Gen.Variant.Strictor.48211_977421d378

by malwarelabrobot on October 26th, 2014 in Malware Descriptions.

Gen:Variant.Strictor.48211 (B) (Emsisoft), Gen:Variant.Strictor.48211 (AdAware), Trojan.Win32.FlyStudio.FD, GenericEmailWorm.YR, TrojanFlyStudio.YR (Lavasoft MAS)
Behaviour: Trojan, Worm, EmailWorm


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 977421d3786ffd26dd5883fe4543ce01
SHA1: 3f85ecc5f4ebe203252ccf02de2efa3c1444e058
SHA256: 4d8908c2ea2a48cae98270dc61dbdd879595aed22c346145542913c15dbce371
SSDeep: 12288:BR TptnHm3kw09nUQhm4MQ0Tvtb7T4cqq30zN9EfHP7p:BRQTnah0OQhmhv4qcN9EfH
Size: 526848 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: no certificate found
Created at: 2014-07-07 15:45:04
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Behaviour Description
EmailWorm Worm can send e-mails.


Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:340

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:340 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S3GBEVGJ\core[1].htm (457 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7EIOH7RW\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MA7TLD31\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S3GBEVGJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TB3FMPNX\regposont[1].htm (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TB3FMPNX\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7EIOH7RW\register[1].jpg (138 bytes)

Registry activity

The process %original file name%.exe:340 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Page_URL" = "http://www.2345.com/?k158189458"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Page_URL bak" = "http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page bak" = "about:blank"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"HomePage" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows Script\Settings]
"JITDebug" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "45 71 B3 20 48 43 69 AF DE C8 54 92 53 D5 7E DB"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.2345.com/?k158189458"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: BY:?? Q158189458
Product Name: ????YY???
Product Version: 2.1.0.0
Legal Copyright: BY:?? Q158189458 ????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 2.1.0.0
File Description: ????YY???
Comments: ????YY???
Language: Russian (Russia)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
UPX0 4096 638976 0 0 d41d8cd98f00b204e9800998ecf8427e
UPX1 643072 516096 513024 5.47654 763f0c233900ef7fd112501d18880126
.rsrc 1159168 16384 12800 1.69798 82e5b54f2847aedb9b434ce368d9d5cd

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://udb.yy.com/regposont.do?act=regfrm&r=1414214835910 120.132.133.53
hxxp://udb.yy.com/register/core.do?regType=inner&appid=1&url= 120.132.133.53
hxxp://udb.duowan.com/verify/register.do?t=r 120.132.133.52
iframe.ip138.com 175.43.122.72


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /verify/register.do?t=r HTTP/1.1
Referer: hXXp://udb.duowan.com/verify/register.do?t=r
Accept: */*
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
Cookie: UDBSESSIONID=19ce13db53bfa488644452979147756abb096a2b; _h=fa4a6c520a9130ac40cb955fadbaabcada4e0e4a; UDBRJESSESSIONID=aaa5ui5NnhEmva43BXfLu
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 2Pac; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Host: udb.duowan.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 25 Oct 2014 05:27:09 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Sat, 25 Oct 2014 05:27:09 GMT
Cache-Control: max-age=0
Pragma: no-cache
a46........JFIF.............C................................... $.' "
,#..(7),01444.'9=82<.342...C...........2!.!222222222222222222222222
22222222222222222222222222......F...."................................
............................}........!1A..Qa."q.2....#B...R..$3br.....
...%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................
......................................................................
..................................w.......!1..AQ.aq."2...B.....#3R..br
...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...............
.....................................................................?
..Z(..2.(...(...(...(...(...(...(...(...(...(...(...(...(...(.......T.
..$.kWX.-.Z.#={1.;...gJT.R\.&RQWe.......tm......b&...._....0>[email protected]..
..\...W.#r.s.KYUQ\p.s...D.$.........MV.[.......J......4..4..gH.]$.p...
.J....9........|...t:..B.E...x[_.h"..u.(.....r.;.....N....i.k..O"Iaqf.
....LLs...a....W.xo.V....Y<f.L....N.P}GJ.._...A......'.oKm.c.v.EEzN
)...[.....O.:7.......f......`..g..&..WF...u/.~...{x....#..!.S..^s..S..
...E....;F.O...V..N....u...(.)u=.i......#Q.f8.W&.>...k=..}JppL.*..5
.x...7...t]6F.*..v.y...]...x_.zTV.j..t.4...._V......_.....l..>0..K5
....!,..pM?[..iZ%..je.o.}..e.$.3..3..X.;[email protected];...?.....
.s.=.z...'.u.5I..k`[email protected].]|..R...5..._j..x...^n..$..
.?.......=..FIm......(.vV>s\.'g.....k.........d... ... .V.....p..,.
.<Q...Y.j6...t.WQ/...'.q.#.;...#~...Z.v3Y^...L.^6.G.=....q.......xO
_..3......W4|...,;.O\[email protected].#..K..L.(/.2!.T.
<<< skipped >>>


