Shiz_23d215d1ef

by malwarelabrobot on May 28th, 2014 in Malware Descriptions.

HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Kazy.13028 (B) (Emsisoft), Gen:Variant.Kazy.13028 (AdAware), Shiz.YR, GenericInjector.YR, BackdoorCaphaw_QKKBAL.YR (Lavasoft MAS)
Behaviour: Trojan, Backdoor


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 23d215d1efcef5f8a1b688d3c49a5643
SHA1: a6a3f720a6dd72937ff1f8f8d8505d544edaeea4
SHA256: 801b9d30e6bf91548329bfe89bd53e80b5094ce3a39bfa7a18a3a0cde723079f
SSDeep: 6144:JoCMLni/oCD/SUfgPt/xnjpF3e2V s8AY23PA7Hw:JoxL0DBfg99jpF3FT4238
Size: 263680 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Premium Installer
Created at: 1991-04-02 14:17:42
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1140
wuauclt.exe:304

The Trojan injects its code into the following process(es):

Explorer.EXE:880

File activity

The process %original file name%.exe:1140 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\AppPatch\vuwxueh.exe (1951 bytes)
%System%\config\software (1896 bytes)
%System%\config\SOFTWARE.LOG (2467 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\1.tmp (0 bytes)

The process wuauclt.exe:304 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (2232 bytes)
%WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)

The Trojan deletes the following file(s):

%WinDir%\SoftwareDistribution\DataStore\Logs\tmp.edb (0 bytes)

Registry activity

The process %original file name%.exe:1140 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "27 27 54 18 B7 68 AA FD 61 BE 62 17 5A 5D 71 0E"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%WinDir%\apppatch\vuwxueh.exe_, \??\%WinDir%\apppatch\vuwxueh.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"a8a67a25" = "pEìX£bÀ¸¬qÄHF‡KöTìd ¦§Q$YÉ<»¹œ³ŒQ\´òd¼Œ¤Kô1,Å $ë›ÛÌ«”¹l}Ë {Å“zΙC%é[qñl4ì;û´[Ã’#»Û:ÑU„„ԝ\±ª²DÆ’uÅ“¡Ü¼); ¼\Æ’tµ2”kDù”a”*›cü$}Sô|ë$¤ô {¬q³#sÃ…Ã¥\yuJÛËu©|ù ¢rKã!$’‹‹b±ÃÄ £ãÍ‚ “ÉUcdÁÄZ¡r»ô”)Û©Š ]“QlYÛl]$$D´ƒÌ£Q$aŒ‚*â„¢ü›ÙóÍÁ=éÔÑщ¬ q9|áíù’‘íÁ©šÄR"

Dropped PE files

MD5 File path
252cf586ae3cf2fc2757ed42b425b524 c:\WINDOWS\AppPatch\vuwxueh.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Trojan installs the following user-mode hooks in CRYPT32.dll:

CertVerifyCertificateChainPolicy

The Trojan installs the following user-mode hooks in WININET.dll:

HttpSendRequestExA
HttpSendRequestW
InternetReadFileExA
InternetWriteFileExA
InternetQueryDataAvailable
HttpSendRequestExW
InternetReadFile
HttpSendRequestA
InternetCloseHandle

The Trojan installs the following user-mode hooks in USER32.dll:

GetWindowTextA
GetClipboardData
SendInput
GetMessageA
GetMessageW
TranslateMessage

The Trojan installs the following user-mode hooks in ADVAPI32.dll:

CryptEncrypt

The Trojan installs the following user-mode hooks in WS2_32.dll:

WSASend
recv
gethostbyname
WSARecv
send

The Trojan installs the following user-mode hooks in kernel32.dll:

CreateFileW

Propagation

VersionInfo

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 24565 24576 4.54057 afa2479c93e94ca1c6a6bff9959f4c60
.rdata 28672 6220 6656 3.4839 eaf1fb01be135a9e27901530c4538516
.data 36864 973565 229376 5.5298 7494715a64ba149b50004ef7cf4bb5c3
.rsrc 1011712 1706 2048 0 c99a74c555371a433d121f551d6c6398

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://xukovoruput.eu/login.php 166.78.144.80
hxxp://xugiqonenuz.eu/login.php 69.195.129.70


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET TROJAN Win32.Shiz.fxm/Agent-TBT Checkin
ET POLICY Unsupported/Fake Windows NT Version 5.0
ET POLICY Unsupported/Fake Internet Explorer Version MSIE 2.
ET TROJAN Known Sinkhole Response Header

