Virus.Win32.Sality_662fc7fa7b

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Virus creates the following process(es):

wmic.exe:2284
biclient.exe:1708
biclient.exe:1340
UpdateCheckerSetup.exe:1328
%original file name%.exe:3336

The Virus injects its code into the following process(es):

update_checker.exe:2232
biclient.exe:1248
ctfmon.exe:252
4.tmp:4080

File activity

The process wmic.exe:2284 makes changes in the file system.

The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\FilesFrog Update Checker\TempWmicBatchFile.bat (0 bytes)

The process update_checker.exe:2232 makes changes in the file system.

The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\ntuser.dat.LOG (29280 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (26996 bytes)

The process biclient.exe:1708 makes changes in the file system.

The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\cd0f26e15f03dd4c8cfe826143cf376a[1].txt (26899 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\storage[2].swf (773 bytes)

The process biclient.exe:1248 makes changes in the file system.

The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp.7 (9760 bytes)
%Documents and Settings%\%current user%\Cookies\L8JU4RSI.txt (547 bytes)
%Documents and Settings%\%current user%\Cookies\EX9WZQ4Y.txt (547 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\ga[1].js (22940 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\tokyo_sprite_full[1].png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp (71020 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\ajax[1].txt (773 bytes)
%Documents and Settings%\%current user%\Cookies\XHEQ03NB.txt (115 bytes)
%Documents and Settings%\%current user%\Cookies\TNYVAA1F.txt (547 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\0e11044f561def4bac902d3d5a6c4169[1].txt (31595 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\tokyoWhiteSparkMiddleBG[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Cookies\QX6HVGMC.txt (285 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\storage[1].swf (773 bytes)
%Documents and Settings%\%current user%\Cookies\U6PVXK8I.txt (547 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp.1 (9760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp.0 (9760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp.3 (9760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp.2 (9760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp.5 (9760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp.4 (9760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp.6 (9760 bytes)
%Documents and Settings%\%current user%\Cookies\F330J03M.txt (547 bytes)
%Documents and Settings%\%current user%\Cookies\HQNSO3HB.txt (547 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\4CVJKYRT.txt (547 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\desktop.ini (67 bytes)

The Virus deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\HQNSO3HB.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\L8JU4RSI.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp.6 (0 bytes)
%Documents and Settings%\%current user%\Cookies\QX6HVGMC.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\U6PVXK8I.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\EX9WZQ4Y.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp.1 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp.0 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp.3 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp.2 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp.5 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp.4 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp.7 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\ajax[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\XHEQ03NB.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\F330J03M.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\TNYVAA1F.txt (0 bytes)

The process biclient.exe:1340 makes changes in the file system.

The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\tokyo_sprite_full[1].png (893 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\storage[1].swf (773 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UpdateCheckerSetup.exe.6 (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UpdateCheckerSetup.exe.4 (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UpdateCheckerSetup.exe.5 (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\ajax-bidl[1].txt (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UpdateCheckerSetup.exe.7 (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UpdateCheckerSetup.exe.0 (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UpdateCheckerSetup.exe.1 (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UpdateCheckerSetup.exe.2 (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UpdateCheckerSetup.exe.3 (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UpdateCheckerSetup.exe (12251 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\8c1a1a3c329da9488dc4f5116e78fda0[1].txt (24432 bytes)

The Virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\UpdateCheckerSetup.exe.4 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UpdateCheckerSetup.exe.5 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UpdateCheckerSetup.exe.6 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UpdateCheckerSetup.exe.7 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UpdateCheckerSetup.exe.0 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UpdateCheckerSetup.exe.1 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UpdateCheckerSetup.exe.2 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UpdateCheckerSetup.exe.3 (0 bytes)

The process UpdateCheckerSetup.exe:1328 makes changes in the file system.

The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Start Menu\Programs\FilesFrog Update Checker\Check for Updates.lnk (1 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\FilesFrog Update Checker\Uninstall.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nslA.tmp (10215 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FilesFrog Update Checker\update_checker.exe (7192 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FilesFrog Update Checker\uninstall.exe (1328 bytes)

The Virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsv9.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nslB.tmp (0 bytes)

The process 4.tmp:4080 makes changes in the file system.

The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\ajs[1].php (3313 bytes)
%Documents and Settings%\All Users\Desktop\FLV Video Player.lnk (721 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse6.tmp\modern-header.bmp (3072 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse6.tmp\UserInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\offer[1].js (5223 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014032120140322\index.dat (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse6\license.txt (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse6.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\%current user%\Cookies\QKFDH3FS.txt (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\init_container[1] (752 bytes)
%Documents and Settings%\%current user%\Cookies\3053U27W.txt (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse6.tmp\UAC.dll (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse6\Helper.dll (36965 bytes)
%Program Files%\FLV Video Player\log.log (7453 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\offer[1].css (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse6\soffer.dll (2243 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\init_offer[1].htm (414 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\init_offer[2].htm (414 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse6.tmp\registry.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\banner[1].jpg (4364 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse6.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\init_container[1] (752 bytes)

The Virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013041520130416\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013040820130415 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\init_container[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013041520130416 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013040820130415\index.dat (0 bytes)
%Documents and Settings%\%current user%\Cookies\QKFDH3FS.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse6.tmp (0 bytes)

The process %original file name%.exe:3336 makes changes in the file system.

The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\config.ini (102 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\biclient.exe (8560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000685DC_rar\%original file name%.exe (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn2.tmp (6436 bytes)

The Virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\biclient.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\config.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd3.tmp (0 bytes)
%WinDir%\67dae (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc1.tmp (0 bytes)

Registry activity

The process wmic.exe:2284 makes changes in the system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "98 6B 9F D1 FE A9 39 89 61 93 EB C1 A9 03 08 EF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process update_checker.exe:2232 makes changes in the system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD 7C 42 66 A1 C0 09 D3 81 73 DD CC 03 8F 53 99"

[HKCU\Software\Somoto\SDP]
"affid" = "network_smb_filesflash"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Somoto\SDP]
"flags" = "32"
"nc" = "Type: REG_QWORD, Length: 8"
"muid" = "cda9ea544c42f5c076ed65a6b085ab29"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCR\sdp]
"(Default)" = "URL:SDP Protocol"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Somoto\SDP]
"uid" = "be617591a98f744b93219419373f5f71"

[HKCU\Software\Microsoft\Internet Explorer\ProtocolExecute\sdp]
"WarnOnOpen" = "0"

[HKCR\sdp]
"URL Protocol" = ""

[HKCR\sdp\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FilesFrog Update Checker\update_checker.exe /protocol %1"

To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"SDP" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FilesFrog Update Checker\update_checker.exe /auto"

The process biclient.exe:1708 makes changes in the system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "ED 69 23 DF 80 27 3F E4 05 0F B1 45 92 39 0B 57"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

The Virus modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Virus modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Virus modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Virus deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process biclient.exe:1248 makes changes in the system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BC E3 6A B1 E1 E7 BC 6D C8 0F 69 8E 98 55 53 E0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 40 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

The Virus modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Virus modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Virus modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Virus deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process biclient.exe:1340 makes changes in the system registry.

The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "92 01 E8 87 17 B1 10 B4 29 EB DA FA 55 17 14 9C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 43 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

The Virus modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Virus modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Virus modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"network_smb_filesflash" = ""

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Virus deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process ctfmon.exe:252 makes changes in the system registry.

The Virus deletes the following value(s) in system registry:

The Virus disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"

The process UpdateCheckerSetup.exe:1328 makes changes in the system registry.

The Virus creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f3-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FilesFrog Update Checker]
"DisplayIcon" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FilesFrog Update Checker\uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FilesFrog Update Checker]
"UninstallString" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FilesFrog Update Checker\uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FilesFrog Update Checker]
"NoModify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FilesFrog Update Checker]
"NoRepair" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FilesFrog Update Checker]
"DisplayName" = "FilesFrog Update Checker"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f2-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "61 47 F8 95 BA 71 45 9D DC 65 9C 86 E8 85 97 5A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{773a730e-74fb-11e2-b597-000c293bdf2f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f5-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

The process 4.tmp:4080 makes changes in the system registry.

The Virus creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014032120140322]
"CacheRepair" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f3-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014032120140322]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014032120140322]
"CacheLimit" = "8192"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f2-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Internet Explorer\Main\WindowsSearch]
"Version" = "WS not installed"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 42 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E FA 0D BF 79 89 DA B3 39 EA 90 71 5E CC 38 40"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCR\Applications\4.tmp]
"IsHostApp" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{773a730e-74fb-11e2-b597-000c293bdf2f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f5-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014032120140322]
"CachePrefix" = ":2014032120140322:"
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014032120140322"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Virus modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Virus modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Virus modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Virus deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013041520130416]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013040820130415]

The Virus deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:3336 makes changes in the system registry.

