MD5: cdb46da6ea297a66555760807fda2dc2
SHA1: 81ef4974985646b1348362eca158779173d86121
SHA256: 1cbd0d5f16c46181de046ce997a7cd118bf2ee3a2e7a8c131aaf653c4bee9c69
SSDeep: 49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NL:DBIKRAGRe5K2UZH
Size: 3350580 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2012-02-09 00:09:46
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1988

The Trojan injects its code into the following process(es):

7ef4f.exe:1996

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1988 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\ÅäÖÃ\7ef4f.exe (22433 bytes)

The process 7ef4f.exe:1996 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\ÅäÖÃ\¹ýÂËÓë³öÊÛ.txt (2 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
C:\ÅäÖÃ\±ù»ðµºÐòÕÂËùÐè²ÄÁÏÒ»ÀÀ.txt (1 bytes)
C:\ÅäÖÃ\¹ýÇÅ·Ïß(´Ó½ø´¬Ò»Ö±µ½ÏÂÆÂÉÏÃæµÄÄã²»ÐèÒª¶¯Ö»ÐèÒª´Ó×îºóÔÙ¼Ó×ø±ê¾Í¿ÉÒÔÁË).txt (166 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@ip138[1].txt (209 bytes)

The Trojan deletes the following file(s):

C:\ÅäÖÃ\7ef4f.exe (0 bytes)

Registry activity

The process %original file name%.exe:1988 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "90 6C 5A 88 3B D5 91 DB BE ED 84 8B C3 76 1E 8B"

The process 7ef4f.exe:1996 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D8 7F CC A7 87 6F E5 16 2F 8B CE 28 1E D9 6E 9D"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: ?????
Product Version: 1.0.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ?????
Comments: ??????????(http://www.eyuyan.com)
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 7
48a9251902677a0bbe667458e3065288
d920debbd516a57a81643d71e2b0bfd5
a99211ba9da9623e76757a69a4903462
da9311605c4fcb9d0b3055cfab5a8ce0
087e3623466ba1a66dea97260b7e573f
dfbda9820dc6e174a1c36040d1993970
1dc9a686d83a8a8c21389f717dd2a612

URLs

URL	IP
hxxp://yd.ecoma.ourwebpic.com/ips8.asp
hxxp://city.ip138.com.cname.yunjiasu-cdn.net/ips8.htm	162.159.210.67
hxxp://www.ip138.com/ips8.asp	87.245.198.83
hxxp://city.ip138.com/ips8.htm	162.159.210.67

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Unsupported/Fake Windows NT Version 5.0

Traffic

GET /ips8.asp HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: VVV.ip138.com

Cache-Control: no-cache

HTTP/1.0 302 Moved Temporarily

Server: Cdn Cache Server V2.0

Date: Fri, 03 Jun 2016 06:56:35 GMT

Content-Length: 0

Location: hXXp://city.ip138.com/ips8.htm

GET /ips8.htm HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: city.ip138.com

Cache-Control: no-cache

Connection: Keep-Alive

HTTP/1.1 503 Service Temporarily Unavailable

Date: Fri, 03 Jun 2016 06:56:36 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: close

Set-Cookie: __cfduid=d4c88a1ecaabfe8dec3c9465c5a1be2a31464936996; expires=Sat, 03-Jun-17 06:56:36 GMT; path=/; domain=.ip138.com; HttpOnly

X-Frame-Options: SAMEORIGIN

Refresh: 8;URL=/cdn-cgi/l/chk_jschl?pass=1464937000.522-eSvLiaVHD7

Cache-Control: no-cache

Server: yunjiasu-nginx

CF-RAY: 2ad13f0444a53720-ARN
da8..<!DOCTYPE HTML>.<html lang="en-US">.<head>.  &l
t;meta charset="UTF-8" />.  <meta http-equiv="Content-Type" cont
ent="text/html; charset=UTF-8" />.  <meta http-equiv="X-UA-Compa
tible" content="IE=Edge,chrome=1" />.  <meta name="robots" conte
nt="noindex, nofollow" />.  <meta name="viewport" content="width
=device-width, initial-scale=1, maximum-scale=1" />.  <title>
..................</title>.  <style type="text/css">.    h
tml, body {width: 100%; height: 100%; margin: 0; padding: 0;}.    body
 {background-color: #ffffff; font-family: Helvetica, Arial, sans-serif
; font-size: 100%;}.    h1 {font-size: 1.5em; color: #404040; text-ali
gn: center;}.    p {font-size: 1em; color: #404040; text-align: center
; margin: 10px 0 0 0;}.    #spinner {margin: 0 auto 30px auto; display
: block;}.    .attribution {margin-top: 20px;}.  </style>..    &
lt;script type="text/javascript">.  //<![CDATA[.  (function(){. 
   var a = function() {try{return !!window.addEventListener} catch(e) 
{return !1} },.    b = function(b, c) {a() ? document.addEventListener
("DOMContentLoaded", b, c) : document.attachEvent("onreadystatechange"
, b)};.    b(function(){.      var a = document.getElementById('yjs-co
ntent');a.style.display = 'block';.      setTimeout(function(){.      
  var s,t,o,p,b,r,e,a,k,i,n,g,f, dsvdUiT={"s": ((! [] !![] !![] []) (!
 [] !![] !![] !![] !![] !![]))};.        t = document.createElement('d
iv');.        t.innerHTML="<a href='/'>x</a>";.       
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

