DeepScan.Generic.Malware.SBVQg.35AB743F_fb54550843

by malwarelabrobot on February 7th, 2015 in Malware Descriptions.

HEUR:Trojan.Win32.Generic (Kaspersky), DeepScan:Generic.Malware.SBVQ!g.35AB743F (B) (Emsisoft), DeepScan:Generic.Malware.SBVQ!g.35AB743F (AdAware), mzpefinder_pcap_file.YR, GenericDownloader.YR (Lavasoft MAS)
Behaviour: Trojan, Malware


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: fb54550843c66b2adef9f87694573ca3
SHA1: 482a784b344efb36c5235ddc36d05957f0b8ee11
SHA256: 6664fa4813cf3cc996089a79b105cf7a4f681619dfc9d6246ace160b4022a021
SSDeep: 1536:02LVBRGSey642RnwAgHcEqSl99GL Uf8sJSS mXbXgO9Jad:VBCSey64ws8EqSl9988sJ sbXgO9Jad
Size: 97589 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2007-03-03 12:01:51
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The DeepScan creates the following process(es):

dh5258.exe:1780
awx5258.exe:504
cccccc.exe:1732
comine.exe:1136
ping.exe:956
ll5258.exe:1036
%original file name%.exe:592

The DeepScan injects its code into the following process(es):

spolsv.exe:1664
conime5258.exe:1320

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process dh5258.exe:1780 makes changes in the file system.
The DeepScan creates and/or writes to the following file(s):

The process cccccc.exe:1732 makes changes in the file system.
The DeepScan creates and/or writes to the following file(s):

%Program Files%\Windows Media Player\comine.exe (61 bytes)

The DeepScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~DFBF3.tmp (0 bytes)

The process spolsv.exe:1664 makes changes in the file system.
The DeepScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%WinDir%\Help\conime5258.exe (115 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\awx5258[1].exe (16681 bytes)
%System%\drivers\etc\hosts (402 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ll5258[1].exe (2907 bytes)
%WinDir%\Help\dh5258.exe (4216 bytes)
%WinDir%\Help\ll5258.exe (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\conime5258[1].exe (7624 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%WinDir%\Help\awx5258.exe (9866 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\dh5258[1].exe (15299 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

The DeepScan deletes the following file(s):

%System%\drivers\etc\hosts (0 bytes)

The process %original file name%.exe:592 makes changes in the file system.
The DeepScan creates and/or writes to the following file(s):

%WinDir%\spolsv.exe (601 bytes)

Registry activity

The process dh5258.exe:1780 makes changes in the system registry.
The DeepScan deletes the following value(s) in system registry:
The DeepScan disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows"

The process awx5258.exe:504 makes changes in the system registry.
The DeepScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "70 DE C8 ED D1 23 40 50 5F 29 47 19 5B 4D 14 9F"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The DeepScan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The DeepScan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The DeepScan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The DeepScan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process cccccc.exe:1732 makes changes in the system registry.
The DeepScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1C CE E4 7C 9F C7 85 E0 E1 D4 9A A6 CA DA ED F6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Windows Media Player]
"comine.exe" = "comine"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The DeepScan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The DeepScan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The DeepScan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the DeepScan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows" = "%Program Files%\Windows Media Player\comine.exe"

The process comine.exe:1136 makes changes in the system registry.
The DeepScan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
"NetHood" = "%Documents and Settings%\%current user%\NetHood"
"Fonts" = "%WinDir%\Fonts"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\yali]
"ID" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCR\yali]
"mac" = "f6:ad:e3:f4:db:9d"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"PrintHood" = "%Documents and Settings%\%current user%\PrintHood"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKCR\yali]
"(Default)" = "daohang"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"SendTo" = "%Documents and Settings%\%current user%\SendTo"
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "65 1A 2A C1 84 F6 DE AF 34 F9 8C 34 99 82 3B B3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Recent" = "%Documents and Settings%\%current user%\Recent"
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