The Virus creates and/or sets the following values in system registry:

[HKCU\Software\Jmicbaaosmd]
"21_314" = "198369541"
"21_315" = "2565714409"
"21_316" = "1704520899"
"21_317" = "2177953948"
"21_310" = "3255381987"
"21_311" = "1430002919"
"21_312" = "2692787077"
"21_313" = "4149981459"
"21_318" = "3799050826"
"21_319" = "2590368752"
"21_228" = "2790688997"
"21_229" = "3451992211"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKCU\Software\Jmicbaaosmd]
"21_220" = "830915321"
"21_221" = "4072426429"
"21_222" = "1341551914"
"21_223" = "1964966719"
"21_224" = "2992116602"
"21_225" = "1617881508"
"21_226" = "490556312"
"21_227" = "1576810620"
"21_119" = "1854942964"
"24_113" = "3991821586"
"24_112" = "3082298848"
"24_111" = "2172776110"
"24_110" = "1263253372"
"24_117" = "3334945242"
"24_116" = "2425422504"
"24_115" = "1515899766"
"24_114" = "606377028"
"24_119" = "859023422"
"24_118" = "4244467980"
"22_381" = "2930785504"
"21_138" = "2930296892"
"21_139" = "2829924066"
"21_134" = "1448195425"
"21_135" = "1934624001"
"21_136" = "2145901388"
"21_137" = "207122105"
"21_130" = "2817874604"
"21_131" = "2934220461"
"21_132" = "2165212274"
"21_258" = "3969002965"
"23_381" = "2947764035"
"23_380" = "2038072337"
"23_383" = "438303207"
"23_382" = "3857004213"
"23_385" = "2257217563"
"23_384" = "1347526953"
"21_253" = "3633827845"
"21_78" = "2931130341"
"21_79" = "2631068127"
"21_76" = "2645557355"
"21_77" = "1258952635"
"21_74" = "2573025028"
"21_252" = "882479750"
"21_72" = "2544558182"
"21_73" = "3484554299"
"21_70" = "3295275765"
"21_71" = "3791887716"
"22_403" = "1465446662"
"22_402" = "555925452"
"22_401" = "3941361462"
"22_400" = "3031833638"
"22_59" = "2122230974"
"22_58" = "1212718138"
"22_55" = "2779104516"
"22_54" = "1869592298"
"22_57" = "303191572"
"22_56" = "3688631370"
"22_51" = "3435979856"
"22_50" = "2526470670"
"22_53" = "960065934"
"22_52" = "50537916"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKCU\Software\Jmicbaaosmd]
"23_172" = "1835958193"
"23_173" = "2745181923"
"23_170" = "17026333"
"23_171" = "926266447"
"23_176" = "1145477193"
"23_177" = "2055160763"
"23_174" = "3655002581"
"23_175" = "235720967"
"23_178" = "2964392685"
"23_179" = "3874225631"
"22_388" = "707506378"
"24_278" = "3739217996"
"24_279" = "353773438"
"24_272" = "2577048864"
"24_273" = "3486571602"
"24_270" = "758003388"
"24_271" = "1667526126"
"24_276" = "1920172520"
"24_277" = "2829695258"
"24_274" = "101127044"
"24_275" = "1010649782"
"22_348" = "2981303007"
"22_349" = "3890815294"
"22_344" = "3638180457"
"22_345" = "252739340"
"22_346" = "1162248355"
"22_347" = "2071774562"
"22_340" = "87724"
"22_341" = "909614253"
"22_342" = "1819126251"
"22_343" = "2728652100"
"23_301" = "3166539747"
"23_300" = "2257306801"
"23_303" = "724057607"
"23_302" = "4076238549"
"23_305" = "2543102139"
"23_304" = "1633870153"
"23_307" = "34036447"
"23_306" = "3452867565"
"23_309" = "1853093235"
"23_308" = "943260161"
"21_307" = "760501197"
"21_306" = "83344398"
"21_305" = "1003352364"
"21_304" = "3471340815"
"21_303" = "2902959707"
"21_302" = "2170639426"
"21_301" = "2846745779"
"21_300" = "1689156325"
"22_387" = "4092945788"
"21_309" = "3484271840"
"21_308" = "507908762"
"24_290" = "1768588964"
"24_291" = "2678111702"
"24_292" = "3587634440"
"21_238" = "3020392969"
"24_294" = "1111712620"
"24_295" = "2021235358"
"24_296" = "2930758096"
"24_297" = "3840280834"
"21_233" = "1809629761"
"21_232" = "4114837773"
"21_231" = "104786848"
"21_230" = "3058023349"
"21_237" = "64539235"
"21_236" = "590333094"
"21_235" = "454229434"
"21_234" = "491748347"
"24_39" = "1111648414"
"24_38" = "202125676"
"24_31" = "2425401102"
"24_30" = "1515878364"
"24_33" = "4244446578"
"24_32" = "3334923840"
"24_35" = "1768524758"
"24_34" = "859002020"
"24_37" = "3587570234"
"24_36" = "2678047496"
"24_126" = "2930715292"
"24_127" = "3840238030"
"24_124" = "1111669816"
"24_125" = "2021192554"
"24_122" = "3587591636"
"24_123" = "202147078"
"23_18" = "3469511597"
"23_19" = "117797535"
"23_16" = "1650465033"
"23_17" = "2560278651"
"23_14" = "4159991445"
"23_15" = "741233095"
"23_12" = "2341076081"
"23_13" = "3250825123"
"24_128" = "454793472"
"24_129" = "1364316210"
"21_129" = "3322028795"
"21_128" = "2963229215"
"21_127" = "1316874688"
"21_126" = "2306504373"
"21_125" = "160173829"
"21_124" = "139595281"
"21_123" = "387847485"
"21_122" = "4277817295"
"21_121" = "216511180"
"21_120" = "4230906552"
"23_399" = "2139319495"
"21_133" = "2738069579"
"22_48" = "707415245"
"22_49" = "1616938022"
"22_42" = "3840219070"
"22_43" = "454777865"
"22_40" = "2021165495"
"22_41" = "2930689458"
"22_46" = "3183341727"
"22_47" = "4092869780"
"22_44" = "1364288404"
"22_45" = "2273814067"
"23_338" = "2459404845"
"23_339" = "3368582431"
"24_389" = "1617026810"
"21_362" = "3708386575"
"23_330" = "3772795997"
"24_228" = "1212754056"
"23_165" = "4059232531"
"23_164" = "3149411873"
"23_167" = "1549626295"
"23_166" = "639934533"
"23_161" = "421256283"
"23_160" = "3772847465"
"23_163" = "2240171775"
"23_162" = "1330481037"
"23_169" = "3368622635"
"23_168" = "2459390713"
"24_269" = "4143447946"
"24_268" = "3233925208"
"24_265" = "505356994"
"24_264" = "3890801552"
"24_267" = "2324402470"
"24_266" = "1414879732"
"24_261" = "1162233338"
"24_260" = "252710600"
"24_263" = "2981278814"
"24_262" = "2071756076"
"22_359" = "101152786"
"22_358" = "3486595716"
"22_357" = "2577064043"
"22_356" = "1667552289"
"22_355" = "758028961"
"22_354" = "4143465442"
"22_353" = "3233943526"
"22_352" = "2324430244"
"22_351" = "1414903458"
"22_350" = "505373563"
"21_75" = "1584276764"
"23_374" = "842516773"
"23_375" = "1751756823"
"23_376" = "2661448537"
"23_377" = "3570672267"
"23_370" = "1532537965"
"23_371" = "2442303327"
"23_372" = "3351993985"
"23_373" = "4261216755"
"23_378" = "219026941"
"23_379" = "1128324399"
"23_208" = "219132553"
"23_209" = "1128293883"
"23_200" = "1532523833"
"23_201" = "2442280043"
"23_202" = "3351570269"
"23_203" = "4261326479"
"23_204" = "842043889"
"23_205" = "1751734563"
"23_206" = "2661482517"
"23_207" = "3570780999"
"21_363" = "1613828443"
"21_338" = "4286308153"
"21_339" = "3156636805"
"21_332" = "2122275357"
"21_333" = "769830237"
"21_330" = "1927494415"
"21_331" = "2244195605"
"21_336" = "722810902"
"21_337" = "3377014428"
"21_334" = "2117094026"
"21_335" = "4048721519"
"24_283" = "3991864390"
"24_282" = "3082341652"
"24_281" = "2172818914"
"24_280" = "1263296176"
"24_287" = "3334988046"
"24_286" = "2425465308"
"24_285" = "1515942570"
"24_284" = "606419832"
"21_206" = "4210957417"
"21_207" = "4253248793"
"21_204" = "3477979747"
"21_205" = "1827943302"
"21_202" = "1887743695"
"21_203" = "3941212771"
"21_200" = "1291585196"
"21_201" = "3031638012"
"24_26" = "2172754708"
"24_27" = "3082277446"
"24_24" = "353709232"
"24_25" = "1263231970"
"24_22" = "2829631052"
"24_23" = "3739153790"
"24_20" = "1010585576"
"24_21" = "1920108314"
"24_28" = "3991800184"
"24_29" = "606355626"
"21_112" = "1540063150"
"21_113" = "569878025"
"23_69" = "2644478547"
"23_68" = "1734722401"
"21_116" = "2719558753"
"21_117" = "2634335657"
"21_114" = "218418582"
"21_115" = "373752776"
"23_63" = "1448410983"
"23_62" = "539112501"
"23_61" = "3957869763"
"23_60" = "3048703377"
"23_67" = "825432127"
"23_66" = "4177088717"
"23_65" = "3267848603"
"23_64" = "2358159017"
"22_9" = "3890734415"
"22_8" = "2981211165"
"22_5" = "252642935"
"22_4" = "3638085957"
"22_7" = "2071697363"
"22_6" = "1162174113"
"22_1" = "909517503"
"22_0" = "5517"
"22_3" = "2728570907"
"22_2" = "1819048937"
"21_18" = "505839807"
"21_19" = "975452888"
"21_10" = "2921620297"
"21_11" = "604692855"
"21_12" = "668986389"
"21_13" = "1805967427"
"21_14" = "2072592997"
"21_15" = "1055094704"
"21_16" = "2755085180"
"21_17" = "4107115022"
"23_190" = "1027579189"
"22_183" = "3233898775"
"21_367" = "2107844203"
"22_180" = "505335926"
"23_27" = "3065297007"
"22_181" = "1414861224"
"23_26" = "2156065085"
"22_186" = "1667498811"
"23_25" = "1246235083"
"23_195" = "1246716223"
"24_316" = "3941343672"
"23_196" = "2155948129"
"23_23" = "3755843415"
"22_185" = "757986474"
"23_22" = "2846610533"
"23_103" = "3469958967"
"24_313" = "1212775458"
"23_102" = "2560268229"
"23_20" = "1027548609"
"23_101" = "1650502803"
"23_100" = "741270945"
"23_107" = "2846522319"
"23_106" = "1936830621"
"23_105" = "1027590571"
"23_104" = "117769849"
"21_279" = "1476590519"
"24_72" = "1061127696"
"24_360" = "1010671184"
"24_361" = "1920193922"
"24_362" = "2829716660"
"24_363" = "3739239398"
"24_364" = "353794840"
"24_365" = "1263317578"
"24_366" = "2172840316"
"24_367" = "3082363054"
"23_4" = "3655055073"
"23_5" = "235698643"
"23_6" = "1145446661"
"23_7" = "2054744183"
"23_0" = "17001001"
"23_1" = "926244123"
"23_2" = "1835992141"
"23_3" = "2745290687"
"23_8" = "2964509625"
"23_9" = "3873741547"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f3-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Jmicbaaosmd]
"23_198" = "3975010949"
"23_199" = "623349239"
"22_188" = "3486552354"
"22_189" = "101101341"
"22_182" = "2324376422"
"23_191" = "1936737383"
"23_192" = "2846494633"
"23_193" = "3755800219"
"23_194" = "337033677"
"22_187" = "2577025874"
"22_184" = "4143430501"
"23_197" = "3065713491"
"22_298" = "454842009"
"22_299" = "1364353946"
"22_296" = "2930756004"
"22_297" = "3840286387"
"22_294" = "1111717569"
"22_295" = "2021229971"
"22_292" = "3587630684"
"22_293" = "202187484"
"22_290" = "1768595342"
"22_291" = "2678104357"