{82B46959-3065-46a0-8340-3BB58B77A259}

[email protected]

hXXp://VVV.ecodeproject.cn/bbs

:16882569

kernel32.dll

ole32.dll

msvcrt.dll

fne.dll

t%SVh

t$(SSh

~%UVW

.tTPV

FTPjK

FtPj;

F.PjRWj

u.WWj

u.VVj

u$SShe

ntdll.dll

IPHLPAPI.DLL

advapi32.dll

shlwapi.dll

user32.dll

EnumWindows

UnregisterHotKey

RegisterHotKey

{86AB1D8A-7995-4D86-AE5F-18710759228B}

MySQL

N@C:\ks77.ini

\\.\PhysicalDrive0

X-X-X-X-X-X

@*.exe

hXXp://VVV.ip138.com/ips8.asp

smtp.163.com

[email protected]

[email protected]

Report

).txt

-127 20\

checkkey:

80818283

xmlhttp

1970-1-1-00-00-01

00000000

88 05 00 00

87 05 00 00

89 05 00 00

(*.txt)|*.txt|

(*.*)|*.*

elementclient.exe

*.txt

,125-126

,127-130

127.0.0.1

21000701

I%.D_ac

.adz||~

.cdz||~

pB))@AC.TJ

1970-01-01 08:00:00

1970-01-01 00:00:00

login

(elementclient.exe)|*.exe

(*.exe)|*.exe|

40 41 17 17 20

023100023100

383 -114

382 -199

402 -199

402 -270

398 -288

407 -316

393 -317

9 10 11 12

13 14 15

\MicroSu.dll

`.data

@.reloc

MSVBVM60.DLL

%System%\MSVBVM60.DLL\3

LogIn

LogInEx

KeyCheck

KeyEndDate

KeyAdd

KeyMod

KeyDel

winmm.dll

GdiplusShutdown

VBA6.DLL

D:\Program Files\Microsoft Visual Studio\VB98\VB6.OLB

password

MicroSu.dll

stdole2.tlbWWW

%SendGifW

ReportWW

KLogInWWW

ULogInExW

KeyEndDateWW

KeyAddWW

4KeyModWW

KeyDelWW

urlW

4,5054585<5

regsvr32 /s MicroSu.dll

MicroSu.Reply

66000001

21000001

49430000

85050000

160004000000

160062000000

160002000000

16 00 04 00 00 00

160030000000

160032000000

160033000000

160036000000

-237.982 47.8555

404 -297

417 -295

400 -294

400 -198

383 -198

160030020000

160038020000

160039020000

160068030000

160070030000

160069030000

160075030000

160074030000

160077030000

LOGIN

(*.mp3)|*.mp3

(7),01444

'9=82<.342

(elementclient.exe)|elementclient.exe

2011:03:31 03:05:53

192.168.1.100

1.2.18

inflate 1.1.3 Copyright 1995-1998 Mark Adler

?%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

MSWHEEL_ROLLMSG

__MSVCRT_HEAP_SELECT

portuguese-brazilian

deflate 1.1.4 Copyright 1995-2002 Jean-loup Gailly

inflate 1.1.4 Copyright 1995-2002 Mark Adler

MSVFW32.dll

AVIFIL32.dll

iphlpapi.dll

SHLWAPI.dll

MPR.dll

WINMM.dll

WS2_32.dll

VERSION.dll

RASAPI32.dll

GetProcessHeap

WinExec

GetWindowsDirectoryA

GetCPInfo

SetNamedPipeHandleState

WaitNamedPipeA

KERNEL32.DLL

GetKeyState

EnumChildWindows

CreateDialogIndirectParamA

UnhookWindowsHookEx

SetWindowsHookExA

USER32.dll

GetViewportOrgEx

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

GDI32.dll

WINSPOOL.DRV

comdlg32.dll

RegCloseKey

RegOpenKeyExA

RegCreateKeyExA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

OLEAUT32.dll

COMCTL32.dll

WSOCK32.dll

HttpQueryInfoA

HttpSendRequestA

HttpOpenRequestA

InternetCrackUrlA

InternetCanonicalizeUrlA

WININET.dll

%x.tmp

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

(%d-%d):