Traffic

POST /login.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Referer: hXXp://VVV.google.com
User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
Host: xukovoruput.eu
Content-Length: 9
Cache-Control: no-cache

....~7.~'
HTTP/1.1 200 OK
Date: Wed, 21 May 2014 07:50:26 GMT
Server: Apache/2.2.20 (Ubuntu)
X-Sinkhole: malware-sinkhole
Vary: Accept-Encoding
Content-Length: 0
Content-Type: text/html
HTTP/1.1 200 OK..Date: Wed, 21 May 2014 07:50:26 GMT..Server: Apache/2
.2.20 (Ubuntu)..X-Sinkhole: malware-sinkhole..Vary: Accept-Encoding..C
ontent-Length: 0..Content-Type: text/html..



POST /login.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Referer: hXXp://VVV.google.com
User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
Host: xugiqonenuz.eu
Content-Length: 9
Cache-Control: no-cache

....~7.~'
HTTP/1.1 200 OK
Server: nginx/1.2.1
Date: Wed, 21 May 2014 07:50:43 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 0
Connection: keep-alive
HTTP/1.1 200 OK..Server: nginx/1.2.1..Date: Wed, 21 May 2014 07:50:43 
GMT..Content-Type: text/plain; charset=utf-8..Content-Length: 0..Conne
ction: keep-alive..

The Trojan connects to the servers at the folowing location(s):

Explorer.EXE_880_rwx_01E50000_000B2000:

.text
`.data
.reloc
`.rdata
@.data
<>http
PASSu98V
PASSu08V
FTPQ
12345678
password1
monkey
monkey1
password
Pname.key
\secrets.key
kernel32.dll
\explorer.exe
user32.dll
multi_pot.exe
HookExplorer.exe
proc_analyzer.exe
sckTool.exe
sniff_hit.exe
sysAnalyzer.exe
idag.exe
ollydbg.exe
dumpcap.exe
wireshark.exe
avp.exe
Software\Microsoft\Windows NT\CurrentVersion
%s!%s!X
sysinfo.log
scr.jpg
minidump.bin
%d.%d.%d.%d
Ý %dh %dm
%s:%d
Software\Microsoft\Internet Explorer\TypedURLs
url%i
4.8.14
%dx%d@%d
%c%d:d
{Windows directory:
links.log
\History.IE5\index.dat
\Opera\Opera\typed_history.xml
avast.com
93.191.13.100
drweb
eset.com
z-oleg.com
kltest.org.ru
.comodo.com
google.com
Dnsapi.dll
ws2_32.dll
Referer: http://www.google.com
Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
/login.php
Global\{EAF799BF-8249-4fe1-9A0D-92CD3CC22014}
Global\{EAF799BF-8449-4fe1-9A0D-95CD39DC2014}
/search.php
Winmm.dll
Kernel32.dll
Gdi32.dll
ntdll.dll
http://
https://
HTTP/1.
nspr4.dll
PR_OpenTCPSocket
[[[URL: %s
Process: %s
User-agent: %s]]]
{{{%s
Crypt32.dll
CertVerifyCertificateChainPolicy
Wininet.dll
HttpSendRequestA
HttpSendRequestW
HttpSendRequestExA
HttpSendRequestExW
set_url
microsoft.public.win32.programmer.kernel
\iexplore.exe
\firefox.exe
keygrab
u.jpg
IprivLibEx.dll
\\.\PhysicalDrive%u
/topic.php
keylog.txt
sniff.log
passwords.txt
%s%u.zip
Content-Disposition: form-data; name="file"; filename="report"
HTTP/1.0
Content-Type: application/x-www-form-urlencoded
Content-Type: multipart/form-data; boundary=---------------------------%s
www.bing.com
www.microsoft.com
frd.exe
command=config&update_url=
&port=
command=load&url=
SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0001
SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0002
SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0003
hid=%s&username=SYSTEM&compname=%s&bot_version=4.8.14&uptime=%u&os=u&local_time=%s%d&token=%d&socks_port=%u&hardware[display]=%s&hardware[driver_av]=%s
\chrome.exe
\svchost.exe
\opera.exe
\cbmain.ex
\iscc.exe
\clmain.exe
\wclnt.exe
internal_wutex_0xx
%s.dbf
%s.DBF
pop2://%s:%s@%s:%i
pop3://%s:%s@%s:%i
nntp://%s:%s@%s:%i
ftp://%s:%s@%s:%i
ftp://anonymous:
AUTHINFO PASS
j_password=
pass.log
command=auth_loginByPassword&back_command=&back_custom1=&
edClientLogin=
edUserLogin=
edPassword=
&LOGIN_AUTHORIZATION_CODE=
login=
password=
pass_
ssleay32.dll
advapi32.dll
path.txt
keys.zip
Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}
%s\d.jpg
Local\{AA53E2BF-8989-4fe1-9A0D-95CD39DC0A14}
Local\{EAF799BF-8989-4fe1-9A0D-95CD39D44014}
keys
private.txt
public.txt
\*.key
\self.cer
self.cer
self.pub
Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC2014}
ctunnel.exe
ctunnel.zip
path_ctunnel.txt
header.key
keys99
\header.key
masks2.key
\masks2.key
masks.key
\masks.key
\name.key
primary2.key
\primary2.key
primary.key
\primary.key
keys99.zip
path99.txt
bsi.dll
&domain=letitbit.net&
cc.txt
Local\{EAF799BF-8989-4fa1-9A0D-95CD39DC0214}
prv_key.pfx
keys\
sign.cer
Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}
sks2xyz.dll
vb_pfx_import
Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC0214}
secret.key
pubkeys.key
Local\{AAF799BF-8989-4fe1-9A0D-95CD39DC0A14}
path1.txt
inter.zip
interpro.ini
Local\{EAF329BF-8989-4fe1-9A0D-95CD39DC0214}
Local\{AAF733BF-8989-4fe1-9A0D-95CD39DC0A14}
Local\{BQQQW777-B777-4e47-8B10-69798A04C732}
cbsmain.dll
Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}
pass.txt
Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214}
FilialRCon.dll
ISClient.cfg
Local\{EAF777BF-8989-4fe1-9A0D-95CD777C0214}
rfk.zip
Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}
Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}
Agava_Client.exe
KeysDiskPath
Agava_Client.ini
Agava_keys
keys_path.txt
Local\{AA53E2BF-8989-4EEE-9A0D-95CD39DC0A14}
mespro.dll
AddPSEPrivateKeyEx
core.exe
data\id.dbf
\data\id.dbf
keys%i.zip
path%i.txt
Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}
cert.pem
Local\{BE3CEFA7-B777-4e47-8B10-69745D04C732}
winmm.dll
1.2.5
unzip 1.01 Copyright 1998-2004 Gilles Vollant - http://www.winimage.com/zLibDll
zip 1.01 Copyright 1998-2004 Gilles Vollant - http://www.winimage.com/zLibDll
%s\%s
#webcam
#webcam%d
RFB d.d
%s (%s)
d/d/d d:d
password check failed!
WinSCard.dll
SensApi.dll
GetTcpTable
IPHLPAPI.DLL
dbghelp.dll
PSAPI.DLL
NETAPI32.dll
DNSAPI.dll
HttpQueryInfoA
HttpAddRequestHeadersW
HttpAddRequestHeadersA
HttpOpenRequestA
WININET.dll
WS2_32.dll
SHFileOperationA
SHELL32.dll
SHLWAPI.dll
GetSystemWindowsDirectoryA
WinExec
SetThreadExecutionState
GetWindowsDirectoryA
KERNEL32.dll
GetKeyboardState
MsgWaitForMultipleObjects
GetKeyboardLayoutList
GetAsyncKeyState
GetKeyboardLayout
MapVirtualKeyW
VkKeyScanW
VkKeyScanExW
keybd_event
EnumChildWindows
ActivateKeyboardLayout
SetKeyboardState
USER32.dll
SetViewportOrgEx
GetViewportOrgEx
GDI32.dll
RegOpenKeyExA
RegCloseKey
RegFlushKey
RegNotifyChangeKeyValue
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
ADVAPI32.dll
ole32.dll
OLEAUT32.dll
gdiplus.dll
MSVCRT.dll
AVICAP32.dll
MSVFW32.dll
ShellExecuteW
GetProcessHeap
?456789:;<=
!"#$%&'()* ,-./0123
;3 #>6.&
'2, / 0&7!4-)1#
5`6C6Q6}6
55
;";,;6;<;_;{;
6&7-737<7|7
3"33393>3}3
;#;);/;=;
<"=3=9=>=}=
:(:-:8:=:
7#7)7/7=7
9&9,929@9
0!02090>0
>$>*>4>9>
Windows Explorer
mavast.com
ya.ru
serverkey.dat
\windows\
dntdll.dll
.NET CLR Networking_Perf_Library_Lock_PID_0
.NET Data Provider for SqlServer_Perf_Library_Lock_PID_0
ASP.NET_2.0.50727_Perf_Library_Lock_PID_0
SOFTWARE\JavaSoft\Java Plug-in\1.6.0_%d
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%d
Software\Microsoft\Windows\CurrentVersion\Internet Settings
iexplore.exe
HighMemoryEvent_x
MSCTF.Shared.MAPPING.x
MSCTF.Shared.EVENT.x
MSCTF.Shared.MUTEX.x
.Prev
.current

