Trojan.GenericKD.3278367_515def999f
Trojan.Win32.Patched.ir (Kaspersky), Trojan.GenericKD.3278367 (B) (Emsisoft), Trojan.GenericKD.3278367 (AdAware), Trojan.Win32.IEDummy.FD, GenericAutorunWorm.YR (Lavasoft MAS)
Behaviour: Trojan, Worm, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
| Requires JavaScript enabled! |
|---|
MD5: 515def999ffc28d780d2587245f4168f
SHA1: ede3390bf6b015dbe92e5a5ebb1345436a8062f8
SHA256: 68e0bf46d660a9d93f40a0745e8379d49a39d679d8cccb5920fc20ab5ef271b8
SSDeep: 12288:5l8GskSBnHw6GDytmxuVcBQPKGO/Yt/783hPdIpG6TL:H1skyHw6GDXxueQSGMYZ7WhPdKPTL
Size: 559862 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: BorlandDelphi30, PolyEnE001byLennartHedlund, UPolyXv05_v6
Company:
Created at: 2003-03-06 01:13:56
Analyzed on: WindowsXP SP3 32-bit
Summary:
Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Payload
| Behaviour | Description |
|---|---|
| WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Trojan creates the following process(es):
logogo.exe:1768
logogo.exe:476
1_.ii:1252
1_.ii:1936
The Trojan injects its code into the following process(es):
%original file name%.exe:388
logogo.exe:1188
Mutexes
The following mutexes were created/opened:
No objects were found.
File activity
The process %original file name%.exe:388 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\_MSI5166._IS (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is1.tmp (0 bytes)
The process logogo.exe:1768 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%WinDir%\system\SYSTEM64.tmp (0 bytes)
The Trojan deletes the following file(s):
%WinDir%\system\SYSTEM64.tmp (0 bytes)
The process logogo.exe:476 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\system\SYSTEM64.tmp (0 bytes)
The Trojan deletes the following file(s):
%WinDir%\system\SYSTEM64.vxd (0 bytes)
%WinDir%\system\SYSTEM64.tmp (0 bytes)
The process logogo.exe:1188 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\setup.exe (78 bytes)
C:\autorun.inf (255 bytes)
The Trojan deletes the following file(s):
%WinDir%\win.log (0 bytes)
C:\autorun.inf (0 bytes)
The process 1_.ii:1936 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\system\logogo.exe (26 bytes)
Registry activity
The process %original file name%.exe:388 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 18 4A 05 5E 31 BD 1F 29 7F C1 0B 13 D0 7F 8F"
The process logogo.exe:1768 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BE EE 6A 01 19 A9 7C AA BA 5E D7 02 0E 90 11 DD"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process logogo.exe:476 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 21 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AC 0F 2E 04 64 F2 5D D9 49 B2 7D E2 52 9D D6 28"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process logogo.exe:1188 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "21 2E D3 58 63 9A 18 3C ED E7 78 68 A8 81 38 B0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"logogo" = "%WinDir%\system\logogo.exe"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The process 1_.ii:1252 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F7 B4 FB 5C EB 2C DA 09 C3 77 D7 13 B7 1D 7D 7D"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The process 1_.ii:1936 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "22 93 E6 C3 A6 D1 71 A2 EF DA 23 96 BB C6 2C CF"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
Dropped PE files
| MD5 | File path |
|---|---|
| cf90e50bbda8df2f248f3df37c4cd6a7 | c:\WINDOWS\system\logogo.exe |
| cf90e50bbda8df2f248f3df37c4cd6a7 | c:\setup.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.
VersionInfo
Company Name: InstallShield Software Corporation
Product Name: Multimedia Card Reader
Product Version: 1.06.5
Legal Copyright: Copyright (C) 2003 InstallShield Software Corp.
