Skip to main content

TrojanPSW.Win32.Fareit_1424df189c


Trojan.Win32.Cutwail.cex (Kaspersky), Trojan.Win32.Generic!BT (VIPRE), Trojan-PSW.Win32.Fareit.FD, TrojanPSWFareit.YR, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 1424df189cf82cd21e6929eefb0da760

SHA1: b6074ec4d83da36da521931c917fbe844c3ed511

SHA256: 2c49b300b7b6a69f897f1b0bbc0ae894035c4367aa6149a894687da203b2f53a

SSDeep: 768:iIdb VltyLTE9gDNgpvfxyRpigLVhKtXaXo4CK9:iIsRcIeDNgLyKgLVhKtl4b9

Size: 38400 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2008-11-02 19:13:23

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan-PSW. Trojan program intended for stealing users passwords.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan-PSW creates the following process(es):

Reader_sl.exe:1064
wuauclt.exe:344
jusched.exe:1056

The Trojan-PSW injects its code into the following process(es):

%original file name%.exe:1572

File activity

The process wuauclt.exe:344 makes changes in the file system.


The Trojan-PSW creates and/or writes to the following file(s):

%WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (3576 bytes)
%WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)

The Trojan-PSW deletes the following file(s):

%WinDir%\SoftwareDistribution\DataStore\Logs\tmp.edb (0 bytes)

The process %original file name%.exe:1572 makes changes in the file system.


The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GZWRQVUZ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GZWRQVUZ\teasing-video[1].htm (1542 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IFWNIZW9\vandeks[1].htm (257 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\sydney[1].htm (357 bytes)
%Documents and Settings%\%current user%\jyrvicewyxmu.exe (38 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHCTSNI3\urantiaproject[1].htm (756 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHCTSNI3\hostphd.com[1].htm (24 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@shipeliteexpress[1].txt (1085 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\theprintinghouseltd.co[1].htm (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IFWNIZW9\empordalia[1].htm (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHCTSNI3\trinity-works[1].htm (16 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bigtopmultimedia[1].txt (239 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IFWNIZW9\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@totalearthcare.com[1].txt (241 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHCTSNI3\403[1].htm (4 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sdlp[1].txt (214 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@racknstackwarehouse.com[1].txt (251 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IFWNIZW9\suspendedpage[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHCTSNI3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\unitedearthgroup[1].htm (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@starmedia[1].txt (223 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@goodvaluecenter[1].txt (237 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IFWNIZW9\sortedorganizing[1].htm (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\aciuba.com[1].htm (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\sun-ele.co[1].htm (12 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@plus[1].txt (214 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@appelfarm[1].txt (225 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cbsprinting.com[1].txt (235 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\c5b88721db08c824db69d0bbc702beb8_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03 (881 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\solutioncorp[1].htm (4184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IFWNIZW9\robertmcintyre.com[1].htm (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHCTSNI3\cath4choice[1].htm (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IFWNIZW9\shipeliteexpress[1].htm (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\combine.or[1].htm (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@altonhousehotel[1].txt (237 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@glmghotels[1].txt (227 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@ctr4process[1].txt (230 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.servico-ind[1].txt (214 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@traderush[1].txt (268 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@agence-des-druides[1].txt (175 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\coketh[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\shs-sales.co[1].htm (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\sarpy[1].htm (20 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@shipeliteexpress[2].txt (317 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\cksglobal[1].htm (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\enzoyrodrigo.com[1].htm (586 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (20720 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GZWRQVUZ\lexjuridica[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GZWRQVUZ\index[1].htm (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GZWRQVUZ\wkhk[1].htm (1832 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@agence-des-druides[2].txt (358 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@istanbultarim.com[1].txt (239 bytes)

The Trojan-PSW deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@shipeliteexpress[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\theprintinghouseltd.co[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IFWNIZW9\vandeks[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IFWNIZW9\robertmcintyre.com[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHCTSNI3\cath4choice[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@shipeliteexpress[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\aciuba.com[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\unitedearthgroup[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\cksglobal[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\combine.or[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHCTSNI3\hostphd.com[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\shs-sales.co[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\sarpy[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GZWRQVUZ\lexjuridica[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHCTSNI3\trinity-works[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@agence-des-druides[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\sun-ele.co[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\enzoyrodrigo.com[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GZWRQVUZ\index[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IFWNIZW9\empordalia[1].htm (0 bytes)

The process jusched.exe:1056 makes changes in the file system.


