MD5: 09044e8d1e7cb7f6883f983c17d17bcc
SHA1: 859700d6b16a0ea866c868024ac5d5f6c8d7e71b
SHA256: 16a93de94ad2d7a840b5dd6fda226bf055ebbd7bb66bbc640f230f37bc21ab7a
SSDeep: 12288:V800kt1sH8jzZg8JA2WCX4OY 0djJORkFQb/0BjQZ2H ELxnMpi8L:V8etjZNtM 0FJYy2g gnf8L
Size: 766465 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-02-21 21:46:23
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

Done.exe:1608
rundll32.exe:2644
%original file name%.exe:312
WinInstall.exe:1056
ntvdm.exe:680
E4U.exe:1068
IC.exe:524
EuroP.exe:768
SLFAT.exe:1664
_tbp.exe:1964

The Trojan injects its code into the following process(es):

stb1.exe:1236
rundll32.exe:1496
tenn2.exe:864
Gi.exe:828
willwnd.exe:1316
svchost.exe:1116
spoolsv.exe:1448
Explorer.EXE:1684

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process stb1.exe:1236 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@quickdomainfwd[1].txt (178 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\js3[1].js (2843 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xt.exe (1286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\numArrow[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\12224[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\min[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\min[2].js (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\quickdomainfwd[1].net&pid=9PO755G95 (388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\track[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\quickdomainfwd[1].htm (12 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\px[1].js (346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\px[1].js (346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\searchIcon[1].gif (1 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\sk-logabpstatus[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\min[1].js (0 bytes)

The process Done.exe:1608 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WinInstall.exe (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsuB.tmp (45 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nszC.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nseA.tmp (0 bytes)

The process %original file name%.exe:312 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\Gi.exe (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\ic8.exe (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp (14400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\SLFAT.exe (12024 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\EuroP.exe (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\_tbp.exe (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\Rich.exe (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\tenn2.exe (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\E4U.exe (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\IC.exe (4992 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\Gi.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\ic8.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\Rich.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\_tbp.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\tenn2.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\EuroP.exe (0 bytes)

The process tenn2.exe:864 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style[1].css (829 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\skenzo[1].css (345 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\sale_simple[1].png (980 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\saledefault[1].css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\px[2].js (692 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\quickdomainfwd[1].com&pid=9PO755G95 (512 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\min[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\quickdomainfwd[1].htm (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery-2.1.4.min[1].js (39035 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\searchIcon[2].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\park.lwken[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\min[2].js (8 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\sk-logabpstatus[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\min[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\px[2].js (0 bytes)

The process WinInstall.exe:1056 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\stb1.exe (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\willwnd.exe (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrF.tmp (1568 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsmE.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh10.tmp (0 bytes)

The process ntvdm.exe:680 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM (4 bytes)
C:\ (4 bytes)
%WinDir%\Temp\scs11.tmp (33872 bytes)
%Documents and Settings%\%current user%\Local Settings\APPLICATION DATA (4 bytes)
%WinDir%\WinSxS (8 bytes)
%WinDir%\Fonts (192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (4 bytes)
%WinDir%\Temp (4 bytes)
%WinDir%\Temp\Perflib_Perfdata_7b4.dat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq7.tmp (4185 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (1596 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\GDIPFONTCACHEV1.DAT (400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~DF4655.tmp (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\CONFIG (4 bytes)
%WinDir% (492 bytes)
C:\$Directory (1660 bytes)
%System% (3016 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J (4 bytes)
%Program Files% (100 bytes)
%WinDir%\assembly (4 bytes)
%WinDir%\Temp\scs12.tmp (10145 bytes)
%Documents and Settings%\%current user% (4 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (484 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (4 bytes)
%Documents and Settings%\%current user%\Cookies (96 bytes)

The Trojan deletes the following file(s):

%WinDir%\Temp\scs11.tmp (0 bytes)
%WinDir%\Temp\scs12.tmp (0 bytes)

