Trojan.GenericKD.3278476_e090554364
Trojan.Win32.Patched.ir (Kaspersky), Trojan.GenericKD.3278476 (B) (Emsisoft), Trojan.GenericKD.3278476 (AdAware), Trojan.Win32.IEDummy.FD, GenericAutorunWorm.YR (Lavasoft MAS)
Behaviour: Trojan, Worm, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
| Requires JavaScript enabled! |
|---|
MD5: e09055436424a717cfb91016dd756305
SHA1: c84790aceedfb2e4edd4d0700d8100f79a4f01c6
SHA256: 41a0e73111b3f2141043cd181206d0212c0604e67de784e2ac7abfc32037f8d1
SSDeep: 12288:WOi0kg7r g9DBtmxuVJBQPKGO/Yt/783hPdIpG6TcYK2fDxnv0:A0/3 g9DCxu5QSGMYZ7WhPdKPTc4NM
Size: 615291 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: BorlandDelphi30, PolyEnE001byLennartHedlund, UPolyXv05_v6
Company: no certificate found
Created at: 2003-04-11 00:51:10
Analyzed on: WindowsXP SP3 32-bit
Summary:
Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Payload
| Behaviour | Description |
|---|---|
| WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Trojan creates the following process(es):
1_.ii:1676
1_.ii:1648
logogo.exe:1932
logogo.exe:1232
The Trojan injects its code into the following process(es):
logogo.exe:844
%original file name%.exe:560
Mutexes
The following mutexes were created/opened:
ShimCacheMutex
File activity
The process 1_.ii:1676 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\system\logogo.exe (26 bytes)
The process logogo.exe:1932 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\system\SYSTEM64.tmp (0 bytes)
The Trojan deletes the following file(s):
%WinDir%\system\SYSTEM64.tmp (0 bytes)
The process logogo.exe:844 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\setup.exe (78 bytes)
C:\autorun.inf (255 bytes)
The Trojan deletes the following file(s):
%WinDir%\win.log (0 bytes)
C:\autorun.inf (0 bytes)
The process logogo.exe:1232 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\system\SYSTEM64.tmp (0 bytes)
The Trojan deletes the following file(s):
%WinDir%\system\SYSTEM64.vxd (0 bytes)
%WinDir%\system\SYSTEM64.tmp (0 bytes)
The process %original file name%.exe:560 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\_MSI5166._IS (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_is1.tmp (0 bytes)
Registry activity
The process 1_.ii:1676 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 A5 15 ED 95 FA CD 3E 1C 39 A6 C7 DC C2 85 C4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The process 1_.ii:1648 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6B BF 4F 8B B8 0A 34 80 9A B8 32 99 91 95 27 42"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The process logogo.exe:1932 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7F F3 17 17 90 70 F4 76 A6 59 92 5C 13 BF CE 09"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process logogo.exe:844 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "25 56 0E 71 85 84 2E 22 D4 F8 CD 84 F0 8D 0A DB"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"logogo" = "%WinDir%\system\logogo.exe"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The process logogo.exe:1232 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B7 96 6B 57 8F 16 B3 A5 0D 03 F6 C1 9F EA 63 FB"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process %original file name%.exe:560 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "53 EB 74 C6 07 15 91 A3 3C 72 FF C5 A1 79 91 BE"
Dropped PE files
| MD5 | File path |
|---|---|
| cf90e50bbda8df2f248f3df37c4cd6a7 | c:\WINDOWS\system\logogo.exe |
| cf90e50bbda8df2f248f3df37c4cd6a7 | c:\setup.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.
VersionInfo
Company Name: Software Provider
Product Name: Multimedia Keyboard
Product Version: 2.0
Legal Copyright: Copyright (C) 2003 InstallShield Software Corp.
