is not compiled with PCRE_UCP support</pre><pre>Error text not found (please report)</pre><pre>WSOCK32.dll</pre><pre>WINMM.dll</pre><pre>VERSION.dll</pre><pre>COMCTL32.dll</pre><pre>GetWindowsDirectoryA</pre><pre>KERNEL32.dll</pre><pre>GetKeyboardLayout</pre><pre>SetWindowsHookExA</pre><pre>UnhookWindowsHookEx</pre><pre>RegisterHotKey</pre><pre>UnregisterHotKey</pre><pre>GetAsyncKeyState</pre><pre>GetKeyboardState</pre><pre>SetKeyboardState</pre><pre>keybd_event</pre><pre>VkKeyScanExA</pre><pre>GetKeyNameTextA</pre><pre>MapVirtualKeyA</pre><pre>EnumChildWindows</pre><pre>EnumWindows</pre><pre>ExitWindowsEx</pre><pre>USER32.dll</pre><pre>GDI32.dll</pre><pre>COMDLG32.dll</pre><pre>RegCloseKey</pre><pre>RegOpenKeyExA</pre><pre>RegQueryInfoKeyA</pre><pre>RegEnumKeyExA</pre><pre>RegCreateKeyExA</pre><pre>RegDeleteKeyA</pre><pre>ADVAPI32.dll</pre><pre>ShellExecuteExA</pre><pre>SHFileOperationA</pre><pre>SHELL32.dll</pre><pre>ole32.dll</pre><pre>OLEAUT32.dll</pre><pre>GetCPInfo</pre><pre>GetProcessHeap</pre><pre>zcÁ</pre><pre>-()[]{}:;'"/\,.?!</pre><pre>%Documents and Settings%\%current user%\Application Data\Microsoft\Office\rundll32.exe</pre><pre>%Documents and Settings%\%current user%\Application Data\Microsoft\Office</pre><pre>#%'''<[[^^\\]</pre><pre>"%<aabm><pre>$-8GGhnsrr}</pre><pre>$-9GGggs}s</pre><pre>%Mgr.RhY4RfE5Qd:f</pre><pre>PA<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.48.05" processorArchitecture="*" name="Microsoft.Windows.AutoHotkey" type="win32"></assemblyIdentity><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo></assembly>PADDINGXXPADDINGPADD</pre><pre>SHELL32.DLL</pre><pre>ShellExecuteA</pre><pre>KERNEL32.DLL</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\001A1260_Rar\rundll32.exe</pre><pre>rundll32.exe</pre><pre>http://www.eri.edu.pk/images/logo.gif</pre><pre>http://fourline.com.tr/images/logo.gif</pre><pre>http://eylenirik.biz/logo.gif</pre><pre>http://fotbalbaska.yc.cz/images/fmain.gif</pre><pre>http://eskimovie.com/images/logo.gif</pre><pre>http://esteticaespacobemestar.com.br/logo.gif</pre><pre>http://forceline.com.tr/images/logo.gif</pre><pre>http://esource.co.in/images/logo2.gif</pre><pre>http://ads.yuppads.com/logo.gif</pre><pre>http://cart133.org/images/main.gif</pre><pre>http://finepearl.com.hk/images/logo.gif</pre><pre>uCo9%f</pre><pre>%F`;O</pre><pre>http://89.11</pre><pre>.info/home.gifI</pre><pre>W.text</pre><pre>L32.dll</pre><pre>^p.At%</pre><pre>rnl.exe?</pre><pre>= =$=(=,=0=4=8=<=@</pre><pre>rv:1.9.2.3)</pre><pre>.NEtCLR</pre><pre>.klkjw:9fqwiBu</pre><pre>f3a.sysB</pre><pre>D6c.pBTab</pre><pre>drfig%s:*:</pre><pre>0}.T&?%x=</pre><pre>~UrlA'W</pre><pre>\'Web%</pre><pre>HTTP)s'PJ</pre><pre>o.ENHCD</pre><pre>KPCKwWEBWUPD</pre><pre>>*?456789:;<=</pre><pre>!"#$%&'()* ,-./01230 0</pre><pre>MSVCRT.dll</pre><pre>WS2_32.dll</pre><pre>.xJnN</pre><pre>C.el3</pre><pre>mscoree.dll</pre><pre>nKERNEL32.DLL</pre><pre>- Attempt to initialize the CRT more than once.