Backdoor.Win32.CosmicDuke_1276d0aa5a

by malwarelabrobot on August 12th, 2014 in Malware Descriptions.

HEUR:Backdoor.Win32.CosmicDuke.gen (Kaspersky), Gen:Variant.Graftor.147251 (B) (Emsisoft), Gen:Variant.Graftor.147251 (AdAware)
Behaviour: Backdoor


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 1276d0aa5ad16fb57426be3050a9bb0b
SHA1: c0003644554da09fed52c9d71b985100c0742a00
SHA256: eaef3614766b3be5b88a375f5c96f005056b6253e432059eb38e8c679f6cd679
SSDeep: 6144:Jn EelAZ9fPaGwMILw xotaLZ1rRQWsBqqjM6LoOIKW5j:xe6TfPaGw/w xoWKWsVjM6UOMF
Size: 1088092 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2012-11-13 11:53:11
Analyzed on: WindowsXP SP3 32-bit


Summary:

Backdoor. Malware that enables a remote control of victim's machine.

Payload

No specific payload has been found.

Process activity

The Backdoor creates the following process(es):

winpdb.exe:332

The Backdoor injects its code into the following process(es):

%original file name%.exe:328
cmswdm.exe:1356

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:328 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Desktop\Total Commander.lnk (1 bytes)
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF80A5F801}.pol (4 bytes)
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF80CD9101}.pol (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%System%\winpdb.exe (194 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\objwm.exe (7495 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\apisql.exe (8417 bytes)
%System%\cmswdm.exe (7675 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Address Book\adm.wab (4250 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\tapidsp.exe (7490 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2c1c2a37-c472-4c0c-a481-6487a06d0372 (5 bytes)
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70141501}.pol (24 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
%Documents and Settings%\All Users\Desktop\Adobe Reader 9.lnk (1 bytes)
%System%\srvinf.exe (8009 bytes)
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF80156501}.pol (4 bytes)
%WinDir%\Tasks\Watchmon Service.job (290 bytes)
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70AA0201}.pol (4 bytes)
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF8094E303}.pol (4 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Wireshark.lnk (1 bytes)

The process cmswdm.exe:1356 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\GX23KPCP\desktop.ini (67 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\W8EBSI63\desktop.ini (67 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7J4KIJM1\desktop.ini (67 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IRU2W0P2\desktop.ini (67 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER (0 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\desktop.ini (0 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\desktop.ini (0 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF (0 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\desktop.ini (0 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\desktop.ini (0 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7 (0 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7 (0 bytes)

Registry activity

The process winpdb.exe:332 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7C B7 02 8F C2 B0 4B 07 93 50 95 12 E8 DF 23 B2"

The process %original file name%.exe:328 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\WLanDiagCtlGuid]
"BitNames" = " WLANHC_AUTOCONFIG WLANHC_RNWFMSM WLANHC_FATMSM WLANHC_DLLMAIN WLANHC_TEST"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\JavaSoft]
"Supplement" = "22 00 43 00 3A 00 5C 00 57 00 49 00 4E 00 44 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\WAB\WAB4\Wab File Name]
"(Default)" = "%Documents and Settings%\%current user%\Application Data\Microsoft\Address Book\adm.wab"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\WAB\WAB4]
"OlkFolderRefresh" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\CtlGuid]
"BitNames" = " DOT11_ASSOCIATE DOT11_ROAMING DOT11_1X DOT11_PNP DOT11_SCAN DOT11_RECEIVE DOT11_SEND DOT11_IOCTL DOT11_OID DOT11_MISC DOT11_UPCALL DOT11_KEYMGR DOT11_PEER DOT11_SOFTAP DOT11_PAM DOT11_REPEATER DOT11_APROUTER DOT11_WME DOT11_CONFIG DOT11_MSM DOT11_MSM_ADAPT DOT11_MSM_SCAN DOT11_MSM_CONNECT DOT11_MSM_SECURITY_PKT DOT11_NOTIFY_OBJECT"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Identities\{37E80C13-CB45-4DCE-A438-545B791476AC}]
"Identity Ordinal" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\CtlGuid]
"Guid" = "d905ac1c-65e7-4242-99ea-fe66a8355df8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\DiagL2SecCtlGuid]
"Guid" = "2e8d9ec5-a712-48c4-8ce0-631eb0c1cd65"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"EnableBalloonTips" = "0"

