Shiz_e73d84408e

HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.Generic.KDV.659231 (B) (Emsisoft), Trojan.Generic.KDV.659231 (AdAware), Backdoor.Win32.Shiz.FD, Shiz.YR, GenericInjector.YR, BackdoorCaphaw_QKKBAL.YR (Lavasoft MAS)Behaviour: Trojan, Backdoor

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

u.jpg

u.jpg

IprivLibEx.dll

IprivLibEx.dll

\\.\PhysicalDrive%u

\\.\PhysicalDrive%u

/topic.php

/topic.php

keylog.txt

keylog.txt

sniff.log

sniff.log

passwords.txt

passwords.txt

%s%u.zip

%s%u.zip

Content-Disposition: form-data; name="file"; filename="report"

Content-Disposition: form-data; name="file"; filename="report"

HTTP/1.0

HTTP/1.0

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

Content-Type: multipart/form-data; boundary=---------------------------%s

Content-Type: multipart/form-data; boundary=---------------------------%s

www.bing.com

www.bing.com

www.microsoft.com

www.microsoft.com

frd.exe

frd.exe

command=config&update_url=

command=config&update_url=

&port=

&port=

command=load&url=

command=load&url=

SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0001

SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0001

SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0002

SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0002

SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0003

SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0003

hid=%s&username=SYSTEM&compname=%s&bot_version=4.8.14&uptime=%u&os=u&local_time=%s%d&token=%d&socks_port=%u&hardware[display]=%s&hardware[driver_av]=%s

hid=%s&username=SYSTEM&compname=%s&bot_version=4.8.14&uptime=%u&os=u&local_time=%s%d&token=%d&socks_port=%u&hardware[display]=%s&hardware[driver_av]=%s

\chrome.exe

\chrome.exe

\svchost.exe

\svchost.exe

\opera.exe

\opera.exe

\cbmain.ex

\cbmain.ex

\iscc.exe

\iscc.exe

\clmain.exe

\clmain.exe

\wclnt.exe

\wclnt.exe

internal_wutex_0xx

internal_wutex_0xx

%s.dbf

%s.dbf

%s.DBF

%s.DBF

pop2://%s:%s@%s:%i

pop2://%s:%s@%s:%i

pop3://%s:%s@%s:%i

pop3://%s:%s@%s:%i

nntp://%s:%s@%s:%i

nntp://%s:%s@%s:%i

ftp://%s:%s@%s:%i

ftp://%s:%s@%s:%i

ftp://anonymous:

ftp://anonymous:

AUTHINFO PASS

AUTHINFO PASS

j_password=

j_password=

pass.log

pass.log

command=auth_loginByPassword&back_command=&back_custom1=&

command=auth_loginByPassword&back_command=&back_custom1=&

edClientLogin=

edClientLogin=

edUserLogin=

edUserLogin=

edPassword=

edPassword=

&LOGIN_AUTHORIZATION_CODE=

&LOGIN_AUTHORIZATION_CODE=

login=

login=

password=

password=

pass_

pass_

ssleay32.dll

ssleay32.dll

advapi32.dll

advapi32.dll

path.txt

path.txt

keys.zip

keys.zip

Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}

Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}

%s\d.jpg

%s\d.jpg

Local\{AA53E2BF-8989-4fe1-9A0D-95CD39DC0A14}

Local\{AA53E2BF-8989-4fe1-9A0D-95CD39DC0A14}

Local\{EAF799BF-8989-4fe1-9A0D-95CD39D44014}

Local\{EAF799BF-8989-4fe1-9A0D-95CD39D44014}

keys

keys

private.txt

private.txt

public.txt

public.txt

\*.key

\*.key

\self.cer

\self.cer

self.cer

self.cer

self.pub

self.pub

Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC2014}

Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC2014}

ctunnel.exe

ctunnel.exe

ctunnel.zip

ctunnel.zip

path_ctunnel.txt

path_ctunnel.txt

header.key

header.key

keys99

keys99

\header.key

\header.key

masks2.key

masks2.key

\masks2.key

\masks2.key

masks.key

masks.key

\masks.key

\masks.key

\name.key

\name.key

primary2.key

primary2.key

\primary2.key

\primary2.key

primary.key

primary.key

\primary.key

\primary.key

keys99.zip

keys99.zip

path99.txt

path99.txt

bsi.dll

bsi.dll

&domain=letitbit.net&

&domain=letitbit.net&

cc.txt

cc.txt

Local\{EAF799BF-8989-4fa1-9A0D-95CD39DC0214}

Local\{EAF799BF-8989-4fa1-9A0D-95CD39DC0214}

prv_key.pfx

prv_key.pfx

keys\

keys\

sign.cer

sign.cer

Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}

Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}

sks2xyz.dll

sks2xyz.dll

vb_pfx_import

vb_pfx_import

Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC0214}

Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC0214}

secret.key

secret.key

pubkeys.key

pubkeys.key

Local\{AAF799BF-8989-4fe1-9A0D-95CD39DC0A14}

Local\{AAF799BF-8989-4fe1-9A0D-95CD39DC0A14}

path1.txt

path1.txt

inter.zip

inter.zip

interpro.ini

interpro.ini

Local\{EAF329BF-8989-4fe1-9A0D-95CD39DC0214}

Local\{EAF329BF-8989-4fe1-9A0D-95CD39DC0214}

Local\{AAF733BF-8989-4fe1-9A0D-95CD39DC0A14}

Local\{AAF733BF-8989-4fe1-9A0D-95CD39DC0A14}

Local\{BQQQW777-B777-4e47-8B10-69798A04C732}

Local\{BQQQW777-B777-4e47-8B10-69798A04C732}

cbsmain.dll

cbsmain.dll

Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}

Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}

pass.txt

pass.txt

Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214}

Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214}

FilialRCon.dll

FilialRCon.dll

ISClient.cfg

ISClient.cfg

Local\{EAF777BF-8989-4fe1-9A0D-95CD777C0214}

Local\{EAF777BF-8989-4fe1-9A0D-95CD777C0214}

rfk.zip

rfk.zip

Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}

Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}

Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}

Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}

Agava_Client.exe

Agava_Client.exe

KeysDiskPath

KeysDiskPath

Agava_Client.ini

Agava_Client.ini

Agava_keys

Agava_keys

keys_path.txt

keys_path.txt

Local\{AA53E2BF-8989-4EEE-9A0D-95CD39DC0A14}

Local\{AA53E2BF-8989-4EEE-9A0D-95CD39DC0A14}

mespro.dll

mespro.dll

AddPSEPrivateKeyEx

AddPSEPrivateKeyEx

core.exe

core.exe

data\id.dbf

data\id.dbf

\data\id.dbf

\data\id.dbf

keys%i.zip

keys%i.zip

path%i.txt

path%i.txt

Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}

Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}

cert.pem

cert.pem

Local\{BE3CEFA7-B777-4e47-8B10-69745D04C732}

Local\{BE3CEFA7-B777-4e47-8B10-69745D04C732}

winmm.dll

winmm.dll

1.2.5

1.2.5

unzip 1.01 Copyright 1998-2004 Gilles Vollant - http://www.winimage.com/zLibDll

unzip 1.01 Copyright 1998-2004 Gilles Vollant - http://www.winimage.com/zLibDll

zip 1.01 Copyright 1998-2004 Gilles Vollant - http://www.winimage.com/zLibDll

zip 1.01 Copyright 1998-2004 Gilles Vollant - http://www.winimage.com/zLibDll

%s\%s

%s\%s

#webcam

#webcam

#webcam%d

#webcam%d

RFB d.d

RFB d.d

%s (%s)

%s (%s)

d/d/d d:d

d/d/d d:d

password check failed!

password check failed!