The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jusched.log (347 bytes)

Registry activity

The process Reader_sl.exe:1064 makes changes in the system registry.


The Trojan-PSW creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process %original file name%.exe:1572 makes changes in the system registry.


The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion]
"2312304364" = "DD 07 0C 00 00 00 16 00 08 00 0B 00 2B 00 6A 03"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion]
"jyrvicewyxmuzap" = "C2 9A 72 4A 22 F9 D1 A9 F4 CC A4 7C 54 2C 04 DB"

"AppManagement" = "23 FA D2 AA 82 5A 32 7D 55 2D 05 DC B4 8C 64 3C"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 88 78 14 FC 13 C1 23 DD 77 1C 75 6F 73 B2 79"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

To automatically run itself each time Windows is booted, the Trojan-PSW adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"jyrvicewyxmu" = "%Documents and Settings%\%current user%\jyrvicewyxmu.exe"

The Trojan-PSW modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan-PSW modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan-PSW modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan-PSW deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Network activity (URLs)

URL IP
hxxp://upsilon89.com/151.236.48.69
hxxp://myfilecenter.com/66.33.213.228
hxxp://mattiussiecologia.com/95.110.200.253
hxxp://cabooseonline.com/192.138.20.228
hxxp://totalearthcare.com.au/108.162.193.154
hxxp://agence-des-druides.com/213.186.33.3
hxxp://saios.net/157.7.184.19
hxxp://mandi-man.com/210.172.144.61
hxxp://denville.ca/204.11.237.35
hxxp://shs-sales.co.uk/193.36.43.104
hxxp://solutioncorp.com/209.208.32.245
hxxp://brookfarm.com.au/116.251.204.207
hxxp://nuritech.com/222.239.78.139
hxxp://combine.or.id/202.162.33.14
hxxp://servico-ind.com/85.159.56.120
hxxp://xing-group.com/59.106.165.171
hxxp://trinity-works.com/219.94.206.70
hxxp://servico-ind.com/index.asp
hxxp://vandeks.com/144.76.86.115
hxxp://skaner.com.pl/109.234.111.40
hxxp://teasing-video.com/99.192.154.182
hxxp://churchsupplies.net/66.232.99.164
hxxp://naijagurus.com/192.64.112.193
hxxp://areafor.com/185.2.130.31
hxxp://sortedorganizing.com/74.220.199.6
hxxp://digpro.se/89.221.250.12
hxxp://cbsprinting.com.au/141.101.116.74
hxxp://sspackaginggroup.com/182.50.130.36
hxxp://cath4choice.org/76.12.228.8
hxxp://urantiaproject.com/69.94.124.47
hxxp://glmghotels.com/141.101.116.108
hxxp://y8k6h.x.incapdns.net/
hxxp://optiver.com.au/217.195.114.124
hxxp://cksglobal.net/185.21.133.34
hxxp://aciuba.com.br/186.249.220.203
hxxp://wkhk.net/203.189.104.242
hxxp://www.optiver.com/sydney/217.195.124.19
hxxp://starmedia.ca/141.101.125.75
hxxp://agrarno.ru/178.63.17.213
hxxp://bigtopmultimedia.com/108.162.198.246
hxxp://plus.ba/141.101.116.246
hxxp://altonhousehotel.com/108.162.205.109
hxxp://lognetic.com/78.47.37.140
hxxp://geodecisions.com/216.174.25.93
hxxp://penavision.co.in/174.136.57.160
hxxp://stop-ddos.me/195.22.26.252
hxxp://merceorti.com/80.93.92.146
hxxp://christybarry.com/66.49.139.143
hxxp://christybarry.com/cgi-sys/suspendedpage.cgi
hxxp://tessera.co.jp/210.150.6.88
hxxp://sdlp.ie/141.101.117.223
hxxp://goodvaluecenter.com/108.162.201.140
hxxp://buzzkillmedia.com/173.201.140.128
hxxp://asterisk.com.sg/211.25.3.196
hxxp://hostphd.com.br/192.196.156.73