GET /register/core.do?regType=inner&appid=1&url= HTTP/1.1
Referer: hXXp://udb.yy.com/register/core.do?regType=inner&appid=1&url=
Accept: */*
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 2Pac; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Host: udb.yy.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 25 Oct 2014 05:27:07 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 5462
Connection: keep-alive
Cache-Control: max-age=0
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Language: zh-CN
Set-Cookie: UDBSESSIONID=19ce13db53bfa488644452979147756abb096a2b; domain=udb.yy.com; path=/;HttpOnly
Set-Cookie: _h=fa4a6c520a9130ac40cb955fadbaabcada4e0e4a; domain=udb.yy.com; path=/
Set-Cookie: UDBRJESSESSIONID=aaa5ui5NnhEmva43BXfLu; path=/
Expires: Sat, 25 Oct 2014 05:27:07 GMT
..........<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional
//EN" "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..&
lt;html xmlns="hXXp://VVV.w3.org/1999/xhtml">......<head>....
<meta http-equiv="Content-Type" content="text/html;charset=utf-8" /
>....<meta name="keywords" content="" />....<meta name="de
scription" content="" />........<title>.................. ...
... ......</title>....<link href="hXXp://res.udb.duowan.com/c
ss/core.css" rel="stylesheet" type="text/css" />..........<link 
href="hXXp://res.udb.duowan.com/udb/css/style-yy.130402.css" rel="styl
esheet" type="text/css" />......<link href="hXXp://res.udb.duowa
n.com/css/regtips.css" rel="stylesheet" type="text/css" />.........
....<script type="text/javascript" src="hXXp://res.udb.duowan.com/j
s/ajax.js"></script>....<script type="text/javascript" src
="hXXp://res.udb.duowan.com/js/jquery-1.4.2.min.js"></script>
....<script type="text/javascript" src="hXXp://res.udb.duowan.com/j
s/message.js"></script>....<script type="text/javascript" 
src="hXXp://res.udb.duowan.com/js/constant.js"></script>.....
.............<script type="text/javascript" src="hXXp://res.udb.duo
wan.com/js/regv2.min.js?140121"></script>................<
/head>...<body onload="RegisterV2.init();">......  .<img i
d="oko" src="" style="display:none;width:0px;height:0px" />.....<
;script type="text/javascript" charset="utf-8">.....document.ge
<<< skipped >>>

GET /regposont.do?act=regfrm&r=1414214835910 HTTP/1.1


Referer: hXXp://udb.yy.com/regposont.do?act=regfrm&r=1414214835910
Accept: */*
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
Cookie: UDBSESSIONID=19ce13db53bfa488644452979147756abb096a2b;_h=fa4a6c520a9130ac40cb955fadbaabcada4e0e4a;UDBRJESSESSIONID=aaa5ui5NnhEmva43BXfLu
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 2Pac; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Host: udb.yy.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 25 Oct 2014 05:27:08 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Sat, 25 Oct 2014 05:27:08 GMT
Cache-Control: max-age=0
e..Error,removed!..0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 25 Oc
t 2014 05:27:08 GMT..Content-Type: text/html; charset=UTF-8..Transfer-
Encoding: chunked..Connection: keep-alive..Expires: Sat, 25 Oct 2014 0
5:27:08 GMT..Cache-Control: max-age=0..e..Error,removed!..0..

The Trojan connects to the servers at the folowing location(s):

%original file name%.exe_340:

`.rsrc
t$(SSh
~%UVW
u$SShe
wininet.dll
kernel32.dll
FastVerCode.dll
ole32.dll
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
ReportError
hXXp://udb.yy.com/ajax.do?action=existUsername&username1=
hXXp://udb.yy.com/ajax.do?action=checkSecurityCode&ajax=true&securityCode1=
hXXp://udb.yy.com/ajaxreg.do?action=chklmt&uname=
hXXp://udb.duowan.com/regin/
&password=
url=&appid=1®Type=inner&_vs=
Content-Type: application/x-www-form-urlencoded
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 2Pac; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
http=
https
HTTP/1.1
hXXps://
hXXp://
udb.yy.com
udb.duowan.com
hXXp://udb.yy.com/register/core.do?regType=inner&appid=1&url=
var passwordBackup = document.getElementById("passwordBackup").value;
if (passwordBackup != "") {
this.getForm()["password"].value = passwordBackup;
document.getElementById("password2").value = passwordBackup
document.getElementById("submitButton").disabled = true;
var flag = this.doSubmit1();
var password = this.getForm()["password"].value;
document.getElementById("passwordBackup").value = password;
document.getElementById("submitButton").disabled = false;
var form = this.getForm();
flag = RegisterV2.check.username();
flag = RegisterV2.check.password();
RegisterV2.check.alertMsg();
flag = RegisterV2.check.password2();
var securityCode1 = form["securityCode1"].value;
Message.error("item_securityCode", "
if (securityCode1.length < 2) {
Message.empty("item_securityCode", "")
var agreement = document.getElementById("agreement");
if (agreement && !agreement.checked) {
agreement.focus();
this.submitCheckUsername()
var username = form["username"].value;
Message.error("item_username", "
RegisterV2.setMessage("username", "
RegisterV2.hideRecommend();
var url = "/ajax.do?action=existUsername&username1="   Constant.encode(username);
RegisterV2.existUsername.username = username;
Ajax.get(url,
var body = obj.responseText;
RegisterV2.submitCheckSecurityCode();
if ("keyword" == body) {
var msg = "
Message.error("item_username", msg);
RegisterV2.setMessage("username", msg);
["   RegisterV2.existUsername.username   "]
Message.error("item_username", body);
RegisterV2.setMessage("username", body)
var securityCode1 = form["securityCode1"].value;
Message.error("item_securityCode", "
var url = "/ajax.do?action=checkSecurityCode&ajax=true&securityCode1="   Constant.encode(securityCode1)   "&time="   (new Date().getTime());
RegisterV2.formSubmit();
RegisterV2.changeSecurityCode();
RegisterV2.setMessage("securityCode1", "
Message.error("item_securityCode", body);
RegisterV2.setMessage("securityCode1", body)
var form = RegisterV2.getForm();
var rdmCode = form["rcall"].value;
var p = RegisterV2.check.computechildpath(deRdmCode);
form.action = "hXXps://"   window.location.hostname   "/regin/"   p   ".do";
$.post("/regposont.do", {
"act": "webregbegin",
"r": Math.random()
form.submit()
var flag = this.doSubmitMobile2();
flag = RegisterV2.check.mobile();
this.submitCheckMobile()
var mobile = form["mobile"].value;
Message.error("item_mobile", "
RegisterV2.setMessage("mobile", "
var url = "/ajax.do?action=existMobile&mobile="   Constant.encode(mobile);
Message.error("item_mobile", msg);
RegisterV2.setMessage("mobile", msg);
<a href='/registerMobile.do?action=mobileB&mobile="   Constant.encode(mobile)   "'>[
Message.error("item_mobile", body);
RegisterV2.setMessage("mobile", body)
form[id].msg = message
return form[id].msg
var form = document.forms["frmpost"];
form[name].focus()
var url = "/ajax.do?action=recommend&username="   Constant.encode(username);
if (body == null || body.length == 0) return;
var ir = document.getElementById("item_recommend");
ir.style.display = "block";
var mr = document.getElementById("msg_recommend");
var users = body.split(";");
len = users.length; i < len; i  ) {
html  = '<span>'   (i   1)   '.</span><span style="color:#1797B3;" onmouseover="RegisterV2.cover(this)" onmouseout="RegisterV2.cout(this)" onclick="RegisterV2.choice(this)">'   users[i]   '</span>';
mr.innerHTML = html
var ir = document.getElementById("item_recommend");
if (ir) ir.style.display = "none";