[HKCU\Identities]
"Identity Ordinal" = "2"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\ServiceCtlGuid]
"BitNames" = " DOT11_AUTOCONF DOT11_AUTOCONF_CLIENT DOT11_AUTOCONF_UI DOT11_FATMSM DOT11_COMMON DOT11_WLANGPA DOT11_CLASS_COINSTALLER"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4A 65 EF 3D 4D CF 21 97 66 D6 14 47 2C CD 8E F3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\ServiceCtlGuid]
"Guid" = "0c5a3172-2248-44fd-b9a6-8389cb1dc56a"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\WDiagCoreCtlGuid]
"BitNames" = " WD_LOG_FLAG_INIT WD_LOG_FLAG_RPC WD_LOG_FLAG_EVENT WD_LOG_FLAG_INTERFACE WD_LOG_FLAG_CONNECTION WD_LOG_FLAG_CONTROL WD_LOG_FLAG_LOCKS WD_LOG_FLAG_MEMORY WD_LOG_FLAG_REFERENCES WD_LOG_FLAG_FUNCTION_TRACE WD_LOG_FLAG_ASSERT"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\DiagL2SecCtlGuid]
"BitNames" = " SECHC_LOG_FLAG_ASSERT SECHC_LOG_FLAG_INIT SECHC_LOG_FLAG_DIAG SECHC_LOG_FLAG_ONEX_DIAG SECHC_LOG_FLAG_REPAIR SECHC_LOG_FLAG_STATE SECHC_LOG_FLAG_EXT SECHC_LOG_FLAG_EVENT_LOG SECHC_LOG_FLAG_FUNCTION SECHC_LOG_FLAG_MEMORY SECHC_LOG_FLAG_LOCKS"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Recent" = "%Documents and Settings%\%current user%\Recent"

[HKCU\Software\Microsoft\WAB\WAB4]
"OlkContactRefresh" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\WLanDiagCtlGuid]
"Guid" = "6da4ddca-0901-4bae-9ad4-7e6030bab531"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\WDiagCoreCtlGuid]
"Guid" = "637a0f36-dff5-4b2f-83dd-b106c1c725e2"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Backdoor deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Identities]
"Changing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

[HKCU\Identities]
"OutgoingID"
"IncomingID"

The process cmswdm.exe:1356 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6F B9 EB 6C 0B D4 76 4E 54 67 CF CD FF 2D 79 38"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\NetworkService\Cookies"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\NetworkService\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"EnableBalloonTips" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Backdoor deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

Dropped PE files

MD5 File path
492756a2e8ccc85b6db827b3da975985 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\apisql.exe
17d000479b93ea97277164ab0e97f99d c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\tapidsp.exe
b59199877e0d68a5e93fc8ea76374ed1 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\mgrhost.exe
5098efd4fdc5fd591c65f9d850e07b30 c:\WINDOWS\system32\cmswdm.exe
eed550d95c90cd155288a2e609d37288 c:\WINDOWS\system32\winpdb.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: NVIDIA Corporation
Product Name: NVIDIA Update Components
Product Version: 1.5.20.0
Legal Copyright: (C) NVIDIA Corporation. All rights reserved.
Legal Trademarks:
Original Filename: WLMerger.exe
Internal Name: WLMerger
File Version: 1.5.20.0
File Description: WLMerger Application
Comments:
Language: Chinese (Simplified, PRC)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 136669 136704 4.55502 1625282d8e32880dcd64cf0d83d477c1
.rdata 143360 25436 25600 3.34715 7da2f39fc2e605b68d02fb73d4804721
.data 172032 1587268 530432 1.98944 48dcab11fabcb0c8bdd4435691adbf71
.rsrc 1761280 4082 4096 2.31339 9088c985e60466a1c6ecf3698c760444