"22_362" = "2829719624"
"22_363" = "3739245367"
"22_360" = "1010665048"
"22_361" = "1920191288"
"22_366" = "2172845350"
"22_367" = "3082366458"
"22_364" = "353791720"
"22_365" = "1263313830"
"22_368" = "3991880296"
"22_369" = "606443950"
"22_160" = "3789709874"
"22_161" = "404268294"
"22_162" = "1313800028"
"22_163" = "2223321830"
"22_164" = "3132835130"
"22_165" = "4042361713"
"22_166" = "656921814"
"22_167" = "1566448132"
"22_168" = "2475958719"
"22_169" = "3385485296"
"23_367" = "3065662087"
"23_366" = "2155971413"
"23_365" = "1246746723"
"23_364" = "336924977"
"23_363" = "3756206543"
"23_362" = "2846451357"
"23_361" = "1936768939"
"23_360" = "1027535993"
"23_369" = "623306043"
"23_368" = "3974905289"
"23_219" = "1633836527"
"23_218" = "724069053"
"23_213" = "437814963"
"23_212" = "3857112897"
"23_211" = "2947290143"
"23_210" = "2038050093"
"23_217" = "4076315467"
"23_216" = "3166566425"
"23_215" = "2257268951"
"23_214" = "1347504613"
"21_329" = "228443755"
"21_328" = "2925564514"
"21_325" = "3129052338"
"21_324" = "432972574"
"21_327" = "985252364"
"21_326" = "844578801"
"21_321" = "1878784131"
"21_320" = "4243214041"
"21_323" = "1815405095"
"21_322" = "4096131743"
"24_53" = "960064858"
"24_52" = "50542120"
"24_51" = "3435986678"
"24_50" = "2526463940"
"24_57" = "303188514"
"24_56" = "3688633072"
"24_55" = "2779110334"
"24_54" = "1869587596"
"24_59" = "2122233990"
"24_58" = "1212711252"
"21_211" = "1973453694"
"21_210" = "1728469375"
"21_213" = "2402202144"
"21_212" = "1176401891"
"21_215" = "2894898752"
"21_214" = "2776163231"
"21_217" = "1490729535"
"21_216" = "2982245356"
"21_219" = "1844118972"
"21_218" = "3988484809"
"21_7" = "124309517"
"21_105" = "515938035"
"21_104" = "208631183"
"21_107" = "2057229751"
"21_106" = "102426057"
"24_148" = "1465379048"
"24_149" = "2374901786"
"21_103" = "36296669"
"21_102" = "269759644"
"24_144" = "2122255392"
"24_145" = "3031778130"
"24_146" = "3941300868"
"24_147" = "555856310"
"24_140" = "2779131736"
"21_108" = "114721388"
"24_142" = "303209916"
"24_143" = "1212732654"
"21_9" = "1275815323"
"22_208" = "202163068"
"21_25" = "1761441157"
"21_24" = "3610011406"
"21_27" = "1134466461"
"21_26" = "4285516377"
"21_21" = "2431469476"
"21_20" = "533870759"
"21_23" = "64627726"
"21_22" = "3091985906"
"21_29" = "1829357595"
"21_28" = "495669329"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKCU\Software\Jmicbaaosmd]
"23_189" = "117822915"
"23_188" = "3469992593"
"22_199" = "606401393"
"22_198" = "3991839384"
"23_183" = "3250724503"
"23_182" = "2340968357"
"23_181" = "1431727219"
"23_180" = "522036481"
"23_187" = "2560179119"
"23_186" = "1650946173"
"22_193" = "3739204846"
"22_192" = "2829664330"
"22_281" = "2172814425"
"22_280" = "1263292220"
"22_283" = "3991872846"
"22_282" = "3082343468"
"22_285" = "1515939966"
"22_284" = "606413340"
"22_287" = "3334994261"
"22_286" = "2425468872"
"22_289" = "859067850"
"22_288" = "4244506837"
"22_375" = "1768604834"
"22_374" = "859093091"
"22_377" = "3587660118"
"22_376" = "2678142138"
"22_371" = "2425481372"
"22_370" = "1515972283"
"22_373" = "4244536565"
"22_372" = "3335007676"
"22_379" = "1111731487"
"22_378" = "202205869"
"22_173" = "2728614671"
"22_172" = "1819084829"
"22_171" = "909560110"
"22_170" = "49068"
"22_177" = "2071738808"
"22_176" = "1162207876"
"22_175" = "252683118"
"22_174" = "3638139831"
"22_179" = "3890775472"
"22_178" = "2981261804"
"23_358" = "3469886917"
"23_359" = "117706039"
"23_352" = "2340982505"
"23_353" = "3250680283"
"23_350" = "521935989"
"23_351" = "1431750567"
"23_356" = "1650961313"
"23_357" = "2560201363"
"23_354" = "4160436493"
"23_355" = "741204095"
"23_228" = "1229603489"
"23_229" = "2138846611"
"23_226" = "3672100877"
"23_227" = "319921023"
"23_224" = "1853039081"
"23_225" = "2762336475"
"23_222" = "33601397"
"23_223" = "943292071"
"23_220" = "2543060177"
"23_221" = "3452881923"
"24_40" = "2021171152"
"24_41" = "2930693890"
"24_42" = "3840216628"
"24_43" = "454772070"
"24_44" = "1364294808"
"24_45" = "2273817546"
"24_46" = "3183340284"
"24_47" = "4092863022"
"24_48" = "707418464"
"24_49" = "1616941202"
"21_264" = "4177316141"
"21_265" = "1315744692"
"21_266" = "1750832513"
"21_267" = "1523600284"
"21_260" = "3951426747"
"21_261" = "4185985867"
"21_262" = "3266001047"
"21_263" = "2347779298"
"21_268" = "2024115471"
"21_269" = "385839158"
"23_45" = "2256853475"
"23_44" = "1347557041"
"23_47" = "4076292103"
"23_46" = "3166601429"
"23_41" = "2947398955"
"23_40" = "2038167033"
"23_43" = "437792591"
"23_42" = "3857081373"
"24_157" = "1061149098"
"24_156" = "151626360"
"24_155" = "3537070918"
"24_154" = "2627548180"
"24_153" = "1718025442"
"24_152" = "808502704"
"24_151" = "4193947262"
"24_150" = "3284424524"
"21_350" = "1423947223"
"21_351" = "695311180"
"21_352" = "1547572745"
"21_353" = "4102448548"
"21_354" = "3394436583"
"21_355" = "2475205503"
"21_356" = "1521653460"
"21_357" = "2622163677"
"21_32" = "2453312797"
"21_33" = "2584463302"
"21_30" = "1628900192"
"21_31" = "1292567928"
"21_36" = "673882630"
"21_37" = "1627537514"
"21_34" = "2142294950"
"21_35" = "2316421795"
"21_38" = "2589360550"
"21_39" = "2027648291"
"22_91" = "1162162678"
"22_90" = "252670643"
"22_93" = "2981238601"
"22_92" = "2071708159"
"22_95" = "505310771"
"22_94" = "3890763924"
"22_97" = "2324364082"
"22_96" = "1414834460"
"22_99" = "4143401121"
"22_98" = "3233889833"
"23_78" = "2240264981"
"23_79" = "3149423175"
"21_101" = "3973559527"
"21_100" = "267007831"
"24_63" = "1465357646"
"23_70" = "3553656197"
"23_71" = "134882551"
"23_72" = "1044180025"
"24_60" = "3031756728"
"22_389" = "1617022234"
"23_73" = "1953945451"
"22_380" = "2021259237"
"21_109" = "1444538359"
"22_382" = "3840297891"
"22_383" = "454865558"
"22_384" = "1364385072"
"22_385" = "2273909055"
"22_386" = "3183420266"
"24_141" = "3688654474"
"22_146" = "3941295083"
"22_147" = "555853900"
"22_144" = "2122258471"
"22_145" = "3031781555"
"22_142" = "303204252"
"22_143" = "1212730841"
"22_140" = "2779133885"
"22_141" = "3688657570"
"23_77" = "1330507811"
"22_148" = "1465370862"
"22_149" = "2374906093"
"23_349" = "3874116867"
"23_348" = "2964352465"
"23_345" = "236128331"
"23_344" = "3654893849"
"23_347" = "2055191279"
"23_346" = "1145435069"
"23_341" = "926216115"
"23_340" = "16917569"
"23_343" = "2745211351"
"23_342" = "1835980517"
"24_388" = "707504072"

