DeepScan.Generic.Malware.PTk.41721171_24e75bde7d
Trojan-Dropper.Win32.Agent.axza (Kaspersky), Trojan.Generic.4539457 (B) (Emsisoft), DeepScan:Generic.Malware.P!Tk.41721171 (AdAware), Backdoor.Win32.PcClient.FD, GenericAutorunWorm.YR (Lavasoft MAS)
Behaviour: Trojan-Dropper, Trojan, Backdoor, Worm, WormAutorun, Malware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
| Requires JavaScript enabled! |
|---|
MD5: 24e75bde7d18226edd597ae697d87e7e
SHA1: d411c7bf7b85b0d28d6fb5cbdb388eb1f7ca85e6
SHA256: ed504a9ad748eb6743b6519201d634b96a7f44d03d4bfd57f4fa9e6e584e4a27
SSDeep: 768:8K6Wpy9udnJcd46Wm8rS8OFfUQQkM0MxRBkhUooda:xBy9uEd4S8rSRykHMLBo7
Size: 37888 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: no certificate found
Created at: 2009-07-25 18:30:12
Analyzed on: WindowsXPESX SP3 32-bit
Summary:
Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.
Payload
| Behaviour | Description |
|---|---|
| WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the DeepScan's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The DeepScan creates the following process(es):
taskkill.exe:604
taskkill.exe:360
taskkill.exe:552
sc.exe:1788
rundll32.exe:744
cacls.exe:692
The DeepScan injects its code into the following process(es):
%original file name%.exe:820
Mutexes
The following mutexes were created/opened:
No objects were found.
File activity
The process %original file name%.exe:820 makes changes in the file system.
The DeepScan creates and/or writes to the following file(s):
C:\ (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (4 bytes)
C:\autorun.inf (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (388 bytes)
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Perflib_Perfdata_2a4.dat (100 bytes)
%System%\m1846741.dll (12169462 bytes)
%System%\drivers\etc\hosts (5 bytes)
%WinDir%\Temp\Perflib_Perfdata_124.dat (100 bytes)
%WinDir% (384 bytes)
%System%\drivers\pcidump.sys (5404535 bytes)
%System% (744 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%System%\config (100 bytes)
%System%\drivers (96 bytes)
%WinDir%\s265006334.dll (35485887 bytes)
C:\1.exe (37 bytes)
The process rundll32.exe:744 makes changes in the file system.
The DeepScan creates and/or writes to the following file(s):
%System%\drivers\acpiec.sys (14 bytes)
Registry activity
The process taskkill.exe:604 makes changes in the system registry.
The DeepScan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "02 1F 05 A9 5B 59 36 28 27 B3 C2 D6 6E 7D 3E CE"
The process taskkill.exe:360 makes changes in the system registry.
The DeepScan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "19 C2 50 F8 81 18 F2 72 1F A5 F4 9E 76 EB 52 B5"
The process taskkill.exe:552 makes changes in the system registry.
The DeepScan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6D 17 27 1F 56 F2 FB D2 90 8D FB A5 1D 94 96 73"
The process sc.exe:1788 makes changes in the system registry.
The DeepScan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E5 22 35 F3 5C 2B 74 53 FE 55 07 73 07 B9 14 8D"
The process rundll32.exe:744 makes changes in the system registry.
The DeepScan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "90 60 41 55 9A 75 9F D4 D7 4E BD EC 3D 0B D1 36"
The process cacls.exe:692 makes changes in the system registry.