Legal Trademarks:
Original Filename: setup.exe
Internal Name: setup.exe
File Version: 1.06.5
File Description: Setup Launcher
Comments:
Language: Language Neutral
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 135710 | 139264 | 4.49413 | 4aff926f380b2391f3b9093a79a095e8 |
| .rdata | 143360 | 15848 | 16384 | 3.59906 | 1504b9b9e70646cdef104bc67d395171 |
| .data | 159744 | 37368 | 20480 | 2.16402 | c9c0d29eed2a639d4dec831e92767b12 |
| .rsrc | 200704 | 41696 | 45056 | 5.01856 | a85b12c24343bb8ed8750725bcf6df4d |
| .lea | 245760 | 27034 | 28672 | 4.23347 | e7a9a3de4b3ef85f5a263ac28e1616cc |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
URLs
No activity has been detected.
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Web Traffic was not found.
The Trojan connects to the servers at the folowing location(s):
.text
`.rdata
@.data
.rsrc
@.lea
t%SWVVVVVVh
SSSSh0u
SShxuB
SShpuB
SShhuB
SShPuB
PSSSSSSh
__MSVCRT_HEAP_SELECT
user32.dll
VERSION.dll
SHELL32.dll
COMCTL32.dll
GetWindowsDirectoryA
KERNEL32.dll
MsgWaitForMultipleObjects
ExitWindowsEx
USER32.dll
GDI32.dll
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegDeleteKeyA
ADVAPI32.dll
ole32.dll
OLEAUT32.dll
GetCPInfo
RegOpenKeyA
NO_KEY_VALUE
_ISMSIDEL.INI
CmdLine
hXXps://
hXXp://
PTF://
Referer: %s
wintrust.dll
WTHelperGetProvCertFromChain
CertCompareCertificate
crypt32.dll
Forcing item moniker %s into ROT...
CLSID\%s
BetaMarker.dat
EvalMarker.dat
Setup.iss
PASSWORD
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion
Software\InstallShield\ISWI\7.0\SetupExeLog
NoSuppressRebootKey
SETUPEXEDIR
CertKey
ISScript.Msi
SupportOS
dotnetredistSp2.exe
langpack.exe
Microsoft(R) .NET Framework
J#CmdLine
/jscmd:
DotNetLangPackCmd
/langcmd:"/c:\"
DotNetFxCmd
vjredist.exe
dotnetredist.exe
dotnetfx.exe
Software\Microsoft\Windows\CurrentVersion\Installer
ISScript8.Msi
%s /a "%s"%s
%s /f%s "%s" %s
%s /j%s "%s" %s
%s /x "%s" %s
/p"%s" %s
%s /p "%s" %s
%s /i "%s" %s
%s %s
%s="%s"
%s TRANSFORMS="%s"
%s%s%s;%s
"%s" %s /l%d /t"%s" /e"%s" /v"%s" %s
"%s" /k %s /l%d /t"%s" /e"%s" /w /v"%s" %s
Software\Microsoft\Windows\CurrentVersion\RunOnce
Software\Microsoft\Windows\CurrentVersion\RunOnceEx
SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries
System\CurrentControlSet\Control\Windows
1.20.1827.0
Msi.DLL
"%s" /c:"msiinst /delayrebootq"
"%s" /q
2.0.2600.0
%s /g %s /g %s
%s /g %s /g %s /s
4.70.0.1300
WinInet.dll
SHFolder.dll
Software\Microsoft\Windows\CurrentVersion\Uninstall\%s
{31EE4FE8-7F9C-11D5-ABB8-00B0D02332EB}{7E76A8D6-33D1-0032-16C3-4593092861D0}{E7E2C871-090A-C372-F9AE-C3C6A988D260}{6741C120-01BA-87F9-8734-5FB9DA8A4445}d.d %s%s
DataCabInSetupExe
Data.Cab
Setup.skin
MSIEXEC.EXE
INSTMSIW.EXE
INSTMSIA.EXE
Setup.INI
Setup.bmp
msi.dll
0x0%s.ini