"24_382" = "3840302236"
"24_383" = "454857678"
"24_380" = "2021256760"
"24_381" = "2930779498"
"24_386" = "3183425892"
"24_387" = "4092948630"
"24_384" = "1364380416"
"24_385" = "2273903154"
"23_231" = "3957892151"
"23_230" = "3048668357"
"23_233" = "1448826539"
"23_232" = "539062137"
"23_235" = "3267870927"
"23_234" = "2358057373"
"23_237" = "825389923"
"23_236" = "4177102897"
"23_239" = "2644438407"
"23_238" = "1734621781"
"21_277" = "260535146"
"21_276" = "449662550"
"21_275" = "3880404491"
"21_274" = "2739039992"
"24_79" = "3132819566"
"24_78" = "2223296828"
"21_271" = "27945311"
"21_270" = "4185908745"
"24_75" = "3789695910"
"24_74" = "2880173172"
"24_77" = "1313774090"
"24_76" = "404251352"
"24_71" = "151604958"
"24_70" = "3537049516"
"24_73" = "1970650434"
"21_278" = "1567817201"
"23_52" = "33577985"
"23_53" = "943327091"
"23_50" = "2543169005"
"23_51" = "3452933343"
"23_56" = "3672078553"
"23_57" = "319889419"
"23_54" = "1852624549"
"23_55" = "2762387863"
"24_368" = "3991885792"
"24_369" = "606441234"
"23_58" = "1229712253"
"23_59" = "2138952367"
"24_162" = "1313795492"
"24_163" = "2223318230"
"24_160" = "3789717312"
"24_161" = "404272754"
"24_166" = "656919148"
"24_167" = "1566441886"
"24_164" = "3132840968"
"24_165" = "4042363706"
"24_168" = "2475964624"
"24_169" = "3385487362"
"22_88" = "2728586645"
"22_89" = "3638109643"
"22_86" = "909547010"
"22_87" = "1819074372"
"22_84" = "3385460432"
"22_85" = "17834"
"22_82" = "1566424046"
"22_83" = "2475946535"
"22_80" = "4042335080"
"22_81" = "656894584"
"24_9" = "3890737346"
"24_8" = "2981214608"
"24_7" = "2071691870"
"24_6" = "1162169132"
"23_48" = "724120393"
"22_194" = "353750032"
"22_399" = "2122322234"
"22_398" = "1212797469"
"22_393" = "960145162"
"22_392" = "50629596"
"22_391" = "3436076625"
"22_390" = "2526545642"
"22_397" = "303269844"
"22_396" = "3688725183"
"22_395" = "2779198120"
"22_394" = "1869671204"
"22_159" = "2880200304"
"22_158" = "1970669625"
"22_151" = "4193947799"
"22_150" = "3284420376"
"22_153" = "1718021465"
"22_152" = "808506601"
"22_155" = "3537072882"
"22_154" = "2627546228"
"22_157" = "1061143084"
"22_156" = "151631898"
"24_399" = "2122319598"
"24_398" = "1212796860"
"24_395" = "2779195942"
"24_394" = "1869673204"
"24_397" = "303274122"
"24_396" = "3688718680"
"24_391" = "3436072286"
"24_390" = "2526549548"
"24_393" = "960150466"
"24_392" = "50627728"
"23_244" = "2863657345"
"23_245" = "3772889331"
"23_246" = "421158949"
"23_247" = "1330391831"
"23_240" = "3553678537"
"23_241" = "134913083"
"23_242" = "1044596589"
"23_243" = "1953828447"
"23_248" = "2240156249"
"23_249" = "3149448587"
"23_396" = "3671985009"
"23_397" = "319877795"
"24_68" = "1718004040"
"21_249" = "759071083"
"23_392" = "34074297"
"23_393" = "943313387"
"23_390" = "2543549445"
"23_391" = "3452774263"
"21_242" = "3948116217"
"21_243" = "365825101"
"21_240" = "192491857"
"21_241" = "1371146414"
"21_246" = "73376946"
"21_247" = "925285623"
"21_244" = "2834667104"
"21_245" = "3529825249"
"24_373" = "4244532186"
"24_372" = "3335009448"
"24_371" = "2425486710"
"24_370" = "1515963972"
"24_377" = "3587655842"
"24_376" = "2678133104"
"24_375" = "1768610366"
"24_374" = "859087628"
"24_379" = "1111734022"
"24_378" = "202211284"
"21_398" = "3803105037"
"21_399" = "3730601139"
"21_394" = "725189665"
"21_395" = "3580315979"
"21_396" = "1496725805"
"21_397" = "2391969988"
"21_390" = "2863425436"
"21_391" = "487010029"
"21_392" = "2336449773"
"21_393" = "2444277112"
"23_89" = "3654965835"
"23_88" = "2745275161"
"23_81" = "639900923"
"23_80" = "4059190665"
"23_83" = "2458947359"
"23_82" = "1549714477"
"23_85" = "16988595"
"23_84" = "3368646209"
"23_87" = "1836035031"
"23_86" = "926277861"
"24_175" = "252689198"
"24_174" = "3638133756"
"24_177" = "2071734674"
"24_176" = "1162211936"
"24_171" = "909565542"
"24_170" = "42804"
"24_173" = "2728611018"
"24_172" = "1819088280"
"24_179" = "3890780150"
"24_178" = "2981257412"
"21_239" = "2347715573"
"24_293" = "202189882"
"24_298" = "454836276"
"24_299" = "1364359014"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A9 9F 35 8B 06 DE 75 FF 40 59 8F 02 C9 F6 D5 8D"

[HKCU\Software\Jmicbaaosmd]
"23_402" = "539084461"
"23_403" = "1448839583"
"23_400" = "3048559625"
"23_401" = "3958316923"