The DeepScan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "72 40 A9 07 F8 AB B5 7B 4F B5 38 EF F3 86 AA AA"
Dropped PE files
| MD5 | File path |
|---|---|
| 47ce67ae447dba7ca7349f53812e9f89 | c:\WINDOWS\LastGood\system32\drivers\acpiec.sys |
| 168b54c167308ae920dbccec4b57eff2 | c:\WINDOWS\s265006334.dll |
| 9859c0f6936e723e4892d7141b1327d5 | c:\WINDOWS\system32\dllcache\acpiec.sys |
| 47ce67ae447dba7ca7349f53812e9f89 | c:\WINDOWS\system32\drivers\OLDB4.tmp |
| 601b3f2466bfa6989b9c7586b5ba54aa | c:\WINDOWS\system32\drivers\pcidump.sys |
| 3e3b8a35aefc6e462746d6689348fa7e | c:\WINDOWS\system32\m1846741.dll |
HOSTS file anomalies
The DeepScan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 5743 bytes in size. The following strings are added to the hosts file listed below:
| 127.0.0.1 | v.onondown.com.cn |
| 127.0.0.2 | ymsdasdw1.cn |
| 127.0.0.3 | h96b.info |
| 127.0.0.0 | fuck.zttwp.cn |
| 127.0.0.0 | www.hackerbf.cn |
| 127.0.0.0 | geekbyfeng.cn |
| 127.0.0.0 | 121.14.101.68 |
| 127.0.0.0 | ppp.etimes888.com |
| 127.0.0.0 | www.bypk.com |
| 127.0.0.0 | CSC3-2004-crl.verisign.com |
| 127.0.0.1 | va9sdhun23.cn |
| 127.0.0.0 | udp.hjob123.com |
| 127.0.0.2 | bnasnd83nd.cn |
| 127.0.0.0 | www.gamehacker.com.cn |
| 127.0.0.0 | gamehacker.com.cn |
| 127.0.0.3 | adlaji.cn |
| 127.0.0.1 | 858656.com |
| 127.1.1.1 | bnasnd83nd.cn |
| 127.0.0.1 | my123.com |
| 127.0.0.0 | user1.12-27.net |
| 127.0.0.1 | 8749.com |
| 127.0.0.0 | fengent.cn |
| 127.0.0.1 | 4199.com |
| 127.0.0.1 | user1.16-22.net |
| 127.0.0.1 | 7379.com |
| 127.0.0.1 | 2be37c5f.3f6e2cc5f0b.com |
| 127.0.0.1 | 7255.com |
| 127.0.0.1 | user1.23-12.net |
| 127.0.0.1 | 3448.com |
| 127.0.0.1 | www.guccia.net |
| 127.0.0.1 | 7939.com |
| 127.0.0.1 | a.o1o1o1.nEt |
| 127.0.0.1 | 8009.com |
| 127.0.0.1 | user1.12-73.cn |
| 127.0.0.1 | piaoxue.com |
| 127.0.0.1 | 3n8nlasd.cn |
| 127.0.0.1 | kzdh.com |
| 127.0.0.0 | www.sony888.cn |
| 127.0.0.1 | about.blank.la |
| 127.0.0.0 | user1.asp-33.cn |
| 127.0.0.1 | 6781.com |
| 127.0.0.0 | www.netkwek.cn |
| 127.0.0.1 | 7322.com |
| 127.0.0.0 | ymsdkad6.cn |
| 127.0.0.0 | www.lkwueir.cn |
| 127.0.0.1 | 06.jacai.com |
| 127.0.1.1 | user1.23-17.net |
| 127.0.0.1 | 1.jopenkk.com |
| 127.0.0.0 | upa.luzhiai.net |
| 127.0.0.1 | 1.jopenqc.com |
| 127.0.0.0 | www.guccia.net |
| 127.0.0.1 | 1.joppnqq.com |
| 127.0.0.0 | 4m9mnlmi.cn |
| 127.0.0.1 | 1.xqhgm.com |
| 127.0.0.0 | mm119mkssd.cn |
| 127.0.0.1 | 100.332233.com |
| 127.0.0.0 | 61.128.171.115:8080 |
| 127.0.0.1 | 121.11.90.79 |
