MD5: 8eff2dbf797a4f02d395bd925a74ce07
SHA1: 30c09ddc700c42e7cd95d4eb05699d9a7c644d1f
SHA256: 2b72ae3a59245f40586d108ac061e88a6a0d28e852c3217d5e0d28ddd5a96b01
SSDeep: 1536:Qqtw62Kb45EagnkyNIjovsbKTVKDXECIxm7CADGWII/UH2QPYf:rwzk8d6kaUoE6KvIxGbG/IC2EY
Size: 99328 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2010-11-05 02:25:00
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:3960
taskhost.exe:252
Explorer.EXE:284
Dwm.exe:528
conhost.exe:1068
TPAutoConnect.exe:2068
conhost.exe:2076

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:3960 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\winhjqup.exe (561 bytes)
C:\Windows\system.ini (70 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\AdobeARM.exe (24 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtoty.exe (561 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\reader_sl.exe (840 bytes)
C:\autorun.inf (259 bytes)
%Program Files%\Common Files\Java\Java Update\jusched.exe (784 bytes)
C:\cojpro.exe (99 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\winhjqup.exe (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\0015F70B_Rar\wincheck.exe (0 bytes)
C:\Windows\14f602 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\0015F70B_Rar (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtoty.exe (0 bytes)

Registry activity

The process %original file name%.exe:3960 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Stvncyfrlda]
"m2_8" = "997419616"
"m2_9" = "2732716847"
"m2_2" = "3470574716"
"m2_3" = "910905847"
"m2_0" = "6636"
"m2_1" = "1735294201"
"m2_6" = "1821804269"
"m2_7" = "3557104874"
"m2_4" = "2646188033"
"m2_5" = "86520365"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKCU\Software\Stvncyfrlda]
"m1_78" = "671894405"
"m1_73" = "2453579874"
"m1_72" = "2613820446"
"m1_71" = "3596156802"
"m1_70" = "3418974377"
"m1_77" = "192472952"
"m1_76" = "3674492519"
"m1_75" = "2305424166"
"m1_74" = "2622019640"
"m2_98" = "2554769535"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKCU\Software\Stvncyfrlda]
"m2_107" = "992511522"
"m2_99" = "4290053527"
"m3_35" = "622481870"
"m3_34" = "3182011987"
"m3_37" = "4092948712"
"m3_36" = "2323956093"
"m3_31" = "2270958618"
"m3_30" = "535979247"
"m3_33" = "1413429028"
"m3_32" = "3972958089"
"m3_39" = "3234960306"
"m3_38" = "1533534215"
"m4_0" = "0"
"m4_1" = "1735290733"
"m4_2" = "3470581466"
"m4_3" = "910904903"
"m4_4" = "2646195636"
"m4_5" = "86519073"
"m4_6" = "1821809806"
"m4_7" = "3557100539"
"m4_8" = "997423976"
"m4_9" = "2732714709"
"m2_69" = "3770946043"
"m2_68" = "2035647251"
"m2_61" = "2773523013"
"m2_60" = "1038223343"
"m2_63" = "1949138791"
"m2_62" = "213837065"
"m2_65" = "1124751833"
"m2_64" = "3684418636"
"m2_67" = "300366894"
"m2_66" = "2860033014"
"m1_79" = "1055895325"
"m4_29" = "3078791001"
"m4_28" = "1343500268"
"m4_23" = "1256981195"
"m4_22" = "3816657758"
"m4_21" = "2081367025"
"m4_20" = "346076292"
"m4_27" = "3903176831"
"m4_26" = "2167886098"
"m4_25" = "432595365"
"m4_24" = "2992271928"
"m1_24" = "2710847078"
"m1_25" = "3061846033"
"m1_26" = "713093732"
"m1_27" = "1923310260"
"m1_20" = "3979948632"
"m1_21" = "2315960365"
"m1_22" = "2774014564"
"m1_23" = "3693455030"
"m1_28" = "2451662373"
"m1_29" = "492027435"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKCU\Software\Stvncyfrlda]
"m1_99" = "2554228337"
"m1_98" = "4197735110"
"m1_91" = "1578746064"
"m1_90" = "1728210924"
"m1_93" = "4072034850"
"m1_92" = "2821968616"
"m1_95" = "901379789"
"m1_94" = "1966643291"
"m1_97" = "618588548"
"m1_96" = "1308147752"
"m1_45" = "3311617427"
"m1_108" = "3789121607"
"m1_109" = "585861079"
"m1_102" = "508930329"
"m1_103" = "2304297883"
"m1_100" = "774699714"
"m1_101" = "525899186"
"m1_106" = "2704384637"
"m1_107" = "2728930357"
"m1_104" = "3235716341"
"m1_105" = "3483609609"
"m3_3" = "927474798"
"m3_2" = "3487544563"
"m3_1" = "1718420804"
"m3_0" = "17001001"
"m3_7" = "3573965266"
"m3_6" = "1838544551"
"m3_5" = "69945096"
"m3_4" = "2629490589"
"m3_9" = "2749530364"
"m3_8" = "980422977"
"m3_93" = "2451378352"
"m3_92" = "716398853"
"m3_91" = "3309498774"
"m3_90" = "1573930619"
"m3_97" = "836457060"
"m3_96" = "3362431689"
"m3_95" = "1626878810"
"m3_94" = "4220485679"