"23_74" = "2863177309"
"23_282" = "3065751357"
"23_283" = "3974917743"
"23_75" = "3772858767"
"22_253" = "2475987038"
"23_288" = "4261245545"
"22_128" = "454789944"
"22_129" = "1364314536"
"23_289" = "842474843"
"22_124" = "1111664267"
"22_125" = "2021189735"
"22_126" = "2930720216"
"22_127" = "3840242924"
"22_120" = "1768539821"
"22_121" = "2678064921"
"22_122" = "3587594638"
"22_123" = "202152550"
"23_76" = "421202161"
"22_255" = "61367"
"22_230" = "3031797364"
"22_231" = "3941322916"
"22_232" = "555879240"
"22_233" = "1465396699"
"22_234" = "2374920096"
"22_235" = "3284449434"
"22_236" = "4193975237"
"22_237" = "808517798"
"22_238" = "1718043400"
"22_239" = "2627571884"
"24_120" = "1768546160"
"24_121" = "2678068898"
"23_257" = "1835926299"
"23_256" = "926177321"
"23_255" = "17010919"
"23_254" = "3368659381"
"23_253" = "2459428419"
"23_252" = "1549614865"
"23_251" = "640381999"
"23_250" = "4059204861"
"23_259" = "3654991295"
"23_258" = "2745223757"
"24_97" = "2324359666"
"24_96" = "1414836928"
"24_95" = "505314190"
"24_94" = "3890758748"
"24_93" = "2981236010"
"24_92" = "2071713272"
"24_91" = "1162190534"
"24_90" = "252667796"
"21_255" = "943234431"
"21_254" = "2737214161"
"21_257" = "3735830555"
"21_256" = "2994273115"
"21_251" = "644089274"
"21_250" = "1291819688"
"24_99" = "4143405142"
"24_98" = "3233882404"
"24_346" = "1162254740"
"24_347" = "2071777478"
"24_344" = "3638176560"
"24_345" = "252732002"
"24_342" = "1819131084"
"24_343" = "2728653822"
"24_340" = "85608"
"24_341" = "909608346"
"24_348" = "2981300216"
"24_349" = "3890822954"
"21_389" = "1482895255"
"21_388" = "2304365972"
"21_387" = "1773803693"
"21_386" = "279835733"
"21_385" = "1510421120"
"21_384" = "2003810992"
"21_383" = "1579947524"
"21_382" = "901539489"
"21_381" = "798121889"
"21_380" = "1290794886"
"23_96" = "1431820521"
"23_97" = "2341045211"
"23_94" = "3874172533"
"23_95" = "521998759"
"23_92" = "2054733777"
"23_93" = "2964416259"
"23_90" = "235670973"
"23_91" = "1145500911"
"23_98" = "3250735885"
"23_99" = "4159976063"
"24_188" = "3486550200"
"24_189" = "101105642"
"24_180" = "505335592"
"24_181" = "1414858330"
"24_182" = "2324381068"
"24_183" = "3233903806"
"24_184" = "4143426544"
"24_185" = "757981986"
"24_186" = "1667504724"
"24_187" = "2577027462"
"21_83" = "612339980"
"21_82" = "1343472978"
"21_81" = "1974367689"
"21_80" = "4093933073"
"21_87" = "3861628229"
"21_86" = "3106391302"
"21_85" = "3093126815"
"21_84" = "1891089074"
"21_89" = "463724496"
"21_88" = "3744823182"
"24_256" = "909586944"
"23_328" = "1953878585"
"24_258" = "2728632420"
"23_326" = "134816645"
"24_401" = "3941365074"
"24_400" = "3031842336"
"24_403" = "1465443254"
"24_402" = "555920516"
"22_139" = "1869605938"
"22_138" = "960092808"
"22_137" = "50568698"
"22_136" = "3436005619"
"22_135" = "2526478922"
"22_134" = "1616967404"
"22_133" = "707443090"
"22_132" = "4092882175"
"22_131" = "3183357443"
"22_130" = "2273841737"
"22_223" = "960105012"
"22_222" = "50579464"
"22_221" = "3436036048"
"22_220" = "2526509256"
"22_227" = "303227014"
"22_226" = "3688669337"
"22_225" = "2779156997"
"22_224" = "1869635497"
"22_229" = "2122271442"
"22_228" = "1212757395"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Jmicbaaosmd]
"23_268" = "3250758257"
"23_269" = "4160001443"
"23_262" = "2055149317"
"23_263" = "2964446839"
"23_260" = "236152033"
"23_261" = "1145384915"
"23_266" = "1431712733"
"23_267" = "2341010191"
"23_264" = "3874193849"
"23_265" = "521947371"
"24_84" = "3385465960"
"24_85" = "21402"
"24_86" = "909544140"
"24_87" = "1819066878"
"24_80" = "4042342304"
"24_81" = "656897746"
"24_82" = "1566420484"
"24_83" = "2475943222"
"24_88" = "2728589616"
"24_89" = "3638112354"
"24_359" = "101148446"
"24_358" = "3486593004"
"24_351" = "1414901134"
"24_350" = "505378396"
"24_353" = "3233946610"
"24_352" = "2324423872"
"24_355" = "758024790"
"24_354" = "4143469348"
"24_357" = "2577070266"
"24_356" = "1667547528"
"23_280" = "1246704793"
"23_281" = "2156003275"
"24_199" = "606398430"
"24_198" = "3991842988"
"23_284" = "623268177"
"23_285" = "1532500099"
"23_286" = "2442314741"
"23_287" = "3351546663"
"24_193" = "3739196594"
"24_192" = "2829673856"
"24_191" = "1920151118"
"24_190" = "1010628380"
"24_197" = "3082320250"
"24_196" = "2172797512"
"24_195" = "1263274774"
"24_194" = "353752036"
"21_286" = "2505560497"
"21_287" = "167796443"
"21_284" = "653259974"
"21_285" = "1952327158"
"21_282" = "1698348135"
"21_283" = "936711201"
"21_280" = "1515575238"
"21_281" = "1906013894"
"21_288" = "2411720444"
"21_289" = "1980560385"
"21_90" = "3382020642"
"21_91" = "908845565"
"21_92" = "1029594306"
"21_93" = "3091943416"
"21_94" = "4108016167"
"21_95" = "2051560188"
"21_96" = "1308778171"
"21_97" = "1022247304"
"21_98" = "1343103469"
"21_99" = "1548170498"
"22_197" = "3082315926"
"21_361" = "2926143692"
"22_196" = "2172803612"
"21_360" = "869381666"
"22_191" = "1920151796"
"21_248" = "1556343629"
"22_190" = "1010625672"
"24_69" = "2627526778"
"23_185" = "741247243"
"21_365" = "4085694487"
"23_184" = "4160012761"
"23_31" = "2442380583"
"23_32" = "3351612521"
"21_366" = "2522357846"
"24_62" = "555834908"
"22_39" = "1111651276"
"22_38" = "202122094"
"22_37" = "3587566474"
"22_36" = "2678051978"
"22_35" = "1768527459"
"22_34" = "859007532"
"22_33" = "4244441173"
"22_32" = "3334928356"
"22_31" = "2425403934"
"22_30" = "1515875810"
"24_61" = "3941279466"
"24_66" = "4193925860"
"24_67" = "808481302"
"24_64" = "2374880384"
"24_65" = "3284403122"
"23_110" = "1246289237"
"23_111" = "2156037255"
"23_112" = "3065728969"
"22_101" = "1667487309"
"23_114" = "623378029"
"22_107" = "2829651881"
"23_116" = "2442291329"
"23_117" = "3351532531"
"23_118" = "4261288741"
"23_119" = "842056215"
"22_108" = "3739178284"
"22_109" = "353735919"
"22_216" = "3183380784"
"22_217" = "4092910738"
"22_214" = "1364341136"
"22_215" = "2273857363"
"22_212" = "3840253952"
"22_213" = "454817095"
"22_210" = "2021219100"
"22_211" = "2930731130"
"22_218" = "707465282"
"22_219" = "1616981901"
"23_279" = "336940375"
"23_278" = "3755776613"
"23_275" = "1027481759"
"23_274" = "117733805"
"23_277" = "2846544691"
"23_276" = "1936780225"
"23_271" = "1650919367"
"23_270" = "741170325"
"23_273" = "3469981307"
"23_10" = "522014173"
"24_218" = "707461268"
"24_219" = "1616984006"
"24_210" = "2021213956"
"24_211" = "2930736694"
"24_212" = "3840259432"
"24_213" = "454814874"
"24_214" = "1364337612"
"23_11" = "1431778575"
"24_216" = "3183383088"
"24_217" = "4092905826"
"24_328" = "1970714640"
"24_329" = "2880237378"
"24_324" = "2627590984"
"24_325" = "3537113722"
"24_326" = "151669164"
"24_327" = "1061191902"
"24_320" = "3284467328"
"24_321" = "4193990066"
"24_322" = "808545508"
"24_323" = "1718068246"
"23_293" = "219039251"
"23_292" = "3570769697"
"23_291" = "2661537791"
"23_290" = "1751772301"
"23_297" = "3857015595"
"23_296" = "2947333113"
"23_295" = "2038100151"
"23_294" = "1128270149"
"23_299" = "1347493199"
"23_298" = "438250013"
"21_299" = "958737417"
"21_298" = "1066549807"
"21_291" = "1167039336"
"21_290" = "1704103153"
"21_293" = "2127398220"
"21_292" = "3176285526"
"21_295" = "4137237151"
"21_294" = "4010356183"
"21_297" = "1814880628"
"21_296" = "1916871587"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKCU\Software\Jmicbaaosmd]
"21_364" = "3190690307"
"22_28" = "3991803880"
"22_29" = "606361272"
"22_24" = "353711572"
"22_25" = "1263236635"
"22_26" = "2172748151"
"22_27" = "3082274834"
"22_20" = "1010589108"
"22_21" = "1920111771"
"22_22" = "2829625907"
"22_23" = "3739149834"
"22_115" = "1515903535"
"22_114" = "606372195"
"22_117" = "3334939642"
"22_116" = "2425428171"
"22_111" = "2172777592"
"22_110" = "1263251141"
"22_113" = "3991816176"
"22_112" = "3082305436"
"23_109" = "337046115"
"23_108" = "3755746097"
"22_119" = "859027779"
"22_118" = "4244465406"
"21_2" = "685386305"
"21_3" = "3052119462"
"21_0" = "1431655765"
"21_1" = "2014316891"
"21_6" = "301322874"
"22_306" = "3436045940"
"21_4" = "1017744945"
"21_5" = "825634610"
"21_8" = "1221900341"
"24_239" = "2627569582"
"22_209" = "1111694582"
"22_308" = "960133971"
"22_309" = "1869647363"
"22_201" = "2425439542"
"22_200" = "1515914856"
"22_203" = "4244495275"
"22_202" = "3334969817"
"22_205" = "1768564117"
"22_204" = "859040848"
"22_207" = "3587618194"
"22_206" = "2678092452"
"24_209" = "1111691218"
"24_208" = "202168480"
"24_203" = "4244489382"
"24_202" = "3334966644"
"24_201" = "2425443906"
"24_200" = "1515921168"
"24_207" = "3587613038"
"24_206" = "2678090300"
"24_205" = "1768567562"
"24_204" = "859044824"
"21_358" = "2967276881"
"21_359" = "1547965605"
"24_339" = "3385530166"
"24_338" = "2476007428"
"24_337" = "1566484690"
"24_336" = "656961952"
"24_335" = "4042406510"
"24_334" = "3132883772"
"24_333" = "2223361034"
"24_332" = "1313838296"
"24_331" = "404315558"
"24_330" = "3789760116"
"21_198" = "1040697628"
"21_199" = "1549894032"
"21_192" = "1623055013"
"21_193" = "1905112294"
"21_190" = "3675907617"
"21_191" = "3502124528"
"21_196" = "1381931873"
"21_197" = "2982205719"
"21_194" = "3659270552"
"21_195" = "1318447915"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKCU\Software\Jmicbaaosmd]
"22_195" = "1263273050"
"23_389" = "1633858771"
"21_170" = "1010944335"
"21_171" = "2160402227"
"21_172" = "4053616866"
"21_173" = "4204954639"
"21_174" = "2852190634"
"21_175" = "3839640641"
"21_176" = "2118873467"
"21_177" = "3426043334"
"21_178" = "1799564415"
"21_179" = "284036659"
"24_5" = "252646394"
"24_4" = "3638090952"
"24_3" = "2728568214"
"24_2" = "1819045476"
"24_1" = "909522738"
"24_0" = "0"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\Jmicbaaosmd]
"23_388" = "724094433"
"22_19" = "101057906"
"22_18" = "3486512621"
"22_11" = "1414808930"
"22_10" = "505297052"
"22_13" = "3233863470"
"22_12" = "2324333828"
"22_15" = "757939759"
"22_14" = "4143386946"
"22_17" = "2576986003"
"22_16" = "1667462881"
"24_306" = "3436050884"
"24_307" = "50606326"
"22_102" = "2576998440"
"22_103" = "3486523510"
"22_100" = "757960837"
"23_113" = "3974969147"
"22_106" = "1920123944"
"24_308" = "960129064"
"23_115" = "1532600671"
"24_309" = "1869651802"
"22_104" = "101087799"
"22_105" = "1010613474"
"24_159" = "2880194574"
"24_158" = "1970671836"
"23_136" = "3452844217"
"23_137" = "33612779"
"23_134" = "1633914373"
"23_135" = "2543087991"
"23_132" = "4076281825"
"23_133" = "724158163"
"23_130" = "2257284429"
"23_131" = "3166524607"
"23_49" = "1633942203"
"23_138" = "943368925"
"23_139" = "1852609039"
"22_278" = "3739216342"
"22_279" = "353776667"
"22_274" = "101124638"
"22_275" = "1010652594"
"22_276" = "1920177537"
"22_277" = "2829692351"
"22_270" = "758001624"
"22_271" = "1667528855"
"22_272" = "2577052052"
"22_273" = "3486565986"
"23_387" = "4076214975"
"22_300" = "2273884351"
"22_301" = "3183410199"
"22_302" = "4092921240"
"22_303" = "707478045"
"22_304" = "1617010184"
"22_305" = "2526532844"
"24_238" = "1718046844"
"22_307" = "50599228"
"24_236" = "4193968664"
"24_237" = "808524106"
"24_234" = "2374923188"
"24_235" = "3284445926"
"24_232" = "555877712"
"24_233" = "1465400450"
"24_230" = "3031799532"
"24_231" = "3941322270"
"21_349" = "3898013184"
"21_348" = "2121637029"
"21_343" = "1926036129"
"21_342" = "1942012017"
"21_341" = "1390837550"
"21_340" = "2015103013"
"21_347" = "2137006773"
"21_346" = "1526472257"
"21_345" = "1729151763"
"21_344" = "3249501578"
"24_302" = "4092927228"
"24_303" = "707482670"
"24_300" = "2273881752"
"24_301" = "3183404490"
"21_189" = "1090017713"
"21_188" = "3906864797"
"24_304" = "1617005408"
"24_305" = "2526528146"
"21_185" = "236690293"
"21_184" = "624185211"
"21_187" = "348326960"
"21_186" = "2645614058"
"21_181" = "1815227653"
"21_180" = "2242006785"
"21_183" = "3516086272"
"21_182" = "3755470585"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKCU\Software\Jmicbaaosmd]
"21_163" = "897902509"
"21_162" = "3659196091"
"21_161" = "1486732845"
"21_160" = "3290186491"
"21_167" = "3389013285"
"21_166" = "3483880473"
"21_165" = "4277607573"
"21_164" = "2405251966"
"21_169" = "2303635421"
"21_168" = "2782570008"

