MD5: fa8899c877040f8c16e4a4ebef4c798a
SHA1: 499531678c6af1f5dcb745320c9fb3cdc0bb737c
SHA256: 5164ac6ed7809fd31097fb0f4f49085d70271214cc26b3c6c66dbde6b253e301
SSDeep: 49152:Hh2CUZTETAg1OSw1f/r068Xq7x2OfH GzPPvmT51sc3sgk:U5ETA/SKr068al2aPu8H
Size: 3068612 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 1972-12-25 08:33:23
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

No files have been created.

Registry activity

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.data

.rsrc

user32.dll

KERNEL32.dll

USER32.dll

GetCPInfo

krnln.fne

krnln.fnr

E_N%X

1.1.3

c:\%original file name%.exe

{A0005538-9391-4dd9-B4D6-8EB7B9360F08}

BmpOperate

42305932-06E6-47a5-AC79-8BDCDC58DF61

WebBrowser2

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

SkinH_EL.dll

GBj%c

}&-4}v

&pass=

hXXp://vip.fbkc.net/chinacn/c40e7431a68c3fbc55f9602cf981bb36.asp?user=

hXXp://vip.fbkc.net/chinacn/tishi.txt

\update.exe

hXXp://vip.fbkc.net/chinacn/3.asp?user=

hXXp://

hXXps://

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

http=

HTTP/1.1

Accept: image/gif, image/bmp, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Content-Type: application/x-www-form-urlencoded

hXXp://down.fbkc.net/chinacn.exe

hXXp://vip.fbkc.net/chinacn/banben.txt

WinHttp.WinhttpRequest.5.1

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)

.html

hXXp://VVV.100ppi.com/forecast/list-13--

hXXp://VVV.100ppi.com/forecast/detail-

(<(\/)?(.*?)>)

hXXp://VVV.100ppi.com/info/list-news-13--

hXXp://VVV.100ppi.com/info/detail-

hXXp://VVV.ah.chinanews.com.cn/portal.php?mod=list&catid=26&page=

hXXp://VVV.ah.chinanews.com.cn/article-

\*.jpg

hXXp://ping.baidu.com/ping/RPC2

<methodName>weblogUpdates.ping</methodName>

hXXp://ping.baidu.com/ping.html

application/x-www-form-urlencoded

_.bin

hXXp://my.cn.china.cn/ajaxnew.php

hXXp://my.cn.china.cn/manage.php?op=SellInfoShowNew&auth=

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

hXXp://my.cn.china.cn/ajaxnew.php?op=sellinforesend

verifystr=&type=online&ids[]=

x-requested-with: XMLHttpRequest

hXXp://my.cn.china.cn/manage.php

hXXp://my.cn.china.cn/ajaxapi.php?op=getAttrGoconfig&industry_id=

hXXp://my.cn.china.cn/manage.php?op=LoginShowNew

hXXp://cn.china.cn/

hXXp://my.cn.china.cn/manage.php?op=captha&t=2&seed=8230

&op=B2BLoginnew&destUrl=&verifyCode={$verifyCode}

&userPassword=

hXXp://my.cn.china.cn/manage.php?op=adminIndex

id=

hXXp://my.cn.china.cn/manage.php?op=SellInfoCatNew&auth=

hXXp://my.cn.china.cn/ajaxnew.php?op=initAlbum&initMode=1&r=0.7703644179888691

_.dat

hXXp://my.cn.china.cn/manage.php?op=SellInfoChangeSNew&auth=

hXXp://my.cn.china.cn/ajaxapi.php

t$(SSh

~%UVW

u$SShe

Wininet.dll

InternetOpenUrlA

HttpQueryInfoA

MsgWaitForMultipleObjects

{E60056EA-07A8-4bf5-B6F0-DF05DE6FAE1F}

hXXp://vip.fbkc.net/1.txt

anonymous@123.com

.exe|.rar|.zip|.gif|.jpg|.mp3|.rm

User-Agent: Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.0; MyIE2; .NET CLR 1.1.4322)