hxxp://beechwoodmetalworks.com/69.163.135.152
hxxp://ctr4process.org/108.162.204.164
hxxp://acicinvestor.ca/207.150.203.36
hxxp://s2s.fr/195.64.165.29
hxxp://asj.co.jp/219.118.206.4
hxxp://istanbultarim.com.tr/108.162.198.72
hxxp://fleshercorp.com/64.111.24.104
hxxp://rea-soft.ru/78.47.135.34
hxxp://ctr4process.org/403.shtml
hxxp://tvndra.net/91.216.141.46
hxxp://ryumachi-jp.com/111.68.174.253
hxxp://toddpipe.com/173.247.243.173
hxxp://shakeyspizza.ph/66.135.32.56
hxxp://marcusgrimes.co.uk/109.74.242.160
hxxp://sun-ele.co.jp/210.169.184.168
hxxp://unslp.edu.bo/50.28.58.0
hxxp://coketh.com/59.106.13.131
hxxp://sarpy.com/66.37.225.130
hxxp://youjoomla.com/69.65.11.200
hxxp://victoria.com.pl/89.161.158.128
hxxp://robertmcintyre.com.au/199.73.58.66
hxxp://nasz-sklep.pl/91.192.164.134
hxxp://vanguardpkg.com/50.62.115.1
hxxp://authentica-travel.com/68.168.112.98
hxxp://shipeliteexpress.com/67.59.133.211
hxxp://avant-ime.com/188.121.45.218
hxxp://empordalia.com/5.56.61.199
hxxp://racknstackwarehouse.com.au/141.101.117.200
hxxp://appelfarm.org/108.162.205.115
hxxp://tutuji-saitama.com/157.7.160.37
hxxp://link-list-uk.com/91.109.14.224
hxxp://sztartufi.com/95.110.192.171
hxxp://theprintinghouseltd.co.uk/46.20.228.113
hxxp://unitedearthgroup.com/213.171.195.105
hxxp://mastechn.com/64.207.148.243
hxxp://automa.it/95.110.195.52
hxxp://enzoyrodrigo.com.br/216.245.218.146
hxxp://etcycles.com/68.171.36.109
hxxp://hinnenwiese.de/85.13.135.246
hxxp://isle-karnataka.org/209.99.40.223
hxxp://careerstodaycanada.com/76.77.71.5
hxxp://ezmedi.com/218.150.78.243
hxxp://calvarycemeterydayton.org/198.1.91.2
hxxp://csmbc.org/149.47.157.224
hxxp://caeweb.com/204.152.118.133
hxxp://lexjuridica.com/176.28.103.205
hxxp://rt-printing.com/69.94.108.207
hxxp://cromwellharbor.com/173.45.246.222
hxxp://cfgreaterjackson.org/12.108.68.136
hxxp://trivax.com/216.172.104.2
hxxp://arpeges.org/88.190.216.198
hxxp://coe.pku.edu.cn/162.105.5.245
hxxp://constancehotels.com/46.21.202.14
hxxp://e-ciencia.com/46.105.32.97
hxxp://syntrinsic.com/69.16.192.61
hxxp://easytrip.net/216.154.212.124
hxxp://ask-romein.com/185.30.205.148
hxxp://dataweave.com.au/208.113.174.41
hxxp://moshk.com/46.165.224.57
hxxp://vivawebinternet.com.br/208.113.185.210
hxxp://5-market.com/210.172.144.179
hxxp://mojos.com/216.171.235.189
hxxp://mtrx.net/72.55.184.109
hxxp://mediadevelopment.com/66.35.84.54
hxxp://omikrondokk.hu/81.0.69.163
hxxp://lavozdelared.net/217.160.7.132
hxxp://dicre.com/203.189.104.227
hxxp://gocommunications.ch/91.193.21.190
hxxp://cabv.com/46.105.111.215
hxxp://imperiumhomes.com/200.58.114.10
hxxp://392430.com/219.94.128.96
hxxp://solutiodesign.com/64.14.68.156
hxxp://petairusa.com/85.234.137.80
hxxp://dialadinner.com.hk/122.128.107.29
hxxp://slow-db.com/59.106.166.251
hxxp://atlantis-shisui.com/210.172.144.246
hxxp://cvswl.org/216.35.196.47
hxxp://bangertcomputer.com/64.13.232.135
hxxp://aedsrl.it/85.94.217.210
hxxp://bedfordlaw.com/69.27.119.9
hxxp://ans-service.com/67.227.252.139
hxxp://3moulins.com/80.74.64.7
hxxp://olganon.org/198.143.166.17
hxxp://roselani.com/72.52.242.220
hxxp://mail.kanglin.com.tw/211.75.193.131
hxxp://toyotafound.or.jp/202.218.52.67
hxxp://alpes-campings.com/94.247.180.34
hxxp://atlasztravel.hu/195.70.57.6
hxxp://putujemouevropu.org/46.22.145.53
hxxp://jidoucenter.com/211.133.134.82