[HKCU\Software\Stvncyfrlda\168128873]
"1735290733" = "87"

[HKCU\Software\Stvncyfrlda]
"m3_99" = "4273372430"
"m2_94" = "4203541069"
"m3_98" = "2571488659"
"m1_5" = "2903278171"
"m1_4" = "2548546497"
"m1_7" = "3045119051"
"m1_6" = "243918297"
"m1_1" = "3023695032"
"m1_0" = "870961961"
"m3_68" = "2018964189"
"m3_69" = "3787940424"
"m3_66" = "2877018163"
"m3_67" = "283394990"
"m3_64" = "3667439977"
"m3_65" = "1107894404"
"m3_62" = "230528591"
"m3_63" = "1965949434"
"m3_60" = "1021409189"
"m3_61" = "2756962000"
"m2_29" = "3078785709"
"m2_28" = "1343500630"
"m2_25" = "432599649"
"m2_24" = "2992273401"
"m2_27" = "3903182891"
"m2_26" = "2167882150"
"m2_21" = "2081370339"
"m2_20" = "346071088"
"m2_23" = "1256986733"
"m2_22" = "3816654681"

[HKCU\Software\Stvncyfrlda\168128873]
"-1648771660" = "30"

[HKCU\Software\Stvncyfrlda]
"m4_110" = "1903419606"
"m4_111" = "3638710339"
"m4_112" = "1079033776"

"m4_74" = "3857462658"
"m4_75" = "1297786095"
"m4_76" = "3033076828"
"m4_77" = "473400265"
"m4_70" = "1211267022"
"m4_71" = "2946557755"
"m4_72" = "386881192"
"m4_73" = "2122171925"
"m4_78" = "2208690998"
"m4_79" = "3943981731"
"m1_3" = "283733500"
"m1_2" = "1947957155"
"m2_90" = "1557345590"
"m2_91" = "3292630499"
"m2_92" = "732962200"
"m1_68" = "4292408138"
"m1_69" = "292902056"
"m2_93" = "2468242244"
"m1_60" = "795685701"
"m1_61" = "1267517895"
"m1_62" = "1328657112"
"m1_63" = "1614649185"
"m1_64" = "2178459899"
"m1_65" = "3391685395"
"m1_66" = "642894497"
"m1_67" = "2307654878"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Stvncyfrlda]
"m2_96" = "3379155612"
"m2_97" = "819473888"
"m3_22" = "3799972215"
"m3_23" = "1273981154"
"m3_20" = "363060909"
"m3_21" = "2097957336"
"m3_26" = "2150906683"
"m3_27" = "3920013910"
"m3_24" = "3008960529"
"m3_25" = "415992716"
"m3_28" = "1360479685"
"m3_29" = "3061970288"