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 1
0e7dff2fbb12d94fb08ac78d58e5219c

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Backdoor connects to the servers at the folowing location(s):

%original file name%.exe_328_rwx_00400000_00020000:

.text
`.rdata
@.data
.rsrc
PSSSSSSh
PSSSSSSh#
PSSSSSSh"
SSj%S
SSh|fB
t$

%original file name%.exe_328_rwx_00420000_00020000:

F%D,3
.mixcrt
KERNEL32.DLL
mscoree.dll
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
kernel32.dll
operator
GetProcessWindowStation
USER32.DLL
?456789:;<=
!"#$%&'()* ,-./0123
NetGetJoinInformation
FtpOpenFileW
FtpSetCurrentDirectoryW
XX
URLOpenBlockingStreamW
PK11_GetInternalKeySlot
sqlite3_open16
sqlite3_close
sqlite3_exec
sqlite3_free
select id, hostname, usernamefield, passwordfield, encryptedusername, encryptedpassword from moz_logins
abe2869f-9b47-4cd9-a358-c22904dba7f7
82BD0E67-9FEA-4748-8672-D5EFE5B779B0
c:\botgenstudio\generations\55ff7700\bin\Bot.pdb
GetWindowsDirectoryW
CreateNamedPipeW
KERNEL32.dll
GetKeyboardType
GetKeyboardState
GetAsyncKeyState
GetKeyboardLayout
SetProcessWindowStation
GetKeyboardLayoutNameW
USER32.dll
GDI32.dll
RegOpenKeyExW
RegEnumKeyW
RegCreateKeyExW
RegOpenKeyW
RegCloseKey
RegQueryInfoKeyW
CryptDestroyKey
CryptImportKey
CryptSetKeyParam
ADVAPI32.dll
ShellExecuteExW
SHFileOperationW
SHELL32.dll
ole32.dll
OLEAUT32.dll
RPCRT4.dll
IPHLPAPI.DLL
WTSAPI32.dll
Secur32.dll
WININET.dll
WS2_32.dll
SHLWAPI.dll
CertCloseStore
PFXExportCertStoreEx
CertOpenStore
CRYPT32.dll
GetProcessHeap
GetCPInfo
HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2)
Content-Type: application/x-www-form-urlencoded
.text
`.rdata
32.dll
KeyW
echo del %0 >> "%TEMP%\msicheck.cmd"
echo copy /y "%SYSTEMROOT%\system32\ping.exe" "%TEMP%\smss.exe" >> "%TEMP%\msicheck.cmd"
echo :z >> "%TEMP%\msicheck.cmd"
echo del %1 >> "%TEMP%\msicheck.cmd"
echo "%TEMP%\smss.exe" 127.1 -n
>> "%TEMP%\msicheck.cmd"
echo attrib -s -h %1 >> "%TEMP%\msicheck.cmd"
echo if exist %1 goto z >> "%TEMP%\msicheck.cmd"
echo del "%TEMP%\smss.exe" >> "%TEMP%\msicheck.cmd"
echo del "%TEMP%\msicheck.cmd" >> "%TEMP%\msicheck.cmd"
"%SYSTEMROOT%\system32\cmd.exe" /c "%TEMP%\msicheck.cmd"
zcÁ
c:\%original file name%.exe
<assemblyIdentity type="win32" name="Java(TM) Support Engine" version="6.1.1.1" processorArchitecture="x86" publicKeyToken="7862835611122721"></assemblyIdentity>
<ms_asmv3:requestedExecutionLevel level="asInvoker" uiAccess="false"></ms_asmv3:requestedExecutionLevel>
\system32\cmd.exe
cmd.exe
savadminservice.exe
scfservice.exe
savservice.exe
ekrn.exe
msseces.exe
MsMpEng.exe
dwengine.exe
ekern.exe
nod32.exe
nod32krn.exe
AvastUi.exe
AvastSvc.exe
kav.exe
navapsvc.exe
mcods.exe
mcvsescn.exe