%s"%s"
%s /q"%s" %s
CloneSetupExe
.rdata
.debug
%d: %s
%s,%u
%u.%u.%u.%u
InternetCanonicalizeUrlA
HttpEndRequestA
HttpSendRequestExA
HttpSendRequestA
HttpOpenRequestA
FtpFindFirstFileA
HttpQueryInfoA
InternetCreateUrlA
InternetCrackUrlA
InternetOpenUrlA
wininet.dll
RPAWINET.DLL
AutoConfigURL
Software\Microsoft\Windows\CurrentVersion\Internet Settings
netscape.exe
FTP_ProxyPort
FTP_Proxy
HTTPS_ProxyPort
HTTPS_Proxy
https=
HTTP_ProxyPort
HTTP_Proxy
http=
\prefs.js
\nsreg.dat
"network.proxy.autoconfig_url"
"network.proxy.no_proxies_on"
"network.proxy.ftp_port"
"network.proxy.ftp"
"network.proxy.ssl_port"
"network.proxy.ssl"
"network.proxy.http_port"
"network.proxy.http"
network.proxy.type
Range: bytes=%d-
zcÁ
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\_is1
c:\Setup.INI
c:\%original file name%.exe
version="1.0.0.0"
name="InstallShield.Setup"
<description>InstallShield.Setup</description>
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
!"#$%&'()* ,
(%U#n
.aFg\3z
WinExec
1_.ii
MZKERNEL32.DLL
.Upack
=%Us9
sPTF://
nSoftware\Microsoft\Active Setup\Installed Components\%s
{1C370964-514B-321C-7237-2B4FD86D8568}{021122EA-49DC-4aeb-9D15-DCEAD9BAB1BC}{F1B13231-13BE-1231-5401-486BA763DEB6}{F279058C-50B2-4BE4-60C9-369CACF06821}{78705f0d-e8db-4b2d-8193-982bdda15ecd}{9B29D757-088E-E8C9-2535-AA319B92C00A}%*.*f
1.06.5
setup.exe
1.06.5
Please enter the password
Password:
/Error extracting '%s' to the temporary location'Error reading setup initialization file
WS\system32\cmd.exe
cmd.exe
cmd.exe2
%System%\cmd.exe
D:\AlCS3TW\Adobe Illustrator CS3
\vcredist_x86_2.0.50727.762.exe
%original file name%.exe_388_rwx_0043C000_00001000:
WinExec
1_.ii
MZKERNEL32.DLL
.Upack
.rsrc
=%Us9
%original file name%.exe_388_rwx_00442000_00001000:
D:\AlCS3TW\Adobe Illustrator CS3
\vcredist_x86_2.0.50727.762.exe
logogo.exe_1188:
MZKERNEL32.DLL
.Upack
.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
1_.ii
CA.exe NMCOSrv.exe CONFIG.exe Updater.exe WE8.exe settings.exe PES5.exe PES6.exe zhengtu.exenettools.exe laizi.exe proxy.exe Launcher.exe WoW.exe Repair.exe BackgroundDownloader.exeo2_unins_web.exe O2Jam.exe O2JamPatchClient.exe O2ManiaDriverSelect.exe OTwo.exe sTwo.exeGAME2.EXE GAME3.EXE Game4.exe game.exe hypwise.exe Roadrash.exe O2Mania.exe Lobby_Setup.exeCoralQQ.exe QQ.exe QQexternal.exe BugReport.exe tm.exe ra2.exe ra3.exe ra4.exe ra21006ch.exedzh.exe Findbug.EXE fb3.exe Meteor.exe mir.exe KartRider.exe NMService.exe AdBalloonExt.exeztconfig.exe patchupdate.exe
setup.exe
autorun.inf
shellexecute=
win.log
*.exe /
KERNEL32.DLL
IEXPLORE.EXE
cmd /c erase /A:RHSA "
"&cmd /c del "
hXXp://web.858656.com/120/tj10.htm
logo_1.exe
logo1_.exe
inudhya.dll
logogo.exe
SYSTEM64.tmp
SYSTEM64.vxd
hXXp://web.858656.com/120/tj.htm