| 127.0.0.0 | www.1119111.com |
| 127.0.0.1 | 121565.net |
| 127.0.0.0 | win.nihao69.cn |
| 127.0.0.1 | 125.90.88.38 |
| 127.0.0.1 | 16888.6to23.com |
| 127.0.0.1 | 2.joppnqq.com |
| 127.0.0.0 | puc.lianxiac.net |
| 127.0.0.1 | 204.177.92.68 |
| 127.0.0.0 | pud.lianxiac.net |
| 127.0.0.1 | 210.74.145.236 |
| 127.0.0.0 | 210.76.0.133 |
| 127.0.0.1 | 219.129.239.220 |
| 127.0.0.0 | 61.166.32.2 |
| 127.0.0.1 | 219.153.40.221 |
| 127.0.0.0 | 218.92.186.27 |
| 127.0.0.1 | 219.153.46.27 |
| 127.0.0.0 | www.fsfsfag.cn |
| 127.0.0.1 | 219.153.52.123 |
| 127.0.0.0 | ovo.ovovov.cn |
| 127.0.0.1 | 221.195.42.71 |
| 127.0.0.0 | dw.com.com |
| 127.0.0.1 | 222.73.218.115 |
| 127.0.0.1 | 203.110.168.233:80 |
| 127.0.0.1 | 3.joppnqq.com |
| 127.0.0.1 | 203.110.168.221:80 |
| 127.0.0.1 | 363xx.com |
| 127.0.0.1 | www1.ip10086.com.cm |
| 127.0.0.1 | 4199.com |
| 127.0.0.1 | blog.ip10086.com.cn |
| 127.0.0.1 | 43242.com |
| 127.0.0.1 | www.ccji68.cn |
| 127.0.0.1 | 5.xqhgm.com |
| 127.0.0.0 | t.myblank.cn |
| 127.0.0.1 | 520.mm5208.com |
| 127.0.0.0 | x.myblank.cn |
| 127.0.0.1 | 59.34.131.54 |
| 127.0.0.1 | 210.51.45.5 |
| 127.0.0.1 | 59.34.198.228 |
| 127.0.0.1 | www.ew1q.cn |
| 127.0.0.1 | 59.34.198.88 |
| 127.0.0.1 | 59.34.198.97 |
| 127.0.0.1 | 60.190.114.101 |
| 127.0.0.1 | 60.190.218.34 |
| 127.0.0.0 | qq-xing.com.cn |
| 127.0.0.1 | 60.191.124.252 |
| 127.0.0.1 | 61.145.117.212 |
| 127.0.0.1 | 61.157.109.222 |
| 127.0.0.1 | 75.126.3.216 |
| 127.0.0.1 | 75.126.3.217 |
| 127.0.0.1 | 75.126.3.218 |
| 127.0.0.0 | 59.125.231.177:17777 |
| 127.0.0.1 | 75.126.3.220 |
| 127.0.0.1 | 75.126.3.221 |
| 127.0.0.1 | 75.126.3.222 |
| 127.0.0.1 | 772630.com |
| 127.0.0.1 | 832823.cn |
| 127.0.0.1 | 8749.com |
| 127.0.0.1 | 888.jopenqc.com |
| 127.0.0.1 | 89382.cn |
| 127.0.0.1 | 8v8.biz |
| 127.0.0.1 | 97725.com |
| 127.0.0.1 | 9gg.biz |
| 127.0.0.1 | www.9000music.com |
| 127.0.0.1 | test.591jx.com |
| 127.0.0.1 | a.topxxxx.cn |
| 127.0.0.1 | picon.chinaren.com |
| 127.0.0.1 | www.5566.net |
| 127.0.0.1 | p.qqkx.com |
| 127.0.0.1 | news.netandtv.com |
| 127.0.0.1 | z.neter888.cn |
| 127.0.0.1 | b.myblank.cn |
| 127.0.0.1 | wvw.wokutu.com |
| 127.0.0.1 | unionch.qyule.com |
| 127.0.0.1 | www.qyule.com |
| 127.0.0.1 | it.itjc.cn |
| 127.0.0.1 | www.linkwww.com |
| 127.0.0.1 | vod.kaicn.com |
| 127.0.0.1 | www.tx8688.com |
| 127.0.0.1 | b.neter888.cn |
| 127.0.0.1 | promote.huanqiu.com |
| 127.0.0.1 | www.huanqiu.com |
| 127.0.0.1 | www.haokanla.com |
| 127.0.0.1 | play.unionsky.cn |
