MD5: 3c519ceb7ab1a3c0159789e488189b9c
SHA1: dff7d3b165ec769a4180de6e57cb277e4e41f1d0
SHA256: ed27776248062bd0e31808803f0d62d88d9c9b275a35efa5a47c5acc58fc4e0d
SSDeep: 1536:ARYpHXbpdF1XJfHM3S0DamJSNggHYH5rFyLvauPk0DRipYaEdmLt43mRpt :OY3dFNJPmDamJXfhWNrcpaCpt
Size: 88222 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Premium Installer
Created at: 2009-02-21 21:46:39
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:368
wuauclt.exe:304
llxicxn.exe:1516
reg.exe:560
reg.exe:1640
reg.exe:1008

The Trojan injects its code into the following process(es):

zmhb.exe:464

File activity

The process zmhb.exe:464 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\PluginInstallHelper.dll (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\inflate.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ftpprtc.dll (6584 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ckahcomm.dll (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\fsdrvplg.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\icqprtc.dll (9320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\hashsha1.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\config.esm (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\am_facade.esm (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\inifile.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\fssync.dll (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\Mail64.reg (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\content_filtering.esm (458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\instrumental.esm (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\clldr.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\imapprtc.ppl (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\btdisk.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\btimages.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\BAIDU2013.key (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\hashmd5.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\extlprtc.ppl (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\arjpack.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\DataFormats-en.xml (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\app_core_meta.dll (12536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\base64p.ppl (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ckahum.dll (8560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb4.tmp (305974 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\BDMSkin.dll (37025 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\deflate.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\httpscan.ppl (16288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\Cleanup64.reg (300 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\app_core_legacy.dll (33633 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\httpanlz.ppl (19096 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\cf_facade.dll (25112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\eka_meta.dll (9320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\filesystem_services.dll (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_assembler.esm (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\Cleanup.reg (276 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ichecker.dll (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\dns_client.dll (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\cf_anti_malware_facade.dll (11048 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\arj.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\app_core_meta.esm (449 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_facade.dll (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\instrumental_meta.dll (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_app_cat.esm (244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\filemap.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\cf_response_provider.dll (5520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\dtreg.ppl (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_integrity_control.esm (274 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_meta.esm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\Mail.reg (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\explode.ppl (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\cf_config.esm (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\imc.ppl (5064 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_facade.esm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\crpthlpr.ppl (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\app_core_legacy.esm (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\buffer.ppl (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\GetSupplyId.dll (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_meta.dll (15168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\appcat.ppl (5520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\res\InstallWnd.zip (21216 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\appinfo.kli (520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\cf_prague_adapter.ppl (11344 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\format_recognizer.dll (19152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\advdis.ppl (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ekasyswatch.dll (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\cab.ppl (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\attestation_task.dll (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\base64.ppl (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\KVInstallHelper.dll (12536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\acassembler.dll (12024 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\dmap.ppl (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\am_meta.dll (9608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_file_categorizer.esm (917 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_process_monitor.esm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\integrity_control.dll (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\avs.ppl (16944 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ckahrule.dll (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\icuio40.dll (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\System.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\am_meta.esm (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\excludemanager.dll (5064 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf3.tmp (0 bytes)

The process %original file name%.exe:368 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Start Menu\Programs\Â̶¹ä¯ÀÀÆ÷\Â̶¹ä¯ÀÀÆ÷.lnk (475 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tqomfn_70567.exe (175036 bytes)
%Documents and Settings%\%current user%\Desktop\Â̶¹ä¯ÀÀÆ÷.lnk (463 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\NSISdl.dll (14 bytes)
%Program Files%\lvdou\ico\ie.ico (17 bytes)
%Documents and Settings%\%current user%\Desktop\360°²È«ä¯ÀÀÆ÷.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\llxicxn.exe (112155 bytes)
%Documents and Settings%\%current user%\Desktop\Internet Explorer.lnk (1 bytes)
%Program Files%\lvdou\ico\anquan.ico (3 bytes)
%Program Files%\lvdou\ico\taobao.ico (2104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\zb.ini (2 bytes)
%Program Files%\lvdou\Unins.exe (363 bytes)
%Program Files%\lvdou\home.bat (689 bytes)
%Program Files%\lvdou\PopWinParam.xml (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\zb.ini.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu1.tmp (0 bytes)

The process wuauclt.exe:304 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (2232 bytes)
%WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)

The Trojan deletes the following file(s):

%WinDir%\SoftwareDistribution\DataStore\Logs\tmp.edb (0 bytes)

The process llxicxn.exe:1516 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\bw\dl.dll (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bw\BDLogicUtils.dll.bdl (42989 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bw\hu.dll (115 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Desktop\Global.db (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bw\BDMNet.dll.bdl (31488 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bw\zmhb.exe.bdl (516798 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bw\BDMNetGetInfo.dll (275 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bw\BDMReport.dll.bdl (39102 bytes)
%Documents and Settings%\All Users\Application Data\Baidu\Common\Global.db (100 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bw\BDMDownload.dll (171 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bw\helpers.7z (1791 bytes)

Registry activity

The process zmhb.exe:464 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CB F7 D8 B0 0A BC BC AB F7 0D F5 C5 08 11 C0 F0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Control\CrashControl]
"CrashDumpEnabled" = "2"

[HKLM\SOFTWARE\Baidu\BaiduSd]
"RtpFlag" = "273"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process %original file name%.exe:368 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCR\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe http://www.p100.pw"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Â̶¹ä¯ÀÀÆ÷]
"DisplayName" = "Â̶¹ä¯ÀÀÆ÷ 1.0.1.1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.p100.pw"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C6 48 22 76 E0 1F 6C A4 66 BE E7 FE B6 6B A7 DD"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Â̶¹ä¯ÀÀÆ÷]
"DisplayVersion" = "1.0.1.1"