WinSCard.dll

WinSCard.dll

SensApi.dll

SensApi.dll

GetTcpTable

GetTcpTable

IPHLPAPI.DLL

IPHLPAPI.DLL

dbghelp.dll

dbghelp.dll

PSAPI.DLL

PSAPI.DLL

NETAPI32.dll

NETAPI32.dll

DNSAPI.dll

DNSAPI.dll

HttpQueryInfoA

HttpQueryInfoA

HttpAddRequestHeadersW

HttpAddRequestHeadersW

HttpAddRequestHeadersA

HttpAddRequestHeadersA

HttpOpenRequestA

HttpOpenRequestA

WININET.dll

WININET.dll

WS2_32.dll

WS2_32.dll

SHFileOperationA

SHFileOperationA

SHELL32.dll

SHELL32.dll

SHLWAPI.dll

SHLWAPI.dll

GetSystemWindowsDirectoryA

GetSystemWindowsDirectoryA

WinExec

WinExec

SetThreadExecutionState

SetThreadExecutionState

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

GetKeyboardState

GetKeyboardState

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

GetKeyboardLayoutList

GetKeyboardLayoutList

GetAsyncKeyState

GetAsyncKeyState

GetKeyboardLayout

GetKeyboardLayout

MapVirtualKeyW

MapVirtualKeyW

VkKeyScanW

VkKeyScanW

VkKeyScanExW

VkKeyScanExW

keybd_event

keybd_event

EnumChildWindows

EnumChildWindows

ActivateKeyboardLayout

ActivateKeyboardLayout

SetKeyboardState

SetKeyboardState

USER32.dll

USER32.dll

SetViewportOrgEx

SetViewportOrgEx

GetViewportOrgEx

GetViewportOrgEx

GDI32.dll

GDI32.dll

RegOpenKeyExA

RegOpenKeyExA

RegCloseKey

RegCloseKey

RegFlushKey

RegFlushKey

RegNotifyChangeKeyValue

RegNotifyChangeKeyValue

RegDeleteKeyA

RegDeleteKeyA

RegEnumKeyExA

RegEnumKeyExA

RegOpenKeyExW

RegOpenKeyExW

RegQueryInfoKeyW

RegQueryInfoKeyW

RegEnumKeyExW

RegEnumKeyExW

ADVAPI32.dll

ADVAPI32.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

gdiplus.dll

gdiplus.dll

MSVCRT.dll

MSVCRT.dll

AVICAP32.dll

AVICAP32.dll

MSVFW32.dll

MSVFW32.dll

ShellExecuteW

ShellExecuteW

GetProcessHeap

GetProcessHeap

?456789:;<=

?456789:;<=

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

;3 #>6.&

;3 #>6.&

'2, / 0&7!4-)1#

'2, / 0&7!4-)1#

5`6C6Q6}6

5`6C6Q6}6

55

55

;";,;6;<;_;{;

;";,;6;<;_;{;

6&7-737<7|7

6&7-737<7|7

3"33393>3}3

3"33393>3}3

;#;);/;=;

;#;);/;=;