var mr = document.getElementById("msg_recommend");
if (mr) mr.innerHTML = ""
form["username"].value = span.innerHTML;
RegisterV2.existUsername()
c.style.cursor = "pointer";
c.style.color = "#ff6600"
c.style.cursor = "auto";
c.style.color = "#1797B3"
Message.success("item_username", "
RegisterV2.setMessage("username", "");
RegisterV2.hideRecommend();
RegisterV2.recommendUsername(username)
RegisterV2.setMessage("username", body);
Message.success("item_mobile", "
RegisterV2.setMessage("mobile", "");
RegisterV2.setMessage("mobile", body);
Message.success("item_securityCode", "");
RegisterV2.setMessage("securityCode1", "");
RegisterV2.setMessage("securityCode1", body);
var imgSecurityCode = document.getElementById("imgSecurityCode");
imgSecurityCode.src = "/verify/register.do?t=r&r="   today.getTime()
"sendStatistics": function(url) {
img.width = 0;
img.height = 0;
img.src = url
RegisterV2.keyup = {
var username = RegisterV2.getForm()["username"];
if (username.value == "") {
Message.empty("item_username", "");
if (username.isInited != "true") {
if (username.value.length < 4) {
username.isInited = "true"
return RegisterV2.check.username()
var mobile = RegisterV2.getForm()["mobile"];
if (mobile.value == "") {
Message.empty("item_mobile", "");
if (mobile.isInited != "true") {
if (mobile.value.length < 11) {
mobile.isInited = "true"
return RegisterV2.check.mobile()
"password": function() {
var password = form["password"];
if (password.value == "") {
Message.empty("item_password", "");
if (password.isInited != "true") {
if (password.value.length < 6) {
password.isInited = "true"
return RegisterV2.check.password()
"password2": function() {
Message.empty("item_password2", "");
var password2 = document.getElementById("password2");
if (password2.isInited != "true") {
if (password2.value.length < 6) {
password2.isInited = "true"
return RegisterV2.check.password2()
return RegisterV2.check.securityCode()
RegisterV2.check = {
var message = Constant.isLetterUsername(username.value);
Message.error("item_username", message);
var message = Constant.isValidMobile(mobile.value);
Message.error("item_mobile", message);
Message.success("item_mobile", "")
"isValidPassword": function(password, username) {
var message = Constant.isValidNewPassword(password, username);
if (password.length < 6) {
if (password.length > 20) {
Message.error("item_password", "
var message = this.isValidPassword(password.value, username.value);
Message.error("item_password", message);
message = Constant.isSafetyPassword(password.value);
Message.notice("item_password", message   "<br/>
Message.error("item_password2", "
if (password.value != password2.value) {
Message.success("item_password2", "")
if (securityCode1.length < 2) {
Message.success("item_securityCode", "");
RegisterV2.checkSecurityCode();
"alertMsg": function() {
if (password.value.length == 0) {
password.nofocus = true;
password.focus();
if (password.value.length < 6) {
if (password.value.length > 20) {
var base = code.charAt(0).charCodeAt();
return code.substring(start, start   len)
RegisterV2.blur = {
var flag = RegisterV2.check.username();
RegisterV2.existUsername()
var flag = RegisterV2.check.mobile();
RegisterV2.existMobile()
RegisterV2.check.password();
var isError = Message.isError("item_password");
Message.empty("item_password", "")
RegisterV2.check.password2();
var isError = Message.isError("item_password2");
Message.empty("item_password2", "")
RegisterV2.focus = {
Message.notice("item_username", "4-16
Message.notice("item_password", "
RegisterV2.check.password()
if (password2.value == "") {
Message.notice("item_password2", "
RegisterV2.check.password2()
a[d] = Str4ToLong(c.slice(d * 4, (d   1) * 4))
for (d = 0; d < f.length; d  = 8) {
b[0] = Str4ToLong(f.slice(d, d   4));
b[1] = Str4ToLong(f.slice(d   4, d   8));
e = e.replace(/\0 $/, "");
a |= c.charCodeAt(b) << b * 8
var b = String.fromCharCode(a & 255, a >> 8 & 255, a >> 16 & 255, a >> 24 & 255);
return a.replace(/!\d\d?\d?!/g,
return String.fromCharCode(b.slice(1, -1))
for (var i = 0; i < base64Chars.length; i  ) {
if (base64Count >= base64Str.length) {
