MD5: b55d121f9788f7ee978560bd6c763d23
SHA1: 4ad951b9dfa66284b9275953cd0a3e119ea49dc7
SHA256: 514303c4eb0842fd8840c81b7482abfb10272deb7641087221386a8bb7039950
SSDeep: 6144:bsxhzF47CxH1XXYWgjZDW6uaXBshI0CD50Y/aFhIqR q8ww:ohzXrYzjZ1uaXBsGP5EFhIqE
Size: 284048 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:46
Analyzed on: Windows7 SP1 32-bit

Summary:

Adware. Delivers advertising content in a manner or context that may be unexpected and unwanted by users. Many adware applications also perform tracking functions. Users may want to remove adware if they object to such tracking, do not wish to see the advertising caused by the program or are frustrated by its effects on system performance.

Payload

No specific payload has been found.

Process activity

The Adware creates the following process(es):
No processes have been created.
The Adware injects its code into the following process(es):

%original file name%.exe:2084

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:2084 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\bab_off.bmp (672 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\skip.bmp (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\locate.dll (804 bytes)
%Program Files%\1ClickDownload\ocmainpack.exe (544 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\box.bmp (3312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GPS1JHSL\MainPackFA2703[1].htm (544 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\x.bmp (776 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\accept1.bmp (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\accept3.bmp (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\inetc3.dll (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFE2D.tmp (14068 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\accept.bmp (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\decline.bmp (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\gC0 (776 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\stvheader2.bmp (4992 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\accept2.bmp (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\nsDialogs.dll (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\35TJMWCT.txt (89 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\J5WT9XQ0.txt (94 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\bab_on.bmp (672 bytes)

The Adware deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdFE1D.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp (0 bytes)

Registry activity

The process %original file name%.exe:2084 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\b55d121f9788f7ee978560bd6c763d23_RASAPI32]
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\b55d121f9788f7ee978560bd6c763d23_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\b55d121f9788f7ee978560bd6c763d23_RASMANCS]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad]
"WpadLastNetwork" = "{24C5EDBC-2851-452A-B521-5DA992F6C1B5}"

[HKCU\Software\1ClickDownload]
"LastInstall0" = "30557600"

[HKLM\SOFTWARE\Microsoft\Tracing\b55d121f9788f7ee978560bd6c763d23_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\b55d121f9788f7ee978560bd6c763d23_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\b55d121f9788f7ee978560bd6c763d23_RASMANCS]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{24C5EDBC-2851-452A-B521-5DA992F6C1B5}]
"WpadDecision" = "3"

[HKLM\SOFTWARE\Microsoft\Tracing\b55d121f9788f7ee978560bd6c763d23_RASAPI32]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{24C5EDBC-2851-452A-B521-5DA992F6C1B5}]
"WpadDecisionTime" = "90 21 80 C8 A0 45 D2 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-e1-da-d8]
"WpadDecision" = "3"

[HKLM\SOFTWARE\Microsoft\Tracing\b55d121f9788f7ee978560bd6c763d23_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-e1-da-d8]
"WpadDecisionReason" = "1"

[HKCU\Software\1ClickDownload]
"UID" = "284555269"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 36 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{24C5EDBC-2851-452A-B521-5DA992F6C1B5}]
"WpadNetworkName" = "Network 2"

[HKLM\SOFTWARE\Microsoft\Tracing\b55d121f9788f7ee978560bd6c763d23_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{24C5EDBC-2851-452A-B521-5DA992F6C1B5}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 09 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\b55d121f9788f7ee978560bd6c763d23_RASMANCS]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-e1-da-d8]
"WpadDecisionTime" = "90 21 80 C8 A0 45 D2 01"

[HKLM\SOFTWARE\Microsoft\Tracing\b55d121f9788f7ee978560bd6c763d23_RASMANCS]
"MaxFileSize" = "1048576"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 8
e8f55980df08ddc314324abfa563a1dd
f2a56a1ec5281e6b864c825240516c3a
7c56707be7d161c5329b2b653e65cb67
eb3102582af87412c27fa904ef6f3992
15007f1438f3514d1cec18578ce05d50
d4ccc779b6c4733a2d14bcc5d789d888
6116177879c42883bb545770edbb7c51
ff94e01cec359e7393c925e90073528a

URLs

URL	IP
hxxp://data.torntv.net/country.asp?st=-1&uid=284555269&tuid=3090437&sref=1CD_16_2_eztv2&vmdt=|vm|&bld=16CJ
hxxp://files.download1click.ws/MainPackFA2703.exe

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers

Traffic

The Adware connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

unpacking data: %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|<>/":

ers\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\nsDialogs.dll

264-IMMERSE.magnet

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\nsDialogs.dll

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp

eland.S02E09.720p.HDTV.x264-IMMERSE&tr=udp://tracker.openbittorrent.com:80&tr=udp://tracker.publicbt.com:80&tr=udp://tracker.istole.it:80

END USER LICENSE AGREEMENT / TERMS OF SERVICE / AND PRIVACY POLICY IMPORTANT - PLEASE READ THE FOLLOWING AGREEMENT CAREFULLY. THIS AGREEMENT SHALL GOVERN YOUR USE OF BABYLON SOFTWARE, SERVICE AND SITE, IF, AFTER READING THIS AGREEMENT, YOU WISH TO USE THE BABYLON SOFTWARE, WEBSITE AND ITS FEATURES AS DESCRIBE LATER.