</pre><pre>- CRT not initialized</pre><pre>- floating point support not loaded</pre><pre>WUSER32.DLL</pre><pre>&Lines most recently executed</pre><pre>&Hotkeys and their methods</pre><pre>&Key history and script info</pre><pre>&Web Site</pre><b>rundll32.exe_1784_rwx_003D0000_00002000:</b><pre>SHELL32.DLL</pre><pre>ShellExecuteA</pre><pre>KERNEL32.DLL</pre><pre>.rsrc</pre><pre>.text</pre><b>rundll32.exe_1784_rwx_003E0000_00001000:</b><pre>|rundll32.exeM_1784_</pre><b>rundll32.exe_1784_rwx_004AE000_00011000:</b><pre>SHELL32.DLL</pre><pre>ShellExecuteA</pre><pre>KERNEL32.DLL</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\001A1260_Rar\rundll32.exe</pre><pre>rundll32.exe</pre><pre>.rsrc</pre><pre>.text</pre><pre>%Documents and Settings%\%current user%\Application Data\Microsoft\Office\rundll32.exe</pre><pre>http://www.eri.edu.pk/images/logo.gif</pre><pre>http://fourline.com.tr/images/logo.gif</pre><pre>http://eylenirik.biz/logo.gif</pre><pre>http://fotbalbaska.yc.cz/images/fmain.gif</pre><pre>http://eskimovie.com/images/logo.gif</pre><pre>http://esteticaespacobemestar.com.br/logo.gif</pre><pre>http://forceline.com.tr/images/logo.gif</pre><pre>http://esource.co.in/images/logo2.gif</pre><pre>http://ads.yuppads.com/logo.gif</pre><pre>http://cart133.org/images/main.gif</pre><pre>http://finepearl.com.hk/images/logo.gif</pre><pre>uCo9%f</pre><pre>%F`;O</pre><pre>http://89.11</pre><pre>.info/home.gifI</pre><pre>W.text</pre><pre>L32.dll</pre><pre>^p.At%</pre><pre>rnl.exe?</pre><pre>= =$=(=,=0=4=8=<=@</pre><pre>rv:1.9.2.3)</pre><pre>.NEtCLR</pre><pre>.klkjw:9fqwiBu</pre><pre>f3a.sysB</pre><pre>D6c.pBTab</pre><pre>drfig%s:*:</pre><pre>0}.T&?%x=</pre><pre>~UrlA'W</pre><pre>\'Web%</pre><pre>HTTP)s'PJ</pre><pre>o.ENHCD</pre><pre>KPCKwWEBWUPD</pre><pre>>*?456789:;<=</pre><pre>!"#$%&'()* ,-./01230 0</pre><pre>ADVAPI32.dll</pre><pre>MSVCRT.dll</pre><pre>SHELL32.dll</pre><pre>USER32.dll</pre><pre>WS2_32.dll</pre><pre>RegCloseKey</pre><pre>SHFileOperationA</pre><b>rundll32.exe_1784_rwx_010E0000_0108E000:</b><pre>c:\windows</pre><pre>http://www.eri.edu.pk/images/logo.gif</pre><pre>http://fourline.com.tr/images/logo.gif</pre><pre>http://eylenirik.biz/logo.gif</pre><pre>http://fotbalbaska.yc.cz/images/fmain.gif</pre><pre>http://eskimovie.com/images/logo.gif</pre><pre>http://esteticaespacobemestar.com.br/logo.gif</pre><pre>http://forceline.com.tr/images/logo.gif</pre><pre>http://esource.co.in/images/logo2.gif</pre><pre>http://ads.yuppads.com/logo.gif</pre><pre>http://cart133.org/images/main.gif</pre><pre>http://finepearl.com.hk/images/logo.gif</pre><pre>%System%\drivers\likrhn.sys</pre><pre>17054377310</pre><pre>SHELL32.DLL</pre><pre>ShellExecuteA</pre><pre>KERNEL32.DLL</pre><pre>.rsrc</pre><pre>.text</pre><pre>http://89.119.67.154/testo5/</pre><pre>http://kukutrustnet777.info/home.gif</pre><pre>http://kukutrustnet888.info/home.gif</pre><pre>http://kukutrustnet987.info/home.gif</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>h.rdata</pre><pre>H.data</pre><pre>.reloc</pre><pre>ntoskrnl.exe</pre><pre>Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731)</pre><pre>Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache</pre><pre>Software\Microsoft\Windows\CurrentVersion\Internet