MD5: acb1893827a1f07f78e313faf45bee13
SHA1: f5ec31518cc02e2a3b460ba9c69c96bb21cfab89
SHA256: f0eda357396aacfd1558f413973db7d57fbe5b60244a20eb03e46cdd3968b130
SSDeep: 6144:Npey2ZmtiDFGC5zJNk2/mHsoH3m5XzK C4ngP8qI/Fa :OlYYD1NkfXUjK CLEqI/
Size: 304128 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2011-07-23 11:49:29
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

attrib.exe:500
%original file name%.exe:468
imapi.exe:952

The Trojan injects its code into the following process(es):

rundll32.exe:380
explorer.exe:432

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:468 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\523968.bat (70 bytes)
%System%\raspprov.exe (1425 bytes)

The process imapi.exe:952 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Temp\riku11dc.TMP (146970 bytes)

Registry activity

The process attrib.exe:500 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4C DC 58 1E 65 B6 F9 1B 06 DC 82 D4 50 9A 23 FE"

The process rundll32.exe:380 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "46 88 DF 64 C7 06 EA 2B 11 48 E4 4C 05 A5 C0 44"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The process %original file name%.exe:468 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B8 FB F6 7B D4 89 FC 52 18 BB D4 A9 48 B1 56 A8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\c:]
"523968.bat" = "523968"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"dcomycfg" = "%System%\raspprov.exe"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process imapi.exe:952 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AD C3 F4 FD 8D 3B 5A DB D6 61 43 72 F9 2B DF A2"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi]
"ControlFlags" = "1"
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi\ImapiSvc]
"BitNames" = " ImapiDebugError ImapiDebugWarning ImapiDebugTrace ImapiDebugInfo ImapiDebugX ImapiDebugSort"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi\ImapiSvc]
"Guid" = "8107d8e9-e323-49f5-bba2-abc35c243dca"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments:
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://cr.yp.to/proto/netstrings.txt	131.193.32.147
parholestringcalled.com

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /proto/netstrings.txt HTTP/1.1

Host: cr.yp.to

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: publicfile

Date: Wed, 24 Sep 2014 00:05:38 GMT

Last-Modified: Mon, 14 Apr 1997 01:44:10 GMT

Content-Type: text/plain

Transfer-Encoding: chunked
400..Netstrings.D. J. Bernstein, [email protected]. Introduct
ion..   A netstring is a self-delimiting encoding of a string. Netstri
ngs are.   very easy to generate and to parse. Any string may be encod
ed as a.   netstring; there are no restrictions on length or on allowe
d bytes..   Another virtue of a netstring is that it declares the stri
ng size up.   front. Thus an application can check in advance whether 
it has enough.   space to store the entire string...   Netstrings may 
be used as a basic building block for reliable network.   protocols. M
ost high-level protocols, in effect, transmit a sequence.   of strings
; those strings may be encoded as netstrings and then.   concatenated 
into a sequence of characters, which in turn may be.   transmitted ove
r a reliable stream protocol such as TCP...   Note that netstrings can
 be used recursively. The result of encoding.   a sequence of strings 
is a single string. A series of those encoded.   strings may in turn b
e encoded into a single string. And so on...   In..400.. this document
, a string of 8-bit bytes may be written in two.   different forms: as
 a series of hexadecimal numbers between angle.   brackets, or as a se
quence of ASCII characters between double quotes..   For example, <
68 65 6c 6c 6f 20 77 6f 72 6c 64 21> is a string of.   length 12; i
t is the same as the string "hello world!"...   Although this document
 restricts attention to strings of 8-bit bytes,.   netstrings could be
 used with any 6-bit-or-larger character set....2. Definition..   
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.text

`.data

.rsrc

@.reloc

ADVAPI32.dll

BROWSEUI.dll

GDI32.dll

KERNEL32.dll

NTDLL.DLL

msvcrt.dll

ole32.dll

OLEAUT32.dll

SHDOCVW.dll

SHELL32.dll

SHLWAPI.dll

USER32.dll

UxTheme.dll

FTSSh

t0SSh

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system

SShwk

98~%SP

ExplorerStartMsgLoop

PSSh;