outpost.exe
acs.exe
avp.exe
ntdll.dll
crypt32.dll
MyKeyContainer
hXXp://
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Software\Microsoft\Windows NT\CurrentVersion
wininet.dll
ntuser{4CB43D7F-7EEE-4906-8698-
}.pol
\\.\pipe\4012D44D-F62E-093E-8A91-736FF2FA2AA2
*.exe;*.ndb;*.mp3;*.avi
*temporary;*Cookies;*games;*system32;*program files;*\windows;*\System Volume Information
*.doc;*.xps;*.xls;*.ppt;*.pps;*.wps;*.wpd;*.ods;*.odt;*.lwp;*.jtd;*.pdf;*.zip;*.rar;*.docx;*.url;*.xlsx;*.pptx;*.ppsx;*.pst;*.ost;*psw*;*pass*;*login*;*admin*;*sifr*;*sifer*;*vpn;*.jpg;*.txt;*.lnk
*.exe;*.dll;*.tmp;*.obj;*.ocx;*.js
*temporary;*Cookies;*games;*system32;*program files;*\windows\;*\System Volume Information
>\config.xml
netapi32.dll
oiphlpapi.dll
*.lnk
Shell32.dll
Microsoft\Windows\Media Center\PBDARegisterSW
WXX
XXXXXXXXXXX
=X&
=XX&
urlmon.dll
XXXXXX
SECURITY\Policy\PolSecretEncryptionKey
wlanapi.dll
Web Data
Login Data
Google\Chrome\User Data\Default\
hXXp://VVV.facebook.com/login.php
hXXps://login.facebook.com/login.php
hXXp://VVV.facebook.com/
hXXp://VVV.facebook.com/index.php
hXXp://m.facebook.com/login.php
hXXp://m.myspace.com/login.wap
hXXp://VVV.myspace.com/
hXXp://VVV.myspace.com/index.cfm
hXXp://babelfish.yahoo.com/translate_url
hXXp://services.msn.com/svcs/hotmail/httpmail.asp
hXXp://google.com/
hXXps://VVV.google.com/analytics/reporting/login
hXXps://VVV.google.com/groups/signin
hXXps://VVV.google.com/accounts/ManageAccount
hXXp://VVV.google.com/
hXXps://VVV.google.com/accounts/Login
hXXp://mail.google.com/mail/
hXXps://VVV.google.com/accounts/ServiceLoginAuth
hXXps://VVV.google.com/accounts/ServiceLogin
wand.dat
\Application Data\Opera
nx
%s::%s --> %s (decrypted: %s)
%s::%s --> %s
%s::%s
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
\account.cfn
nss3.dll
sqlite3.dll
mozsqlite3.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\thunderbird.exe
Mozilla
signons.sqlite
s\Application Data\Mozilla\Firefox\Profiles
INTERNET EXPLORER 7.x-8.x HTTPPASS
advapi32.dll
pstorec.dll
INTERNET EXPLORER 6.x HTTPPASS
SMTP
Password
POP3 Port
IMAP Port
SMTP Port
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70737200}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70AA0201}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70245201}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70775500}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF80CD9101}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF8094E303}.pol
iphlpapi.dll
c:\program files\common files\
6, 1, 1, 1
javacc.exe

cmswdm.exe_1356_rwx_00400000_00020000:

.text
`.rdata
@.data
.rsrc
PSSSSSSh
PSSSSSSh#
PSSSSSSh"
SSj%S
SSh|fB
t$

cmswdm.exe_1356_rwx_00420000_00020000:

F%D,3
.mixcrt
KERNEL32.DLL
mscoree.dll
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
kernel32.dll
operator
GetProcessWindowStation
USER32.DLL
?456789:;<=
!"#$%&'()* ,-./0123
NetGetJoinInformation
FtpOpenFileW
FtpSetCurrentDirectoryW
XX
URLOpenBlockingStreamW
PK11_GetInternalKeySlot
sqlite3_open16
sqlite3_close
sqlite3_exec
sqlite3_free
select id, hostname, usernamefield, passwordfield, encryptedusername, encryptedpassword from moz_logins
abe2869f-9b47-4cd9-a358-c22904dba7f7
82BD0E67-9FEA-4748-8672-D5EFE5B779B0
c:\botgenstudio\generations\55ff7700\bin\Bot.pdb
GetWindowsDirectoryW
CreateNamedPipeW
KERNEL32.dll
GetKeyboardType
GetKeyboardState
GetAsyncKeyState
GetKeyboardLayout
SetProcessWindowStation
GetKeyboardLayoutNameW
USER32.dll
GDI32.dll
RegOpenKeyExW
RegEnumKeyW
RegCreateKeyExW
RegOpenKeyW
RegCloseKey
RegQueryInfoKeyW
CryptDestroyKey
CryptImportKey
CryptSetKeyParam
ADVAPI32.dll
ShellExecuteExW
SHFileOperationW
SHELL32.dll
ole32.dll
OLEAUT32.dll
RPCRT4.dll
IPHLPAPI.DLL
WTSAPI32.dll
Secur32.dll
WININET.dll
WS2_32.dll
SHLWAPI.dll
CertCloseStore
PFXExportCertStoreEx
CertOpenStore
CRYPT32.dll
GetProcessHeap
GetCPInfo
HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2)
Content-Type: application/x-www-form-urlencoded
.text
`.rdata
32.dll
KeyW
echo del %0 >> "%TEMP%\msicheck.cmd"
echo copy /y "%SYSTEMROOT%\system32\ping.exe" "%TEMP%\smss.exe" >> "%TEMP%\msicheck.cmd"
echo :z >> "%TEMP%\msicheck.cmd"
echo del %1 >> "%TEMP%\msicheck.cmd"
echo "%TEMP%\smss.exe" 127.1 -n
>> "%TEMP%\msicheck.cmd"
echo attrib -s -h %1 >> "%TEMP%\msicheck.cmd"
echo if exist %1 goto z >> "%TEMP%\msicheck.cmd"
echo del "%TEMP%\smss.exe" >> "%TEMP%\msicheck.cmd"
echo del "%TEMP%\msicheck.cmd" >> "%TEMP%\msicheck.cmd"
"%SYSTEMROOT%\system32\cmd.exe" /c "%TEMP%\msicheck.cmd"
zcÁ
%System%\cmswdm.exe
<assemblyIdentity type="win32" name="Java(TM) Support Engine" version="6.1.1.1" processorArchitecture="x86" publicKeyToken="7862835611122721"></assemblyIdentity>
<ms_asmv3:requestedExecutionLevel level="asInvoker" uiAccess="false"></ms_asmv3:requestedExecutionLevel>
\system32\cmd.exe
cmd.exe
savadminservice.exe
scfservice.exe
savservice.exe
ekrn.exe
msseces.exe
MsMpEng.exe
dwengine.exe
ekern.exe
nod32.exe
nod32krn.exe
AvastUi.exe
AvastSvc.exe
kav.exe
navapsvc.exe
mcods.exe
mcvsescn.exe
outpost.exe
acs.exe
avp.exe
ntdll.dll
crypt32.dll
MyKeyContainer
hXXp://
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Software\Microsoft\Windows NT\CurrentVersion
wininet.dll
ntuser{4CB43D7F-7EEE-4906-8698-
}.pol
\\.\pipe\4012D44D-F62E-093E-8A91-736FF2FA2AA2
*.exe;*.ndb;*.mp3;*.avi
*temporary;*Cookies;*games;*system32;*program files;*\windows;*\System Volume Information
*.doc;*.xps;*.xls;*.ppt;*.pps;*.wps;*.wpd;*.ods;*.odt;*.lwp;*.jtd;*.pdf;*.zip;*.rar;*.docx;*.url;*.xlsx;*.pptx;*.ppsx;*.pst;*.ost;*psw*;*pass*;*login*;*admin*;*sifr*;*sifer*;*vpn;*.jpg;*.txt;*.lnk
*.exe;*.dll;*.tmp;*.obj;*.ocx;*.js
*temporary;*Cookies;*games;*system32;*program files;*\windows\;*\System Volume Information
>\config.xml
netapi32.dll
oiphlpapi.dll
*.lnk
Shell32.dll
Microsoft\Windows\Media Center\PBDARegisterSW
WXX
XXXXXXXXXXX
=X&
=XX&
urlmon.dll
XXXXXX
SECURITY\Policy\PolSecretEncryptionKey
wlanapi.dll
Web Data
Login Data
Google\Chrome\User Data\Default\
hXXp://VVV.facebook.com/login.php
hXXps://login.facebook.com/login.php
hXXp://VVV.facebook.com/
hXXp://VVV.facebook.com/index.php
hXXp://m.facebook.com/login.php
hXXp://m.myspace.com/login.wap
hXXp://VVV.myspace.com/
hXXp://VVV.myspace.com/index.cfm
hXXp://babelfish.yahoo.com/translate_url
hXXp://services.msn.com/svcs/hotmail/httpmail.asp
hXXp://google.com/
hXXps://VVV.google.com/analytics/reporting/login
hXXps://VVV.google.com/groups/signin
hXXps://VVV.google.com/accounts/ManageAccount
hXXp://VVV.google.com/
hXXps://VVV.google.com/accounts/Login
hXXp://mail.google.com/mail/
hXXps://VVV.google.com/accounts/ServiceLoginAuth
hXXps://VVV.google.com/accounts/ServiceLogin
wand.dat
\Application Data\Opera
nx
%s::%s --> %s (decrypted: %s)
%s::%s --> %s
%s::%s
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
\account.cfn
nss3.dll
sqlite3.dll
mozsqlite3.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\thunderbird.exe
Mozilla
signons.sqlite
s\Application Data\Mozilla\Firefox\Profiles
INTERNET EXPLORER 7.x-8.x HTTPPASS
advapi32.dll
pstorec.dll
INTERNET EXPLORER 6.x HTTPPASS
SMTP
Password
POP3 Port
IMAP Port
SMTP Port
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70737200}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70AA0201}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70245201}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70775500}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF80CD9101}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF8094E303}.pol
iphlpapi.dll
c:\program files\common files\
6, 1, 1, 1
javacc.exe