| 127.0.0.1 | www.52v.com |
| 127.0.0.1 | www.gghka.cn |
| 127.0.0.1 | icon.ajiang.net |
| 127.0.0.1 | new.ete.cn |
| 127.0.0.1 | www.stiae.cn |
| 127.0.0.1 | o.neter888.cn |
| 127.0.0.1 | comm.jinti.com |
| 127.0.0.1 | www.google-analytics.com |
| 127.0.0.1 | hz.mmstat.com |
| 127.0.0.1 | www.game175.cn |
| 127.0.0.1 | x.neter888.cn |
| 127.0.0.1 | z.neter888.cn |
| 127.0.0.1 | p.etimes888.com |
| 127.0.0.1 | hx.etimes888.com |
| 127.0.0.1 | abc.qqkx.com |
| 127.0.0.1 | dm.popdm.cn |
| 127.0.0.1 | www.yl9999.com |
| 127.0.0.1 | www.dajiadoushe.cn |
| 127.0.0.1 | v.onondown.com.cn |
| 127.0.0.1 | www.interoo.net |
| 127.0.0.1 | bally1.bally-bally.net |
| 127.0.0.1 | www.bao5605509.cn |
| 127.0.0.1 | www.rty456.cn |
| 127.0.0.1 | www.werqwer.cn |
| 127.0.0.1 | 1.360-1.cn |
| 127.0.0.1 | user1.23-16.net |
| 127.0.0.1 | www.guccia.net |
| 127.0.0.1 | www.interoo.net |
| 127.0.0.1 | upa.netsool.net |
| 127.0.0.1 | js.users.51.la |
| 127.0.0.1 | vip2.51.la |
| 127.0.0.1 | web.51.la |
| 127.0.0.1 | qq.gong2008.com |
| 127.0.0.1 | 2008tl.copyip.com |
| 127.0.0.1 | tla.laozihuolaile.cn |
| 127.0.0.1 | www.tx6868.cn |
| 127.0.0.1 | p001.tiloaiai.com |
| 127.0.0.1 | s1.tl8tl.com |
| 127.0.0.1 | s1.gong2008.com |
| 127.0.0.1 | 4b3ce56f9g.3f6e2cc5f0b.com |
Rootkit activity
The DeepScan installs the following kernel-mode hooks:
ZwQuerySystemInformation
Using the driver "%System%\drivers\pcidump.sys" the DeepScan substitutes IRP handlers in a file system driver (NTFS) to control operations with files:
MJ_CREATE
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the DeepScan's file once a user opens a drive's folder in Windows Explorer.
VersionInfo
Company Name: Microsoft Corporation
Product Name: Microsoft(R) Windows(R) Operating System
Product Version: 5.1.2600.0
Legal Copyright: (C) Microsoft Corporation. All rights reserved.
Legal Trademarks:
Original Filename: CALC.EXE
Internal Name: CALC
File Version: 5.1.2600.0 (xpclient.010817-1148)
File Description: Windows Calculator application file
Comments:
Language: English (United States)
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| UPX0 | 4096 | 86016 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| UPX1 | 90112 | 36864 | 34816 | 5.46756 | 27187ad0d6bcef9a5b59fa51d062316e |
| .rsrc | 126976 | 4096 | 2048 | 1.91925 | 0b2c49604cc338a65a6b41dff3b6d7f9 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
URLs
No activity has been detected.
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Web Traffic was not found.