F%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

__MSVCRT_HEAP_SELECT

RASAPI32.dll

GetProcessHeap

WinExec

GetKeyState

GetViewportOrgEx

WINMM.dll

WINSPOOL.DRV

RegCloseKey

RegOpenKeyExA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

ole32.dll

OLEAUT32.dll

WS2_32.dll

HttpSendRequestA

HttpOpenRequestA

InternetCrackUrlA

InternetCanonicalizeUrlA

WININET.dll

CreateDialogIndirectParamA

UnhookWindowsHookEx

SetWindowsHookExA

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

comdlg32.dll

RegCreateKeyExA

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

(%d-%d):

%ld%c

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.0

%s <%s>

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

[%s:%d]

Range: bytes=%s-

[%s:%d]

PASS %s

PASS ******

USER %s

E:\dev\e\static_link\static_libs\source\downlib\mystrlib.cpp

SIZE %s

PORT

User-Agent: %s

Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)

Referer: %s

Host: %s

GET %s HTTP/1.1

Cookie: %s

%d, %s

\\192.168.0.129\TCP\1037

NSPlayer/9.0.0.2980; {%s}; Host: %s

rmff_fix_header: assuming data.size=%i

rmff_fix_header: assuming data.num_packets=%i

rmff_fix_header: assuming prop.num_packets=%i

rmff_fix_header: setting prop.data_offset from %i to %i

rmff_fix_header: correcting prop.num_streams from %i to %i

rmff_fix_header: correcting prop.size from %i to %i

%s %s %s

Session: %s

Cseq: %u

%*s %s

%*s %u

CSeq: %u

rtsp://%s:%i

rtsp://%s:%i/%s

ClientID: Linux_2.4_6.0.9.1235_play32_RN01_EN_586

GUID: 00000000-0000-0000-0000-000000000000

[%s:%d]

User-Agent: RealMedia Player Version 6.0.9.1235 (linux-2.0-libc6-i386-gcc2.95)

Range: npt=%s-

%s/streamid=1

%s/streamid=0

Transport: x-pn-tng/tcp;mode=play,rtp/avp/tcp;unicast;mode=play

If-Match: %s

RealChallenge2: %s, sd=%s

Title: %s

Copyright: %s

Author: %s

real: Content-length for description too big (> %uMB)!

Require: com.real.retain-entity-for-setup

SupportsMaximumASMBandwidth: 1

Bandwidth: %u

Challenge1: %s

hash output: %x %x %x %x

hash input: %x %x %x %x

stream=%u;rule=%u,

Illegal character '%c' in input.

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

zcÁ

#include "l.chs\afxres.rc" // Standard components

PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGhXXp://vip.gangguan.in/gonggao.txt