<"=3=9=>=}=</pre><pre>:(:-:8:=:</pre><pre>7#7)7/7=7</pre><pre>9&9,929@9</pre><pre>0!02090>0</pre><pre>>$>*>4>9></pre><pre>Windows Explorer</pre><pre>mavast.com</pre><pre>ya.ru</pre><pre>serverkey.dat</pre><pre>\windows\</pre><pre>dntdll.dll</pre><pre>.NET CLR Networking_Perf_Library_Lock_PID_0</pre><pre>.NET Data Provider for SqlServer_Perf_Library_Lock_PID_0</pre><pre>ASP.NET_2.0.50727_Perf_Library_Lock_PID_0</pre><pre>SOFTWARE\JavaSoft\Java Plug-in\1.6.0_%d</pre><pre>Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%d</pre><pre>Software\Microsoft\Windows\CurrentVersion\Internet Settings</pre><pre>iexplore.exe</pre><pre>HighMemoryEvent_x</pre><pre>MSCTF.Shared.MAPPING.x</pre><pre>MSCTF.Shared.EVENT.x</pre><pre>MSCTF.Shared.MUTEX.x</pre><pre>.Prev</pre><pre>.current</pre><b>Explorer.EXE_1948_rwx_025B0000_000B8000:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.reloc</pre><pre><>http</pre><pre>PASSu98V</pre><pre>PASSu08V</pre><pre>FTPQ</pre><pre>12345678</pre><pre>password1</pre><pre>monkey</pre><pre>monkey1</pre><pre>password</pre><pre>Pname.key</pre><pre>\secrets.key</pre><pre>kernel32.dll</pre><pre>\explorer.exe</pre><pre>user32.dll</pre><pre>multi_pot.exe</pre><pre>HookExplorer.exe</pre><pre>proc_analyzer.exe</pre><pre>sckTool.exe</pre><pre>sniff_hit.exe</pre><pre>sysAnalyzer.exe</pre><pre>idag.exe</pre><pre>ollydbg.exe</pre><pre>dumpcap.exe</pre><pre>wireshark.exe</pre><pre>avp.exe</pre><pre>Software\Microsoft\Windows NT\CurrentVersion</pre><pre>%s!%s!X</pre><pre>sysinfo.log</pre><pre>scr.jpg</pre><pre>minidump.bin</pre><pre>%d.%d.%d.%d</pre><pre>Ý %dh %dm</pre><pre>%s:%d</pre><pre>Software\Microsoft\Internet Explorer\TypedURLs</pre><pre>url%i</pre><pre>4.8.14</pre><pre>%dx%d@%d</pre><pre>%c%d:d</pre><pre>{Windows directory:</pre><pre>links.log</pre><pre>\History.IE5\index.dat</pre><pre>\Opera\Opera\typed_history.xml</pre><pre>avast.com</pre><pre>93.191.13.100</pre><pre>drweb</pre><pre>eset.com</pre><pre>z-oleg.com</pre><pre>kltest.org.ru</pre><pre>.comodo.com</pre><pre>google.com</pre><pre>Dnsapi.dll</pre><pre>ws2_32.dll</pre><pre>Referer: http://www.google.com</pre><pre>Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)</pre><pre>/login.php</pre><pre>Global\{EAF799BF-8249-4fe1-9A0D-92CD3CC22014}</pre><pre>Global\{EAF799BF-8449-4fe1-9A0D-95CD39DC2014}</pre><pre>/search.php</pre><pre>Winmm.dll</pre><pre>Kernel32.dll</pre><pre>Gdi32.dll</pre><pre>ntdll.dll</pre><pre>http://</pre><pre>https://</pre><pre>HTTP/1.</pre><pre>nspr4.dll</pre><pre>PR_OpenTCPSocket</pre><pre>[[[URL: %s</pre><pre>Process: %s</pre><pre>User-agent: %s]]]</pre><pre>{{{%s</pre><pre>Crypt32.dll</pre><pre>CertVerifyCertificateChainPolicy</pre><pre>Wininet.dll</pre><pre>HttpSendRequestA</pre><pre>HttpSendRequestW</pre><pre>HttpSendRequestExA</pre><pre>HttpSendRequestExW</pre><pre>set_url</pre><pre>microsoft.public.win32.programmer.kernel</pre><pre>\iexplore.exe</pre><pre>\firefox.exe</pre><pre>keygrab</pre><pre>u.jpg</pre><pre>IprivLibEx.dll</pre><pre>\\.\PhysicalDrive%u</pre><pre>/topic.php</pre><pre>keylog.txt</pre><pre>sniff.log</pre><pre>passwords.txt</pre><pre>%s%u.zip</pre><pre>Content-Disposition: form-data; name="file"; filename="report"