The process IC.exe:524 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp (601 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\5.tmp (0 bytes)

The process EuroP.exe:768 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Scv..bat (166 bytes)

The process SLFAT.exe:1664 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\7za.exe (18424 bytes)
%Documents and Settings%\%current user%\Application Data\Done.exe (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq7.tmp (12234 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\a1.7z (5 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsa6.tmp (0 bytes)

The process _tbp.exe:1964 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\wuto60.dll (90 bytes)

Registry activity

The process stb1.exe:1236 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"xt.exe" = "xt"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E0 59 1C 56 BD 5E 37 1C 7F 88 22 05 B4 C0 9D 82"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process Done.exe:1608 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "46 FC 18 64 4E 70 AD 9F 5A 46 74 5A B6 6D EE 81"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"WinInstall.exe" = "WinInstall"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Temp\7]
"7" = "http://www.flvtube.net/12224"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process rundll32.exe:2644 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7C 43 F2 90 17 BC F7 6E D7 92 38 FB 93 67 00 71"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Wtube]
"Bveqayeweci" = "43 01 38 03 58 05 51 07 41 09 44 0B 48 0D 41 0F"

The process rundll32.exe:1496 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "03 D7 7C 93 46 5A 10 C9 7C 5B 3F 1F 90 E2 B7 EC"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Wtube]
"Eqegaqojoqoka" = "180"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Ihoragiqinicim" = "rundll32.exe %WinDir%\wuto60.dll,Startup"

The process %original file name%.exe:312 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\9.tmp, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp\EuroP.exe,"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp]
"_tbp.exe" = "FrameDbl"
"ic.exe" = "CTF Loader"

"tenn2.exe" = "DrawOverWindows"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp]
"Rich.exe" = "Rich"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp]
"E4U.exe" = "Pagefile Manager"

"Gi.exe" = "Gi"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4F EE 56 AB D7 E3 76 17 72 3B 69 FF D9 1B 65 E1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp]
"SLFAT.exe" = "SLFAT"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp]
"ic8.exe" = "Systray .exe stub"
"EuroP.exe" = "EuroP"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process tenn2.exe:864 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 21 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "86 0B 74 19 DF 9F 72 DA 7C 4F 55 74 DA 16 1F 3E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process WinInstall.exe:1056 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "07 8B 10 67 E1 2E 9B BB 05 8F FC 01 84 FC 72 F1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"stb1.exe" = "stb1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"willwnd.exe" = "willwnd"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process Gi.exe:828 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "23 80 1B EB EB 69 50 D3 75 FF 00 3D AE 3F CB 0A"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process ntvdm.exe:680 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "75 14 65 BD AB 32 5F FE 6D 77 48 5E B9 C6 C3 9D"

The process willwnd.exe:1316 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "63 53 CB A7 EC 08 D2 9B 98 12 39 96 3B 37 3E EA"

The process E4U.exe:1068 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "55 FE 37 76 72 4A A0 06 59 E9 6D 16 A7 D5 CD 0C"

The process IC.exe:524 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E1 9D 1A 6C 71 9E 87 39 A2 8F 5D 8D 1F 6B 7E 8E"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\9.tmp,"

The process EuroP.exe:768 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\]
"1806" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E 54 28 7A E7 36 55 68 F9 CA 39 85 99 73 A7 29"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process SLFAT.exe:1664 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6F 8E 7B 01 B1 23 B6 19 2D CD 15 F0 CC C2 27 95"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data]
"done.exe" = "Done"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process _tbp.exe:1964 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1A 19 F0 2C 0D BE 63 0C 5F 40 38 CD AF 01 FA FC"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Wtube]
"Bveqayeweci" = "43 01 38 03 58 05 51 07 41 09 44 0B 48 0D 41 0F"
"Ydapup" = "36 01 3B 03 33 05 47 07 3D 09 3F 0B 3F 0D 4C 0F"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "UNKNOWN" the Trojan controls loading executable images into a memory by installing the Load image notifier.
Using the driver ROOTKITPATH the Trojan intercepts DriverStartIO in a miniport driver of a hard drive controller (ATAPI) to handle request to its own files:

StartIo

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 73
13ab683047580206713a0f19ebe0427e
35f27015c54bef542f360a7c2ba5c229
0503370605c61ff728ff008dc03a1825
709c892167fce654126edb577421be29
1dc8f3bb2a983d7137276a217b4d705b
0f339065053ebd425e75b23558963750
ca5d6a20d387eb2e49389f6a39636da9
8a2f117c3e780d2a0ee0aefc9602d738
14e473d02dd6b3107715a02a70cfc4ca
450999c36485a084aa7dd1b603da875b
a51b0e4d59528d3c37c089b3920aefe1
2f92f621850cf288ff8a61cc0a7e1034
0092c82b8f71c849b1799747344a0013
848bd0a9a22e7e72609328d19e9ac880
273bae01660db7dac324f798d2c8812b
e612517c3e59b53ffb829dab9699a8f7
5853e9ba1c8d75393dcef359471d5a9e
90eeaf37ac1ec866ddf48f1f56edf745
65b18506a33d72ec059fb281acf7f87e
485f7cc7b007342caccad569a8eb6b44
8dd7ebf5a62c9e827a47347570e45811
e3f9c53041e0b03574cfab09dd2f52b0
ba09f806f9384606a5ec869cdbef26c1
a4693a1a63e0cae305d6a79b8002d2b4
a9b71e2f32432de14c3f7e1530879405

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

unpacking data: %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|<>/":

cuments and Settings\"%CurrentUserName%"\Application Data\Done.exe

open "%Documents and Settings%\%current user%\Application Data\Done.exe"

"%Documents and Settings%\%current user%\Application Data\Done.exe"

.reloc

q.cf&

MB, # %s =

RAM %s

N)0.BG

:\Documents and Settings\"%CurrentUserName%"\Application Data\Done.exe"

"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp\SLFAT.exe"

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp

SLFAT.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa6.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp\SLFAT.exe

Gi.exe_828:

`.rsrc

Ludps

WebBrtsLr

vb6chs.dll

udpsocket

AutoDownload.Socket

WebBrowser1

SHDocVwCtl.WebBrowser

shdocvw.dll

WebBrowser

VBA6.DLL

InternetOpenUrlA

wininet.dll

HttpQueryInfoA

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

%System%\shdocvw.oca

oudpsocket

advapi32.dll

RegCreateKeyA

RegCloseKey

RegOpenKeyA

shell32.dll

udpstop

ws2_32.dll

%System%\msvbvm60.dll\3

RemotePort

LocalPort

netapi32.dll

GetProcessHeap

SAFE_zQuZurLIyBzlabGZV6J67mp4vZAE92eS

SAFE_xYSsheV2XTHEjnoMQnsB5YaROhI86Qj8

Returns/Sets the port to be connected to on the remote computer

lngPort

Returns/Sets the port used on the local computer

Binds socket to specific port and adapter

Occurs after a send operation has completed

.text

`.data

.rsrc

wsS2%S-eu$S2%ro@

K.WAR

BlS2%Sizz%S2%arS2

orS2u`d/ o%S2%f 2%S2WarS2%Scra$S2%ftQ

dJol%S2

Cd 2%S2of S2%SWar%S2%cr2%S2aftj

2%S2w.eF2%Sxe

Tr%S2%ia

òlat

Lexe

WS2%Sow.%S2%exH

Atl%S2%an2%S2tic

ofS2%S wa%S2%rc2%S2rafe!%St@

KERNEL32.DLL

MSVBVM60.DLL

*\AS:\Worker\tempvbp\AutoDownload.vbp

USER32.DLL

ADVAPI32.DLL

WININET.DLL

RegOpenKeyExA

@*\AS:\Worker\tempvbp\AutoDownload.vbp

dick.exe

tenn2.exe_864_rwx_049F0000_00010000:

U8VSSh

Gi.exe_828_rwx_00401000_00057000:

udpsocket

AutoDownload.Socket

WebBrowser1

SHDocVwCtl.WebBrowser

vb6chs.dll

shdocvw.dll

WebBrowser

VBA6.DLL

InternetOpenUrlA

wininet.dll

HttpQueryInfoA

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

%System%\shdocvw.oca

oudpsocket

advapi32.dll

RegCreateKeyA

RegCloseKey

RegOpenKeyA

shell32.dll

udpstop

ws2_32.dll

%System%\msvbvm60.dll\3

RemotePort

LocalPort

netapi32.dll

GetProcessHeap

SAFE_zQuZurLIyBzlabGZV6J67mp4vZAE92eS

SAFE_xYSsheV2XTHEjnoMQnsB5YaROhI86Qj8

Returns/Sets the port to be connected to on the remote computer

lngPort

Returns/Sets the port used on the local computer

Binds socket to specific port and adapter

Occurs after a send operation has completed

.text

`.data

.rsrc

wsS2%S-eu$S2%ro@

K.WAR

BlS2%Sizz%S2%arS2

orS2u`d/ o%S2%f 2%S2WarS2%Scra$S2%ftQ

dJol%S2

Cd 2%S2of S2%SWar%S2%cr2%S2aftj

2%S2w.eF2%Sxe

*\AS:\Worker\tempvbp\AutoDownload.vbp

USER32.DLL

KERNEL32.DLL

ADVAPI32.DLL

WININET.DLL

RegOpenKeyExA

@*\AS:\Worker\tempvbp\AutoDownload.vbp

rundll32.exe_1496:

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

GDI32.dll

USER32.dll

IMAGEHLP.dll

rundll32.pdb

.....eZXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

...eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

%Xnnnnnnnnnnnnnnn1

O3$dS7"%U9

.manifest

5.1.2600.5512 (xpsp.080413-2105)

RUNDLL.EXE

Windows

Operating System

5.1.2600.5512

YThere is not enough memory to run the file %s.

Please close other windows and try again.

9The file %s or one of its components could not be opened.

0The file %s or one of its components cannot run.

MThe file %s or one of its components requires a different version of Windows.

UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"

Error in %s

Missing entry:%s

Error loading %s

rundll32.exe_1496_rwx_00970000_00010000:

U8VSSh

stb1.exe_1236:

.text

`.data

.rsrc

MSVBVM60.DLL

Project1.UserControl1

SHDocVwCtl.WebBrowser

StrUrl

ieframe.dll

WebBrowser

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

C:\Windows\System32\ieframe.oca

user32.dll

EnumWindows

shell32.dll

ShellExecuteA

VBA6.DLL

EnumChildWindows

WinHttp

.HTTPDownload

 .C:\Windows\system32\winhttp.dll

C:\Windows\system32\mshtml.tlb

*\AC:\Users\Sean\Desktop\stbnes\Project1.vbp

\xt.exe

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

@*\AC:\Users\Sean\Desktop\stbnes\Project1.vbp

1.00.0011

stb1.exe

rundll32.exe_1496_rwx_10000000_00001000:

.text

`.data

.reloc

willwnd.exe_1316:

.text

`.data

.rsrc

MSVBVM60.DLL

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

user32.dll

VBA6.DLL

@*\AC:\Users\Sean\Desktop\stbnes\willwind\Project1.vbp

killwnd.exe

willwnd.exe_1316_rwx_00E60000_00010000:

U8VSSh

stb1.exe_1236_rwx_032C0000_00010000:

U8VSSh

svchost.exe_1116_rwx_017A0000_00012000:

t.FE;l$

winmm.dll

ole32.dll

maxhttpredirects

software\microsoft\windows\currentversion\internet settings

enablehttp1_1

software\microsoft\windows\currentversion\internet settings\zones\3

%s\%s

hXXp://%s/?xurl=%s&xref=%s

clk=%s&bid=%s&aid=%s&sid=%s&rd=%s

atl.dll

oleaut32.dll

n%D,3

Global\3006345f-6baf-4669-a7e1-aaa310564be9

kdmf.tmp

%d|%d|%s|%s

Mozilla/4.0 (compatible; MSIE 1.0; Windows NT; CMD3)

DownloadAndExecute

DownloadCryptedAndExecute

DownloadCryptedAndExecute2

%[^.].%[^(](%[^)])

command|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s

setup.exe

google;yahoo;bing.;live.com;msn.com;altavista.com;ask.com;exalead.com;excite.com;dogpile.com;metacrawler.com;webcrawler.com;alltheweb.com;.lycos.;gigablast.com;cuil.com;.aol.;entireweb.com;.search.com;mamma.com;mytalkingbuddy.com;about.com;myspace.com;answers.com;conduit.com;alexa.com;alltheinternet.com;blinkx.com;macromedia.com;adobe.com;amazon.com;facebook.com;youtube.com;wikipedia.org;wikimedia.org;twitter.com;aolcdn.com;othersonline.com;everesttech.net;adrevolver.com;tribalfusion.com;adbureau.net;abmr.net;gstatic.com;virtualearth.net;atdmt.com;ivwbox.;powerset.net;yimg.com;2mdn.net;doubleclick.net;iwon.com;scorecardresearch.com;66.235.120.66;66.235.120.67;ytimg.com;infospace.com;edgesuite.net;superpages.com;lygo.com;compete.com;firmserve.com;worthathousandwords.com;yieldmanager.com;wazizu.com;meedea.com;atwola.com;doubleverify.com;tacoda.net;truveo.com;openx.org;adcertising.com;twimg.com;picsearch.com;oneriot.com;.com.com;flickr.com;searchvideo.com;.tqn.com;myspacecdn.com;fimservecdn.com;alexametrics.com

HTTP/1.1 302 Found

Location: %s

HTTP/1.1 200 OK

Content-Length: %d

<html><head><script type="text/javascript">function f(){var url="%s";try{var x=document.getElementById("_a");x.href=url;x.click()}catch(e){try{var x=document.getElementById("_f");x.action=url;x.submit()}catch(e){}}}</script></head><body onload="f()"><a id="_a"></a><form id="_f" method="get"></form></body></html>

<html><body onload="javascript:history.back()"></body></html>

hXXps://68b6b6b6.com/;hXXps://61.61.20.132/;hXXps://34jh7alm94.asia/;hXXps://61.61.20.135/;hXXps://nyewrika.in/;hXXps://rukkieanno.in/

hXXp://rudolfdisney.com/;hXXp://crozybanner.com/;hXXp://imagemonstar.com/;hXXp://funimgpixson.com/;hXXp://bunnylandisney.com/

hXXp://cri71ki813ck.com/

hXXp://lkckclckl1i1i.com/

cfg.ini

urlmon.dll

bckfg.tmp

svchost.exe

Global\9e6af8f3-75f3-4b67-877a-c80125d7bc08

*firefox*

*chrome*

*opera*

Global\a68d7de8-eba6-4a54-90e0-9cb9d93b3ed7

Global\cc51461b-e32a-4883-8e97-e0706dc65415

keywords

Accept-Language: %s

%s hXXp://%s/?xurl=%s&xref=%s

%s %s

1.6|%s|%s|%s|%s|%s|%s

0123456789

software\classes\http\shell\open\command

firefox

<>:"/\|?*

%s-%s

. d SP.%s

%s.dll

kernel32.dll

.text

.rdata

Global\452fefe0-a06e-400f-8d6b-6a12a0a09d4b

VVV.google.

