MD5: dff091e8d49824eb69e45d5abd0639d3
SHA1: 5cc462098b4ec37eef8835d8c6a43fffbd506e0c
SHA256: 0bb8e496f29d0eedaa7c4518a5f08de6866a177ba13b09fca092390d4f970cda
SSDeep: 1536:h3VuEqJ3J2X6kkkkkkkkCkkkkTkkkkkkkkkkkkkkkkkkk/GwHByFRVwyA0F5kHUN:h3VuE2k6kkkkkkkkCkkkkTkkkkkkkkkJ
Size: 76288 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 1992-06-20 01:22:17
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

dff091e8d49824eb69e45d5abd0639d3Srv.exe:1776
%original file name%.exe:1780

The Trojan injects its code into the following process(es):

AdobeART.exe:2996
chrome.exe:2696

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process dff091e8d49824eb69e45d5abd0639d3Srv.exe:1776 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\Microsoft\DesktopLayer.exe (113 bytes)

The Trojan deletes the following file(s):

%Program Files%\Microsoft\pxBE3F.tmp (0 bytes)

The process %original file name%.exe:1780 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\dff091e8d49824eb69e45d5abd0639d3Srv.exe (113 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\AdobeART.exe (678 bytes)

The process chrome.exe:2696 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\Google\Chrome\Application\dmlconf.dat (48 bytes)
C:\dff091e8d49824eb69e45d5abd0639d3Srv.exe (1750 bytes)

Registry activity

The process AdobeART.exe:2996 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeART" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\AdobeART.exe"

The process %original file name%.exe:1780 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process chrome.exe:2696 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Google\Chrome\BLBeacon]
"State" = "2"
"failed_count" = "0"

The Trojan adds the reference to itself to be executed when a user logs on:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "c:\windows\system32\userinit.exe,,c:\program files\microsoft\desktoplayer.exe"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
google.com
dns.msftncsi.com
fget-career.com

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.gfids

@.tls

.rsrc

@.reloc

D$,j.Xf

j.Yf;

_tcPVj@

.PjRW

Cv.SCv

ole32.dll

POWRPROF.dll

address family not supported

broken pipe

function not supported

inappropriate io control operation

not supported

operation canceled

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

InitOnceExecuteOnce

operator

operator ""

?#%X.y

%S#[k

?OLEAUT32.dll

user32.dll

c:\b\build\slave\win-pgo\build\src\chrome\app\chrome_exe_main_win.cc

c:\b\build\slave\win-pgo\build\src\chrome\app\main_dll_loader_win.cc

Failed to load Chrome DLL from

ChromeMain

RelaunchChromeBrowserWithNewCommandLineIfNeeded

Could not find exported function

%s: option `%s' is ambiguous (could be `--%s' or `--%s')

%s: invalid option -- `-%c'

%s: argument required for option `

--%s'

0.8.0

%ls (%s) %s

hXXps://crashpad.chromium.org/

hXXps://crashpad.chromium.org/bug/new

Report %ls bugs to

%s home page: <%s>

%ls: %s

(0x%X)

Error (0x%X) while retrieving error. (0x%X)

PlatformFile.UnknownErrors.Windows

c:\b\build\slave\win-pgo\build\src\base\threading\thread_local_win.cc

0123456789

Histogram: %s recorded %d samples

(flags = 0x%x)

.syzygy

.thunks

Windows NT

Histogram.InconsistentCountHigh

Histogram.InconsistentCountLow

c:\b\build\slave\win-pgo\build\src\base\metrics\persistent_memory_allocator.cc

(%d = %3.1f%%)

UMA.CreatePersistentHistogram.Result

Dictionary keys must be quoted.

Unsupported encoding. JSON must be UTF-8.