"21_259" = "275075014"
"21_47" = "2273150803"
"21_46" = "242181002"
"21_45" = "2637276589"
"21_44" = "4185248738"
"21_43" = "606997208"
"21_42" = "930111988"
"21_41" = "1696968276"
"21_40" = "2098300431"
"21_49" = "2700601796"
"21_48" = "349795886"
"23_394" = "1853069533"
"23_395" = "2762227727"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f5-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Jmicbaaosmd]
"23_386" = "3166458701"
"23_129" = "1347598875"
"23_128" = "437842729"
"23_121" = "2661514379"
"23_120" = "1751823705"
"23_123" = "219148079"
"23_122" = "3570739197"
"23_125" = "2038143299"
"23_124" = "1128388113"
"23_127" = "3857058791"
"23_126" = "2947301557"
"23_272" = "2560216841"
"22_269" = "4143440708"
"22_268" = "3233927360"
"22_267" = "2324398498"
"22_266" = "1414888510"
"22_265" = "505363868"
"22_264" = "3890804924"
"22_263" = "2981274827"
"22_262" = "2071752424"
"22_261" = "1162236802"
"22_260" = "252711132"
"24_221" = "3436029482"
"24_220" = "2526506744"
"24_223" = "960107662"
"24_222" = "50584924"
"24_225" = "2779153138"
"24_224" = "1869630400"
"24_227" = "303231318"
"24_226" = "3688675876"
"24_229" = "2122276794"
"23_331" = "421148559"
"23_332" = "1330446065"
"23_333" = "2240194083"
"23_334" = "3149883669"
"23_335" = "4059123783"
"23_336" = "640359305"
"23_337" = "1549648635"
"22_313" = "1212771219"
"22_312" = "303257476"
"22_311" = "3688700248"
"22_310" = "2779172556"
"22_317" = "555896254"
"22_316" = "3941348702"
"22_315" = "3031825626"
"22_314" = "2122293982"
"22_319" = "2374950518"
"22_318" = "1465418632"
"21_378" = "2535764842"
"21_379" = "429302223"
"21_376" = "1927905188"
"21_377" = "1268382192"
"21_374" = "778649426"
"21_375" = "47397995"
"21_372" = "269538689"
"21_373" = "1670415496"
"21_370" = "3705528118"
"21_371" = "4085956039"
"23_398" = "1229628821"
"24_315" = "3031820934"
"24_314" = "2122298196"
"24_317" = "555899114"
"23_24" = "337004185"
"24_311" = "3688697278"
"24_310" = "2779174540"
"23_21" = "1936846131"
"24_312" = "303252720"
"24_319" = "2374944590"
"24_318" = "1465421852"
"23_29" = "623323779"
"23_28" = "3974980433"
"24_215" = "2273860350"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f2-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Jmicbaaosmd]
"21_208" = "976969161"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{773a730e-74fb-11e2-b597-000c293bdf2f}]
"BaseClass" = "Drive"