Explorer.EXE_880_rwx_02010000_000B8000:

.text
`.rdata
@.data
.reloc
<>http
PASSu98V
PASSu08V
FTPQ
12345678
password1
monkey
monkey1
password
Pname.key
\secrets.key
kernel32.dll
\explorer.exe
user32.dll
multi_pot.exe
HookExplorer.exe
proc_analyzer.exe
sckTool.exe
sniff_hit.exe
sysAnalyzer.exe
idag.exe
ollydbg.exe
dumpcap.exe
wireshark.exe
avp.exe
Software\Microsoft\Windows NT\CurrentVersion
%s!%s!X
sysinfo.log
scr.jpg
minidump.bin
%d.%d.%d.%d
Ý %dh %dm
%s:%d
Software\Microsoft\Internet Explorer\TypedURLs
url%i
4.8.14
%dx%d@%d
%c%d:d
{Windows directory:
links.log
\History.IE5\index.dat
\Opera\Opera\typed_history.xml
avast.com
93.191.13.100
drweb
eset.com
z-oleg.com
kltest.org.ru
.comodo.com
google.com
Dnsapi.dll
ws2_32.dll
Referer: http://www.google.com
Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
/login.php
Global\{EAF799BF-8249-4fe1-9A0D-92CD3CC22014}
Global\{EAF799BF-8449-4fe1-9A0D-95CD39DC2014}
/search.php
Winmm.dll
Kernel32.dll
Gdi32.dll
ntdll.dll
http://
https://
HTTP/1.
nspr4.dll
PR_OpenTCPSocket
[[[URL: %s
Process: %s
User-agent: %s]]]
{{{%s
Crypt32.dll
CertVerifyCertificateChainPolicy
Wininet.dll
HttpSendRequestA
HttpSendRequestW
HttpSendRequestExA
HttpSendRequestExW
set_url
microsoft.public.win32.programmer.kernel
\iexplore.exe
\firefox.exe
keygrab
u.jpg
IprivLibEx.dll
\\.\PhysicalDrive%u
/topic.php
keylog.txt
sniff.log
passwords.txt
%s%u.zip
Content-Disposition: form-data; name="file"; filename="report"
HTTP/1.0
Content-Type: application/x-www-form-urlencoded
Content-Type: multipart/form-data; boundary=---------------------------%s
www.bing.com
www.microsoft.com
frd.exe
command=config&update_url=
&port=
command=load&url=
SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0001
SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0002
SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0003
hid=%s&username=SYSTEM&compname=%s&bot_version=4.8.14&uptime=%u&os=u&local_time=%s%d&token=%d&socks_port=%u&hardware[display]=%s&hardware[driver_av]=%s
\chrome.exe
\svchost.exe
\opera.exe
\cbmain.ex
\iscc.exe
\clmain.exe
\wclnt.exe
internal_wutex_0xx
%s.dbf
%s.DBF
pop2://%s:%s@%s:%i
pop3://%s:%s@%s:%i
nntp://%s:%s@%s:%i
ftp://%s:%s@%s:%i
ftp://anonymous:
AUTHINFO PASS
j_password=
pass.log
command=auth_loginByPassword&back_command=&back_custom1=&
edClientLogin=
edUserLogin=
edPassword=
&LOGIN_AUTHORIZATION_CODE=
login=
password=
pass_
ssleay32.dll
advapi32.dll
path.txt
keys.zip
Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}
%s\d.jpg
Local\{AA53E2BF-8989-4fe1-9A0D-95CD39DC0A14}
Local\{EAF799BF-8989-4fe1-9A0D-95CD39D44014}
keys
private.txt
public.txt
\*.key
\self.cer
self.cer
self.pub
Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC2014}
ctunnel.exe
ctunnel.zip
path_ctunnel.txt
header.key
keys99
\header.key
masks2.key
\masks2.key
masks.key
\masks.key
\name.key
primary2.key
\primary2.key
primary.key
\primary.key
keys99.zip
path99.txt
bsi.dll
&domain=letitbit.net&
cc.txt
Local\{EAF799BF-8989-4fa1-9A0D-95CD39DC0214}
prv_key.pfx
keys\
sign.cer
Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}
sks2xyz.dll
vb_pfx_import
Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC0214}
secret.key
pubkeys.key
Local\{AAF799BF-8989-4fe1-9A0D-95CD39DC0A14}
path1.txt
inter.zip