/webhp

search.yahoo.com

.altavista.com

/web/results

.ask.com

VVV.exalead.com

/search/web/results

VVV.alltheweb.com

search.lycos.

tab=web

gigablast.com

cuil.com

.aol.

entireweb.com

md=web

VVV.search.com

VVV.mamma.com

mytalkingbuddy.com

searchservice.myspace.com

type=web

search.conduit.com

search.toolbars.alexa.com

alltheinternet.com

/ws/results/web/

%u|%u

ver=%s&bid=%s&aid=%s&sid=%s&rd=%s&eng=%s&q=%s

hXXp://%s%s

?xurl=

http/1.

mozilla

windowsupdate

\\?\globalroot\device\00000ecd\3857ae4d\kdmf.tmp

%WinDir%\System32\svchost.exe

796845957

\\?\globalroot\device\00000ecd\3857ae4d

cmd.dll

\\?\globalroot\device\00000ecd\3857ae4d\keywords

\\?\globalroot\device\00000ecd\3857ae4d\cfg.ini

WinExec

SHEnumKeyExA

FindFirstUrlCacheEntryW

UnlockUrlCacheEntryFileW

DeleteUrlCacheEntryW

FindNextUrlCacheEntryW

InternetCrackUrlA

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoW

FindCloseUrlCache

`.rdata

@.data

.reloc

KERNEL32.DLL

ADVAPI32.dll

imagehlp.dll

ntdll.dll

SHLWAPI.dll

USER32.dll

WININET.dll

WebBrowser

%s-%d

eplorer\iexplore.exe" -nohome

spoolsv.exe_1448_rwx_012E0000_00100000:

.tesx

`.rdat

.config

Ng.

.Lu;;:

DP%xU

.cV#~E

O.BY#

/xi.FQ

.Bg)(am>

9=!%F

.text

`.rdata

@.data

.reloc

N. d SP.

%x%x%x%x%x%x

%s|%s|%s|%x|%x|%s|prn3

%[^;];%[^;];%[^;];

ntdll.dll

system\currentcontrolset\services\%x

\\?\globalroot%wZ\cmd.dll

\\?\globalroot%wZ\cfg.ini

\\?\globalroot%wZ\bckfg.tmp

cmd.dll

%[^|]|%[^|]|%s

\\?\globalroot%wZ\ldr16

\\?\globalroot%wZ\ldr32

\\?\globalroot%wZ\ldr64

\\?\globalroot%wZ\drv64

\\?\globalroot%wZ\cmd64.dll

cmd64.dll

\\?\globalroot%wZ\drv32

aid=%s

sid=%s

*=cmd.dll

* (x64)=cmd64.dll

[cmd]

srv=%s

wsrv=%s

psrv=%s

cfg.ini

bckfg.tmp

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><ms_asmv2:trustInfo xmlns:ms_asmv2="urn:schemas-microsoft-com:asm.v2"><ms_asmv2:security><ms_asmv2:requestedPrivileges><ms_asmv2:requestedExecutionLevel level="requireAdministrator"></ms_asmv2:requestedExecutionLevel></ms_asmv2:requestedPrivileges></ms_asmv2:security></ms_asmv2:trustInfo></assembly>

ZwConnectPort

GetWindowsDirectoryW

KERNEL32.dll

RegCreateKeyA

RegCloseKey

ADVAPI32.dll

SHDeleteKeyA

SHLWAPI.dll

imagehlp.dll

PSAPI.DLL

RPCRT4.dll

InternetCrackUrlA

HttpOpenRequestA

HttpSendRequestA

WININET.dll

ShellExecuteW

SHELL32.dll

ole32.dll

WINSPOOL.DRV

Error loading operating system

Missing operating system

`.reloc

kdcom.dll

ntoskrnl.exe

`.pdata

.pdata

@.reloc

tùXXt

\\?\globalroot%S

%s (x64)

KeDelayExecutionThread

ZwOpenKey

ZwQueryValueKey

ZwSetValueKey

!Win64 .DLL.