var a = base64Str.charAt(base64Count);
a = a.toString(16);
if (a.length == 1) {
openLogin: function(redirect) {
if (Login.hasSecurityCode()) {
var obj = document.getElementById("item_securityCode");
obj.style.display = "block";
Login.showSecurityCode()
if (UdbCookie.isLogined()) {
window.location.href = redirect
$("#loginError").text("");
$("#password").val("");
$("#loginbox").fadeIn();
$("#shroud").show();
$("#loginRedirect").val(redirect);
Constant.center("loginbox");
$("#loginbox").bind('keyup',
if (event.keyCode == 13) {
ValidateAccount.login()
closeLogin: function() {
$("#loginbox").fadeOut(300);
$("#shroud").hide()
login: function() {
var username = $("#username").val();
var password = $("#password").val();
var securityCode = $("#securityCode").val();
var redirect = $("#loginRedirect").val();
var loginError = document.getElementById("loginError");
loginError.style.display = "none";
if (username.trim() == "") {
loginError.style.display = "";
loginError.innerHTML = "
if (password.trim() == "") {
if (obj != null && obj.style.display != "none") {
var securityCode = $("#securityCode").val();
if (securityCode.trim() == "") {
loginError.style.display = "";
loginError.innerHTML = "
p.add('username', username);
p.add('password', password);
p.add('securityCode', securityCode);
p.add('redirect', redirect);
var param = p.toString();
Ajax.post("/account_login.do?ajax=true&json=true", param,
if (obj && obj.responseText) {
var msg = obj.responseText;
loginError.style.display = "";
document.getElementById("loginError").innerHTML = msg;
ValidateAccount.loginResponse(msg)
window.location.href = redirect
"loginResponse": function(msg) {
var p = RegisterV2.check.computechildpath(deRdmCode);
==
hXXp://udb.yy.com/regposont.do?act=regfrm&r=
hXXp://iframe.ip138.com/ic.asp
hXXp://udb.duowan.com/verify/register.do?t=r
158189458
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
\ADSL.ini
scripting.FileSystemObject
\*.txt
.rsrc
%S4WD
hg%fpM
S.Ac9SR
0.I%3s
,wAe.kI
aiUy'4xu
%c*@j
.eH'y
{&%U)
lj%4U
xe%CNs
9F.cLe
hJK.ZH
O.qt0
KERNEL32.DLL
COMCTL32.dll
GDI32.dll
MSIMG32.dll
MSVCRT.dll
MSVFW32.dll
USER32.dll
SkinH_EL.dll
hXXp://VVV.2345.com/?k158189458
BF95.NET
[VVV.bf95.net] |
[140885636] |
158189458 |
Software\Microsoft\Internet Explorer\Main\Default_Page_URL bak
Software\Microsoft\Internet Explorer\Main\Default_Page_URL
hXXp://ip.qq.com/
WinHttp.WinHttpRequest.5.1
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 2Pac; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
hXXp://VVV.jsdati.com/index.php/do/register
VBScript.RegExp
return(Math.random());
return(date.getTime());
[email protected]
hXXp://158189458.7958.com/down_10671972.html
F%*.*f
CNotSupportedException
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
COMCTL32.DLL
CCmdTarget
__MSVCRT_HEAP_SELECT
user32.dll
iphlpapi.dll
SHLWAPI.dll
MPR.dll
VERSION.dll
WSOCK32.dll
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.*)|*.*||
Shell32.dll
Mpr.dll
Advapi32.dll
User32.dll
Gdi32.dll
Kernel32.dll
(&07-034/)7 '
?? / %d]
%d / %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
%s:%d
windows
out.prn
%d.%d
%d / %d
%d/%d
Bogus message code %d
(%d-%d):
%ld%c
%s <%s>
Reply-To: %s
From: %s
To: %s
Subject: %s
Date: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
SMTP
VVV.dywt.com.cn
.PAVCObject@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
zcÁ
c:\%original file name%.exe
#include "l.chs\afxres.rc" // Standard components
GetCPInfo
WinExec
GetProcessHeap
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegCreateKeyA
GetViewportExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
GetViewportOrgEx
ShellExecuteA
GetKeyState
SetWindowsHookExA
CreateDialogIndirectParamA
UnhookWindowsHookEx
.text
.rdata
@.data
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity name="E.App" processorArchitecture="x86" version="5.1.0.0" type="win32"/><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency></assembly>PAD
ADVAPI32.dll
comdlg32.dll
OLEAUT32.dll
RASAPI32.dll
SHELL32.dll
WININET.dll
WINMM.dll
WINSPOOL.DRV
WS2_32.dll
1, 0, 6, 6
- Skin.dll
(*.*)
2.1.0.0