6SSSSh

SSSSh

SPSSSShL

u%SSh

t.WWWW

xpsp2res.dll

xpsp3res.dll

tbSSh

Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartMenu

Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartPanel

kernel32.dll

GetSystemWindowsDirectoryW

NetGetJoinInformation

WINMM.dll

SETUPAPI.dll

WINSTA.dll

OLEACC.dll

USERENV.dll

ntdll.dll

RegEnumKeyExW

RegNotifyChangeKeyValue

RegOpenKeyExA

RegEnumKeyW

RegCloseKey

RegCreateKeyW

RegQueryInfoKeyW

RegOpenKeyExW

RegCreateKeyExW

OffsetViewportOrgEx

GetViewportOrgEx

SetViewportOrgEx

SetProcessShutdownParameters

GetProcessHeap

GetWindowsDirectoryW

CreateIoCompletionPort

ShellExecuteExW

SHRegCloseUSKey

SHRegCreateUSKeyW

AssocQueryKeyW

SHRegOpenUSKeyW

SHDeleteKeyW

TileWindows

ExitWindowsEx

RegisterHotKey

UnregisterHotKey

EnumChildWindows

GetKeyState

GetAsyncKeyState

CascadeWindows

MsgWaitForMultipleObjects

EnumWindows

explorer.pdb

name="Microsoft.Windows.Shell.explorer"

version="5.1.0.0"

<description>Windows Shell</description>

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

]]"```^]]\

3333333330

3333330

333333334

)@.   '5 !*

.DEHHF>?/

2<===@@=

&$%Uooqkezs

['$$#%&(4

3333333333333333333

33333333333330

7'''')) 

3'')))33.

222`444(555

%%%{///-

000000000

00000000

`[66...00

0000000

`]66./.000

/./././././././.

66///0000

0000000000000

0000000000

6666,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,0.010.010.010.010.010.010.010.010.010.010.001

4366666666K,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6.010.010.010.010.010.010.010.010.010.010.000

:;<;:;<;:;<;:;<;:;<0

)   )   )   )   )

|2222'2'2'2'2'2'2'2'2'2'2'2'2'2'2'2',),),),),),),),),),),),),),),),),),),),),),, 

22222222222

3333333

.SB99;;;99twv}ut{oxt~

.SB;;;:::2:w}{{qddgghg

" """ """ """ """ "" #

""" """ """ "#

.SG>''';;9::p

:5:5:5:5:5:5:5:5:5:5#"

# # # # # # # # # # # # # # # # # # # # # ##$

( # # # # # # # # # # # # # # # # # # # # ###

1232123212321232123

(&(((&(((&(((&(((&((&&)

&(((&(((&(((&()

`,''')))

'4,4'4,4'4,4'4,4'4,4)(

55///0000

5555-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-0

555555555

55555555

5555555

14441444144414441

4343434343434343

5555555555555

5555555555

-,-,-,-,-,-,-,-,-,-,-*.

..............................JFJFJFJFJFJFJFJFJFJFJ.-

{22*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-../

|ujjjjuhF..BBBBBBBBBBBBT

~j|F.BB*BBB*BBB*Bwop

&!!!&!!!&

44466666

44444444416

4446666

66666666

|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= 

|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= 

DDDDE%CTDD@

A%US$

%UUUU

%%UUU

33U

""2222!!

!"!"%UUR""

!""!"#2"""

"!!"#3"!"

dnnnnn:n.nfCnmddddd

////;/;;88

;888;;!/

!//!!;;^

:;:!::!!!

.88.88.8

.N.NN.M

::8.8...

:::!;;:!

//!!;888

.8.8.88...

:;!::!!;!//!;

!!;:!!::

.88..8..

!!:::/^!

!;/;!;;;!!!:

.8:!!!!^

!!:;:::..