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_8918');'><a class='sub-cate' data-valueid='8918' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_8918'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_8919');'><a class='sub-cate' data-valueid='8919' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_8919'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_4396');'><a class='sub-cate' data-valueid='4396' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_4396'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_2624');'><a class='sub-cate' data-valueid='2624' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_2624'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_2681');'><a class='sub-cate' data-valueid='2681' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_2681'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_4493');'><a class='sub-cate' data-valueid='4493' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_4493'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_4673');'><a class='sub-cate' data-valueid='4673' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_4673'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_2214');'><a class='sub-cate' data-valueid='2214' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_2214'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_2300');'><a class='sub-cate' data-valueid='2300' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_2300'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_2381');'><a class='sub-cate' data-valueid='2381' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_2381'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_1');'><a class='sub-cate' data-valueid='1' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_1'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_239');'><a class='sub-cate' data-valueid='239' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_239'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_372');'><a class='sub-cate' data-valueid='372' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_372'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_211');'><a class='sub-cate' data-valueid='211' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_211'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_2442');'><a class='sub-cate' data-valueid='2442' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_2442'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_5741');'><a class='sub-cate' data-valueid='5741' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_5741'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_5740');'><a class='sub-cate' data-valueid='5740' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_5740'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_2738');'><a class='sub-cate' data-valueid='2738' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_2738'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_6985');'><a class='sub-cate' data-valueid='6985' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_6985'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_2592');'><a class='sub-cate' data-valueid='2592' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_2592'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_2993');'><a class='sub-cate' data-valueid='2993' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_2993'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_4759');'><a class='sub-cate' data-valueid='4759' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_4759'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_629');'><a class='sub-cate' data-valueid='629' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_629'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_3186');'><a class='sub-cate' data-valueid='3186' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_3186'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_5721');'><a class='sub-cate' data-valueid='5721' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_5721'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_5029');'><a class='sub-cate' data-valueid='5029' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_5029'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_3368');'><a class='sub-cate' data-valueid='3368' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_3368'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_5055');'><a class='sub-cate' data-valueid='5055' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_5055'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_5134');'><a class='sub-cate' data-valueid='5134' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_5134'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_5726');'><a class='sub-cate' data-valueid='5726' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_5726'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_5727');'><a class='sub-cate' data-valueid='5727' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_5727'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_1176');'><a class='sub-cate' data-valueid='1176' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_1176'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_1277');'><a class='sub-cate' data-valueid='1277' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_1277'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_3504');'><a class='sub-cate' data-valueid='3504' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_3504'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_3615');'><a class='sub-cate' data-valueid='3615' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_3615'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_1536');'><a class='sub-cate' data-valueid='1536' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_1536'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_1590');'><a class='sub-cate' data-valueid='1590' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_1590'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_3816');'><a class='sub-cate' data-valueid='3816' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_3816'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_1851');'><a class='sub-cate' data-valueid='1851' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_1851'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_3967');'><a class='sub-cate' data-valueid='3967' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_3967'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_4058');'><a class='sub-cate' data-valueid='4058' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_4058'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_4157');'><a class='sub-cate' data-valueid='4157' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_4157'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_1970');'><a class='sub-cate' data-valueid='1970' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_1970'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_2056');'><a class='sub-cate' data-valueid='2056' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_2056'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_5202');'><a class='sub-cate' data-valueid='5202' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_5202'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_3013');'><a class='sub-cate' data-valueid='3013' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_3013'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_4289');'><a class='sub-cate' data-valueid='4289' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_4289'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_5722');'><a class='sub-cate' data-valueid='5722' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_5722'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_4378');'><a class='sub-cate' data-valueid='4378' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_4378'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_2149');'><a class='sub-cate' data-valueid='2149' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_2149'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_5720');'><a class='sub-cate' data-valueid='5720' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_5720'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_4386');'><a class='sub-cate' data-valueid='4386' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_4386'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_9216');'><a class='sub-cate' data-valueid='9216' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_9216'>LED</a></li>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_9215');'><a class='sub-cate' data-valueid='9215' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_9215'>

<li onclick='$(this).siblings().find('a').removeClass('current');$(this).find('a').addClass('current');changeCate1('cate_1_1511');'><a class='sub-cate' data-valueid='1511' data-isvirtual='0' data-isleaf='0' data-cur_level='1' data-attr_id='0' id='cate_1_1511'>

hXXp://my.cn.china.cn/manage.php?op=SellInfoListNew&auth=

,url:'

hXXp://vip.fbkc.net/chinacn/2ef955d371f3ab0cbb54cfbc6abef844.asp?uid=

hXXp://my.cn.china.cn/manage.php?op=SellInfoAddv2

&keyword3=

&keyword2=

&tradeleadtype=10&keyword1=

&capitalscore=5&picscore=5&attrscore=5&groupscore=5&introscore=5&jyscore=5&keywordscore=5&id=&categoryid=

@advapi32.dll

kernel32.dll

wininet.dll

Ole32.dll

Windows

*.jpg|*.jpg

Www.FbKc.Net

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity name="E.App" processorArchitecture="x86" version="5.2.0.0" type="win32"/><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency></assembly>

1, 0, 6, 6

- Skin.dll

(*.*)

1.1.0.0

(hXXp://VVV.eyuyan.com)

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.