Line: %i, column: %i, %s

widevinecdmadapter.dll

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_update_settings.cc

Removed incremental installer failure key; switching to channel:

Failed to write to application's ClientState key

Removed multi-install failure key; switching to channel:

CHROME_PROBED_PROGRAM_FILES_PATH

chrome-sxs

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\google_chrome_distribution.cc

iexplore.exe

googlechrome

googlechromeframe

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\channel_info.cc

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\language_selector.cc

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_commands.cc

Cannot initialize AppCommands from an invalid key.

Skipping over key "

Failed to open key "

Cannot initialize an AppCommand from an invalid key.

c:\b\build\slave\win-pgo\build\src\chrome\installer\util\app_command.cc

CHROME_MAIN_TICKS

user_experience_metrics.reporting_enabled

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\settings.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\numeric\in_range_cast.h

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\crash_report_database_win.cc

x-x-x-xx-xxxxxx

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\misc\uuid.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_io.cc

--annotation=KEY=VALUE set a process annotation in each crash report

--database=PATH store the crash report database at PATH

create a new pipe and send its name via HANDLE

--pipe-name=PIPE communicate with the client over PIPE

--url=URL send crash reports to this Breakpad server URL,

pipe-name

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\handler_main.cc

duplicate key

--annotation requires KEY=VALUE

--handshake-handle and --pipe-name are incompatible

--handshake-handle or --pipe-name is required

SetProcessShutdownParameters

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\crash_report_upload_thread.cc

reserved key

FinishedWritingCrashReport failed

PrepareNewCrashReport failed

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\handler\win\crash_report_exception_handler.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_file_writer.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writer_util.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_writable.cc

%s.%s,%s,%s

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\minidump\minidump_context_writer.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\process_snapshot_minidump.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_snapshot_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\crashpad_info_client_options.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_simple_string_dictionary_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\module_snapshot_minidump.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\exception_snapshot_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\module_snapshot_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\system_snapshot_win.cc

%s %d.%d.%d.%s%s

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_reader_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\minidump\minidump_string_list_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\capture_memory.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\cpu_context_win.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_annotations_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\process_subrange_reader.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\snapshot\win\pe_image_resource_reader.cc

kernel32.dll

c:\b\build\slave\win-pgo\build\src\sandbox\win\src\sandbox_policy_base.cc

NtOpenKey

NtCreateKey

GetCertificateSize

GetCertificate

GetCertificateSizeByHandle

GetCertificateByHandle

SetOPMSigningKeyAndSequenceNumbers

CreateNamedPipeW

NtOpenKeyEx

PruneCrashReportDatabase: Failed to get pending reports

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\client\prune_crash_reports.cc

PruneCrashReportDatabase: Failed to get completed reports

Database Pruning: Failed to remove report

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\exception_handler_server.cc

::GetNamedPipeClientProcessId

\\.\pipe\crashpad_%d_

ImpersonateNamedPipeClient

ConnectNamedPipe

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_reader.cc

WinHttpSetTimeouts

WinHttpCrackUrl

WinHttpConnect

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_transport_win.cc

WinHttpCloseHandle

Crashpad/0.8.0

WinHttpOpen

WinHttpSendRequest

WinHttpReceiveResponse

WinHttpQueryHeaders

HTTP status %d

WinHttpOpenRequest

WinHttpAddRequestHeaders

WinHttpReadData

%%x

--%s%sContent-Disposition: form-data; name="%s"

; filename="%s"%s

Content-Type: %s%s

multipart/form-data; boundary=%s

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_process_suspend.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\file\file_seeker.cc

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\process_info.cc

Reading x64 process from x86 process not supported

0x%llx   0x%llx (%s)

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\module_version.cc

(0xx)

<failed to retrieve error message (0x%x)>

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\scoped_local_alloc.cc

WaitNamedPipe

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\win\registration_protocol_win.cc

TransactNamedPipe

SetNamedPipeHandleState

TransactNamedPipe: expected

c:\b\build\slave\win-pgo\build\src\third_party\crashpad\crashpad\util\net\http_body.cc