/:!^^!;{8{../

...:::.-

**6***66*6**6566*5666 ,

6*6666*6*6 655*65

6*65 56*5 55  555 *5  6

555( 55 (5 5(  

76 5   66  555*677

6*6 5 5(5 (55( '5((5 (556 ('5

665**6(('S((((((S(((]('((@('SS((S(((((((6C-.NEC66S5sU

555(555(5((5(5(5(

5 5 5 5555 (555(555'(((5(5('55(((

((''('5'5(5('('('('('((''('(((@(((('&(((&

%&&%&&&&3>&3&3&33&3&3333&&3>3333

'(3&'&3&

3&33&&((

3323>33>%>3%>3>33>3%3&%

*5'(('((&@3(

,63%3>323>3%>&>33323>>%>

3(3'(((@@'5('@(@(&('(

>2>323%>3

75((((@3&333&3&&&%&3&&3&33>33%3>23%>3

>2%$32%>2>%>2$3>

3&%&&3&33>3>33

3>%>3%&3$23>23$2>2%$>2>

)4433((&(&('*

('((((''(**6(('' *

32323>3>

2$%>22%>%3' (

&(&''((5(5 *

'(&(&((&('''

&&%&3&&%3%

2%>22>22

5''3(((3(('&(&'&

3%%3%3%2#$

22$22$2%$22$2%2%$2%$2$222%$22

&>2$2$2$222$22$%%

:7'((('(3('(3(&(&

222222222222

22222222222222

222222222222222

22$22$22$22$

&(%3%&&&&3&&&3%3

222222222222222222

&&(&3(&(&'('((3'(&&

2222222

22$<$$2$22$%

&&(3(3('(&'

222"2212

22<2<22"

(&(3(3((

((565 ((( 6

333&33(&&

'(('('(('( 

 '&%%"$

2"2"22"2

2222<2"222

"2"22<2<22

2%('(3'32222?&'

2"2"2"121212<

2"2"2$"?

%%22%2

&3(3(3((&

"2"<"2<2<

<2<"<"<"<

1"?((&21

<?<?22<$2

2%""22&&

2<2$$2222

'&('(3(''

((%%%"

5(3%"%

"2%5*67

))) ))))

""**<****"""

"*<<<<*"

#2#---2222-222442-

--&#-(-%

$/222(--444222!

#&-221269924999;

&$-22-($2%

#(2---222622212-

#2221299629968

#&--%#(2##!

-222422422426662-%

"2-##&

!##-#&#-&&#%---#---#&-219662%

$&-(151,44.9

&1242662-

-(..19.19

,4492.12

12-$-,-,

-, $$----

#%#-15/-&

-,(,,(,(,

$$11651566/,$&&

,2592&&&-

2466/!$$

""*<*"****""

) '????[

&&&$-556>>61,,5994511-

$(//$$$(6>6/,$,-$

#$-22692/,,$,-&

-266661..4514#

&,2-&&##

&-222,22--#

#&&---2-,-&$&(,,291.566..BNNNTNNNNNAABIAA88

&!#&!-##

&#--//11468>885882&

$266961$&--$&%

,1661,!-((#

&$,4255$,92

&$,44..&

""**""***""

"****<*<<**"

"**""""*""""

&-569./-,16522$

.BAA=86546888=AAAEAAEMNRMQQSWZZ\]gk__m__\

bTRHHHHHQQHQJQWJSSSSSSSSSSSSSSSSWWSSSS\\V]VZW8,.FW]\\]\]\]\\ZZ\\WFR>38(

.BTTkgn]ktvgmvvvvvmvvvsvzzzyzyzyzyyyzmkkkkkZSRA816;F87

yzyzyzym^Z]WN3   $&$.Wt\

""*"""****""""

"***"**""**<**"

$5612,.2,

&$$,,,5]