%original file name%.exe_340_rwx_00401000_00119000:

t$(SSh
~%UVW
u$SShe
wininet.dll
kernel32.dll
FastVerCode.dll
ole32.dll
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
ReportError
hXXp://udb.yy.com/ajax.do?action=existUsername&username1=
hXXp://udb.yy.com/ajax.do?action=checkSecurityCode&ajax=true&securityCode1=
hXXp://udb.yy.com/ajaxreg.do?action=chklmt&uname=
hXXp://udb.duowan.com/regin/
&password=
url=&appid=1®Type=inner&_vs=
Content-Type: application/x-www-form-urlencoded
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 2Pac; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
http=
https
HTTP/1.1
hXXps://
hXXp://
udb.yy.com
udb.duowan.com
hXXp://udb.yy.com/register/core.do?regType=inner&appid=1&url=
var passwordBackup = document.getElementById("passwordBackup").value;
if (passwordBackup != "") {
this.getForm()["password"].value = passwordBackup;
document.getElementById("password2").value = passwordBackup
document.getElementById("submitButton").disabled = true;
var flag = this.doSubmit1();
var password = this.getForm()["password"].value;
document.getElementById("passwordBackup").value = password;
document.getElementById("submitButton").disabled = false;
var form = this.getForm();
flag = RegisterV2.check.username();
flag = RegisterV2.check.password();
RegisterV2.check.alertMsg();
flag = RegisterV2.check.password2();
var securityCode1 = form["securityCode1"].value;
Message.error("item_securityCode", "
if (securityCode1.length < 2) {
Message.empty("item_securityCode", "")
var agreement = document.getElementById("agreement");
if (agreement && !agreement.checked) {
agreement.focus();
this.submitCheckUsername()
var username = form["username"].value;
Message.error("item_username", "
RegisterV2.setMessage("username", "
RegisterV2.hideRecommend();
var url = "/ajax.do?action=existUsername&username1="   Constant.encode(username);
RegisterV2.existUsername.username = username;
Ajax.get(url,
var body = obj.responseText;
RegisterV2.submitCheckSecurityCode();
if ("keyword" == body) {
var msg = "
Message.error("item_username", msg);
RegisterV2.setMessage("username", msg);
["   RegisterV2.existUsername.username   "]
Message.error("item_username", body);
RegisterV2.setMessage("username", body)
var securityCode1 = form["securityCode1"].value;
Message.error("item_securityCode", "
var url = "/ajax.do?action=checkSecurityCode&ajax=true&securityCode1="   Constant.encode(securityCode1)   "&time="   (new Date().getTime());
RegisterV2.formSubmit();
RegisterV2.changeSecurityCode();
RegisterV2.setMessage("securityCode1", "
Message.error("item_securityCode", body);
RegisterV2.setMessage("securityCode1", body)
var form = RegisterV2.getForm();
var rdmCode = form["rcall"].value;
var p = RegisterV2.check.computechildpath(deRdmCode);
form.action = "hXXps://"   window.location.hostname   "/regin/"   p   ".do";
$.post("/regposont.do", {
"act": "webregbegin",
"r": Math.random()
form.submit()
var flag = this.doSubmitMobile2();
flag = RegisterV2.check.mobile();
this.submitCheckMobile()
var mobile = form["mobile"].value;
Message.error("item_mobile", "
RegisterV2.setMessage("mobile", "
var url = "/ajax.do?action=existMobile&mobile="   Constant.encode(mobile);
Message.error("item_mobile", msg);
RegisterV2.setMessage("mobile", msg);
<a href='/registerMobile.do?action=mobileB&mobile="   Constant.encode(mobile)   "'>[
Message.error("item_mobile", body);
RegisterV2.setMessage("mobile", body)
form[id].msg = message
return form[id].msg
var form = document.forms["frmpost"];
form[name].focus()
var url = "/ajax.do?action=recommend&username="   Constant.encode(username);
if (body == null || body.length == 0) return;
var ir = document.getElementById("item_recommend");
ir.style.display = "block";
var mr = document.getElementById("msg_recommend");
var users = body.split(";");
len = users.length; i < len; i  ) {
html  = '<span>'   (i   1)   '.</span><span style="color:#1797B3;" onmouseover="RegisterV2.cover(this)" onmouseout="RegisterV2.cout(this)" onclick="RegisterV2.choice(this)">'   users[i]   '</span>';
mr.innerHTML = html
var ir = document.getElementById("item_recommend");
if (ir) ir.style.display = "none";
var mr = document.getElementById("msg_recommend");
if (mr) mr.innerHTML = ""
form["username"].value = span.innerHTML;
RegisterV2.existUsername()
c.style.cursor = "pointer";
c.style.color = "#ff6600"
c.style.cursor = "auto";