The process ping.exe:956 makes changes in the system registry.
The DeepScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB 4A FA 6E 4F 8A FC 02 99 EA E4 65 55 4F 90 E9"

The process spolsv.exe:1664 makes changes in the system registry.
The DeepScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "07 64 CA FF B6 38 71 7A 29 4D 37 CE 49 E8 41 3A"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The DeepScan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The DeepScan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the DeepScan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"conime" = "%WinDir%\spolsv.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The DeepScan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The DeepScan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process ll5258.exe:1036 makes changes in the system registry.
The DeepScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "57 77 EF 08 D5 69 72 BE BD 77 E5 38 FB 57 99 9A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

The process conime5258.exe:1320 makes changes in the system registry.
The DeepScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6E 85 C6 18 F3 2A DC 4D CC 3E 49 26 61 DB 0E 87"

The process %original file name%.exe:592 makes changes in the system registry.
The DeepScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BC 90 9F 94 AA 7F 03 95 11 B9 18 A0 DA 35 E2 3F"

Dropped PE files

MD5 File path
391545ec6af518ed54a155b5e544c8c8 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\dh5258[1].exe
e415565ea9d7f3936c07aee187396f26 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\awx5258[1].exe
57a20c291ac47a75e0274d52a2aab36b c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\conime5258[1].exe
433a350a9c531e431fe5ffa91e3c0d3c c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ll5258[1].exe
e6fdd746e4d611e4d41f8a1504577768 c:\Program Files\Windows Media Player\comine.exe
e415565ea9d7f3936c07aee187396f26 c:\WINDOWS\Help\awx5258.exe
57a20c291ac47a75e0274d52a2aab36b c:\WINDOWS\Help\conime5258.exe
391545ec6af518ed54a155b5e544c8c8 c:\WINDOWS\Help\dh5258.exe
433a350a9c531e431fe5ffa91e3c0d3c c:\WINDOWS\Help\ll5258.exe

HOSTS file anomalies

The DeepScan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 402 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1 www.360.cn
127.0.0.1 www.kaspersky.com.cn
127.0.0.1 www.ijinshan.com
127.0.0.1 www.rising.com.cn
127.0.0.1 cn.trendmicro.com
127.0.0.1 www.symantec.com
127.0.0.1 sd.360.cn
127.0.0.1 www.eset.com.cn
127.0.0.1 www.avast.com
127.0.0.1 www.micropoint.com.cn
127.0.0.1 www.avira.com
127.0.0.1 www.avg.com
127.0.0.1 www.jiangmin.com
127.0.0.1 www.ggsafe.com
127.0.0.1 guanjia.qq.com


Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 40960 40960 4.51994 3622afcc00cdce4af935f6d62313dd60
.rdata 45056 5028 8192 2.43557 ae167dac5cd7096a69a89a3fb1a988ed
.data 53248 49152 44341 4.21613 43a9388b3b5882fb4db180be2607bffc

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://int.dpool.sina.com.cn/iplookup/iplookup.php?format=js&t=50769.46 180.149.136.250
hxxp://www.it885.com.cn/num3.html 124.248.254.82
hxxp://www.it885.com.cn/num3_51la.asp 124.248.254.82
hxxp://www.it885.com.cn/web/get_ad3.asp?type=loadall&machinename=XP1-A8A67A25&cr=yes 124.248.254.82
dk.23145.com 124.232.141.61


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY HTTP Request on Unusual Port Possibly Hostile
ET TROJAN Gaboc Trojan Check-in

Traffic

GET /web/get_ad3.asp?type=loadall&machinename=XP1-A8A67A25&cr=yes HTTP/1.1
Accept: */*
Referer: 
Accept-Language: zh-cn
UA-CPU: x86
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50215)
Host: VVV.it885.com.cn
Connection: Keep-Alive
Cookie: 


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 8
Content-Type: text/html
Expires: Fri, 06 Feb 2015 12:06:20 GMT
Server: Microsoft-IIS/7.5
Set-Cookie: ASPSESSIONIDQAQASBQA=BCBGJAKBJHCCLKNCMEGOMPOB; path=/
X-Powered-By: ASP.NET
Date: Fri, 06 Feb 2015 12:07:20 GMT
No China..