This combined End User License Agreement / Terms / and Privacy policy (The "Agreement") constitutes a valid and binding agreement between Babylon LTD which governs the use of the Babylon Website, Software and its features and you, for the use of the Babylon Toolbar, Content and Services as defined below. You must enter into this agreement in order to install and use the Babylon Toolbar. When you download the Babylon Software, you will receive the following software features:

1.4.1

1.4.2

1.4.3

To uninstall the Software, you may use the standard uninstall procedures offered by your computer's Operating System or your Internet Browser.

1.5.1

from Windows "Add/Remove Programs" dialog, find the Software in the list of installed applications and click on it, and then click on the "Uninstall" button.

1.5.2

Uninstall from Firefox

Third Party Code; Notice and Attribution. The Babylon Toolbar includes third party software subject to open source license terms, including, without limitation, the following applications: Compression Algorithm, PCRE, Firefox Plug-in Modules, and NSIS Toolkit and Plug-ins. All rights are reserved by the licensors of such code and ownership is attributed as follows:

1.6.1

Firefox Plug-ins: Copyright

1.6.2

2009 Contributors as identified at hXXp://nsis.sourceforge.net/Main_Page

THE SOFTWARE (ASIDE FROM THE Babylon Toolbar FOR FIREFOX) CAN BE UNINSTALLED FROM THE "ADD OR REMOVE PROGRAMS" DIALOG BOX IN THE WINDOWS CONTROL PANEL.

The Babylon Toolbar is being licensed to you by Babylon Toolbar on an "AS IS" basis, for your private personal use only. Subject to the terms of this Agreement, Babylon Toolbar and its current, and future , parent and subsidiary companies (collectively "Licensor", "we", "us" or "our") hereby grants you a limited, non-exclusive, personal, non-sub licensable, non-assignable license to download, install and use the Babylon Toolbar, including any online or enclosed documentation, data distributed to your computer for processing and any future programming fixes, updates and upgrades provided to you (collectively, the "Babylon Toolbar") onto a computer for your sole use to install, interact with and utilize the Babylon Toolbar, including the content and features contained therein and the services and the Network related thereto ("Services"). The Babylon Toolbar may only be used in connection with the Services. As used herein, the term "Network" means the universe of computers connected to the Internet that are operating the Babylon Toolbar.

(a) Notwithstanding anything to the contrary, you may not: (i) remove any proprietary notices from the Services, Babylon Toolbar or any copy thereof; (ii) cause, permit or authorize the modification, creation of derivative works, translation, reverse engineering, decompiling or disassembling or hacking of the Babylon Toolbar, the Services or the Network; (iii) sell, assign, rent, lease, act as a service bureau, or grant rights in the Babylon Toolbar or Services, including, without limitation, through sublicense, to any other entity without the prior written consent of Babylon ; (iv) export or re-export the Babylon Toolbar in violation of export laws; (v) use the Babylon Toolbar or Services for any commercial purpose or the benefit of any third party or charge any person for the use of the Babylon ; or (vi) use the Babylon Toolbar or Services to, or in any way that would violate any applicable law, regulation or ordinance; (vii) collect any information or communication about the Network or users of the Babylon Toolbar or Services by monitoring, interdicting or interce

ÏUI

*i%3s

.jioX

J5uFlashInstall.log

78560bd6c763d23.exe

FLASHI~1.LOG

Watch free TV channels, live sports and more

iles\1ClickDownload\1ClickDownloader.exe

-8388609

6BHLG6CALLX6M4VIU5A&dn=Homeland.S02E09.720p.HDTV.x264-IMMERSE&tr=udp://tracker.openbittorrent.com:80&tr=udp://tracker.publicbt.com:80&tr=udp://tracker.istole.it:80,Homeland_S02E09_720p_HDTV_x264-IMMERSE.exe,ca

Path=Profiles/5a2ce8gs.default

X6M4VIU5A&dn=Homeland.S02E09.720p.HDTV.x264-IMMERSE&tr=udp://tracker.openbittorrent.com:80&tr=udp://tracker.publicbt.com:80&tr=udp://tracker.istole.it:80

it:80,Homeland_S02E09_720p_HDTV_x264-IMMERSE.exe,ca

f9788f7ee978560bd6c763d23.exe

BHLG6CALLX6M4VIU5A&dn=Homeland.S02E09.720p.HDTV.x264-IMMERSE&tr=udp://tracker.openbittorrent.com:80&tr=udp://tracker.publicbt.com:80&tr=udp://tracker.istole.it:80,Homeland_S02E09_720p_HDTV_x264-IMMERSE.exe,ca