SoftWare\Microsoft\Windows\CurrentVersion\Run
=%Us9
KWindows
GetProcessHeap
USER32.DLL
ADVAPI32.DLL
RegCreateKeyExA
RegCloseKey
PeekNamedPipe
GetWindowsDirectoryA
CreatePipe
SHLWAPI.DLL
SHELL32.DLL
ShellExecuteA
WS\system32\cmd.exe
cmd.exe
cmd.exe2
%System%\cmd.exe
D:\AlCS3TW\Adobe Illustrator CS3
\vcredist_x86_2.0.50727.762.exe
logogo.exe_1188_rwx_00401000_00014000:
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
1_.ii
CA.exe NMCOSrv.exe CONFIG.exe Updater.exe WE8.exe settings.exe PES5.exe PES6.exe zhengtu.exenettools.exe laizi.exe proxy.exe Launcher.exe WoW.exe Repair.exe BackgroundDownloader.exeo2_unins_web.exe O2Jam.exe O2JamPatchClient.exe O2ManiaDriverSelect.exe OTwo.exe sTwo.exeGAME2.EXE GAME3.EXE Game4.exe game.exe hypwise.exe Roadrash.exe O2Mania.exe Lobby_Setup.exeCoralQQ.exe QQ.exe QQexternal.exe BugReport.exe tm.exe ra2.exe ra3.exe ra4.exe ra21006ch.exedzh.exe Findbug.EXE fb3.exe Meteor.exe mir.exe KartRider.exe NMService.exe AdBalloonExt.exeztconfig.exe patchupdate.exe
setup.exe
autorun.inf
shellexecute=
win.log
*.exe /
KERNEL32.DLL
IEXPLORE.EXE
cmd /c erase /A:RHSA "
"&cmd /c del "
hXXp://web.858656.com/120/tj10.htm
logo_1.exe
logo1_.exe
inudhya.dll
logogo.exe
SYSTEM64.tmp
SYSTEM64.vxd
hXXp://web.858656.com/120/tj.htm
SoftWare\Microsoft\Windows\CurrentVersion\Run
MZKERNEL32.DLL
.Upack
.rsrc
=%Us9
KWindows
GetProcessHeap
USER32.DLL
ADVAPI32.DLL
RegCreateKeyExA
RegCloseKey
PeekNamedPipe
GetWindowsDirectoryA
CreatePipe
SHLWAPI.DLL
SHELL32.DLL
ShellExecuteA
WS\system32\cmd.exe
cmd.exe
cmd.exe2
%System%\cmd.exe
D:\AlCS3TW\Adobe Illustrator CS3
\vcredist_x86_2.0.50727.762.exe
iexplore.exe_1884:
%?9-*09,*19}*09
.text
`.data
.rsrc
msvcrt.dll
KERNEL32.dll
NTDLL.DLL
USER32.dll
SHLWAPI.dll
SHDOCVW.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
rsabase.dll
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
watson.microsoft.com
IEWatsonURL
%s -h %u
iedw.exe
Iexplore.XPExceptionFilter
jscript.DLL
mshtml.dll
mlang.dll
urlmon.dll
wininet.dll
shdocvw.DLL
browseui.DLL
comctl32.DLL
IEXPLORE.EXE
iexplore.pdb
ADVAPI32.dll
MsgWaitForMultipleObjects
IExplorer.EXE
IIIIIB(II<.Fg
7?_____ZZSSH%
)z.UUUUUUUU
,....Qym
````2```
{.QLQIIIKGKGKGKGKGKG;33;33;0
8888880
8887080
browseui.dll
shdocvw.dll
6.00.2900.5512 (xpsp.080413-2105)
Windows
Operating System
6.00.2900.5512
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
logogo.exe:1768
logogo.exe:476
1_.ii:1252
1_.ii:1936 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%WinDir%\system\SYSTEM64.tmp (0 bytes)
C:\setup.exe (78 bytes)
C:\autorun.inf (255 bytes)
%WinDir%\system\logogo.exe (26 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"logogo" = "%WinDir%\system\logogo.exe" - Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