.MPRESS1

.MPRESS2*

%X%XLA

AndExecu

https:/

alm94.as(ia

wrika.in

pG&$.KG

DB.fD

\{x-x-x-x-xx}

\registry\machine\%S

\??\physicaldrive%d

services.exe

\??\globalroot\systemroot\system32\tasks\%x

\\?\globalroot%s

%s.manifest

%s\setup%u.exe

%s\%S

*\KERNEL32.DLL

\device\%s

%s\cfg.ini

%s\mbr

Explorer.EXE_1684_rwx_00ED0000_00009000:

.exeu]

%szptfzubjhp.php?adv=adv468&code1=%s&code2=%s&id=%d&p=%s&b=%s

Chrome

Firefox

Opera

%swtlj.exe

%ssjnlgn.php?adv=adv468

%stmvspdwr.exe

%styfnhc.php?adv=adv468

%sifdla.exe

%sxbvqxsa.php?adv=adv468

%syset.exe

%sxavdxsz.php?adv=adv468

%sldnhp.exe

%shyfaitavt.php?adv=adv468

%sbekyd.exe

%sqhlkrzhf.php?adv=adv468

%sbxxlpcxo.exe

%skbwdyfeyta.php?adv=adv468

%shywgxge.exe

%smmaucwe.php?adv=adv468

%sokyqih.exe

%scptrlg.php?adv=adv468

%snyjq.exe

%sizgowq.php?adv=adv468

%saydvhkl.exe

%siztbjhowu.php?adv=adv468

%sultamgbih.php?adv=adv468

hXXp://bbpolis.com/timuo/

hXXp://abretor.com/timuo/

psapi.dll

ddraw.dll

urlmon.dll

shell32.dll

kernel32.dll

user32.dll

wininet.dll

ntdll.dll

\svchost.exe

explorer.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp\E4U.exe

ShellExecuteExA

InternetOpenUrlA

HttpQueryInfoA

.text

`.rdata

@.data

.reloc

%szptfzubjhp.p

ChromeFirefox

httpo%u

fnhcifdla$%sxbvk

polis.Qm/timuo/

`.rd!!

KERNEL32.DLL

ADVAPI32.dll

DDRAW.dll

PSAPI.DLL

SHELL32.dll

SHLWAPI.dll

USER32.dll

WININET.dll

Explorer.EXE_1684_rwx_00EE0000_00013000:

HTTP/1.1

Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry

SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore

\user32.dll

kb.dll

\updhlp.dat

<script src="hXXp://

Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

19792079

[%subid]

[%key]

google.com/

**http://

search.yahoo.com

bing.com

.info/message.php

\temp.ini

\admin.txt

.aspx

iexplore.exe

&HTTP_REFERER=

\server.dat

\Windows

\winhelp.exe

<h3 class="r"><a href="hXXp://

<h3 class=r><a href="hXXp://

yschttl spt" href="hXXp://

<div><a href="hXXp://rds.yahoo.com

<a href="hXXp://

sb_tlst"><h3><a href="hXXp://

19091979

HTTP/1.1 302 Moved Temporarily

HTTP/1.1 200 OK

<html><head><script language="JavaScript">function f(){var form = document.forms["rr"];form.submit();}if(document.cookie==""){if (history.length!=0) document.cookie="k=1";window.onload=f;}else{document.cookie="k=1;expires=Mon, 01-Jan-2001 00:00:00 GMT";history.back();}</script></head><body><form action="hXXp://

<html><head></head><body><script type="text/javascript">location.href="hXXp://

keyword

hXXp://

HTTP/1.