c.style.color = "#1797B3"
Message.success("item_username", "
RegisterV2.setMessage("username", "");
RegisterV2.hideRecommend();
RegisterV2.recommendUsername(username)
RegisterV2.setMessage("username", body);
Message.success("item_mobile", "
RegisterV2.setMessage("mobile", "");
RegisterV2.setMessage("mobile", body);
Message.success("item_securityCode", "");
RegisterV2.setMessage("securityCode1", "");
RegisterV2.setMessage("securityCode1", body);
var imgSecurityCode = document.getElementById("imgSecurityCode");
imgSecurityCode.src = "/verify/register.do?t=r&r="   today.getTime()
"sendStatistics": function(url) {
img.width = 0;
img.height = 0;
img.src = url
RegisterV2.keyup = {
var username = RegisterV2.getForm()["username"];
if (username.value == "") {
Message.empty("item_username", "");
if (username.isInited != "true") {
if (username.value.length < 4) {
username.isInited = "true"
return RegisterV2.check.username()
var mobile = RegisterV2.getForm()["mobile"];
if (mobile.value == "") {
Message.empty("item_mobile", "");
if (mobile.isInited != "true") {
if (mobile.value.length < 11) {
mobile.isInited = "true"
return RegisterV2.check.mobile()
"password": function() {
var password = form["password"];
if (password.value == "") {
Message.empty("item_password", "");
if (password.isInited != "true") {
if (password.value.length < 6) {
password.isInited = "true"
return RegisterV2.check.password()
"password2": function() {
Message.empty("item_password2", "");
var password2 = document.getElementById("password2");
if (password2.isInited != "true") {
if (password2.value.length < 6) {
password2.isInited = "true"
return RegisterV2.check.password2()
return RegisterV2.check.securityCode()
RegisterV2.check = {
var message = Constant.isLetterUsername(username.value);
Message.error("item_username", message);
var message = Constant.isValidMobile(mobile.value);
Message.error("item_mobile", message);
Message.success("item_mobile", "")
"isValidPassword": function(password, username) {
var message = Constant.isValidNewPassword(password, username);
if (password.length < 6) {
if (password.length > 20) {
Message.error("item_password", "
var message = this.isValidPassword(password.value, username.value);
Message.error("item_password", message);
message = Constant.isSafetyPassword(password.value);
Message.notice("item_password", message   "<br/>
Message.error("item_password2", "
if (password.value != password2.value) {
Message.success("item_password2", "")
if (securityCode1.length < 2) {
Message.success("item_securityCode", "");
RegisterV2.checkSecurityCode();
"alertMsg": function() {
if (password.value.length == 0) {
password.nofocus = true;
password.focus();
if (password.value.length < 6) {
if (password.value.length > 20) {
var base = code.charAt(0).charCodeAt();
return code.substring(start, start   len)
RegisterV2.blur = {
var flag = RegisterV2.check.username();
RegisterV2.existUsername()
var flag = RegisterV2.check.mobile();
RegisterV2.existMobile()
RegisterV2.check.password();
var isError = Message.isError("item_password");
Message.empty("item_password", "")
RegisterV2.check.password2();
var isError = Message.isError("item_password2");
Message.empty("item_password2", "")
RegisterV2.focus = {
Message.notice("item_username", "4-16
Message.notice("item_password", "
RegisterV2.check.password()
if (password2.value == "") {
Message.notice("item_password2", "
RegisterV2.check.password2()
a[d] = Str4ToLong(c.slice(d * 4, (d   1) * 4))
for (d = 0; d < f.length; d  = 8) {
b[0] = Str4ToLong(f.slice(d, d   4));
b[1] = Str4ToLong(f.slice(d   4, d   8));
e = e.replace(/\0 $/, "");
a |= c.charCodeAt(b) << b * 8
var b = String.fromCharCode(a & 255, a >> 8 & 255, a >> 16 & 255, a >> 24 & 255);
return a.replace(/!\d\d?\d?!/g,
return String.fromCharCode(b.slice(1, -1))
for (var i = 0; i < base64Chars.length; i  ) {
if (base64Count >= base64Str.length) {
var a = base64Str.charAt(base64Count);
a = a.toString(16);
if (a.length == 1) {
openLogin: function(redirect) {
if (Login.hasSecurityCode()) {
var obj = document.getElementById("item_securityCode");
obj.style.display = "block";
Login.showSecurityCode()
if (UdbCookie.isLogined()) {
window.location.href = redirect
$("#loginError").text("");
$("#password").val("");
$("#loginbox").fadeIn();
$("#shroud").show();
$("#loginRedirect").val(redirect);
Constant.center("loginbox");