interpro.ini
Local\{EAF329BF-8989-4fe1-9A0D-95CD39DC0214}
Local\{AAF733BF-8989-4fe1-9A0D-95CD39DC0A14}
Local\{BQQQW777-B777-4e47-8B10-69798A04C732}
cbsmain.dll
Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}
pass.txt
Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214}
FilialRCon.dll
ISClient.cfg
Local\{EAF777BF-8989-4fe1-9A0D-95CD777C0214}
rfk.zip
Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}
Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}
Agava_Client.exe
KeysDiskPath
Agava_Client.ini
Agava_keys
keys_path.txt
Local\{AA53E2BF-8989-4EEE-9A0D-95CD39DC0A14}
mespro.dll
AddPSEPrivateKeyEx
core.exe
data\id.dbf
\data\id.dbf
keys%i.zip
path%i.txt
Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}
cert.pem
Local\{BE3CEFA7-B777-4e47-8B10-69745D04C732}
winmm.dll
1.2.5
unzip 1.01 Copyright 1998-2004 Gilles Vollant - http://www.winimage.com/zLibDll
zip 1.01 Copyright 1998-2004 Gilles Vollant - http://www.winimage.com/zLibDll
%s\%s
#webcam
#webcam%d
RFB d.d
%s (%s)
d/d/d d:d
password check failed!
WinSCard.dll
SensApi.dll
GetTcpTable
IPHLPAPI.DLL
dbghelp.dll
PSAPI.DLL
NETAPI32.dll
DNSAPI.dll
HttpQueryInfoA
HttpAddRequestHeadersW
HttpAddRequestHeadersA
HttpOpenRequestA
WININET.dll
WS2_32.dll
SHFileOperationA
SHELL32.dll
SHLWAPI.dll
GetSystemWindowsDirectoryA
WinExec
SetThreadExecutionState
GetWindowsDirectoryA
KERNEL32.dll
GetKeyboardState
MsgWaitForMultipleObjects
GetKeyboardLayoutList
GetAsyncKeyState
GetKeyboardLayout
MapVirtualKeyW
VkKeyScanW
VkKeyScanExW
keybd_event
EnumChildWindows
ActivateKeyboardLayout
SetKeyboardState
USER32.dll
SetViewportOrgEx
GetViewportOrgEx
GDI32.dll
RegOpenKeyExA
RegCloseKey
RegFlushKey
RegNotifyChangeKeyValue
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
ADVAPI32.dll
ole32.dll
OLEAUT32.dll
gdiplus.dll
MSVCRT.dll
AVICAP32.dll
MSVFW32.dll
ShellExecuteW
GetProcessHeap
?456789:;<=
!"#$%&'()* ,-./0123
;3 #>6.&
'2, / 0&7!4-)1#
SYSTEM!XP3!F9BE9A8A
%WinDir%\apppatch\vuwxueh.exe
%Documents and Settings%\%current user%\Application Data\
5`6C6Q6}6
55
;";,;6;<;_;{;
6&7-737<7|7
3"33393>3}3
;#;);/;=;
<"=3=9=>=}=
:(:-:8:=:
7#7)7/7=7
9&9,929@9
0!02090>0
>$>*>4>9>
`.data
Windows Explorer
mavast.com
ya.ru
serverkey.dat
\windows\
dntdll.dll
.NET CLR Networking_Perf_Library_Lock_PID_0
.NET Data Provider for SqlServer_Perf_Library_Lock_PID_0
ASP.NET_2.0.50727_Perf_Library_Lock_PID_0
SOFTWARE\JavaSoft\Java Plug-in\1.6.0_%d
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%d
Software\Microsoft\Windows\CurrentVersion\Internet Settings
iexplore.exe
HighMemoryEvent_x
MSCTF.Shared.MAPPING.x
MSCTF.Shared.EVENT.x
MSCTF.Shared.MUTEX.x
.Prev
.current


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Scan a system with an anti-rootkit tool.
  2. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:1140
    wuauclt.exe:304

  3. Delete the original Trojan file.
  4. Delete or disinfect the following files created/modified by the Trojan:

    %WinDir%\AppPatch\vuwxueh.exe (1951 bytes)
    %System%\config\software (1896 bytes)
    %System%\config\SOFTWARE.LOG (2467 bytes)
    %WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
    %WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (2232 bytes)
    %WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now