%ld%c

(*.avi)|*.avi

%d.%d.%d.%d

WPFT532.CNV

WPFT632.CNV

EXCEL32.CNV

write32.wpc

Windows Write

mswrd632.wpc

Word for Windows 6.0

wword5.cnv

Word for Windows 5.0

mswrd832.cnv

mswrd632.cnv

Word 6.0/95 for Windows & Macintosh

html32.cnv

TrayIcon event: %x

1.1.3

;3 #>6.&

'2, / 0&7!4-)1#

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.0

%s <%s>

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

HELO %s

SMTP

AUTH LOGIN

AUTH=LOGIN

EHLO %s

Content-Type: application/octet-stream; name=%s

Content-Disposition: attachment; filename=%s

MAIL FROM:<%s>

RCPT TO:<%s>

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

zcÁ

PIPE

ssl-cert

ssl-key

pipe

port

MYSQL

\\%s\pipe\%s

Unknown option to protocol: %s

d:t:o,/tmp/client.trace

MYSQL_PWD

Windows_NT

MYSQL_UNIX_PORT

MYSQL_TCP_PORT

mysql

Connection using old (pre 4.1.1) authentication protocol refused (client option 'secure_auth' enabled)

Can't open shared memory. %s event don't create for client (%lu)

Using unsupported buffer type: %d (parameter: %d)

Can't send long data for non string or binary data types (parameter: %d)

Can't set state of named pipe to host: %-.64s pipe: %-.32s (%lu)

Can't open named pipe to host: %-.64s pipe: %-.32s (%lu)

Can't wait for named pipe to host: %-.64s pipe: %-.32s (%lu)

%-.100s via named pipe

Lost connection to MySQL server during query

%-.100s via TCP/IP

MySQL client run out of memory

Protocol mismatch. Server Version = %d Client Version = %d

MySQL server has gone away

Unknown MySQL Server Host '%-.100s' (%d)

Can't create TCP/IP socket (%d)

Can't connect to MySQL server on '%-.100s' (%d)

Can't connect to local MySQL server through socket '%-.100s' (%d)

Can't create UNIX socket (%d)

Unknown MySQL error

TCP/IP (%d)

socket (%d)

named pipe

%s would have been started with the following arguments:

error: Found option without preceding group in config file: %s at line: %d

error: Wrong group definition in config file: %s at line %d

C:/mysql/

Index.xml

Software\MySQL

HAVE_TCPIP

SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

Can't initialize threads: error %d

Can't sync file '%s' to disk (Errcode: %d)

Error on realpath() on '%s' (Error %d)

Can't create symlink '%s' pointing at '%s' (Error %d)

Can't read value for symlink '%s' (Error %d)

Out of resources when opening file '%s' (Errcode: %d)

Character set '%s' is not a compiled character set and is not specified in the '%s' file

Can't create directory '%s' (Errcode: %d)

Disk is full writing '%s'. Waiting for someone to free space...

%d files and %d streams is left open

Warning: '%s' had %d links

Can't change dir to '%s' (Errcode: %d)

Can't get working dirctory (Errcode: %d)

Can't open stream from handle (Errcode: %d)

Can't change size of file (Errcode: %d)

Can't get stat of '%s' (Errcode: %d)

Can't read dir of '%s' (Errcode: %d)

Can't unlock file (Errcode: %d)

Can't lock file (Errcode: %d)

Unexpected eof found when reading file '%s' (Errcode: %d)

Error on rename of '%s' to '%s' (Errcode: %d)

Error on delete of '%s' (Errcode: %d)

Out of memory (Needed %u bytes)

Error on close of '%s' (Errcode: %d)

Error writing file '%s' (Errcode: %d)

Error reading file '%s' (Errcode: %d)

Can't create/write to file '%s' (Errcode: %d)