[HKCU\Software\Stvncyfrlda\168128873]
"910904903" = "0"

[HKCU\Software\Stvncyfrlda]
"m2_76" = "3033075042"
"m2_77" = "473404855"
"m2_74" = "3857453128"
"m2_75" = "1297789911"
"m2_72" = "386879084"
"m2_73" = "2122174715"
"m2_70" = "1211263906"
"m2_71" = "2946561455"
"m2_78" = "2208690174"
"m2_79" = "3943985511"
"m3_57" = "110470508"
"m3_56" = "2703963633"
"m3_55" = "968530498"
"m3_54" = "3494439639"
"m3_53" = "1759411128"
"m3_52" = "57526285"
"m3_51" = "2583910558"
"m3_50" = "848472419"
"m3_59" = "3614491702"
"m3_58" = "1845908635"
"m4_38" = "1516538414"
"m4_39" = "3251829147"
"m4_30" = "519114438"
"m4_31" = "2254405171"
"m4_32" = "3989695904"
"m4_33" = "1430019341"
"m4_34" = "3165310074"
"m4_35" = "605633511"
"m4_36" = "2340924244"
"m4_37" = "4076214977"

[HKCU\Software\Stvncyfrlda\168128873]
"-824385830" = "0"

[HKCU\Software\Stvncyfrlda]
"m1_11" = "2719326495"
"m1_10" = "2169590595"
"m1_13" = "911155253"
"m1_12" = "1440379350"
"m1_15" = "495854613"
"m1_14" = "1290102348"
"m1_17" = "2096654006"
"m1_16" = "4070377324"
"m1_19" = "2475376462"
"m1_18" = "1241316083"
"m4_89" = "4117019877"
"m4_88" = "2381729144"
"m4_85" = "1470824241"
"m4_84" = "4030500804"
"m4_87" = "646438411"
"m4_86" = "3206114974"
"m4_81" = "3119595901"
"m4_80" = "1384305168"
"m4_83" = "2295210071"
"m4_82" = "559919338"
"m1_86" = "2055350319"
"m1_87" = "314608323"
"m1_84" = "2145776655"
"m1_85" = "4011252328"
"m1_82" = "208342817"
"m1_83" = "976758942"
"m1_80" = "1899283575"
"m1_81" = "1964051400"
"m1_88" = "2123678734"
"m1_89" = "2476116880"
"m1_111" = "473965588"
"m1_110" = "1808135857"
"m1_112" = "1016854278"
"m3_80" = "1401010233"
"m3_81" = "3102878548"
"m3_82" = "542956227"
"m3_83" = "2311932542"
"m3_84" = "4047496685"
"m3_85" = "1453954328"
"m3_86" = "3189376183"
"m3_87" = "663008290"
"m3_88" = "2364876625"
"m3_89" = "4100445900"
"m3_19" = "2888904510"
"m3_18" = "1153482627"
"m3_13" = "1100530336"
"m3_12" = "3626914613"
"m3_11" = "1891476358"
"m3_10" = "190001259"
"m3_17" = "3746958356"
"m3_16" = "2011536633"
"m3_15" = "243002698"
"m3_14" = "2835971551"