InvokeMainViaCRT

ExitMainViaCRT

Microsoft.CRTProvider

C:\b\build\slave\win-pgo\build\src\out\Release\initialexe\chrome.exe.pdb

.text$di

.text$mn

.text$x

.text$yd

.idata$5

.CRT$XCA

.CRT$XCAA

.CRT$XCC

.CRT$XCL

.CRT$XCU

.CRT$XCZ

.CRT$XIA

.CRT$XIAA

.CRT$XIAC

.CRT$XIC

.CRT$XIZ

.CRT$XLA

.CRT$XLB

.CRT$XLZ

.CRT$XPA

.CRT$XPX

.CRT$XPXA

.CRT$XPZ

.CRT$XTA

.CRT$XTZ

.rdata

.rdata$T

.rdata$r

.rdata$sxdata

.rdata$zETW0

.rdata$zETW1

.rdata$zETW2

.rdata$zETW9

.rdata$zzzdbg

.rtc$IAA

.rtc$IZZ

.rtc$TAA

.rtc$TZZ

.xdata$x

.didat$2

.didat$3

.didat$4

.didat$6

.didat$7

.edata

.idata$2

.idata$3

.idata$4

.idata$6

.data

.data$r

.didat$5

.gfids$x

.gfids$y

.tls$ZZZ

.rsrc$01

.rsrc$02

chrome.exe

SignalChromeElf

SignalInitializeCrashReporting

chrome_elf.dll

RegOpenKeyExW

RegEnumKeyExW

RegCreateKeyExW

RegQueryInfoKeyW

RegCloseKey

ADVAPI32.dll

CreateIoCompletionPort

GetWindowsDirectoryW

GetProcessHandleCount

KERNEL32.dll

ShellExecuteExW

SHELL32.dll

CloseWindowStation

CreateWindowStationW

GetProcessWindowStation

SetProcessWindowStation

USER32.dll

VERSION.dll

WINMM.dll

WTSAPI32.dll

RPCRT4.dll

GetCPInfo

GetProcessHeap

PeekNamedPipe

DisconnectNamedPipe

WaitNamedPipeW

WINHTTP.dll

.?AU_Crt_new_delete@std@@

a.IDATx

%F?????????3 

ÿFFFFFFFFFFFFFFF?B%

:1----16

Rhgf^rrrr(   ?NOCdhgfrrrr...DlEBScjhg^rr,001k>985Tnhherr-12

:BBBBBBBBBB>>-.jdddcccca

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><dependency><dependentAssembly><assemblyIdentity type="win32" name="54.0.2840.71" version="54.0.2840.71" language="*"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></supportedOS><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"></supportedOS><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"></supportedOS></application></compatibility></assembly>

3 3*363@3

6#6(60676

0%1X1y1

4"4'4-44494p4K5Z9j9t9}9

; ;%;7;>;^;

< =0=4=8=<=

6 6$6(6,60646

8-8C8}8

? ?$?(?,?0?4?8?<?

= =$=(=,=0=4=8=

5 5$5(5,5054585

? ?$?(?,?0?

= =@=\=`=

KERNEL32.DLL

mscoree.dll

ext-ms-win-ntuser-windowstation-l1-1-0

portuguese-brazilian

Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers

nchrome_watcher.dll

PreReadChromeChildInBrowser

${windows}

Ndebug.log

\StringFileInfo\xx\%ls

ntdll.dll

shell32.dll

script.log

resources.pak

chrome

pepflashplayer.dll

Browse the web

Software\Microsoft\Windows\CurrentVersion\Uninstall\Chromium

{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}

{7D2B3E1D-D096-4594-9D8F-A6667F12E0AC}

Chrome

chrome_child.dll

chrome.dll

Google Chrome Canary

Chrome Canary HTML Document

ChromeSSHTM

{1BEAC3E3-B852-44F4-B468-8906C062422E}

{4ea16ac7-fd5a-47c3-875b-dbf4a2008c20}

ChromeCanary

{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}

Google Chrome binaries

hXXps://support.google.com/chrome/contact/chromeuninstall3?hl=$1

Google Chrome

%d.%d.%d

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

ChromeHTML

Chrome HTML Document

{8A69D345-D564-463c-AFF1-A69D9E530F96}

{5C65F4B0-3651-4514-B207-D10CB699B14B}

Google Chrome Frame

Chrome in a Frame.