<"=3=9=>=}=</pre><pre>:(:-:8:=:</pre><pre>7#7)7/7=7</pre><pre>9&9,929@9</pre><pre>0!02090>0</pre><pre>>$>*>4>9></pre><pre>Windows Explorer</pre><pre>mavast.com</pre><pre>ya.ru</pre><pre>serverkey.dat</pre><pre>\windows\</pre><pre>dntdll.dll</pre><pre>.NET CLR Networking_Perf_Library_Lock_PID_0</pre><pre>.NET Data Provider for SqlServer_Perf_Library_Lock_PID_0</pre><pre>ASP.NET_2.0.50727_Perf_Library_Lock_PID_0</pre><pre>SOFTWARE\JavaSoft\Java Plug-in\1.6.0_%d</pre><pre>Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%d</pre><pre>Software\Microsoft\Windows\CurrentVersion\Internet Settings</pre><pre>iexplore.exe</pre><pre>HighMemoryEvent_x</pre><pre>MSCTF.Shared.MAPPING.x</pre><pre>MSCTF.Shared.EVENT.x</pre><pre>MSCTF.Shared.MUTEX.x</pre><pre>.Prev</pre><pre>.current</pre><b>Explorer.EXE_1948_rwx_025B0000_000B8000:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.reloc</pre><pre><>http</pre><pre>PASSu98V</pre><pre>PASSu08V</pre><pre>FTPQ</pre><pre>12345678</pre><pre>password1</pre><pre>monkey</pre><pre>monkey1</pre><pre>password</pre><pre>Pname.key</pre><pre>\secrets.key</pre><pre>kernel32.dll</pre><pre>\explorer.exe</pre><pre>user32.dll</pre><pre>multi_pot.exe</pre><pre>HookExplorer.exe</pre><pre>proc_analyzer.exe</pre><pre>sckTool.exe</pre><pre>sniff_hit.exe</pre><pre>sysAnalyzer.exe</pre><pre>idag.exe</pre><pre>ollydbg.exe</pre><pre>dumpcap.exe</pre><pre>wireshark.exe</pre><pre>avp.exe</pre><pre>Software\Microsoft\Windows NT\CurrentVersion</pre><pre>%s!%s!X</pre><pre>sysinfo.log</pre><pre>scr.jpg</pre><pre>minidump.bin</pre><pre>%d.%d.%d.%d</pre><pre>Ý %dh %dm</pre><pre>%s:%d</pre><pre>Software\Microsoft\Internet Explorer\TypedURLs</pre><pre>url%i</pre><pre>4.8.14</pre><pre>%dx%d@%d</pre><pre>%c%d:d</pre><pre>{Windows directory:</pre><pre>links.log</pre><pre>\History.IE5\index.dat</pre><pre>\Opera\Opera\typed_history.xml</pre><pre>avast.com</pre><pre>93.191.13.100</pre><pre>drweb</pre><pre>eset.com</pre><pre>z-oleg.com</pre><pre>kltest.org.ru</pre><pre>.comodo.com</pre><pre>google.com</pre><pre>Dnsapi.dll</pre><pre>ws2_32.dll</pre><pre>Referer: http://www.google.com</pre><pre>Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)</pre><pre>/login.php</pre><pre>Global\{EAF799BF-8249-4fe1-9A0D-92CD3CC22014}</pre><pre>Global\{EAF799BF-8449-4fe1-9A0D-95CD39DC2014}</pre><pre>/search.php</pre><pre>Winmm.dll</pre><pre>Kernel32.dll</pre><pre>Gdi32.dll</pre><pre>ntdll.dll</pre><pre>http://</pre><pre>https://</pre><pre>HTTP/1.</pre><pre>nspr4.dll</pre><pre>PR_OpenTCPSocket</pre><pre>[[[URL: %s</pre><pre>Process: %s</pre><pre>User-agent: %s]]]</pre><pre>{{{%s</pre><pre>Crypt32.dll</pre><pre>CertVerifyCertificateChainPolicy</pre><pre>Wininet.dll</pre><pre>HttpSendRequestA</pre><pre>HttpSendRequestW</pre><pre>HttpSendRequestExA</pre><pre>HttpSendRequestExW</pre><pre>set_url</pre><pre>microsoft.public.win32.programmer.kernel</pre><pre>\iexplore.exe</pre><pre>\firefox.exe</pre><pre>keygrab</pre><pre>u.jpg</pre><pre>IprivLibEx.dll</pre><pre>\\.\PhysicalDrive%u</pre><pre>/topic.php</pre><pre>keylog.txt</pre><pre>sniff.log</pre><pre>passwords.txt</pre><pre>%s%u.zip</pre><pre>Content-Disposition: form-data; name="file"; filename="report"

HTTP/1.0

HTTP/1.0

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

Content-Type: multipart/form-data; boundary=---------------------------%s

Content-Type: multipart/form-data; boundary=---------------------------%s

www.bing.com

www.bing.com

www.microsoft.com

www.microsoft.com

frd.exe

frd.exe

command=config&update_url=

command=config&update_url=

&port=

&port=

command=load&url=

command=load&url=

SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0001

SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0001

SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0002

SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0002

SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0003

SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0003

hid=%s&username=SYSTEM&compname=%s&bot_version=4.8.14&uptime=%u&os=u&local_time=%s%d&token=%d&socks_port=%u&hardware[display]=%s&hardware[driver_av]=%s

hid=%s&username=SYSTEM&compname=%s&bot_version=4.8.14&uptime=%u&os=u&local_time=%s%d&token=%d&socks_port=%u&hardware[display]=%s&hardware[driver_av]=%s