File '%s' not found (Errcode: %d)

charsets.charset.collation.map

charsets.charset.collation.flag

charsets.charset.collation.order

charsets.charset.collation.id

charsets.charset.collation.name

charsets.charset.collation

charsets.charset.unicode.map

charsets.charset.unicode

charsets.charset.lower.map

charsets.charset.lower

charsets.charset.upper.map

charsets.charset.upper

charsets.charset.ctype.map

charsets.charset.ctype

charsets.charset.alias

charsets.charset.description

charsets.charset.family

charsets.charset.name

charsets.charset.binary-id

charsets.charset.primary-id

charsets.charset

charsets.max-id

xml.encoding

xml.version

1.1.4

%,%$%4%<%

eZl%u

Q.YeY

R:\Sg|p5rL

e$e#e e4e5e7e6e8eKuHeVeUeMeXe^e]erexe

s4s/s)s%s>sNsOs

!&"&#&$&%&&&'&(&)&*& &,&-&.&/&0&1&

2&3&4&5&6&7&8&

!(,("(-(

 !,!5!6!

!%"%#%$%%%&%'%(%)%*% %,%-%.%/%0%1%2%3%4%5%6%7%8%9%:%;%<$=%>%?%@%A%B%C%D%E%F%G%H%I%J%K%L%M%N%O%P%Q%R%S%T%U%V%W%X%Y%Z%[%\%]%^%_%`%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%

g9H5_DF>L!9yMGE~8

%Sv0$S

|T)>~T%C

8]7]:]=5

.Dh26a

Z6%d#d

ReXeQe

uewexe

<[email protected]@

6*6 8*8 5*5 :*: ;*; =*= <*

/"2"6"5"

21314151

'2(2)2*2 2

-6.6/6061626

.7/70717

[7\7]7^7

=8>8?8@8

19293949

%;&;';(;

<<=<><?<@<

%>&>'>(>

<>=>>>?>@>

[@\@]@^@

"U#U$U%U

8[9[:[;[<[=[>[

&\'\(\)\

~\!]"]#]

/]0]1]2]

4]5]6]7]8]

|_}_~_!`

&`'`(`)`

2`3`4`5`

WeXe

vewexe

$f%f&f

@mAmBmCmDm

S%S'S(S)S S,S-S0S2S5S<S=S>SBSLSKSYS[SaScSeSlSmSrSyS~S

d d"d$d%d)d*d/d0d5d=d?dKdOdQdRdSdTdZd[d\d]d_d`dadcdmdsdtd{d}d

.AK.)

.uGvG

/%S67

-<.GIg

 I.pKqK

J.AeRtH49

U U!U"U#U$U%U&U'U(U)U*U U,U-U.U/U0U1U2U3U4U5U6U7U8U9U:U;U<U=U>U?U@UAUBUCUDUEUFUGUHUIUJUKULUMUNUOUPUQURUSUTUUUVUWUXUYUZU[U\U]U^U_U`UaUbUcUdUeUfUgUhUiUjUkUlUmUnUoUpUqUrUsUtUuUvU

?q.SM!@

$R&ß

C.JMH

-)./...6. .

E~ExE|E{E

&t.KIx

"*0QIs%u1

)Q.GN

X X!X"X#X$X%X&X'X(X)X*X X,X-X.X/X0X1X2X3X4X5X6X7X8X9X:X;X<X=X>X?X@XAXBXCXDXEXFXGXHXIXJXKXLXMXNXOXPXQXRXSXTXUXVXWXXXYXZX[X\X]X^X_X`XaXbXcXdXeXfX

S"S$S%S'S(S)S S,S-S/S0S1S2S3S4S5S6S7S8S<S=S@SBSDSFSKSLSMSPSTSXSYS[S]SeShSjSlSmSrSvSyS{S|S}S~S

U!U%U&U

X"X#X%X&X'X(X)X X,X-X.X/X1X2X3X4X6X7X8X9X:X;X<X=X

_!_"_#_$_

%d'd(d)d d.d/d0d1d2d3d5d6d7d8d9d;d<d>d@dBdCdIdKdLdMdNdOdPdQdSdUdVdWdYdZd[d\d]d_d`dadbdcdddedfdhdjdkdldndodpdqdrdsdtdudvdwd{d|d}d~d

"e#e$e&e'e(e)e*e,e-e0e1e2e3e7e:e<e=e@eAeBeCeDeFeGeJeKeMeNePeReSeTeWeXeZe\e_e`eaedeeegeheiejemeneoeqeseuevexeyeze{e|e}e~e

2!2"2#2$2%2&2'2(2)2

"P%Q%R%S%T%U%V%W%X%Y%Z%[%\%]%^%_%`%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%

1 1!1"1#1$1%1&1'1(1)1

!0"0#0$0%0&0'0(0)0

% %!%"%#%$%%%&%'%(%)%*% %,%-%.%/%0%1%2%3%4%5%6%7%8%9%:%;%<$=%>%?%@%A%B%C%D%E%F%G%H%I%J%K%

W%f?i

e.lFO

}!}#}$}%}&}(})}*},}-}.}0}1}2}3}4}5}6}

urlsS

~ ~!~"~#~$~%~&~'~(~)~*~ ~,~-~.~/~0~1~2~3~4~5~6~7~8~9~

u%urrGS

]']&].]$]

s"s9s%s,s8s1sPsMsWs`slsos~s

x<x%x,x#x)xNxmxVxWx&xPxGxLxjx

{.{1{ {%{${3{>{

!!"!#!(!