$]t.Ft

7%8U8

3 303<3]3

2<3

8 8$8(8,8084888<8}8

5%5,575{6

<,<0<4<8<

7 7$7(7,70747

rundll32.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage

Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

::{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}

::{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}

::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}

::{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}

::{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}

::{D20EA4E1-3957-11d2-A40B-0C5020524153}

::{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}

{208D2C60-3AEA-1069-A2D7-08002B30309D}

{20D04FE0-3AEA-1069-A2D8-08002B30309D}

Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites

{450D8FBA-AD25-11D0-98A8-0800361B1103}

CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}

Software\Microsoft\Windows\CurrentVersion\RunOnce

Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad

Software\Microsoft\Windows\CurrentVersion\Explorer\DontShowMeThisDialogAgain

Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\CleanupWiz

\\.\WMIDataDevice

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Software\Microsoft\Windows NT\CurrentVersion\Windows

ExplorerIsShellMutex

desk.cpl

Software\Microsoft\Windows\CurrentVersion\Explorer

tourstart.exe

tourstart.exe,0

Microsoft.OfferTour

WINWORD.EXE

Software\Microsoft\Windows\CurrentVersion\Applets

Software\Microsoft\Windows\CurrentVersion\Applets\Tour

explorer.exe,9

Microsoft.FixScreenResolution

shell:::{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}

Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation

Software\Microsoft\Windows NT\CurrentVersion

shell:::{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}

Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

DDEEXECUTESHORTCIRCUIT

http\shell

IEXPLORE.EXE

Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop

Software\Microsoft\Windows\CurrentVersion\RunOnceEx

comctl32.dll

Software\Microsoft\Windows\Internet Settings

AutoConfigURL

system.ini

AppEvents\Schemes\Apps\.Default\%s\.current

Software\Microsoft\Windows\CurrentVersion\Explorer\TrayNotify

MSShellRunDlgReady

res://mys.dll/mys.hta /explorer

mshta.exe

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\Welcome

Software\Microsoft\Windows\CurrentVersion\Explorer\Tips

SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\MYS

cys.exe

SOFTWARE\Microsoft\Windows NT\CurrentVersion\srvWiz

install.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel

OUTLOOK.EXE

explorer.exe,16

iernonce.dll

WININET.DLL

UpdateURL

WindowsUpdate

HWND%x

Software\Microsoft\Windows\CurrentVersion\OemStartMenuData

fldrclnr.dll,Wizard_RunDLL

iexplore.exe

winbrand.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\Remote\%d

shell32.dll

nusrmgr.cpl ,initialTask=ChangePicture

NewExeName

Windows

ediskeer.dll

timedate.cpl

Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\LastVisitedMRU

Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\OpenSaveMRU

Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU

Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Software\Microsoft\Internet Explorer\TypedURLs

%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Calculator.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Games\Solitaire.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Paint.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\WordPad.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Files and Settings Transfer Wizard.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Windows Movie Maker.lnk

%USERPROFILE%\Start Menu\Programs\Accessories\Tour Windows XP.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Windows Messenger.lnk

%USERPROFILE%\Start Menu\Programs\Windows Media Player.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\MSN.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Get Online with MSN.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Get Going with Tablet PC.lnk

%ALLUSERSPROFILE%\Start Menu\Set Program Access and Defaults.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Windows Journal.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Media Center\Media Center.lnk

%USERPROFILE%\Start Menu\Programs\Internet Explorer.lnk

Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel

TSAppCMP.DLL

netapi32.dll

%SystemRoot%\system32\restore\rstrui.exe

RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL ?0x%X?%s

RunDLL32.EXE

%s%d%s

Software\Microsoft\Windows\CurrentVersion\Policies\System

settings.dll

explorer.exe "

explorer.exe /e, "

WindowsLogon

WindowsLogoff

%s %s

Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count

uAppWiz.Cpl

\explorer.exe

Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu

::{20D04FE0-3AEA-1069-A2D8-08002B30309D}

taskmgr.exe

ShellExecute

Software\Microsoft\Windows\CurrentVersion\Explorer\AppKey\%d

\WindowsShell.Manifest

Get Online with MSN.lnk

Set Program Access and Defaults.lnk

Link%d

OEM%d

Software\Microsoft\Windows\CurrentVersion\SMDEn

::{D20EA4E1-3957-11d2-A40B-0C5020524152}

%WinDir%\explorer.exe

There is a file or folder on your computer called "%s" which could cause certain applications to not function correctly. Renaming it to "%s" would solve this problem. Would you like to rename it now?