\chrome.exe

\chrome.exe

\svchost.exe

\svchost.exe

\opera.exe

\opera.exe

\cbmain.ex

\cbmain.ex

\iscc.exe

\iscc.exe

\clmain.exe

\clmain.exe

\wclnt.exe

\wclnt.exe

internal_wutex_0xx

internal_wutex_0xx

%s.dbf

%s.dbf

%s.DBF

%s.DBF

pop2://%s:%s@%s:%i

pop2://%s:%s@%s:%i

pop3://%s:%s@%s:%i

pop3://%s:%s@%s:%i

nntp://%s:%s@%s:%i

nntp://%s:%s@%s:%i

ftp://%s:%s@%s:%i

ftp://%s:%s@%s:%i

ftp://anonymous:

ftp://anonymous:

AUTHINFO PASS

AUTHINFO PASS

j_password=

j_password=

pass.log

pass.log

command=auth_loginByPassword&back_command=&back_custom1=&

command=auth_loginByPassword&back_command=&back_custom1=&

edClientLogin=

edClientLogin=

edUserLogin=

edUserLogin=

edPassword=

edPassword=

&LOGIN_AUTHORIZATION_CODE=

&LOGIN_AUTHORIZATION_CODE=

login=

login=

password=

password=

pass_

pass_

ssleay32.dll

ssleay32.dll

advapi32.dll

advapi32.dll

path.txt

path.txt

keys.zip

keys.zip

Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}

Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}

%s\d.jpg

%s\d.jpg

Local\{AA53E2BF-8989-4fe1-9A0D-95CD39DC0A14}

Local\{AA53E2BF-8989-4fe1-9A0D-95CD39DC0A14}

Local\{EAF799BF-8989-4fe1-9A0D-95CD39D44014}

Local\{EAF799BF-8989-4fe1-9A0D-95CD39D44014}

keys

keys

private.txt

private.txt

public.txt

public.txt

\*.key

\*.key

\self.cer

\self.cer

self.cer

self.cer

self.pub

self.pub

Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC2014}

Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC2014}

ctunnel.exe

ctunnel.exe

ctunnel.zip

ctunnel.zip

path_ctunnel.txt

path_ctunnel.txt

header.key

header.key

keys99

keys99

\header.key

\header.key

masks2.key

masks2.key

\masks2.key

\masks2.key

masks.key

masks.key

\masks.key

\masks.key

\name.key

\name.key

primary2.key

primary2.key

\primary2.key

\primary2.key

primary.key

primary.key

\primary.key

\primary.key

keys99.zip

keys99.zip

path99.txt

path99.txt

bsi.dll

bsi.dll

&domain=letitbit.net&

&domain=letitbit.net&

cc.txt

cc.txt

Local\{EAF799BF-8989-4fa1-9A0D-95CD39DC0214}

Local\{EAF799BF-8989-4fa1-9A0D-95CD39DC0214}

prv_key.pfx

prv_key.pfx

keys\

keys\

sign.cer

sign.cer

Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}

Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}

sks2xyz.dll

sks2xyz.dll

vb_pfx_import

vb_pfx_import

Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC0214}

Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC0214}

secret.key

secret.key

pubkeys.key

pubkeys.key

Local\{AAF799BF-8989-4fe1-9A0D-95CD39DC0A14}

Local\{AAF799BF-8989-4fe1-9A0D-95CD39DC0A14}

path1.txt

path1.txt

inter.zip

inter.zip

interpro.ini

interpro.ini

Local\{EAF329BF-8989-4fe1-9A0D-95CD39DC0214}

Local\{EAF329BF-8989-4fe1-9A0D-95CD39DC0214}

Local\{AAF733BF-8989-4fe1-9A0D-95CD39DC0A14}

Local\{AAF733BF-8989-4fe1-9A0D-95CD39DC0A14}

Local\{BQQQW777-B777-4e47-8B10-69798A04C732}

Local\{BQQQW777-B777-4e47-8B10-69798A04C732}

cbsmain.dll

cbsmain.dll

Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}

Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}

pass.txt

pass.txt

Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214}

Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214}

FilialRCon.dll

FilialRCon.dll

ISClient.cfg

ISClient.cfg

Local\{EAF777BF-8989-4fe1-9A0D-95CD777C0214}

Local\{EAF777BF-8989-4fe1-9A0D-95CD777C0214}

rfk.zip

rfk.zip

Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}

Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}

Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}

Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}

Agava_Client.exe

Agava_Client.exe

KeysDiskPath

KeysDiskPath

Agava_Client.ini

Agava_Client.ini

Agava_keys

Agava_keys

keys_path.txt

keys_path.txt

Local\{AA53E2BF-8989-4EEE-9A0D-95CD39DC0A14}

Local\{AA53E2BF-8989-4EEE-9A0D-95CD39DC0A14}

mespro.dll

mespro.dll

AddPSEPrivateKeyEx

AddPSEPrivateKeyEx

core.exe

core.exe

data\id.dbf

data\id.dbf

\data\id.dbf

\data\id.dbf

keys%i.zip

keys%i.zip

path%i.txt

path%i.txt

Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}

Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}

cert.pem

cert.pem

Local\{BE3CEFA7-B777-4e47-8B10-69745D04C732}

Local\{BE3CEFA7-B777-4e47-8B10-69745D04C732}

winmm.dll

winmm.dll

1.2.5

1.2.5

unzip 1.01 Copyright 1998-2004 Gilles Vollant - http://www.winimage.com/zLibDll

unzip 1.01 Copyright 1998-2004 Gilles Vollant - http://www.winimage.com/zLibDll

zip 1.01 Copyright 1998-2004 Gilles Vollant - http://www.winimage.com/zLibDll

zip 1.01 Copyright 1998-2004 Gilles Vollant - http://www.winimage.com/zLibDll

%s\%s

%s\%s

#webcam

#webcam

#webcam%d

#webcam%d

RFB d.d

RFB d.d

%s (%s)

%s (%s)

d/d/d d:d

d/d/d d:d

password check failed!

password check failed!