[HKCU\Software\Stvncyfrlda\168128873]
"-737866757" = "58885256CEB138BF289B3FE61C5E671D2E4D94225C4FBCE4F0DE94D4B7C6392939AA4886E4653CEE7B60948B66308353C8BBD5AE9DDF9D8811FEE480E8441E72BE888FD57C7DF806E086A0E5DB748F0253CF7C7D80F1B655BBDC36A6B023154295785206CD56E65771B4CF0086E88C785CF8C0E79612D1A27360920106C8FD553BA45DC6F2A1000AB402F36DBF857C1185A98D2E85109D9FD5DA5D9DAC6CF78DD42468E6AAA565B58EBD7520B7BC8A2F1C00B75D6B842D36E293F4AF3B51E71EE226DED82E8165CB677EE0EA5BDDA27433B041F67665D554619E5A8CC804F9380D19D04300BC619829CDC374400D9780AF7BBAE5BA38A609F7EDFA8C4C4A9E5B"

[HKCU\Software\Stvncyfrlda]
"m2_49" = "3424876055"
"m2_48" = "1689581113"
"m2_47" = "4249247780"
"m2_46" = "2513967159"
"m2_45" = "778669037"
"m2_44" = "3338351381"
"m2_43" = "1603053615"
"m2_42" = "4162743520"
"m2_41" = "2427437078"
"m2_40" = "692157436"
"m2_38" = "1516540852"
"m2_39" = "3251823067"
"m2_32" = "3989698458"
"m2_33" = "1430014035"
"m2_30" = "519115160"
"m2_31" = "2254399257"
"m2_36" = "2340916894"
"m2_37" = "4076211195"
"m2_34" = "3165312846"
"m2_35" = "605627741"

"m4_107" = "992514703"
"m4_106" = "3552191266"
"m4_105" = "1816900533"
"m4_104" = "81609800"
"m4_103" = "2641286363"
"m4_102" = "905995630"
"m4_101" = "3465672193"
"m4_100" = "1730381460"
"m4_109" = "168128873"
"m4_108" = "2727805436"
"m4_41" = "2427443317"
"m4_40" = "692152584"
"m4_43" = "1603057487"
"m4_42" = "4162734050"
"m4_45" = "778671657"
"m4_44" = "3338348220"
"m4_47" = "4249253123"
"m4_46" = "2513962390"
"m4_49" = "3424867293"
"m4_48" = "1689576560"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Stvncyfrlda]
"m1_55" = "2108029091"
"m1_54" = "2024209999"
"m1_57" = "1001712939"
"m1_56" = "1805004130"
"m1_51" = "2285055180"
"m1_50" = "1813758913"
"m1_53" = "3531385150"
"m1_52" = "3506646570"
"m1_59" = "3006126154"
"m1_58" = "1618647233"
"m3_108" = "2744413141"
"m3_109" = "184949568"
"m3_104" = "98446945"
"m3_105" = "1833490844"
"m3_106" = "3535358219"
"m3_107" = "975960230"
"m3_100" = "1713433789"
"m3_101" = "3482491944"
"m3_102" = "922947399"
"m3_103" = "2624438002"