Legal Trademarks:
Original Filename: setup.exe
Internal Name: setup.exe
File Version: 2.0
File Description: Setup Launcher
Comments:
Language: English (United States)
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 135758 | 139264 | 4.49592 | f96bfe7b22d758523bf84addd2b273bf |
| .rdata | 143360 | 15848 | 16384 | 3.5958 | 8f1ec722899c5ceb4512f01c7703a05d |
| .data | 159744 | 37368 | 20480 | 2.16432 | d36eea8062de8d70028e5fcbe15b833c |
| .rsrc | 200704 | 41696 | 45056 | 5.01794 | 4f2002b6bc86f14cc05c14a15874d8b7 |
| .lea | 245760 | 27034 | 28672 | 4.23347 | 7c0aa76aaf286d1550dfa48ca8ecfbbe |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 1
7e58db8868e7d942cc34f8c3a44d59c7
URLs
No activity has been detected.
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Web Traffic was not found.
The Trojan connects to the servers at the folowing location(s):
.text
`.rdata
@.data
.rsrc
@.lea
t%SWVVVVVVh
SSSSh0u
SShxuB
SShpuB
SShhuB
SShPuB
PSSSSSSh
__MSVCRT_HEAP_SELECT
user32.dll
VERSION.dll
SHELL32.dll
COMCTL32.dll
GetWindowsDirectoryA
KERNEL32.dll
MsgWaitForMultipleObjects
ExitWindowsEx
USER32.dll
GDI32.dll
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegDeleteKeyA
ADVAPI32.dll
ole32.dll
OLEAUT32.dll
GetCPInfo
RegOpenKeyA
NO_KEY_VALUE
_ISMSIDEL.INI
CmdLine
hXXps://
hXXp://
PTF://
Referer: %s
wintrust.dll
WTHelperGetProvCertFromChain
CertCompareCertificate
crypt32.dll
Forcing item moniker %s into ROT...
CLSID\%s
BetaMarker.dat
EvalMarker.dat
Setup.iss
PASSWORD
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion
Software\InstallShield\ISWI\7.0\SetupExeLog
NoSuppressRebootKey
SETUPEXEDIR
CertKey
ISScript.Msi
SupportOS
dotnetredistSp2.exe
langpack.exe
Microsoft(R) .NET Framework
J#CmdLine
/jscmd:
DotNetLangPackCmd
/langcmd:"/c:\"
DotNetFxCmd
vjredist.exe
dotnetredist.exe
dotnetfx.exe
Software\Microsoft\Windows\CurrentVersion\Installer
ISScript8.Msi
%s /a "%s"%s
%s /f%s "%s" %s
%s /j%s "%s" %s
%s /x "%s" %s
/p"%s" %s
%s /p "%s" %s
%s /i "%s" %s
%s %s
%s="%s"
%s TRANSFORMS="%s"
%s%s%s;%s
"%s" %s /l%d /t"%s" /e"%s" /v"%s" %s
"%s" /k %s /l%d /t"%s" /e"%s" /w /v"%s" %s
Software\Microsoft\Windows\CurrentVersion\RunOnce
Software\Microsoft\Windows\CurrentVersion\RunOnceEx
SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries
System\CurrentControlSet\Control\Windows
1.20.1827.0
Msi.DLL
"%s" /c:"msiinst /delayrebootq"
"%s" /q
2.0.2600.0
%s /g %s /g %s
%s /g %s /g %s /s
4.70.0.1300
WinInet.dll
SHFolder.dll
Software\Microsoft\Windows\CurrentVersion\Uninstall\%s
{31EE4FE8-7F9C-11D5-ABB8-00B0D02332EB}{7E76A8D6-33D1-0032-16C3-4593092861D0}{E7E2C871-090A-C372-F9AE-C3C6A988D260}{6741C120-01BA-87F9-8734-5FB9DA8A4445}d.d %s%s
DataCabInSetupExe
Data.Cab
Setup.skin
MSIEXEC.EXE
INSTMSIW.EXE
INSTMSIA.EXE
Setup.INI
Setup.bmp