hxxp://poyrazoto.com.tr/37.230.104.123
hxxp://ramybrook.com/208.86.153.246
hxxp://searrp.org/103.6.196.150
hxxp://palmbeachbeaute.com/108.174.158.213
hxxp://camphillscotland.org.uk/62.255.174.64
hxxp://thlabel.com/114.80.156.67
hxxp://capacitacionypnd.com/69.64.81.51
hxxp://aschroofing.com/184.168.46.66
hxxp://slakes.net/72.29.68.107
hxxp://bradleybray.com.au/203.143.82.28
hxxp://reflex.com.pl/62.129.214.85
hxxp://watermaticcoolers.com/67.227.138.16
hxxp://kitchencollage.com/67.225.214.101
hxxp://schuster-treppen.de/212.227.54.147
hxxp://worldtourism.com.au/203.144.4.66
hxxp://maybellecarter.com/198.20.250.199
hxxp://cimtech.ca/168.144.87.138
hxxp://saweightlosscenter.com/50.28.84.225
hxxp://mjfdesigns.com/94.23.11.23
hxxp://hotelkunlun.com/119.31.233.123
hxxp://acuprint.com/216.35.197.49
hxxp://aandporchids.com/216.30.187.127
hxxp://koeppl.com/178.77.96.167
hxxp://rokayfloral.com/67.212.167.194
hxxp://technicorp.co.cr/67.210.101.185
hxxp://earthworks-j.com/211.1.224.76
hxxp://rabinco.com.my/202.75.53.90
hxxp://iberclean.com/198.58.86.155
hxxp://saudireadymix.com.sa/216.55.98.216
hxxp://invertek.co.uk/109.228.11.78
hxxp://minority-inc.com/180.222.182.167
hxxp://norm-fasteners.com.tr/78.129.226.93
hxxp://peralesaguiar.com.ar/200.58.107.237
hxxp://exo2.co.uk/87.117.239.204
hxxp://internationalcabinets.com.au/66.244.147.199
hxxp://rentinmarin.com/199.59.58.68
hxxp://uwlowcountry.org/69.64.77.63
hxxp://dpmsystems.com/67.225.236.114
hxxp://insulationaustralia.com.au/118.127.40.56
hxxp://uhren-schmuckhaus-moeckel.de/83.169.16.130
hxxp://easy-networx.de/217.91.166.9
hxxp://chicanofederation.org/66.240.194.76
hxxp://imsa.com.ar/5.9.198.70
hxxp://solustan.com/64.13.192.118
hxxp://agro-trans.biz/217.96.23.27
hxxp://luksus.net.pl/195.238.166.18
hxxp://monsoybenet.com/85.214.148.76
hxxp://provang.com/204.27.61.50
hxxp://gvcustomsoftware.com.au/111.223.234.21
hxxp://telemkting.com/184.107.156.250
hxxp://isisgroup.co.uk/80.88.198.8
hxxp://adaptworkforce.com/217.19.254.22
hxxp://businessengineers.de/217.110.123.146
hxxp://admik.ru/46.4.196.154
hxxp://autocidade.com.br/67.19.82.226
hxxp://alshares.com/37.58.82.167
hxxp://thevelvetstore.com/74.121.236.92
hxxp://diving-bg.com/91.196.124.63
hxxp://tinnitus.se/89.221.250.20
hxxp://rokyu.net/49.212.34.96
hxxp://newfocas.co.uk/46.20.227.248
hxxp://ohnosha.co.jp/203.145.245.160
hxxp://progir.com/81.25.121.212
hxxp://cpi.com.ar/69.25.136.17
hxxp://waco-cccc.com/68.171.34.203
hxxp://inglett-stubbs.com/70.32.68.171
hxxp://sankalpplacement.com/216.55.136.132
hxxp://ekahosting.com/72.44.94.117
hxxp://marinescape.co.nz/119.47.118.89
hxxp://mc-integ.co.uk/149.255.63.116
hxxp://afsservice.com/216.55.143.63
hxxp://rdidiamonds.com/67.151.215.130
hxxp://ipoaonline.org/70.32.68.135
hxxp://littleblue.com/92.48.127.198
hxxp://computerlogicdirect.com/208.78.155.38
hxxp://plubiz.com/91.121.36.93
hxxp://oremc.com/137.118.32.114
hxxp://rmslive.com/217.114.175.80
hxxp://ibntel.com/68.178.158.24
hxxp://roulottesdecampagne.com/178.33.106.197
hxxp://sps-jia.cz/195.113.221.6
hxxp://snowboardweb.net/210.172.144.27
hxxp://dtc-telecom.co.uk/37.61.234.11
hxxp://musawa.ps/174.46.134.54
hxxp://marcanthony.com/199.103.61.58
hxxp://pluto.com.au/27.131.73.214
hxxp://unitrix.sk/37.9.170.179
hxxp://narsaria.com/174.142.222.216
hxxp://korsil.ru/77.246.146.106
hxxp://ray-jp.com/219.94.203.112