"m3_44" = "3354938517"
"m3_45" = "795540480"
"m3_46" = "2497408959"
"m3_47" = "4232388394"
"m3_40" = "675414817"
"m3_41" = "2444014172"
"m3_42" = "4179439051"
"m3_43" = "1586486630"
"m3_48" = "1706528345"
"m3_49" = "3441441268"
"m2_112" = "1079029206"
"m2_110" = "1903424815"
"m2_111" = "3638706705"
"m4_98" = "2554767290"
"m4_99" = "4290058023"
"m4_92" = "732957484"
"m4_93" = "2468248217"
"m4_90" = "1557343314"
"m4_91" = "3292634047"
"m4_96" = "3379153120"
"m4_97" = "819476557"
"m4_94" = "4203538950"
"m4_95" = "1643862387"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKCU\Software\Stvncyfrlda]
"m1_9" = "10883819"
"m1_8" = "2945441082"
"m2_108" = "2727809560"
"m2_58" = "1862609150"
"m2_59" = "3597907591"
"m2_54" = "3511390972"
"m2_55" = "951707939"
"m2_56" = "2686995160"
"m2_57" = "127324801"
"m2_50" = "865194589"
"m2_51" = "2600480383"
"m2_52" = "40812048"
"m2_53" = "1776094407"
"m2_106" = "3552198218"
"m4_58" = "1862614706"
"m4_59" = "3597905439"
"m4_56" = "2687000536"
"m4_57" = "127323973"
"m4_54" = "3511386366"
"m4_55" = "951709803"
"m4_52" = "40804900"
"m4_53" = "1776095633"
"m4_50" = "865190730"
"m4_51" = "2600481463"
"m1_37" = "4244350696"
"m1_36" = "3718357544"
"m1_35" = "2925412188"
"m1_34" = "2153411083"
"m1_33" = "1315358006"
"m1_32" = "3343165086"
"m1_31" = "440829504"
"m1_30" = "3523535549"
"m1_39" = "1708505067"
"m1_38" = "2459789549"
"m1_42" = "3704044585"
"m1_43" = "2104525374"
"m1_40" = "807137587"
"m1_41" = "2556790475"
"m1_46" = "1061096743"
"m1_47" = "1193400690"
"m1_44" = "1764249825"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKCU\Software\Stvncyfrlda]
"m1_48" = "3409562153"
"m1_49" = "1779596020"
"m3_112" = "1096013209"
"m3_111" = "3655416426"
"m3_110" = "1886423807"
"m2_95" = "1643856046"
"m2_10" = "173031958"
"m2_11" = "1908332661"
"m2_12" = "3643616941"
"m2_13" = "1083946057"
"m2_14" = "2819230422"
"m2_15" = "259560087"
"m2_16" = "1994843276"
"m2_17" = "3730141631"
"m2_18" = "1170460554"
"m2_19" = "2905759377"
"m3_71" = "2929954066"
"m3_70" = "1227955687"
"m3_73" = "2139008060"
"m3_72" = "369900673"
"m3_75" = "1280954054"
"m3_74" = "3840892843"
"m3_77" = "490007008"
"m3_76" = "3049946741"
"m3_79" = "3927378058"
"m3_78" = "2191956255"
"m2_89" = "4117012689"
"m2_88" = "2381732839"
"m2_83" = "2295216480"
"m2_82" = "559918672"
"m2_81" = "3119601689"
"m2_80" = "1384302569"
"m2_87" = "646432612"
"m2_86" = "3206117557"
"m2_85" = "1470819703"
"m2_84" = "4030502059"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\Stvncyfrlda]
"m2_109" = "168127839"
"m4_12" = "3643619612"
"m4_13" = "1083943049"
"m4_10" = "173038146"
"m4_11" = "1908328879"
"m4_16" = "1994847952"
"m4_17" = "3730138685"
"m4_14" = "2819233782"
"m4_15" = "259557219"
"m2_105" = "1816895665"
"m2_104" = "81613301"
"m4_18" = "1170462122"
"m4_19" = "2905752855"
"m2_101" = "3465667854"
"m2_100" = "1730387512"
"m2_103" = "2641282895"
"m2_102" = "905998738"

[HKCU\Software\Stvncyfrlda\168128873]
"1821809806" = "0200687474703A2F2F7061647275702E636F6D2E64732F736F62616B61312E67696600687474703A2F2F34362E3130352E3130332E3231392F736F62616B61766F6C6F732E676966"

[HKCU\Software\Stvncyfrlda]
"m4_67" = "300362119"
"m4_66" = "2860038682"
"m4_65" = "1124747949"
"m4_64" = "3684424512"
"m4_63" = "1949133779"
"m4_62" = "213843046"
"m4_61" = "2773519609"
"m4_60" = "1038228876"
"m4_69" = "3770943585"
"m4_68" = "2035652852"

[HKCU\Software\Stvncyfrlda\168128873]
"86519073" = "73"