Google\Chrome Frame

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame

{8BA986DA-5100-405E-AA35-86F34A02ACBF}

WebAccessible

-chromeframe

-chrome

lSOFTWARE\Policies\Google\Chrome

reports

settings.dat

ALPC Port

\Sessions\%d\AppContainerNamedObjects\%ls

sHKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_PERFORMANCE_TEXT

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_PERFORMANCE_NLSTEXT

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

pipe\

tgdi32.dll

xntdll.dll

Chrome_MessageWindow

Failed to create directory %ls, last error is %d

Chrome SxS\Application

winhttp.dll

54.0.2840.71

chrome_exe

chrome.exe_2696_rwx_00090000_00001000:

w%Program Files%\Microsoft\DesktopLayer.exe

chrome.exe_2696_rwx_20010000_00009000:

.text

.rdata

@.data

.reloc

Srv.exe

kernel32.dll

AdobeART.exe_2996:

`.rsrc

.rmnet

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Windows 2000

Windows XP

Windows Server 2003

Windows Server 2003 R2

Windows Vista

Windows Server 2008

Windows Server 2008 R2

Windows 7

Windows 8

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0

Mozilla/5.0 (Windows NT 5.1; rv:12.0) Gecko/20100101 Firefox/12.0

Mozilla/5.0 (Windows NT 6.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_4) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_4) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5

Mozilla/5.0 (Windows NT 6.1; rv:12.0) Gecko/20100101 Firefox/12.0

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:12.0) Gecko/20100101 Firefox/12.0

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.52 Safari/536.5

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:12.0) Gecko/20100101 Firefox/12.0

Mozilla/5.0 (Windows NT 6.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.52 Safari/536.5

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.14) Gecko/2009082707 Firefox/3.0.14 (.NET CLR 3.5.30729)

Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.25 (jaunty) Firefox/3.8

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.5 Safari/534.55.3

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.52 Safari/536.5

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:12.0) Gecko/20100101 Firefox/12.0

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-GB; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; Media Center PC 6.0; InfoPath.2; MS-RTC LM 8)

Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)

Mozilla/5.0 (Windows; U; Windows NT 5.1; pl; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 GTB5

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_4) AppleWebKit/534.56.5 (KHTML, like Gecko) Version/5.1.6 Safari/534.56.5

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_4) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.52 Safari/536.5

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.221.7 Safari/532.2

Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0

Mozilla/5.0 (Windows NT 6.0) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.168 Safari/535.19

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0

Mozilla/5.0 (X11; U; Linux i686; pl; rv:1.8.0.3) Gecko/20060426 Firefox/1.5.0.3

Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)

Mozilla/5.0 (iPhone; CPU iPhone OS 5_1_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9B206 Safari/7534.48.3

Mozilla/5.0 (Windows NT 6.0; rv:12.0) Gecko/20100101 Firefox/12.0

Mozilla/5.0 (Windows NT 6.1; rv:11.0) Gecko/20100101 Firefox/11.0

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.168 Safari/535.19

co.uk

POST / HTTP/1.

HEAD / HTTP/1.

/ HTTP/1.