WinSCard.dll

WinSCard.dll

SensApi.dll

SensApi.dll

GetTcpTable

GetTcpTable

IPHLPAPI.DLL

IPHLPAPI.DLL

dbghelp.dll

dbghelp.dll

PSAPI.DLL

PSAPI.DLL

NETAPI32.dll

NETAPI32.dll

DNSAPI.dll

DNSAPI.dll

HttpQueryInfoA

HttpQueryInfoA

HttpAddRequestHeadersW

HttpAddRequestHeadersW

HttpAddRequestHeadersA

HttpAddRequestHeadersA

HttpOpenRequestA

HttpOpenRequestA

WININET.dll

WININET.dll

WS2_32.dll

WS2_32.dll

SHFileOperationA

SHFileOperationA

SHELL32.dll

SHELL32.dll

SHLWAPI.dll

SHLWAPI.dll

GetSystemWindowsDirectoryA

GetSystemWindowsDirectoryA

WinExec

WinExec

SetThreadExecutionState

SetThreadExecutionState

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

GetKeyboardState

GetKeyboardState

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

GetKeyboardLayoutList

GetKeyboardLayoutList

GetAsyncKeyState

GetAsyncKeyState

GetKeyboardLayout

GetKeyboardLayout

MapVirtualKeyW

MapVirtualKeyW

VkKeyScanW

VkKeyScanW

VkKeyScanExW

VkKeyScanExW

keybd_event

keybd_event

EnumChildWindows

EnumChildWindows

ActivateKeyboardLayout

ActivateKeyboardLayout

SetKeyboardState

SetKeyboardState

USER32.dll

USER32.dll

SetViewportOrgEx

SetViewportOrgEx

GetViewportOrgEx

GetViewportOrgEx

GDI32.dll

GDI32.dll

RegOpenKeyExA

RegOpenKeyExA

RegCloseKey

RegCloseKey

RegFlushKey

RegFlushKey

RegNotifyChangeKeyValue

RegNotifyChangeKeyValue

RegDeleteKeyA

RegDeleteKeyA

RegEnumKeyExA

RegEnumKeyExA

RegOpenKeyExW

RegOpenKeyExW

RegQueryInfoKeyW

RegQueryInfoKeyW

RegEnumKeyExW

RegEnumKeyExW

ADVAPI32.dll

ADVAPI32.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

gdiplus.dll

gdiplus.dll

MSVCRT.dll

MSVCRT.dll

AVICAP32.dll

AVICAP32.dll

MSVFW32.dll

MSVFW32.dll

ShellExecuteW

ShellExecuteW

GetProcessHeap

GetProcessHeap

?456789:;<=

?456789:;<=

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

;3 #>6.&

;3 #>6.&

'2, / 0&7!4-)1#

'2, / 0&7!4-)1#

SYSTEM!XP2!89D4A5A6

SYSTEM!XP2!89D4A5A6

%WinDir%\apppatch\kndaxn.exe

%WinDir%\apppatch\kndaxn.exe

%Documents and Settings%\%current user%\Application Data\

%Documents and Settings%\%current user%\Application Data\

5`6C6Q6}6

5`6C6Q6}6

55

55

;";,;6;<;_;{;

;";,;6;<;_;{;

6&7-737<7|7

6&7-737<7|7

3"33393>3}3

3"33393>3}3

;#;);/;=;

;#;);/;=;