GET /num3.html HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
If-Modified-Since: Mon, 15 Dec 2014 07:59:55 GMT
If-None-Match: "90466b1d3d18d01:0"
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.it885.com.cn
Connection: Keep-Alive


HTTP/1.1 304 Not Modified
Date: Fri, 06 Feb 2015 12:07:22 GMT
Etag: "90466b1d3d18d01:0"
....


GET /num3_51la.asp HTTP/1.1


Accept: */*
Referer: hXXp://VVV.it885.com.cn/num3.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.it885.com.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 0
Content-Type: text/html
Server: Microsoft-IIS/7.5
Set-Cookie: ASPSESSIONIDQAQASBQA=CJBGJAKBDJPELHGGMKEOCMPH; path=/
X-Powered-By: ASP.NET
Date: Fri, 06 Feb 2015 12:07:22 GMT



GET /num3.html HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.it885.com.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Last-Modified: Mon, 15 Dec 2014 07:59:55 GMT
Accept-Ranges: bytes
ETag: "90466b1d3d18d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 06 Feb 2015 12:06:58 GMT
Content-Length: 37
<script src="num3_51la.asp"></script>....


GET /num3_51la.asp HTTP/1.1


Accept: */*
Referer: hXXp://VVV.it885.com.cn/num3.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.it885.com.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 0
Content-Type: text/html
Server: Microsoft-IIS/7.5
Set-Cookie: ASPSESSIONIDQAQASBQA=JJMFJAKBHFEKOOJCMAGMDABO; path=/
X-Powered-By: ASP.NET
Date: Fri, 06 Feb 2015 12:06:59 GMT







The DeepScan connects to the servers at the folowing location(s):







spolsv.exe_1664:




.text
.rdata
@.data
wC%F{
__MSVCRT_HEAP_SELECT
user32.dll
WinExec
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegOpenKeyA
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
InternetOpenUrlA
FindCloseUrlCache
FindNextUrlCacheEntryA
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
WININET.dll
URLDownloadToFileA
urlmon.dll
GetCPInfo
Software\Microsoft\Windows\CurrentVersion\Run
127.0.0.1 VVV.360.cn
127.0.0.1 VVV.kaspersky.com.cn
127.0.0.1 VVV.ijinshan.com
127.0.0.1 VVV.rising.com.cn
127.0.0.1 cn.trendmicro.com
127.0.0.1 VVV.symantec.com
127.0.0.1 sd.360.cn
127.0.0.1 VVV.eset.com.cn
127.0.0.1 VVV.avast.com
127.0.0.1 VVV.micropoint.com.cn
127.0.0.1 VVV.avira.com
127.0.0.1 VVV.avg.com
127.0.0.1 VVV.jiangmin.com
127.0.0.1 VVV.ggsafe.com
127.0.0.1 guanjia.qq.com
hXXp://192.253.233.21:8914/test/shua.txt
hXXp://192.253.233.21:8914/test/down.txt
%Program Files%\Internet Explorer\iexplore.exe
del "%s"
if exist "%s" goto nimei
del_.bat
hXXp://
spolsv.exe
\spolsv.exe
conime.exe
%WinDir%\spolsv.exe
.pzEz
Zftp

spolsv.exe_1664_rwx_0040D000_00001000:




Software\Microsoft\Windows\CurrentVersion\Run
127.0.0.1 VVV.360.cn
127.0.0.1 VVV.kaspersky.com.cn
127.0.0.1 VVV.ijinshan.com
127.0.0.1 VVV.rising.com.cn
127.0.0.1 cn.trendmicro.com
127.0.0.1 VVV.symantec.com
127.0.0.1 sd.360.cn
127.0.0.1 VVV.eset.com.cn
127.0.0.1 VVV.avast.com
127.0.0.1 VVV.micropoint.com.cn
127.0.0.1 VVV.avira.com
127.0.0.1 VVV.avg.com
127.0.0.1 VVV.jiangmin.com
127.0.0.1 VVV.ggsafe.com
127.0.0.1 guanjia.qq.com
hXXp://192.253.233.21:8914/test/shua.txt
hXXp://192.253.233.21:8914/test/down.txt
%Program Files%\Internet Explorer\iexplore.exe
del "%s"
if exist "%s" goto nimei
del_.bat
hXXp://
spolsv.exe
\spolsv.exe
conime.exe

spolsv.exe_1664_rwx_0040F000_00003000:




%WinDir%\spolsv.exe

conime5258.exe_1320:




.text
`.rdata
@.data
__MSVCRT_HEAP_SELECT
user32.dll
KERNEL32.dll
USER32.dll
RegCloseKey
RegOpenKeyExA
ADVAPI32.dll
WS2_32.dll
GetCPInfo
.rsrc
GET %s HTTP/1.1
Referer: %s
Accept-Language: %s
User-Agent: %s
Host: %s
Cookie: %s
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50215)
hXXp://192.253.234.50/toopu.png
Applications\iexplore.exe\shell\open\command
%s "%s"
hXXp://VVV.it885.com.cn/num3.html
%WinDir%\Help\conime5258.exe

comine.exe_1136:




.text
`.data
.rsrc
MSVBVM60.DLL
vb6chs.dll
d:\Program Files\Microsoft Visual Studio\VB98\VB6.OLB
psapi.dll
kernel32.dll
NTDLL.DLL
shell32.dll
SHFileOperationA
ShellExecuteA
VBA6.DLL
1.vbp
hXXp://VVV.hao12338.com/?index
IEXPLORE.EXE|TTRAVELER.EXE|SOGOUEXPLORER.EXE|360SE.EXE|GREENBROWSER.EXE|FIREFOX.EXE|MAXTHON.EXE|THEWORLD.EXE|OPERA.EXE|CHROME.EXE|SAFARI.EXE|NETSCAPE.EXE
%Program Files%\Windows Media Player
%Program Files%
explorer.exe
WScript.Shell
Iexplore.exe
wscript.shell
cmd /c ping 127.0.0.1 -n 2&del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows
%Program Files%\Windows Media Player\comine.exe
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
%Program Files%\Internet Explorer\iexplore.exe
WindowStyle
Hotkey
serv.dat

ll5258.exe_1036:




.text
`.rdata
@.data
KERNEL32.dll
EnumWindows
USER32.dll
RegCloseKey
RegOpenKeyExA
ADVAPI32.dll
WS2_32.dll
MSVCP60.dll
MSVCRT.dll
DeleteUrlCacheEntry
WININET.dll
URLDownloadToFileA
urlmon.dll
hXXp://623968.6600.org:99/3.htm
201411261939
124.232.158.160
dk.23145.com
Applications\iexplore.exe\SHELL\OPEN\COMMAND
%s?%c%c%c%c%c
%s%c%c%c%c%c.htm
124.232.141.61

seo5258.exe_544:




.text
.data
.rsrc
.aspack
.adata
2014919
ieframe.dll
SHDocVwCtl.WebBrowser
WebBrowser
shell32.dll
ShellExecuteA
wininet.dll
RegisterHotKey
UnregisterHotKey
VBA6.DLL
%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB
!Web1
%System%\ieframe.oca
cmdStop
Webdata
cmdMana
lblURL
urlmon.dll
UrlMkSetSessionOption
user32.dll
GetWindowsDirectoryA
winmm.dll
keybd_event
MapVirtualKeyA
EnumWindows
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindCloseUrlCache
DeleteUrlCacheEntryA
advapi32.dll
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
advapi32.dll
RegDeleteKeyA
<,.yU
vurl
MSVBVM60.DLL
kernel32.dll
The procedure entry point %s could not be located in the dynamic link library %s
The ordinal %u could not be located in the dynamic link library %s
msvbvm60.dll
@isual Studio\VB98\C2.EXE
@isual Studio\VB98\C2.EXE.Manif
@ual Studio\VB98\C2.EXE.Manifes
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
wscript.shell
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
hXXp://60.173.26.44:6666/Getnews.asp?t=
hXXp://
window.alert=null;
window.confirm=null;
window.showModalDialog=null;
window.open=null;
hXXp://VVV.baidu.com/
hXXp://VVV.so.com/
http=
Software\Microsoft\Windows\CurrentVersion\Internet Settings\
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\
hXXp://VVV.51proxied.com/http_non_anonymous.html
8.00.0002
2014919.exe