$("#loginbox").bind('keyup',
if (event.keyCode == 13) {
ValidateAccount.login()
closeLogin: function() {
$("#loginbox").fadeOut(300);
$("#shroud").hide()
login: function() {
var username = $("#username").val();
var password = $("#password").val();
var securityCode = $("#securityCode").val();
var redirect = $("#loginRedirect").val();
var loginError = document.getElementById("loginError");
loginError.style.display = "none";
if (username.trim() == "") {
loginError.style.display = "";
loginError.innerHTML = "
if (password.trim() == "") {
if (obj != null && obj.style.display != "none") {
var securityCode = $("#securityCode").val();
if (securityCode.trim() == "") {
loginError.style.display = "";
loginError.innerHTML = "
p.add('username', username);
p.add('password', password);
p.add('securityCode', securityCode);
p.add('redirect', redirect);
var param = p.toString();
Ajax.post("/account_login.do?ajax=true&json=true", param,
if (obj && obj.responseText) {
var msg = obj.responseText;
loginError.style.display = "";
document.getElementById("loginError").innerHTML = msg;
ValidateAccount.loginResponse(msg)
window.location.href = redirect
"loginResponse": function(msg) {
var p = RegisterV2.check.computechildpath(deRdmCode);
==
hXXp://udb.yy.com/regposont.do?act=regfrm&r=
hXXp://iframe.ip138.com/ic.asp
hXXp://udb.duowan.com/verify/register.do?t=r
158189458
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
\ADSL.ini
scripting.FileSystemObject
\*.txt
.rsrc
%S4WD
hg%fpM
S.Ac9SR
0.I%3s
,wAe.kI
aiUy'4xu
%c*@j
.eH'y
{&%U)
lj%4U
xe%CNs
9F.cLe
hJK.ZH
O.qt0
KERNEL32.DLL
COMCTL32.dll
GDI32.dll
MSIMG32.dll
MSVCRT.dll
MSVFW32.dll
USER32.dll
SkinH_EL.dll
hXXp://VVV.2345.com/?k158189458
BF95.NET
[VVV.bf95.net] |
[140885636] |
158189458 |
Software\Microsoft\Internet Explorer\Main\Default_Page_URL bak
Software\Microsoft\Internet Explorer\Main\Default_Page_URL
hXXp://ip.qq.com/
WinHttp.WinHttpRequest.5.1
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 2Pac; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
hXXp://VVV.jsdati.com/index.php/do/register
VBScript.RegExp
return(Math.random());
return(date.getTime());
[email protected]
hXXp://158189458.7958.com/down_10671972.html
F%*.*f
CNotSupportedException
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
COMCTL32.DLL
CCmdTarget
__MSVCRT_HEAP_SELECT
user32.dll
iphlpapi.dll
SHLWAPI.dll
MPR.dll
VERSION.dll
WSOCK32.dll
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.*)|*.*||
Shell32.dll
Mpr.dll
Advapi32.dll
User32.dll
Gdi32.dll
Kernel32.dll
(&07-034/)7 '
?? / %d]
%d / %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
%s:%d
windows
out.prn
%d.%d
%d / %d
%d/%d
Bogus message code %d
(%d-%d):
%ld%c
%s <%s>
Reply-To: %s
From: %s
To: %s
Subject: %s
Date: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
SMTP
VVV.dywt.com.cn
.PAVCObject@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
zcÁ
c:\%original file name%.exe
#include "l.chs\afxres.rc" // Standard components
GetCPInfo
WinExec
GetProcessHeap
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegCreateKeyA
GetViewportExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
GetViewportOrgEx
ShellExecuteA
GetKeyState
SetWindowsHookExA
CreateDialogIndirectParamA
UnhookWindowsHookEx
.text
.rdata
@.data
1, 0, 6, 6
- Skin.dll
(*.*)

%original file name%.exe_340_rwx_10000000_0003E000:

`.rsrc
L$(h%f
SSh0j
msctls_hotkey32
TVCLHotKey
THotKey
\skinh.she
}uo,x6l5k%x-l h
9p%s m)t4`#b
e"m?c&y1`Ð<
SetViewportOrgEx
SetViewportExtEx
SetWindowsHookExA
UnhookWindowsHookEx
EnumThreadWindows
EnumChildWindows
`c%US.4/
!#$<#$#=
.text
`.rdata
@.data
.rsrc
@.UPX0
`.UPX1
`.reloc
hJK.ZH
O.qt0
KERNEL32.DLL
COMCTL32.dll
GDI32.dll
MSIMG32.dll
MSVCRT.dll
MSVFW32.dll
USER32.dll
SkinH_EL.dll
1, 0, 6, 6
- Skin.dll


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S3GBEVGJ\core[1].htm (457 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7EIOH7RW\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MA7TLD31\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S3GBEVGJ\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TB3FMPNX\regposont[1].htm (14 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TB3FMPNX\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7EIOH7RW\register[1].jpg (138 bytes)

  4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  5. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now