<"=3=9=>=}=</pre><pre>:(:-:8:=:</pre><pre>7#7)7/7=7</pre><pre>9&9,929@9</pre><pre>0!02090>0</pre><pre>>$>*>4>9></pre><pre>`.data</pre><pre>Windows Explorer</pre><pre>mavast.com</pre><pre>ya.ru</pre><pre>serverkey.dat</pre><pre>\windows\</pre><pre>dntdll.dll</pre><pre>.NET CLR Networking_Perf_Library_Lock_PID_0</pre><pre>.NET Data Provider for SqlServer_Perf_Library_Lock_PID_0</pre><pre>ASP.NET_2.0.50727_Perf_Library_Lock_PID_0</pre><pre>SOFTWARE\JavaSoft\Java Plug-in\1.6.0_%d</pre><pre>Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%d</pre><pre>Software\Microsoft\Windows\CurrentVersion\Internet Settings</pre><pre>iexplore.exe</pre><pre>HighMemoryEvent_x</pre><pre>MSCTF.Shared.MAPPING.x</pre><pre>MSCTF.Shared.EVENT.x</pre><pre>MSCTF.Shared.MUTEX.x</pre><pre>.Prev</pre><pre>.current</pre></div><div class="blog_tab" id="tab3"><p><strong class="font_20"><span style="font-size:medium;">Remove it with Ad-Aware</span></strong></p><ol><li>Click (<a href="http://lavasoft.com/thankyou.php?internal=true&inter=encyclopedia"><span style="color: #0000ff;">here</span></a>) to download and install Ad-Aware Free Antivirus.</li><li>Update the definition files.</li><li>Run a full scan of your computer.</li></ol><p><strong class="font_20"><span style="font-size:medium;">Manual removal*</span></strong></p><ol><li>Scan a system with an anti-rootkit tool.<br /></li><li>Terminate malicious process(es) (<a href="http://www.lavasoft.com/mylavasoft/malware-removal-support/blog/how-to-end-a-process-with-the-task-manager"><span style="color: #0000ff;">How to End a Process With the Task Manager</span></a>):<p style="padding-left: 30px; font-size: x-small; color: #ff0000;">%original file name%.exe:216<br /></p></li><li>Delete the original Trojan file.<br /></li><li>Delete or disinfect the following files created/modified by the Trojan:<p style="padding-left: 30px; font-size: x-small; color: #ff0000;">%WinDir%\AppPatch\kndaxn.exe (1961 bytes)<br />%System%\config\software (3028 bytes)<br />%System%\config\software.LOG (5300 bytes)</p></li><li>Clean the Temporary Internet Files folder, which may contain infected files (<a href="http://www.lavasoft.com/mylavasoft/malware-removal-support/blog/how-to-clean-the-temporary-internet-files-folder"><span style="color: #0000ff;">How to clean Temporary Internet Files folder</span></a>).<br /></li><li>Reboot the computer.<br /></li></ol>*Manual removal may cause unexpected system behaviour and should be performed at your own risk.