Firewall notifications are disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 64
83d510bd2a45d7733cd608d175f45d55
8d7c7d22fd66d1607d2b1b07b4e6e000
a1672bee7315f9ac858b472ec08c5678
4bb6dae811e5e55c5e479f62c2980d35
2e93a9fe2ba945bc61f9e5d00057f032
a4618240fddbcbb7f41b3701325e7a7d
c15671da0ad3939f38ed25acfbe2e9a2
2a6858a8bcb5696c096ea365bc1d6b24
bf6d8f2ec93f0920fb5f930226768e80
579957b70fe090db68d681aee77a2385
7191fca3d3d8134feedafe63a1660268
39153dd51c72264e0329ecae5279c1bc
d6d1434aa6d796c4d9c0c492145e97ca
cb6b1d4cf3b27269736ed2b8eda478f0
8cb2a1c78ea2402be91f5fe5d96c3610
a670e53f752f7d409113c29416ba1460
82865afaf8887b43eb1955db40db3a50
cda6ea71c39ac0d117f87a74998fa640
79c31d76ea0bd6176e62541c98f18df0
993d00124c4ce0dee940f02f2009ecb7
8564e9daa6f02cd8fccbc45995127ae7
0643e7b37754ed2b2c4dadefc613f15c
823c435457013c8c9c62548059630b23
744b001a4cf4cb067287ec7dcb1bd33d
dd2e464a7485346e74a1fde5c12a168d

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

.text

KERNEL32.dll

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

%original file name%.exe

eff2dbf797a4f02d395bd925a74ce07.exe

hXXp://padrup.com.ds/sobaka1.gif

hXXp://46.105.103.219/sobakavolos.gif

hXXp://89.11

.info/home.gifIh

bW.text

JKERNEL32.dll

%x.exe

h.rdla&

mH.MN8

T4.At%

S.twa

.klkjw:9fqwiBumW

.sysa

Zc.pBTa

~%s:*:yd:

.!.VF*

.d&?%x=

GUrlA'

"\'Web%w}

HTTP)s'PS

2GUARDCMD

o.ENHCDM

wWEBWUPD

MM.PF

%xn'[

>>?456789:;

!"#$%&'()* ,-./4

qn%CXf

UP*dB.PPd@.

%FoAN-x

ÄEW

%F" *" a

ADVAPI32.dll

MSVCRT.dll

SHELL32.dll

USER32.dll

WS2_32.dll

RegCloseKey

SHFileOperationA

%original file name%.exe_3960_rwx_003F0000_00002000:

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

.text

%original file name%.exe_3960_rwx_00401000_00011000:

KERNEL32.dll

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

%original file name%.exe

.text

eff2dbf797a4f02d395bd925a74ce07.exe

hXXp://padrup.com.ds/sobaka1.gif

hXXp://46.105.103.219/sobakavolos.gif

hXXp://89.11

.info/home.gifIh

bW.text

JKERNEL32.dll

%x.exe

h.rdla&

mH.MN8

T4.At%

S.twa

.klkjw:9fqwiBumW

.sysa

Zc.pBTa

~%s:*:yd:

.!.VF*

.d&?%x=

GUrlA'

"\'Web%w}

HTTP)s'PS

2GUARDCMD

o.ENHCDM

wWEBWUPD

MM.PF

%xn'[

>>?456789:;

!"#$%&'()* ,-./4

qn%CXf

UP*dB.PPd@.

%FoAN-x

ÄEW

%F" *" a

ADVAPI32.dll

MSVCRT.dll

SHELL32.dll

USER32.dll

WS2_32.dll

RegCloseKey

SHFileOperationA

taskhost.exe_252_rwx_00290000_00002000:

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

.text

%original file name%.exe_3960_rwx_00520000_010BA000:

hXXp://89.11

.info/home.gifIh

bW.text

JKERNEL32.dll

%x.exe

hXXp://89.119.67.154/testo5/

hXXp://kukutrustnet777.info/home.gif

hXXp://kukutrustnet888.info/home.gif

hXXp://kukutrustnet987.info/home.gif

.text

KERNEL32.dll

.reloc

USER32.dll

h.rdata

H.data

ntoskrnl.exe

Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0)

Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion

hXXp://VVV.klkjwre9fqwieluoi.info/

hXXp://kukutrustnet777888.info/

Software\Microsoft\Windows\CurrentVersion\policies\system

Software\Microsoft\Windows\ShellNoRoam\MUICache

%s:*:Enabled:ipsec

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced

GdiPlus.dll

hXXp://

ipfltdrv.sys

VVV.microsoft.com

?%x=%d

&%x=%d

SYSTEM.INI

USER32.DLL

.%c%s

\\.\amsint32

NTDLL.DLL

autorun.inf

ADVAPI32.DLL

win%s.exe

%s.exe

WININET.DLL

InternetOpenUrlA

avast! Web Scanner

Avira AntiVir Premium WebGuard

cmdGuard

cmdAgent

Eset HTTP Server

ProtoPort Firewall service

SpIDer FS Monitor for Windows NT

Symantec Password Validation

WebrootDesktopFirewallDataService

WebrootFirewall

%d%d.tmp

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

%s\%s

%s\Software\Microsoft\Windows\CurrentVersion\Ext\Stats

Software\Microsoft\Windows\CurrentVersion\Ext\Stats

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

KERNEL32.DLL

Explorer.exe

A2CMD.

ASHWEBSV.

AVGCC.AVGCHSVX.

DRWEB

DWEBLLIO

DWEBIO

FSGUIEXE.

MCVSSHLD.

NPFMSG.

SYMSPORT.

WEBSCANX.

%c%d_%d

purity_control_%x

.adata

M_%d_

?456789:;<=

!"#$%&'()* ,-./0123

mongC:\Windows\

C:\Windows\hywjfubtsnl.log

hXXp://padrup.com.ds/sobaka1.gif

hXXp://46.105.103.219/sobakavolos.gif

C:\Windows\system32\drivers\hnrmn.sys

1373776355

SHELL32.DLL

ShellExecuteA

GetProcessHeap

GetWindowsDirectoryA

RegEnumKeyExA

RegDeleteKeyA

RegOpenKeyExA

RegCreateKeyA

RegCloseKey

SHFileOperationA

&3&3&3&389

%F" *" a

ADVAPI32.dll

MSVCRT.dll

SHELL32.dll

WS2_32.dll

%original file name%.exe_3960_rwx_03590000_00001000:

u%original file name%.exeM_3960_

taskhost.exe_252_rwx_002A0000_00001000:

utaskhost.exeM_252_

Explorer.EXE_284_rwx_01DA0000_00002000:

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

.text

Explorer.EXE_284_rwx_039E0000_00001000:

uexplorer.exeM_284_

Dwm.exe_528_rwx_01040000_00002000:

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

.text

Dwm.exe_528_rwx_010A0000_00001000:

udwm.exeM_528_

conhost.exe_1068_rwx_00060000_00002000:

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

.text

conhost.exe_1068_rwx_00100000_00001000:

uconhost.exeM_1068_

TPAutoConnect.exe_2068_rwx_00260000_00002000:

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

.text

TPAutoConnect.exe_2068_rwx_00550000_00001000:

utpautoconnect.exeM_2068_

conhost.exe_2076_rwx_000D0000_00002000:

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

.text

conhost.exe_2076_rwx_000E0000_00001000:

uconhost.exeM_2076_

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\winhjqup.exe (561 bytes)
   C:\Windows\system.ini (70 bytes)
   %Program Files%\Common Files\Adobe\ARM\1.0\AdobeARM.exe (24 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtoty.exe (561 bytes)
   %Program Files%\Adobe\Reader 9.0\Reader\reader_sl.exe (840 bytes)
   C:\autorun.inf (259 bytes)
   %Program Files%\Common Files\Java\Java Update\jusched.exe (784 bytes)
   C:\cojpro.exe (99 bytes)

4. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.