4!5!6!7!8!9!:!;!>!?!

~!2!3!<!=!

.VZN'Uu:&7V@

%FxG=R

~e%fWM

rP.BPb

C^%X*?M[lRzF*E

(m|P%c

NN"L.PSD25X^uU7<S;

.QqP8j9j:j5:

%CxF-kJD

(d.deB

3G,===%d

&8.pB1

mS.Xk@

tq.RG^JK

B]HC<F.NL]

yTDI.SS8`3

t6ZeXeYe@5

*M%u#u4=(u

"*")"'"("

%d&`&a&e&g&c&

%!%"%&%'%)%*%-%.%1%2%5%6%9%:$=%>%@%A%C%D%E%F%G%H%I%J%

[!\!]!^!

mQ.bx

{ | }9},

d6exe9j

]%sOu

m.t.zB}

w%xIyWy

%f?iCt

#$%&'()* ,

!"#$%&'()* ,-./0123456789:;<=>?@

%<%4%,%$%

%q%r%s%

`!`'`)` `

e%f-f f'f/f

%x-x x

~NzP}P\PGPCPLPZPIPePvPNPUPuPtPwPOP

]8^6^3^7^

c{cichczc]eVeQeYeWe_UOeXeUeTe

r6s%s4s)s:t*t3t"t%t5t6t4t/t

t&t(t%u&ukuju

a.bidodyd

duewexe

]!^"^#^ ^$^

t.uGuHu

h&h(h.hMh:h%h h,k/k-k1k4kmk

k%lzmcmdmvm

{1{ {-{/{2{8{

WHX%X

`IaJa aEa6a2a.aFa/aOa)a@a bh

d@d%d'd

kCpDpJpHpIpEpFp

3: %s unexpected (ident or '/' wanted)

5: %s unexpected ('>' wanted)

6: %s unexpected ('?' wanted)

4: %s unexpected (ident or string wanted)

1: %s unexpected (ident wanted)

'</%s>' unexpected ('</%s>' wanted)

\7ef4f.exe

#include "l.chs\afxres.rc" // Standard components

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity name="E.App" processorArchitecture="x86" version="5.1.0.0" type="win32"/><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency></assembly>PAD

dll\agentReply.vbp

hXXp://su.microrui.com/

hXXp://su2.microrui.com/

&password=

Msxml2.XMLHTTP

Microsoft.XMLHTTP

&passwordstr=

uploadpic.aspx?

application/x-www-form-urlencoded

getanswer.aspx?IDString=

report.aspx?IDString=

CardUse.aspx?action=reg&username=

CardUse.aspx?action=denglu&username=

CardUse.aspx?action=chongzhi&username=

CardUse.aspx?action=chaxun&username=

ZhuceUse.aspx?

{557CF401-1A04-11D3-9A73-0000F81EF32E}

{1D5BE4B5-FA4A-452D-9CDD-5DB35105E7EB}

c:\temp.xml

Microsoft.XMLDOM

ADODB.Stream

bin.base64

c:\\MicroSu.log

Scripting.FileSystemObject

su.microrui.com

1.00.0002

(*.*)

1.0.0.0

(hXXp://VVV.eyuyan.com)

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:1988
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\ÅäÖÃ\7ef4f.exe (22433 bytes)
   C:\ÅäÖÃ\¹ýÂËÓë³öÊÛ.txt (2 bytes)
   %Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
   C:\ÅäÖÃ\±ù»ðµºÐòÕÂËùÐè²ÄÁÏÒ»ÀÀ.txt (1 bytes)
   C:\ÅäÖÃ\¹ýÇÅ·Ïß(´Ó½ø´¬Ò»Ö±µ½ÏÂÆÂÉÏÃæµÄÄã²»ÐèÒª¶¯Ö»ÐèÒª´Ó×îºóÔÙ¼Ó×ø±ê¾Í¿ÉÒÔÁË).txt (166 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@ip138[1].txt (209 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.