hxxp://gazdic.com/209.41.133.210
hxxp://zanyhost.com/108.60.130.154
hxxp://dominos.co.id/202.169.44.158
hxxp://goodwins-removals.com/84.39.115.126
hxxp://3int.net/149.126.96.164
hxxp://tacsa.ws/64.150.187.245
hxxp://aozoramame.com/211.1.227.93
hxxp://mortgageleads.com/184.105.209.117
hxxp://247petreturn.com/67.211.47.40
hxxp://safedoormatic.com/202.91.240.67
hxxp://casino-top.net/94.23.75.101
hxxp://tomgegax.com/69.163.184.244
hxxp://fsesudmuntenia.ro/128.140.230.196
hxxp://efoa.org/94.107.192.101
hxxp://sagsheriff.com/198.7.59.141
hxxp://carteluz.com.ar/200.58.120.9
hxxp://the-marketing-company.at/78.138.92.184
hxxp://lelund.com/65.60.53.221
hxxp://locbem.com.br/199.48.164.230
hxxp://nnppd.com/64.177.91.97
hxxp://neaco.co.uk/62.255.174.104
hxxp://werta.net/87.120.40.16
hxxp://magnatekenterprises.com/75.119.192.177
hxxp://hwplan.org/216.26.168.132
hxxp://ashleyquinncpas.com/206.51.225.190
maki-hs.com203.137.80.208
counsellingpsychotherapytoronto.com173.236.125.2
alt1.aspmx.l.google.com216.239.34.10
authoritative.net66.33.213.228
ns10.worldnic.com206.188.199.44
kurecci.or.jp119.245.143.88
dns.other-world.com204.11.64.5
in1.smtp.messagingengine.com66.111.4.71
www.traderush.com199.83.132.93
bluecolash.com213.239.215.247
s-style.co.jp209.238.128.37
www.myfilecenter.com66.33.213.228
ibcd.com.br192.168.0.1
pekachemie.com213.217.60.186
limaingenieriayconstruccion.com192.254.143.157
vitalur.by178.159.246.76
mxs.mail.ru94.100.176.20
www.avant-ime.com188.121.45.218
norakuroya.com175.45.136.72
alt4.gmail-smtp-in.l.google.com74.125.136.26
audio-direkt.net127.0.0.1
www.servico-ind.com85.159.56.120
natvideo.com208.122.223.237
doggybag.org62.193.211.35
atanor.ru82.138.1.142
allaroundbouncing.com66.241.231.114
gmail-smtp-in.l.google.com74.125.142.26
ecotechsystem.com93.93.200.130
hpp-services.com127.0.0.1
born-club.com37.140.192.111
aethora.com67.207.143.253
www.trinity-works.com219.94.206.70
craigrichards.com67.228.168.156
iwantsex.org178.32.60.125
nataliecurtiss.com192.168.100.1
konishi-hp.com122.219.254.148
ns-fra.proofpoint.com62.209.50.50
tenpole.com127.0.0.1
pro-networks.co.uk109.73.165.20
mxa-00105401.gslb.pphosted.com208.84.67.208
vivare.nl89.105.202.47
gjk.com.pl148.81.111.98
ns87.hostia.name213.155.29.186
www.cbsprinting.com.au141.101.116.74
www.solutioncorp.com209.208.32.245
www.beechwoodmetalworks.com69.163.135.152
tokushima-med.jrc.or.jp180.37.239.56
www.ctr4process.org108.162.203.164
theartofhair.com0.0.0.0
agrohorizonte.com.ar201.253.108.68
www.wkhk.net203.189.104.242
mx.directgroup.org83.220.44.51
bredainternet.nl127.0.0.1
blagotvoritel.org87.120.6.182
www.saios.net157.7.184.19
iaiglobal.or.id49.50.8.93
fineartsassociation.org70.33.214.138
mail7.digitalwaves.co.nz127.0.0.1
iwamoto-hiroyoshi.com210.172.144.61
aspmx4.googlemail.com173.194.78.26
smtp.live.com65.55.162.200
www.vanguardpkg.com50.62.115.1
bospianoservice.nl195.211.73.89
trenpalau.comUnresolvable
aspmx3googlemail.comUnresolvable
pointopines.comUnresolvable
nichedictionary.comUnresolvable
aspmx2.googlemail.comUnresolvable
aspmx.l.google.comUnresolvable
meubles-jacquelin.comUnresolvable
meridies.orgUnresolvable
manuyantralaya.comUnresolvable
alt2.aspmx.l.google.comUnresolvable
toutenmeuse.comUnresolvable
hoyuu.comUnresolvable
aspmx5.googlemail.comUnresolvable
hifuken.comUnresolvable
mxb-00105401.gslb.pphosted.comUnresolvable


HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    wuauclt.exe:344

  2. Delete the original Trojan-PSW file.
  3. Delete or disinfect the following files created/modified by the Trojan-PSW:

    %WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
    %WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (3576 bytes)
    %WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GZWRQVUZ\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GZWRQVUZ\teasing-video[1].htm (1542 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IFWNIZW9\vandeks[1].htm (257 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\sydney[1].htm (357 bytes)
    %Documents and Settings%\%current user%\jyrvicewyxmu.exe (38 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHCTSNI3\urantiaproject[1].htm (756 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHCTSNI3\hostphd.com[1].htm (24 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@shipeliteexpress[1].txt (1085 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\theprintinghouseltd.co[1].htm (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IFWNIZW9\empordalia[1].htm (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHCTSNI3\trinity-works[1].htm (16 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@bigtopmultimedia[1].txt (239 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IFWNIZW9\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@totalearthcare.com[1].txt (241 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHCTSNI3\403[1].htm (4 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@sdlp[1].txt (214 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@racknstackwarehouse.com[1].txt (251 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IFWNIZW9\suspendedpage[1].htm (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHCTSNI3\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\unitedearthgroup[1].htm (1 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@starmedia[1].txt (223 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@goodvaluecenter[1].txt (237 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IFWNIZW9\sortedorganizing[1].htm (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\aciuba.com[1].htm (73 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\sun-ele.co[1].htm (12 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@plus[1].txt (214 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@appelfarm[1].txt (225 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@cbsprinting.com[1].txt (235 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\c5b88721db08c824db69d0bbc702beb8_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03 (881 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\solutioncorp[1].htm (4184 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IFWNIZW9\robertmcintyre.com[1].htm (14 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHCTSNI3\cath4choice[1].htm (33 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IFWNIZW9\shipeliteexpress[1].htm (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\combine.or[1].htm (1 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@altonhousehotel[1].txt (237 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@glmghotels[1].txt (227 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@ctr4process[1].txt (230 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@www.servico-ind[1].txt (214 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@traderush[1].txt (268 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@agence-des-druides[1].txt (175 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\coketh[1].htm (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\shs-sales.co[1].htm (20 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\sarpy[1].htm (20 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@shipeliteexpress[2].txt (317 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\cksglobal[1].htm (31 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2J4LCDS9\enzoyrodrigo.com[1].htm (586 bytes)
    %Documents and Settings%\%current user%\Cookies\index.dat (20720 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GZWRQVUZ\lexjuridica[1].htm (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GZWRQVUZ\index[1].htm (13 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GZWRQVUZ\wkhk[1].htm (1832 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@agence-des-druides[2].txt (358 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@istanbultarim.com[1].txt (239 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\jusched.log (347 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "jyrvicewyxmu" = "%Documents and Settings%\%current user%\jyrvicewyxmu.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

Network Activity

Map

Strings from Dumps