The DeepScan connects to the servers at the folowing location(s):
`.rsrc
%s\s%d
32.exe
%dm^`[
%s\s%d%d.dll
rundll32.exe %s, droqp
%s\system32\m%d%d.dll
cmd /c taskkill /im ScanFrm.exe /f
cmd /c taskkill /im egui.exe /f
cmd /c taskkill /im ekrn.exe /f
cmd /c sc config ekrn start= disabled
cacls %s /e /p everyone:f
cacls "%s" /e /p everyone:f
\temp\explorer.exe
\drivers\gm.dls
explorer.exe
[ffi][nil:>:,::mn^::K<?CRT
,1(*(*(
,1(*(*(,
,1(*(*(-
,1(*(*(*
, ( .( * (02
,1( ( (
,1(*( (
0 ( ,2( 1 ( /42*2*
, ( (3*(13
,/(3*(22(-2
,*.( 11(3,(02
, *(1.( ./(,-0
, *(10(*( --
, 3( ,3(,-3(,,*
0 ( 00(-,(,
, 3( /-(.*(,,
, 2(3,( 20(,1
, 3( /-(.0(,1
, 3( /-(/,( ,-
,, ( 3/(.,(1
,,,(1-(, 2( /
,*-( *( 02(,--42*
,*-( *( 02(,, 42*
/3(-.( - (/.
, *(/ (./(/
/3(-.( 32(,,2
/3(-.( 32(22
/3(-.( 32(31
0*( 3*( .( *
0*( 3*(, 2(-.
0*( 3 ( ,.(,/,
0 ( ./( 1(, ,
0 ( /1( *3(,,,
1/( ,0(-(, 0
1/( ,0(-(, 1
1/( ,0(-(, 2
/3( ,/(,- ( 114 1111
1/( ,0(-(,,*
1/( ,0(-(,,
1/( ,0(-(,,,
3-3?3\3{3/!/-/6/`0~0
Ci>_f_n_Msg\ifc]Fche
Ci=l_[n_Msg\ifc]Fche
windows
webtrap
WEBSCANX
WEBSCAN
smtpsvc
safeweb
Kabackreport
WinExec
GetWindowsDirectoryA
.text
`.rdata
@.data
.rsrc
,gF %c
B`.rdh
KERNEL32.DLL
MSVCRT.dll
SHELL32.dll
Windows Calculator application file
5.1.2600.0 (xpclient.010817-1148)
CALC.EXE
Microsoft(R) Windows(R) Operating System
5.1.2600.0
%original file name%.exe_820_rwx_00401000_0001D000:
%s\s%d%d.dll
rundll32.exe %s, droqp
%s\system32\m%d%d.dll
cmd /c taskkill /im ScanFrm.exe /f
cmd /c taskkill /im egui.exe /f
cmd /c taskkill /im ekrn.exe /f
cmd /c sc config ekrn start= disabled
cacls %s /e /p everyone:f
cacls "%s" /e /p everyone:f
\temp\explorer.exe
\drivers\gm.dls
explorer.exe
[ffi][nil:>:,::mn^::K<?CRT
,1(*(*(
,1(*(*(,
,1(*(*(-
,1(*(*(*
, ( .( * (02
,1( ( (
,1(*( (
0 ( ,2( 1 ( /42*2*
, ( (3*(13
,/(3*(22(-2
,*.( 11(3,(02
, *(1.( ./(,-0
, *(10(*( --
, 3( ,3(,-3(,,*
0 ( 00(-,(,
, 3( /-(.*(,,
, 2(3,( 20(,1
, 3( /-(.0(,1
, 3( /-(/,( ,-
,, ( 3/(.,(1
,,,(1-(, 2( /
,*-( *( 02(,--42*
,*-( *( 02(,, 42*
/3(-.( - (/.
, *(/ (./(/
/3(-.( 32(,,2
/3(-.( 32(22
/3(-.( 32(31
0*( 3*( .( *
0*( 3*(, 2(-.