msi.dll
0x0%s.ini
%s"%s"
%s /q"%s" %s
CloneSetupExe
.rdata
.debug
%d: %s
%s,%u
%u.%u.%u.%u
InternetCanonicalizeUrlA
HttpEndRequestA
HttpSendRequestExA
HttpSendRequestA
HttpOpenRequestA
FtpFindFirstFileA
HttpQueryInfoA
InternetCreateUrlA
InternetCrackUrlA
InternetOpenUrlA
wininet.dll
RPAWINET.DLL
AutoConfigURL
Software\Microsoft\Windows\CurrentVersion\Internet Settings
netscape.exe
FTP_ProxyPort
FTP_Proxy
HTTPS_ProxyPort
HTTPS_Proxy
https=
HTTP_ProxyPort
HTTP_Proxy
http=
\prefs.js
\nsreg.dat
"network.proxy.autoconfig_url"
"network.proxy.no_proxies_on"
"network.proxy.ftp_port"
"network.proxy.ftp"
"network.proxy.ssl_port"
"network.proxy.ssl"
"network.proxy.http_port"
"network.proxy.http"
network.proxy.type
Range: bytes=%d-
zcÁ
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\_is1
c:\Setup.INI
c:\%original file name%.exe
version="1.0.0.0"
name="InstallShield.Setup"
<description>InstallShield.Setup</description>
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
!"#$%&'()* ,
(%U#n
.aFg\3z
WinExec
1_.ii
MZKERNEL32.DLL
.Upack
=%Us9
sPTF://
nSoftware\Microsoft\Active Setup\Installed Components\%s
{1C370964-514B-321C-7237-2B4FD86D8568}{021122EA-49DC-4aeb-9D15-DCEAD9BAB1BC}{F1B13231-13BE-1231-5401-486BA763DEB6}{F279058C-50B2-4BE4-60C9-369CACF06821}{78705f0d-e8db-4b2d-8193-982bdda15ecd}{9B29D757-088E-E8C9-2535-AA319B92C00A}%*.*f
setup.exe
Multimedia Keyboard
Please enter the password
Password:
/Error extracting '%s' to the temporary location'Error reading setup initialization file
WS\system32\cmd.exe
cmd.exe
cmd.exe2
%System%\cmd.exe
D:\AlCS3TW\Adobe Illustrator CS3
\vcredist_x86_2.0.50727.762.exe
%original file name%.exe_560_rwx_0043C000_00001000:
WinExec
1_.ii
MZKERNEL32.DLL
.Upack
.rsrc
=%Us9
%original file name%.exe_560_rwx_00442000_00001000:
D:\AlCS3TW\Adobe Illustrator CS3
\vcredist_x86_2.0.50727.762.exe
logogo.exe_844:
MZKERNEL32.DLL
.Upack
.rsrc
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
1_.ii
CA.exe NMCOSrv.exe CONFIG.exe Updater.exe WE8.exe settings.exe PES5.exe PES6.exe zhengtu.exenettools.exe laizi.exe proxy.exe Launcher.exe WoW.exe Repair.exe BackgroundDownloader.exeo2_unins_web.exe O2Jam.exe O2JamPatchClient.exe O2ManiaDriverSelect.exe OTwo.exe sTwo.exeGAME2.EXE GAME3.EXE Game4.exe game.exe hypwise.exe Roadrash.exe O2Mania.exe Lobby_Setup.exeCoralQQ.exe QQ.exe QQexternal.exe BugReport.exe tm.exe ra2.exe ra3.exe ra4.exe ra21006ch.exedzh.exe Findbug.EXE fb3.exe Meteor.exe mir.exe KartRider.exe NMService.exe AdBalloonExt.exeztconfig.exe patchupdate.exe
setup.exe
autorun.inf
shellexecute=
win.log
*.exe /
KERNEL32.DLL
IEXPLORE.EXE
cmd /c erase /A:RHSA "
"&cmd /c del "
hXXp://web.858656.com/120/tj10.htm
logo_1.exe
logo1_.exe
inudhya.dll
logogo.exe
SYSTEM64.tmp
SYSTEM64.vxd
hXXp://web.858656.com/120/tj.htm