Content-Type: application/x-www-form-urlencoded

Microsoft\WinNT.tmp

calc.exe

127.0.0.1

encpassword

Bv.TBv

MPHTTP

KWindows

MPUDP

RegOpenKeyExA

RegCloseKey

ShellExecuteA

URLDownloadToFileA

GetKeyboardType

.idata

.rdata

P.reloc

P.rsrc

.NE>CLR

W.uk'M8

.Socvt

c.exe'

]3_%X

password

PPTCP

.kmY-

URLD

KERNEL32.DLL

advapi32.dll

oleaut32.dll

shell32.dll

shfolder.dll

urlmon.dll

user32.dll

wsock32.dll

Srv.exe

kernel32.dll

4.xBT

AdobeART.exe_2996_rwx_00401000_00011000:

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Windows 2000

Windows XP

Windows Server 2003

Windows Server 2003 R2

Windows Vista

Windows Server 2008

Windows Server 2008 R2

Windows 7

Windows 8

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0

Mozilla/5.0 (Windows NT 5.1; rv:12.0) Gecko/20100101 Firefox/12.0

Mozilla/5.0 (Windows NT 6.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_4) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_4) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5

Mozilla/5.0 (Windows NT 6.1; rv:12.0) Gecko/20100101 Firefox/12.0

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:12.0) Gecko/20100101 Firefox/12.0

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.52 Safari/536.5

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:12.0) Gecko/20100101 Firefox/12.0

Mozilla/5.0 (Windows NT 6.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.52 Safari/536.5

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.14) Gecko/2009082707 Firefox/3.0.14 (.NET CLR 3.5.30729)

Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.25 (jaunty) Firefox/3.8

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.5 Safari/534.55.3

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.52 Safari/536.5

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:12.0) Gecko/20100101 Firefox/12.0

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-GB; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; Media Center PC 6.0; InfoPath.2; MS-RTC LM 8)

Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)

Mozilla/5.0 (Windows; U; Windows NT 5.1; pl; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 GTB5

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_4) AppleWebKit/534.56.5 (KHTML, like Gecko) Version/5.1.6 Safari/534.56.5

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_4) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.52 Safari/536.5

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.221.7 Safari/532.2

Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0

Mozilla/5.0 (Windows NT 6.0) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.168 Safari/535.19

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0

Mozilla/5.0 (X11; U; Linux i686; pl; rv:1.8.0.3) Gecko/20060426 Firefox/1.5.0.3

Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)

Mozilla/5.0 (iPhone; CPU iPhone OS 5_1_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9B206 Safari/7534.48.3

Mozilla/5.0 (Windows NT 6.0; rv:12.0) Gecko/20100101 Firefox/12.0

Mozilla/5.0 (Windows NT 6.1; rv:11.0) Gecko/20100101 Firefox/11.0

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.168 Safari/535.19

co.uk

POST / HTTP/1.

HEAD / HTTP/1.

/ HTTP/1.

Content-Type: application/x-www-form-urlencoded

Microsoft\WinNT.tmp

calc.exe

127.0.0.1

encpassword

Bv.TBv

MPHTTP

KWindows

MPUDP

RegOpenKeyExA

RegCloseKey

ShellExecuteA

URLDownloadToFileA

GetKeyboardType

.idata

.rdata

P.reloc

P.rsrc

.NE>CLR

W.uk'M8

.Socvt

AdobeART.exe_2996_rwx_00414000_00001000:

Srv.exe

kernel32.dll

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   dff091e8d49824eb69e45d5abd0639d3Srv.exe:1776
   %original file name%.exe:1780
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Program Files%\Microsoft\DesktopLayer.exe (113 bytes)
   C:\dff091e8d49824eb69e45d5abd0639d3Srv.exe (113 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\AdobeART.exe (678 bytes)
   %Program Files%\Google\Chrome\Application\dmlconf.dat (48 bytes)
   

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "AdobeART" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\AdobeART.exe"

5. Remove the references to the Trojan by modifying the following registry value(s) (How to Work with System Registry):
   

   [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
   "UserInit" = "c:\windows\system32\userinit.exe,,c:\program files\microsoft\desktoplayer.exe"

6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.