[HKCU\Software\Jmicbaaosmd]
"21_209" = "1844791791"
"21_156" = "1638157877"
"21_157" = "25601011"
"21_154" = "1916891434"
"21_155" = "3107738747"
"21_152" = "2336350734"
"21_153" = "4028717196"
"21_150" = "426629123"
"21_151" = "2602438068"
"21_400" = "2577291273"
"21_401" = "4022372925"
"21_402" = "720589368"
"21_403" = "946952389"
"21_404" = "4230415188"
"24_289" = "859066226"
"21_158" = "1936241629"
"21_159" = "3169004735"
"24_288" = "4244510784"
"22_73" = "1970644964"
"22_72" = "1061133528"
"22_71" = "151606042"
"22_70" = "3537047400"
"22_77" = "1313768533"
"22_76" = "404256224"
"22_75" = "3789698926"
"22_74" = "2880170050"
"22_79" = "3132821939"
"22_78" = "2223293436"
"21_54" = "329575482"
"21_55" = "3950776836"
"21_56" = "4142443835"
"21_57" = "1628591961"
"21_50" = "4029186162"
"21_51" = "2297640591"
"21_52" = "3595875837"
"21_53" = "3452783339"
"21_58" = "306115623"
"21_59" = "4228837455"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"

[HKCU\Software\Jmicbaaosmd]
"23_158" = "1953856245"
"23_159" = "2863604263"
"23_154" = "2644401725"
"23_155" = "3553624431"
"23_156" = "134924369"
"23_157" = "1044165507"
"23_150" = "3267837285"
"23_151" = "4177126487"
"23_152" = "825470873"
"23_153" = "1734710987"
"22_252" = "1566459938"
"24_139" = "1869608998"
"22_250" = "4042391305"
"22_251" = "656934558"
"22_256" = "909583977"
"22_257" = "1819101488"
"22_254" = "3385513521"
"24_138" = "960086260"
"22_258" = "2728640059"
"22_259" = "3638151468"
"21_110" = "1132196651"
"21_111" = "310184299"
"24_131" = "3183361686"
"24_130" = "2273838948"
"21_118" = "12959428"
"24_254" = "3385508764"
"24_255" = "64206"
"23_329" = "2863629675"
"24_257" = "1819109682"
"24_250" = "4042385108"
"24_251" = "656940550"
"24_252" = "1566463288"
"24_253" = "2475986026"
"23_323" = "1734659647"
"23_322" = "825362125"
"23_321" = "4177026971"
"23_320" = "3267859625"
"23_327" = "1044638455"
"24_259" = "3638155158"
"23_325" = "3554113619"
"23_324" = "2644423009"
"22_326" = "151674488"
"22_327" = "1061198525"
"22_324" = "2627587376"
"22_325" = "3537111711"
"22_322" = "808548995"
"22_323" = "1718073186"
"22_320" = "3284460277"
"22_321" = "4193988498"
"24_133" = "707439866"
"24_136" = "3436008080"
"22_328" = "1970709966"
"22_329" = "2880227976"
"24_132" = "4092884424"
"23_34" = "842022541"
"23_35" = "1751835135"
"23_36" = "2661067041"
"23_37" = "3570831379"
"23_30" = "1532567029"
"24_135" = "2526485342"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKCU\Software\Jmicbaaosmd]
"23_33" = "4261312347"
"21_369" = "2340592065"
"21_368" = "536071717"
"23_38" = "219110213"
"23_39" = "1128334007"
"24_134" = "1616962604"
"24_19" = "101062838"
"24_18" = "3486507396"
"24_17" = "2576984658"
"24_16" = "1667461920"
"24_15" = "757939182"
"24_14" = "4143383740"
"24_13" = "3233861002"
"24_12" = "2324338264"
"24_11" = "1414815526"
"24_10" = "505292788"
"24_137" = "50563522"
"24_100" = "757960584"
"24_101" = "1667483322"
"24_102" = "2577006060"
"24_103" = "3486528798"
"24_104" = "101084240"
"24_105" = "1010606978"
"24_106" = "1920129716"
"24_107" = "2829652454"
"24_108" = "3739175192"
"24_109" = "353730634"
"21_149" = "3576538832"
"21_148" = "85980837"
"21_141" = "3384498884"
"21_140" = "2465505661"
"21_143" = "651458463"
"21_142" = "4064170125"
"21_145" = "3856896380"
"21_144" = "2891582549"
"21_147" = "1212848873"
"21_146" = "4065684409"
"22_60" = "3031758900"
"22_61" = "3941281933"
"22_62" = "555829035"
"22_63" = "1465352538"
"22_64" = "2374885220"
"22_65" = "3284407630"
"22_66" = "4193920722"
"22_67" = "808478393"
"22_68" = "1718009020"
"22_69" = "2627532110"
"21_61" = "2130005713"
"21_60" = "4132673783"
"21_63" = "2994069232"
"21_62" = "2577234757"
"21_65" = "2546014933"
"21_64" = "852993339"
"21_67" = "1370269995"
"21_66" = "1146015066"
"21_69" = "2525616991"
"21_68" = "1955596862"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\biclient.exe,"

[HKCU\Software\Jmicbaaosmd]
"24_241" = "151647762"
"24_240" = "3537092320"
"21_273" = "3203454221"
"24_249" = "3132862370"
"21_272" = "765955342"
"24_248" = "2223339632"
"23_149" = "2358069811"
"23_148" = "1448379073"
"23_147" = "539155359"
"23_146" = "3957854381"
"23_145" = "3048614267"
"23_144" = "2138859017"
"23_143" = "1229700807"
"23_142" = "319944597"
"23_141" = "3672050851"
"23_140" = "2762294641"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

[HKCU\Software\Jmicbaaosmd]
"22_245" = "3789736343"
"22_244" = "2880209567"
"22_247" = "1313822750"
"22_246" = "404295937"
"22_241" = "151644383"
"22_240" = "3537087108"
"22_243" = "1970696667"
"22_242" = "1061172222"
"22_249" = "3132863937"
"22_248" = "2223336442"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Jmicbaaosmd]
"24_247" = "1313816894"
"24_246" = "404294156"
"24_245" = "3789738714"
"24_244" = "2880215976"
"24_243" = "1970693238"
"24_242" = "1061170500"
"23_318" = "1448868405"
"23_319" = "2358095207"
"23_316" = "3958328209"
"23_317" = "539046595"
"23_314" = "2138888573"
"23_315" = "3048636591"
"23_312" = "319827673"
"23_313" = "1229592075"
"23_310" = "2762325157"
"23_311" = "3672008599"
"22_339" = "3385527694"
"22_338" = "2476012480"
"22_331" = "404309016"
"22_330" = "3789766320"
"22_333" = "2223363153"
"22_332" = "1313833183"
"22_335" = "4042400691"
"22_334" = "3132888530"
"22_337" = "1566489736"
"22_336" = "656958790"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"%original file name%.exe" = "c:\%original file name%.exe:*:Enabled:ipsec"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

Firewall notifications are disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

Network activity (URLs)