Settings</pre><pre>Software\Microsoft\Windows\CurrentVersion</pre><pre>http://www.klkjwre9fqwieluoi.info/</pre><pre>http://kukutrustnet777888.info/</pre><pre>Software\Microsoft\Windows\CurrentVersion\policies\system</pre><pre>Software\Microsoft\Windows\ShellNoRoam\MUICache</pre><pre>%s:*:Enabled:ipsec</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced</pre><pre>GdiPlus.dll</pre><pre>http://</pre><pre>ipfltdrv.sys</pre><pre>www.microsoft.com</pre><pre>?%x=%d</pre><pre>&%x=%d</pre><pre>SYSTEM.INI</pre><pre>USER32.DLL</pre><pre>.%c%s</pre><pre>\\.\amsint32</pre><pre>NTDLL.DLL</pre><pre>autorun.inf</pre><pre>ADVAPI32.DLL</pre><pre>win%s.exe</pre><pre>%s.exe</pre><pre>WININET.DLL</pre><pre>InternetOpenUrlA</pre><pre>avast! Web Scanner</pre><pre>Avira AntiVir Premium WebGuard</pre><pre>cmdGuard</pre><pre>cmdAgent</pre><pre>Eset HTTP Server</pre><pre>ProtoPort Firewall service</pre><pre>SpIDer FS Monitor for Windows NT</pre><pre>Symantec Password Validation</pre><pre>WebrootDesktopFirewallDataService</pre><pre>WebrootFirewall</pre><pre>%d%d.tmp</pre><pre>SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList</pre><pre>%s\%s</pre><pre>%s\Software\Microsoft\Windows\CurrentVersion\Ext\Stats</pre><pre>Software\Microsoft\Windows\CurrentVersion\Ext\Stats</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects</pre><pre>Explorer.exe</pre><pre>A2CMD.</pre><pre>ASHWEBSV.</pre><pre>AVGCC.AVGCHSVX.</pre><pre>DRWEB</pre><pre>DWEBLLIO</pre><pre>DWEBIO</pre><pre>FSGUIEXE.</pre><pre>MCVSSHLD.</pre><pre>NPFMSG.</pre><pre>SYMSPORT.</pre><pre>WEBSCANX.</pre><pre>.adata</pre><pre>M_%d_</pre><pre>%c%d_%d</pre><pre>?456789:;<=</pre><pre>!"#$%&'()* ,-./0123</pre><pre>GetProcessHeap</pre><pre>GetWindowsDirectoryA</pre><pre>RegEnumKeyExA</pre><pre>RegDeleteKeyA</pre><pre>RegOpenKeyExA</pre><pre>RegCreateKeyA</pre><pre>RegCloseKey</pre><pre>SHFileOperationA</pre><pre>&3&3&3&389</pre><pre>.rdata</pre><pre>.data</pre><pre>rnl.exe?</pre><pre>= =$=(=,=0=4=8=<=@</pre><pre>rv:1.9.2.3)</pre><pre>.NEtCLR</pre><pre>.klkjw:9fqwiBu</pre><pre>f3a.sysB</pre><pre>D6c.pBTab</pre><pre>drfig%s:*:</pre><pre>0}.T&?%x=</pre><pre>~UrlA'W</pre><pre>\'Web%</pre><pre>HTTP)s'PJ</pre><pre>o.ENHCD</pre><pre>KPCKwWEBWUPD</pre><pre>>*?456789:;<=</pre><pre>!"#$%&'()* ,-./01230 0</pre><pre>ADVAPI32.dll</pre><pre>MSVCRT.dll</pre><pre>SHELL32.dll</pre><pre>WS2_32.dll</pre><b>Explorer.EXE_840_rwx_01450000_00002000:</b><pre>SHELL32.DLL</pre><pre>ShellExecuteA</pre><pre>KERNEL32.DLL</pre><pre>.rsrc</pre><pre>.text</pre><b>Explorer.EXE_840_rwx_01D60000_00001000:</b><pre>|explorer.exeM_840_</pre></aabm></pre></pre></RI>