99032376

402982697

s/5a2ce8gs.default

5a2ce8gs.default

43790880

S02E09_720p_HDTV_x264-IMMERSE.exe

Windows 7 Ultimate

9.tmp

ore.exe

c:\%original file name%.exe

C:\Users\"%CurrentUserName%"\Desktop

%Program Files%\1ClickDownload

nssFF18.tmp

%original file name%.exe

ers\"%CurrentUserName%"\AppData\Local\Temp\nsdFE1D.tmp

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\

hXXp://files.download1click.ws/MainPackFA2703.exe

hXXp://files.download1click.ws/gzip2.exe

hXXp://data.torntv.net/

hXXp://data.oa-software.com/

hXXp://files.download1click.ws/BTB0612.exe

hXXp://cdn.download.sweetpacks.com/simsdm/bundle/BundleSweetIMSetup.exe

hXXp://files.download1click.ws/FmoodsV21.exe

hXXp://files.download1click.ws/IminentSetup5.exe

hXXp://files.download1click.ws/Fantapper.exe

hXXp://files.download1click.ws/weatherbugsetup.msi

hXXp://files.download1click.ws/IWantThisSetupRS.exe

hXXp://files.download1click.ws/ciuvoSetup.exe

hXXp://files.download1click.ws/incredibar_install3.exe

hXXp://files.download1click.ws/yontoo-c4.exe

hXXp://files.download1click.ws/yontoo-c2.exe

hXXp://files.download1click.ws/yontoo-b2.exe

hXXp://download.sterkly.com/yontoo-c3.exe

hXXp://download.sterkly.com/yontoo-c5.exe

hXXp://files.download1click.ws/GophotoExtSetup.exe

hXXp://files.download1click.ws/OneClickExt1_filter03.exe

hXXp://files.download1click.ws/OneClickExt1_filter13.exe

ocmainpack.exe

Inetc33 (Mozilla; FW 4; WinNT 6.1|Windows 7 Ultimate; wd 20112013; dbw ie; yo ; nd 0; sd 0; fl 1; ch 02; ge ; hi 0|0|10|0)

magnet:?xt=urn:btih:3YM4Y7YIYOVBK6BHLG6CALLX6M4VIU5A&dn=Homeland.S02E09.720p.HDTV.x264-IMMERSE&tr=udp://tracker.openbittorrent.com:80&tr=udp://tracker.publicbt.com:80&tr=udp://tracker.istole.it:80

Software\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload

1342834137

284555269

3090437

eztv2,magnet:?xt=urn:btih:3YM4Y7YIYOVBK6BHLG6CALLX6M4VIU5A&dn=Homeland.S02E09.720p.HDTV.x264-IMMERSE&tr=udp://tracker.openbittorrent.com:80&tr=udp://tracker.publicbt.com:80&tr=udp://tracker.istole.it:80,Homeland_S02E09_720p_HDTV_x264-IMMERSE.exe,ca

251987010

302318660

285541447

C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\5a2ce8gs.default\

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\

503645668

285869121

285869132

285869128

235537459

118097131

436864558

319423565

302646790

319423563

201983218

1074398269

604636405

118097133

1460274425

671745274

Homeland_S02E09_720p_HDTV_x264-IMMERSE.exe

30557600

VVV.oneclickdownloader.com

sbiectrl.exe

vmtoolsd.exe

prl_cc.exe

coherence.exe

VirtualBox.exe

VBoxSVC.exe

DrWeb

%Program Files%\1ClickDownload\Homeland_S02E09_720p_HDTV_x264-IMMERSE.magnet

20112013

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

country.asp?st=

)-.Yln

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>

%original file name%.exe_2084_rwx_10004000_00001000:

callback%d

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Adware file.
   
3. Delete or disinfect the following files created/modified by the Adware:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\System.dll (23 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\bab_off.bmp (672 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\skip.bmp (784 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\locate.dll (804 bytes)
   %Program Files%\1ClickDownload\ocmainpack.exe (544 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\box.bmp (3312 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GPS1JHSL\MainPackFA2703[1].htm (544 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\x.bmp (776 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\accept1.bmp (784 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\accept3.bmp (784 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\inetc3.dll (784 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFE2D.tmp (14068 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\accept.bmp (784 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\decline.bmp (784 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\gC0 (776 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\stvheader2.bmp (4992 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\accept2.bmp (784 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\nsDialogs.dll (21 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\35TJMWCT.txt (89 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\J5WT9XQ0.txt (94 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nssFF18.tmp\bab_on.bmp (672 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.