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    winpdb.exe:332

  2. Delete the original Backdoor file.
  3. Delete or disinfect the following files created/modified by the Backdoor:

    %Documents and Settings%\%current user%\Desktop\Total Commander.lnk (1 bytes)
    %Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF80A5F801}.pol (4 bytes)
    %Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF80CD9101}.pol (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %System%\winpdb.exe (194 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\objwm.exe (7495 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\apisql.exe (8417 bytes)
    %System%\cmswdm.exe (7675 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\Address Book\adm.wab (4250 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\tapidsp.exe (7490 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2c1c2a37-c472-4c0c-a481-6487a06d0372 (5 bytes)
    %Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70141501}.pol (24 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
    %Documents and Settings%\All Users\Desktop\Adobe Reader 9.lnk (1 bytes)
    %System%\srvinf.exe (8009 bytes)
    %Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF80156501}.pol (4 bytes)
    %WinDir%\Tasks\Watchmon Service.job (290 bytes)
    %Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70AA0201}.pol (4 bytes)
    %Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF8094E303}.pol (4 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Wireshark.lnk (1 bytes)
    %Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\GX23KPCP\desktop.ini (67 bytes)
    %Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\W8EBSI63\desktop.ini (67 bytes)
    %Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7J4KIJM1\desktop.ini (67 bytes)
    %Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IRU2W0P2\desktop.ini (67 bytes)

  4. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now