Ca&scade Windows

Tile Windows &Horizontally

Tile Windows V&ertically

&Windows Security...

&Help and Support

&Log Off %s...

Windows Explorer

6.00.2900.5512 (xpsp.080413-2105)

EXPLORER.EXE

Windows

Operating System

6.00.2900.5512

Keep the &taskbar on top of other windows

To remove records of recently accessed documents, programs, and Web sites, click Clear.

Windows displays icons for active and urgent notifications, and hides inactive ones. You can change this behavior for items in the list below.

Select this option to use the menu style from earlier versions of Windows.

6There is not enough memory to complete this operation.8Unable to run command.

The folder '%1' has been removed.WMy Computer or Windows Explorer has not been properly initialized yet. Try again later.

&Undo %s

Windows is running in safe mode.

This special diagnostic mode of Windows enables you to fix a problem which may be caused by your network or hardware settings. Make sure these settings are correct in Control Panel, and then try starting Windows again. While in safe mode, some of your devices may not be available.

startRThere was an internal error and one of the windows you were using has been closed.

Restrictions{This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.

&Show Open Windows

Windows was unable to change the display settings for the new configuration. Return the computer to the previous state, shut down Windows, and restart the computer in the desired configuration.

There may be a problem with your display settings if you continue. To safely change to a new configuration, you should shut down Windows and restart the computer in the desired configuration. Do you want to continue anyway?

This pre-release version of "Internet Explorer 4.0" Desktop/Explorer has expired. Please update to the latest release of "Internet Explorer 4.0" from WWW.MICROSOFT.COM

helpctr.exe>-FromStartHelp

Take a tour of Windows XP

NOpens a window where you can pick search options and work with search results.aOpens a central location for Help topics, tutorials, troubleshooting, and other support services.

/Opens a program, folder, document, or Web site.

Provides options for closing your programs and logging off, or for leaving your programs running and switching to another user.lProvides options for turning off or restarting your computer, or for activating Stand By or Hibernate modes.RDisconnects your session. You can reconnect to the session when you log on again.

&Windows Security

iOpens the My Documents folder, where you can store letters, reports, notes, and other kinds of documents./Displays recently opened documents and folders.KOpens the My Music folder, where you can store music and other audio files.]Opens the My Pictures folder, where you can store digital photos, images, and graphics files.zGives access to, and information about, the disk drives, cameras, scanners, and other hardware connected to your computer.MGives access to, and information about, folders and files on other computers.8Connects to other computers, networks, and the Internet.

explorer.exe_432_rwx_00981000_0001F000:

FTPR

.text

`.rdata

@.data

.reloc

=HTTPt

?http

HTTPt

WININET.dll

SHLWAPI.dll

gdiplus.dll

WS2_32.dll

CRYPT32.dll

USER32.dll

GDI32.dll

ADVAPI32.dll

SHELL32.dll

ole32.dll

PSAPI.DLL

!DLL load status: %u

/t%s.php?%s=

regisforbelowactu.net

/d%s.php?%s=

/c%s.php?%s=

.rdata

%s=%s&

SMTP

HTTPMail

Port

Password2

account{*}.oeaccount

Software\Microsoft\Windows Mail

Software\Microsoft\Windows Live Mail

SetWindowsHookExW

SetWindowsHookExA

user32.dll

CreateDialogIndirectParam

DeleteUrlCacheEntry

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

FindCloseUrlCache

HttpQueryInfoA

HttpSendRequestW

HttpAddRequestHeadersW

HttpQueryInfoW

HttpAddRequestHeadersA

HttpSendRequestA

InternetCanonicalizeUrlA

HttpOpenRequestA

SHDeleteKeyA

CertOpenSystemStoreW

CertCloseStore

CertEnumCertificatesInStore

PFXExportCertStoreEx

ExitWindowsEx

CryptGetUserKey

RegCreateKeyA

RegOpenKeyA

RegCloseKey

RegNotifyChangeKeyValue

UnhookWindowsHookEx

GetKeyboardLayout

GetKeyboardState

ShellExecuteA

ntdll.dll

GetWindowsDirectoryA

CallNamedPipeA

WaitNamedPipeA

ConnectNamedPipe

DisconnectNamedPipe

CreateNamedPipeA

KERNEL32.dll

OLEAUT32.dll

client.dll

5 5-555<5

7$70767=7

type=%S, name=%s, address=%s, server=%s, port=%u, ssl=%s, user=%s, password=%s

type=%S, name=%S, address=%S, server=%S, port=%u, ssl=%S, user=%S, password=%S

EmailAddressCollection/EmailAddress[%u]/Address

n%S_%S

SMTP_Email_Address

u-u-u u:u:u

%s:(%s)

rundll32.exe_380:

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

GDI32.dll

USER32.dll

IMAGEHLP.dll

rundll32.pdb

.....eZXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

...eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

%Xnnnnnnnnnnnnnnn1

O3$dS7"%U9

.manifest

5.1.2600.5512 (xpsp.080413-2105)

RUNDLL.EXE

Windows

Operating System

5.1.2600.5512

YThere is not enough memory to run the file %s.

Please close other windows and try again.

9The file %s or one of its components could not be opened.

0The file %s or one of its components cannot run.

MThe file %s or one of its components requires a different version of Windows.

UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"

Error in %s

Missing entry:%s

Error loading %s

rundll32.exe_380_rwx_00951000_0001F000:

FTPR

.text

`.rdata

@.data

.reloc

=HTTPt

?http

HTTPt

WININET.dll

SHLWAPI.dll

gdiplus.dll

WS2_32.dll

CRYPT32.dll

USER32.dll

GDI32.dll

ADVAPI32.dll

SHELL32.dll

ole32.dll

PSAPI.DLL

!DLL load status: %u

/t%s.php?%s=

regisforbelowactu.net

/d%s.php?%s=

/c%s.php?%s=

.rdata

%s=%s&

SMTP

HTTPMail

Port

Password2

account{*}.oeaccount

Software\Microsoft\Windows Mail

Software\Microsoft\Windows Live Mail

SetWindowsHookExW

SetWindowsHookExA

user32.dll

CreateDialogIndirectParam

DeleteUrlCacheEntry

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

FindCloseUrlCache

HttpQueryInfoA

HttpSendRequestW

HttpAddRequestHeadersW

HttpQueryInfoW

HttpAddRequestHeadersA

HttpSendRequestA

InternetCanonicalizeUrlA

HttpOpenRequestA

SHDeleteKeyA

CertOpenSystemStoreW

CertCloseStore

CertEnumCertificatesInStore

PFXExportCertStoreEx

ExitWindowsEx

CryptGetUserKey

RegCreateKeyA

RegOpenKeyA

RegCloseKey

RegNotifyChangeKeyValue

UnhookWindowsHookEx

GetKeyboardLayout

GetKeyboardState

ShellExecuteA

ntdll.dll

GetWindowsDirectoryA

CallNamedPipeA

WaitNamedPipeA

ConnectNamedPipe

DisconnectNamedPipe

CreateNamedPipeA

KERNEL32.dll

OLEAUT32.dll

client.dll

5 5-555<5

7$70767=7

type=%S, name=%s, address=%s, server=%s, port=%u, ssl=%s, user=%s, password=%s

type=%S, name=%S, address=%S, server=%S, port=%u, ssl=%S, user=%S, password=%S

EmailAddressCollection/EmailAddress[%u]/Address

n%S_%S

SMTP_Email_Address

u-u-u u:u:u

%s:(%s)

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   attrib.exe:500
   %original file name%.exe:468
   imapi.exe:952
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\523968.bat (70 bytes)
   %System%\raspprov.exe (1425 bytes)
   %WinDir%\Temp\riku11dc.TMP (146970 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "dcomycfg" = "%System%\raspprov.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.