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

ntdll.dll

kernel32.dll

user32.dll

ws2_32.dll

advapi32.dll

shell32.dll

Wininet.dll

version.dll

ole32.dll

Dnsapi.dll

hXXp://google.ru/s.php?dd=giuy

c:\feed1.txt

:VVV.u

google.com

\windows\

sfc_os.dll

wininit.exe

winlogon.exe

dllcache\winlogon.exe

explorer.exe

dllcache\explorer.exe

z.exe

.datj

5xplorer.exe

opera.exe

firefox.exe

chrome.exe

8.texu5

cryptbase.dll

sysprep.exe

8.datu

9(999(((

((''((((999

998;:=<?>10325476)( *-,/.! #"%$'&

9'999™95999?999

<-&9)9999

<{%9)9999

<%&9)9999

M%S9S9S9Q&969i

.text

`.rdata

@.data

.reloc

dll.dll

%System%\dll

fchrome.exe

lkb.dll

mgoogle.com

\cryptbase.dll

Explorer.EXE_1684_rwx_01FF0000_00001000:

.text

`.data

.reloc

Explorer.EXE_1684_rwx_021E0000_00010000:

U8VSSh

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   Done.exe:1608
   rundll32.exe:2644
   %original file name%.exe:312
   WinInstall.exe:1056
   ntvdm.exe:680
   E4U.exe:1068
   IC.exe:524
   EuroP.exe:768
   SLFAT.exe:1664
   _tbp.exe:1964
   

3. Delete the original Trojan file.
   
4. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@quickdomainfwd[1].txt (178 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\js3[1].js (2843 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\xt.exe (1286 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\numArrow[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\12224[1].htm (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\min[1].js (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\min[2].js (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\quickdomainfwd[1].net&pid=9PO755G95 (388 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\track[1].htm (0 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\quickdomainfwd[1].htm (12 bytes)
   %Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\px[1].js (346 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\px[1].js (346 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\searchIcon[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\WinInstall.exe (1552 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsuB.tmp (45 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\Gi.exe (2392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\ic8.exe (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp (14400 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\SLFAT.exe (12024 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\EuroP.exe (2392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\_tbp.exe (3312 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\Rich.exe (2392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\tenn2.exe (12 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\E4U.exe (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\IC.exe (4992 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style[1].css (829 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\skenzo[1].css (345 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\sale_simple[1].png (980 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\saledefault[1].css (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\px[2].js (692 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\quickdomainfwd[1].com&pid=9PO755G95 (512 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\min[1].js (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\quickdomainfwd[1].htm (13 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery-2.1.4.min[1].js (39035 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\searchIcon[2].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\park.lwken[1].htm (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\min[2].js (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\stb1.exe (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\willwnd.exe (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsrF.tmp (1568 bytes)
   %WinDir%\Temp\scs11.tmp (33872 bytes)
   %Documents and Settings%\%current user%\Local Settings\APPLICATION DATA (4 bytes)
   %WinDir%\WinSxS (8 bytes)
   %WinDir%\Fonts (192 bytes)
   %WinDir%\Temp\Perflib_Perfdata_7b4.dat (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsq7.tmp (4185 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (1596 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\GDIPFONTCACHEV1.DAT (400 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\~DF4655.tmp (4 bytes)
   %WinDir%\Microsoft.NET\Framework\v2.0.50727\CONFIG (4 bytes)
   C:\$Directory (1660 bytes)
   %System% (3016 bytes)
   %Program Files% (100 bytes)
   %WinDir%\assembly (4 bytes)
   %WinDir%\Temp\scs12.tmp (10145 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (484 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4.tmp (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Scv..bat (166 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\7za.exe (18424 bytes)
   %Documents and Settings%\%current user%\Application Data\Done.exe (1856 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\a1.7z (5 bytes)
   %WinDir%\wuto60.dll (90 bytes)

5. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Ihoragiqinicim" = "rundll32.exe %WinDir%\wuto60.dll,Startup"

6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.