URL	IP
hxxp://installer.betterinstaller.com/network_smb_filesflash/flvplayerrsha/0e11044f561def4bac902d3d5a6c4169?v=2.1&uid=0e11044f561def4bac902d3d5a6c4169&muid=CDA9EA544C42F5C076ED65A6B085AB29
hxxp://d69bfzwbyt513.cloudfront.net/images/Tokyo/tokyo_sprite_full.png	54.230.90.125
hxxp://d24mpw184ozx1g.cloudfront.net/images/Tokyo/tokyoWhiteSparkMiddleBG.jpg	205.251.253.34
hxxp://download.betterinstaller.com/js/libs/storage.swf?191096
hxxp://installer.betterinstaller.com/installer/ajax
hxxp://d1vvae5pk0e4pe.cloudfront.net/mirror/imesh/FLVSetupStub_signed2.exe?a=1	205.251.253.108
hxxp://installer.betterinstaller.com/downloader/network_smb_filesflash/flvplayerrsha/cd0f26e15f03dd4c8cfe826143cf376a?v=2.1&uid=cd0f26e15f03dd4c8cfe826143cf376a&muid=CDA9EA544C42F5C076ED65A6B085AB29
hxxp://download.betterinstaller.com/js/libs/storage.swf?678068
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=cda9ea544c42f5c076ed65a6b085ab29&client_uid=0e11044f561def4bac902d3d5a6c4169&affiliate_id=network_smb_filesflash&software_id=flvplayerrsha&sponsored_id=imesh_download_manager_flv_network2&tokyo_csrf2_key=46f6d20ad2c9596c6470b39243028df0&tokyo_csrf2_timestamp=1395402332&offer_index=1&0.1802907590862624
hxxp://www-google-analytics.l.google.com/ga.js
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.8&utms=1&utmn=1493686174&utmhn=bi.bisrv.com&utmhid=1479356444&utmr=-&utmp=Installer_Init&utmht=1395385095849&utmac=UA-31676879-1&utmcc=__utma=1.798769483.1395385094.1395385094.1395385094.1;+__utmz=1.1395385094.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmu=qhCAAAAAAAAB~
hxxp://secondoffer-lb-126442588.us-east-1.elb.amazonaws.com/www/delivery/so/init_offer.php?brand_name=FLV Video Player&brand_host=FLVPlayer.org&offer_index=1&offer_id=51&sysid=473&appid=107&ln=en&ab=IE&db=&osver=5.1&ostype=win32&osl=en-US&pver=&ptype=n
hxxp://installer.betterinstaller.com/downloader/network_smb_filesflash/flvplayerrsha/8c1a1a3c329da9488dc4f5116e78fda0?v=2.1&uid=8c1a1a3c329da9488dc4f5116e78fda0&muid=CDA9EA544C42F5C076ED65A6B085AB29
hxxp://secondoffer-lb-126442588.us-east-1.elb.amazonaws.com/www/delivery/ajs.php?zoneid=15&cb=32413900408&charset=unicode&loc=http://www.secondofferdelivery.com/www/delivery/so/init_offer.php?brand_name=FLV Video Player&brand_host=FLVPlayer.org&offer_index=1&offer_id=51&sysid=473&appid=107&ln=en&ab=IE&db=&osver=5.1&ostype=win32&osl=en-US&pver=&ptype=n
hxxp://secondoffer-lb-126442588.us-east-1.elb.amazonaws.com//www/delivery/so/offer.css?r=370b3e3cf2
hxxp://secondoffer-lb-126442588.us-east-1.elb.amazonaws.com//www/delivery/so/files/torch/banner.jpg
hxxp://secondoffer-lb-126442588.us-east-1.elb.amazonaws.com//www/delivery/so/offer.js?r=370b3e3cf2
hxxp://installer.betterinstaller.com/installer/ajax-bidl?offers[filesfrog][exec_args]=/S /visible /enable /ff_affid network_smb_filesflash /nodesktopshortcut &uid_orig=0e11044f561def4bac902d3d5a6c4169&uid=8c1a1a3c329da9488dc4f5116e78fda0&tokyo_csrf_key=ce6a16412a68d10cf2220c5fedb24396&tokyo_csrf_timestamp=1395402345&ffInstalled=false&affid=network_smb_filesflash&sid=flvplayerrsha&country=CA&hostBrowser=ch&unique_id=662fc7fa7bc066d5f38bfcf19998b39a
hxxp://secondoffer-lb-126442588.us-east-1.elb.amazonaws.com/www/delivery/so/init_offer.php?brand_name=FLV Video Player&brand_host=FLVPlayer.org&offer_index=2&offer_id=52&sysid=473&appid=107&ln=en&ab=IE&db=&osver=5.1&ostype=win32&osl=en-US&pver=&ptype=n
hxxp://d1vvae5pk0e4pe.cloudfront.net/mirror/filesfrog/UpdateCheckerSetup.exe
hxxp://secondoffer-lb-126442588.us-east-1.elb.amazonaws.com/www/delivery/ajs.php?zoneid=16&exclude=bannerid:11&cb=35130297303&charset=unicode&loc=http://www.secondofferdelivery.com/www/delivery/so/init_offer.php?brand_name=FLV Video Player&brand_host=FLVPlayer.org&offer_index=2&offer_id=52&sysid=473&appid=107&ln=en&ab=IE&db=&osver=5.1&ostype=win32&osl=en-US&pver=&ptype=n
hxxp://d24mpw184ozx1g.cloudfront.net/images/Tokyo/tokyo_sprite_full.png
hxxp://download.betterinstaller.com/js/libs/storage.swf?511901
static.bisrv.com	78.138.97.8
bi.bisrv.com	78.138.127.15
www.google-analytics.com	173.194.43.32
www.secondofferdelivery.com	23.21.124.71

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   wmic.exe:2284
   biclient.exe:1708
   biclient.exe:1340
   UpdateCheckerSetup.exe:1328
   %original file name%.exe:3336

2. Delete the original Virus file.
   
3. Delete or disinfect the following files created/modified by the Virus:

   %Documents and Settings%\%current user%\Local Settings\Application Data\FilesFrog Update Checker\TempWmicBatchFile.bat (0 bytes)
   %Documents and Settings%\%current user%\ntuser.dat.LOG (29280 bytes)
   %Documents and Settings%\%current user%\NTUSER.DAT (26996 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\cd0f26e15f03dd4c8cfe826143cf376a[1].txt (26899 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\storage[2].swf (773 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4.tmp.7 (9760 bytes)
   %Documents and Settings%\%current user%\Cookies\L8JU4RSI.txt (547 bytes)
   %Documents and Settings%\%current user%\Cookies\EX9WZQ4Y.txt (547 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\ga[1].js (22940 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\tokyo_sprite_full[1].png (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\ajax[1].txt (773 bytes)
   %Documents and Settings%\%current user%\Cookies\XHEQ03NB.txt (115 bytes)
   %Documents and Settings%\%current user%\Cookies\TNYVAA1F.txt (547 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\0e11044f561def4bac902d3d5a6c4169[1].txt (31595 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\tokyoWhiteSparkMiddleBG[1].jpg (392 bytes)
   %Documents and Settings%\%current user%\Cookies\QX6HVGMC.txt (285 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\storage[1].swf (773 bytes)
   %Documents and Settings%\%current user%\Cookies\U6PVXK8I.txt (547 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4.tmp.1 (9760 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4.tmp.0 (9760 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4.tmp.3 (9760 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4.tmp.2 (9760 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4.tmp.5 (9760 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4.tmp.4 (9760 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4.tmp.6 (9760 bytes)
   %Documents and Settings%\%current user%\Cookies\F330J03M.txt (547 bytes)
   %Documents and Settings%\%current user%\Cookies\HQNSO3HB.txt (547 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Cookies\4CVJKYRT.txt (547 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\tokyo_sprite_full[1].png (893 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\storage[1].swf (773 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\UpdateCheckerSetup.exe.6 (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\UpdateCheckerSetup.exe.4 (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\UpdateCheckerSetup.exe.5 (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\ajax-bidl[1].txt (762 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\UpdateCheckerSetup.exe.7 (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\UpdateCheckerSetup.exe.0 (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\UpdateCheckerSetup.exe.1 (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\UpdateCheckerSetup.exe.2 (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\UpdateCheckerSetup.exe.3 (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\8c1a1a3c329da9488dc4f5116e78fda0[1].txt (24432 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\FilesFrog Update Checker\Check for Updates.lnk (1 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\FilesFrog Update Checker\Uninstall.lnk (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nslA.tmp (10215 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\FilesFrog Update Checker\update_checker.exe (7192 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\FilesFrog Update Checker\uninstall.exe (1328 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\ajs[1].php (3313 bytes)
   %Documents and Settings%\All Users\Desktop\FLV Video Player.lnk (721 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse6.tmp\modern-header.bmp (3072 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse6.tmp\UserInfo.dll (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\offer[1].js (5223 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014032120140322\index.dat (16 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse6\license.txt (23 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse6.tmp\nsDialogs.dll (9 bytes)
   %Documents and Settings%\%current user%\Cookies\QKFDH3FS.txt (114 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\init_container[1] (752 bytes)
   %Documents and Settings%\%current user%\Cookies\3053U27W.txt (114 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse6.tmp\UAC.dll (13 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse6\Helper.dll (36965 bytes)
   %Program Files%\FLV Video Player\log.log (7453 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\offer[1].css (73 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse6\soffer.dll (2243 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\init_offer[1].htm (414 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\init_offer[2].htm (414 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse6.tmp\registry.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\banner[1].jpg (4364 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse6.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\init_container[1] (752 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\config.ini (102 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\biclient.exe (8560 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000685DC_rar\%original file name%.exe (1281 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn2.tmp (6436 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "SDP" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FilesFrog Update Checker\update_checker.exe /auto"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
   "network_smb_filesflash" = ""

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

Network Activity

Map

Strings from Dumps