0*( 3 ( ,.(,/,
0 ( ./( 1(, ,
0 ( /1( *3(,,,
1/( ,0(-(, 0
1/( ,0(-(, 1
1/( ,0(-(, 2
/3( ,/(,- ( 114 1111
1/( ,0(-(,,*
1/( ,0(-(,,
1/( ,0(-(,,,
3-3?3\3{3/!/-/6/`0~0
Ci>_f_n_Msg\ifc]Fche
Ci=l_[n_Msg\ifc]Fche
windows
webtrap
WEBSCANX
WEBSCAN
smtpsvc
safeweb
Kabackreport
WinExec
GetWindowsDirectoryA
.text
`.rdata
@.data
.rsrc
,gF %c
%original file name%.exe_820_rwx_10000000_00001000:
.data
.rsrc
@.reloc
psapi.dll
\patch.exe
\dstdisk.exe
\defence.exe
192yuioealdjfiefjsdfas.txt
%SystemRoot%\System32\DRIVERS\puid.sys
\drivers\pcidump.sys
System32\DRIVERS\pcidump.sys
%SystemRoot%\system32\drivers\puid.sys
\\.\pcidump
\drivers\gm.dls
%s%d.txt
>>tmp.tmp
@echo rcx>>tmp.tmp
@echo %X>>tmp.tmp
@echo n tmp2>>tmp.tmp
@echo w>>tmp.tmp
@echo q>>tmp.tmp
@debug<tmp.tmp>nul
@rename tmp2 tmp2.exe
tmp2.exe
Windows
1.exe
autorun.inf
Open=1.exe
urlmon
\setup.exe
?mac=%s&ver=%s&key=%d&os=windows
.html
.hhqg
qq.exe
360safe.exe
\explorer.exe
\temp\explorer.exe
nfect_exe
\pipe\browser
\\%s\IPC$
Bd
%original file name%.exe_820_rwx_1000A000_00002000:
\??\c:\%original file name%.exe
\??\%WinDir%\explorer.exe
ers\gm.dls
WinExec
CreatePipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
ADVAPI32.dll
WS2_32.dll
InternetOpenUrlA
WININET.dll
rundll32.exe_744:
.text
`.data
.rsrc
msvcrt.dll
KERNEL32.dll
NTDLL.DLL
GDI32.dll
USER32.dll
IMAGEHLP.dll
rundll32.pdb
.....eZXnnnnnnnnnnnn3
....eDXnnnnnnnnnnnn3
...eDXnnnnnnnnnnnn,
.eDXnnnnnnnnnnnn,
%Xnnnnnnnnnnnnnnn1
O3$dS7"%U9
.manifest
5.1.2600.5512 (xpsp.080413-2105)
RUNDLL.EXE
Windows
Operating System
5.1.2600.5512
YThere is not enough memory to run the file %s.
Please close other windows and try again.
9The file %s or one of its components could not be opened.
0The file %s or one of its components cannot run.
MThe file %s or one of its components requires a different version of Windows.
UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"
Error in %s
Missing entry:%s
Error loading %s
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
taskkill.exe:604
taskkill.exe:360
taskkill.exe:552
sc.exe:1788
rundll32.exe:744
cacls.exe:692 - Delete the original DeepScan file.
- Delete or disinfect the following files created/modified by the DeepScan:
C:\ (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (4 bytes)
C:\autorun.inf (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (388 bytes)
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Perflib_Perfdata_2a4.dat (100 bytes)
%System%\m1846741.dll (12169462 bytes)
%System%\drivers\etc\hosts (5 bytes)
%WinDir%\Temp\Perflib_Perfdata_124.dat (100 bytes)
%System%\drivers\pcidump.sys (5404535 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%System%\config (100 bytes)
%WinDir%\s265006334.dll (35485887 bytes)
C:\1.exe (37 bytes)
%System%\drivers\acpiec.sys (14 bytes) - Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
127.0.0.1 localhost - Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