iexplore.exe_1540:




%?9-*09,*19}*09
.text
`.data
.rsrc
msvcrt.dll
KERNEL32.dll
NTDLL.DLL
USER32.dll
SHLWAPI.dll
SHDOCVW.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
rsabase.dll
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
watson.microsoft.com
IEWatsonURL
%s -h %u
iedw.exe
Iexplore.XPExceptionFilter
jscript.DLL
mshtml.dll
mlang.dll
urlmon.dll
wininet.dll
shdocvw.DLL
browseui.DLL
comctl32.DLL
IEXPLORE.EXE
iexplore.pdb
ADVAPI32.dll
MsgWaitForMultipleObjects
IExplorer.EXE
IIIIIB(II<.Fg
7?_____ZZSSH%
)z.UUUUUUUU
,....Qym
````2```
{.QLQIIIKGKGKGKGKGKG
;33;33;0
8888880
8887080
browseui.dll
shdocvw.dll
6.00.2900.5512 (xpsp.080413-2105)
Windows
Operating System
6.00.2900.5512






Remove it with Ad-Aware




    

  1. Click (here) to download and install Ad-Aware Free Antivirus.
    2. 

  2. Update the definition files.
    3. 

  3. Run a full scan of your computer.
    4. 





Manual removal*




    

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):
    

    dh5258.exe:1780
    awx5258.exe:504
    cccccc.exe:1732
    comine.exe:1136
    ping.exe:956
    ll5258.exe:1036
    %original file name%.exe:592
    

    2. 

  2. Delete the original DeepScan file.
    3. 

  3. Delete or disinfect the following files created/modified by the DeepScan:
    

    %Program Files%\Windows Media Player\comine.exe (61 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %WinDir%\Help\conime5258.exe (115 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\awx5258[1].exe (16681 bytes)
    %System%\drivers\etc\hosts (402 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ll5258[1].exe (2907 bytes)
    %WinDir%\Help\dh5258.exe (4216 bytes)
    %WinDir%\Help\ll5258.exe (24 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\conime5258[1].exe (7624 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
    %WinDir%\Help\awx5258.exe (9866 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\dh5258[1].exe (15299 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
    %WinDir%\spolsv.exe (601 bytes)
    

    4. 

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):
    

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows" = "%Program Files%\Windows Media Player\comine.exe"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "conime" = "%WinDir%\spolsv.exe"
    

    5. 

  5. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
    
    127.0.0.1       localhost
    6. 

  6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
    7. 

  7. Reboot the computer.
    8. 



*Manual removal may cause unexpected system behaviour and should be performed at your own risk.












 
 




 
No votes yet












				


							


			

				
					  
							

		

		


					
							

	

	
	        


	

        
      
 

      
      

      
    
 

    
  
 

		


		

		
			

			

				

					Lavasoft is the maker of Ad-Aware,
					the world's most popular anti-malware 
					software with over 450 million 
					downloads.
				

				

					© 2026 Lavasoft. All rights reserved.

					Terms Of Use |   Privacy Policy
					


								

			


		

		


	

	
	

	

		x
		
Our best antivirus yet!

		
Fresh new look. Faster scanning. Better protection.

		

			
Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

			
For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

			
			Download adaware antivirus 12
		

		No thanks, continue to lavasoft.com
	

	

		

			close x
			
Discover the new adaware antivirus 12

			
Our best antivirus yet

			Download Now