SoftWare\Microsoft\Windows\CurrentVersion\Run
=%Us9
KWindows
GetProcessHeap
USER32.DLL
ADVAPI32.DLL
RegCreateKeyExA
RegCloseKey
PeekNamedPipe
GetWindowsDirectoryA
CreatePipe
SHLWAPI.DLL
SHELL32.DLL
ShellExecuteA
WS\system32\cmd.exe
cmd.exe
cmd.exe2
%System%\cmd.exe
D:\AlCS3TW\Adobe Illustrator CS3
\vcredist_x86_2.0.50727.762.exe
logogo.exe_844_rwx_00401000_00014000:
Portions Copyright (c) 1999,2003 Avenger by NhT
kernel32.dll
1_.ii
CA.exe NMCOSrv.exe CONFIG.exe Updater.exe WE8.exe settings.exe PES5.exe PES6.exe zhengtu.exenettools.exe laizi.exe proxy.exe Launcher.exe WoW.exe Repair.exe BackgroundDownloader.exeo2_unins_web.exe O2Jam.exe O2JamPatchClient.exe O2ManiaDriverSelect.exe OTwo.exe sTwo.exeGAME2.EXE GAME3.EXE Game4.exe game.exe hypwise.exe Roadrash.exe O2Mania.exe Lobby_Setup.exeCoralQQ.exe QQ.exe QQexternal.exe BugReport.exe tm.exe ra2.exe ra3.exe ra4.exe ra21006ch.exedzh.exe Findbug.EXE fb3.exe Meteor.exe mir.exe KartRider.exe NMService.exe AdBalloonExt.exeztconfig.exe patchupdate.exe
setup.exe
autorun.inf
shellexecute=
win.log
*.exe /
KERNEL32.DLL
IEXPLORE.EXE
cmd /c erase /A:RHSA "
"&cmd /c del "
hXXp://web.858656.com/120/tj10.htm
logo_1.exe
logo1_.exe
inudhya.dll
logogo.exe
SYSTEM64.tmp
SYSTEM64.vxd
hXXp://web.858656.com/120/tj.htm
SoftWare\Microsoft\Windows\CurrentVersion\Run
MZKERNEL32.DLL
.Upack
.rsrc
=%Us9
KWindows
GetProcessHeap
USER32.DLL
ADVAPI32.DLL
RegCreateKeyExA
RegCloseKey
PeekNamedPipe
GetWindowsDirectoryA
CreatePipe
SHLWAPI.DLL
SHELL32.DLL
ShellExecuteA
WS\system32\cmd.exe
cmd.exe
cmd.exe2
%System%\cmd.exe
D:\AlCS3TW\Adobe Illustrator CS3
\vcredist_x86_2.0.50727.762.exe
iexplore.exe_948:
%?9-*09,*19}*09
.text
`.data
.rsrc
msvcrt.dll
KERNEL32.dll
NTDLL.DLL
USER32.dll
SHLWAPI.dll
SHDOCVW.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
rsabase.dll
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
watson.microsoft.com
IEWatsonURL
%s -h %u
iedw.exe
Iexplore.XPExceptionFilter
jscript.DLL
mshtml.dll
mlang.dll
urlmon.dll
wininet.dll
shdocvw.DLL
browseui.DLL
comctl32.DLL
IEXPLORE.EXE
iexplore.pdb
ADVAPI32.dll
MsgWaitForMultipleObjects
IExplorer.EXE
IIIIIB(II<.Fg
7?_____ZZSSH%
)z.UUUUUUUU
,....Qym
````2```
{.QLQIIIKGKGKGKGKGKG;33;33;0
8888880
8887080
browseui.dll
shdocvw.dll
6.00.2900.5512 (xpsp.080413-2105)
Windows
Operating System
6.00.2900.5512
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
1_.ii:1676
1_.ii:1648
logogo.exe:1932
logogo.exe:1232 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%WinDir%\system\logogo.exe (26 bytes)
%WinDir%\system\SYSTEM64.tmp (0 bytes)
C:\setup.exe (78 bytes)
C:\autorun.inf (255 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"logogo" = "%WinDir%\system\logogo.exe" - Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