[HKCU\Software\SOFTWARE\Policies\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.p100.pw"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Â̶¹ä¯ÀÀÆ÷]
"Publisher" = "ä¯ÀÀÆ÷Ô´Âë×Ô¶¯°æ.nsi_nsis-2.44_24406"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\lvdou]
"home.bat" = "home"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GreeDou" = "%Program Files%\lvdou\gdad.exe"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The process llxicxn.exe:1516 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "82 95 AB 40 4F A6 50 0F 7A 7C 51 3E 62 EA 85 43"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCR\metnsd\clsid]
"SequenceID" = "FA B3 15 49 1B 77 3D 47 85 1A DD CA 78 B0 83 93"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\bw]
"zmhb.exe" = "zmhb"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process reg.exe:560 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "83 C3 00 14 02 A1 68 44 42 35 A3 C4 C0 23 67 74"

[HKCU\Software\Policies\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.pz100.pw"

The process reg.exe:1640 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E2 EB 41 FF EE 89 3C EE 62 52 10 19 13 E0 35 EC"

[HKCR\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe http://www.pz100.pw"

The process reg.exe:1008 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3D 9B A6 84 8D 48 A6 66 56 B4 D5 3E 2F 00 02 6D"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.pz100.pw"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://pxsw.n.shifen.com/
hxxp://baidubrs.dlmix.glb0.lxdns.com/client/dllqq/BDLogicUtils.dll
hxxp://209.170.78.71/dl1sw.baidu.com/client/dllqq/BDLogicUtils.dll?wsiphost=ipdb
hxxp://bcs.jomodns.com/sw-search-shadu/client/dllv4/BDMReport.dll
hxxp://baidubrs.dlmix.glb0.lxdns.com/client1/common/patch/16101830722/BDMNet.dll
hxxp://209.170.78.71/dl1sw.baidu.com/client1/common/patch/16101830722/BDMNet.dll?wsiphost=ipdb
hxxp://sxsw.n.shifen.com/
hxxp://baidubrs.dlmix.glb0.lxdns.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe
hxxp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb
hxxp://dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe	117.21.189.102
hxxp://dl1sw.baidu.com/client/dllqq/BDLogicUtils.dll	117.21.189.102
hxxp://dlsw.baidu.com/sw-search-shadu/client/dllv4/BDMReport.dll	61.155.165.27
hxxp://s.x.baidu.com/	180.76.2.46
hxxp://p.x.baidu.com/	123.125.65.152
hxxp://dl1sw.baidu.com/client1/common/patch/16101830722/BDMNet.dll	117.21.189.102
tk.download.iyuntian.com	123.125.69.209
rc.download.iyuntian.com	123.125.65.153
down.cnlww.org	222.186.60.2
res.download.iyuntian.com	123.125.65.129
dtrp.download.iyuntian.com	123.125.65.150
utk.download.iyuntian.com	123.125.65.147
cfg.download.iyuntian.com	123.125.65.132
res2.download.iyuntian.com
res3.download.iyuntian.com

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected

Traffic

GET /client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dl1sw.baidu.com

Range: bytes=917504-

Referer: hXXp://dl1sw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.0 302 Found

Cache-Control: no-cache

Connection: close

Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb

GET /client/dllqq/BDLogicUtils.dll HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dl1sw.baidu.com

Referer: hXXp://dl1sw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.0 302 Found

Cache-Control: no-cache

Connection: close

Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/dllqq/BDLogicUtils.dll?wsiphost=ipdb

GET /client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dl1sw.baidu.com

Range: bytes=8388608-

Referer: hXXp://dl1sw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.0 302 Found

Cache-Control: no-cache

Connection: close

Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb

GET /dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: 209.170.78.71

Range: bytes=15597568-

Referer: hXXp://dl1sw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.0 206 Partial Content

Expires: Fri, 30 May 2014 07:17:39 GMT

Date: Wed, 30 Apr 2014 07:17:39 GMT

Server: nginx

Content-Type: application/octet-stream

Last-Modified: Mon, 21 Apr 2014 18:43:49 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

Content-Range: bytes 15597568-30231023/30231024

Content-Length: 14633456

Age: 19203

Via: 1.0 wzpy200:80 (Cdn Cache Server V2.0), 1.0 fra71:8888 (Cdn Cache Server V2.0)

Connection: keep-alive

Content-Disposition: attachment;filename="Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe"
..C..H..3T.?Y.(h....v5&.(.y...e!..1c..R@f_#Q.\........._^uW..3...../..
....(.<!...".`.u.@..(.P9./.....y..........$.`[email protected]..;.....xT.0
..=T.>.(LQ,.H...=.........GM........ra.).. y.X:....m ...&...3\...V.
..R....r.\...2}.P......!TEuPz.5.............z.vN*.Tg....W.A...9J.....,
..Q"... ...ep.r4........!.I.....C`.......Cs..*.. ...o......t.&A..O. .z
-e...#s......&X?........}.5.&.9 03W....E.uU...=.; ..H* .|Gd...=B.;..(.
.p...,.[T....a...t.j..B....q.! C=.....D..qT..w.wq.g.Cu.5..!..J.$0C(...
..Fi.4!..........a.h.%..L]g.F^5. "...b.....2.....l.....V... n.......U.
}.!D.Zab..........L..4.)!.N.CX.h.-c.2..|......D1\\,.....p.S&j8.,p..."B
Iv.d.. .)$..Fq....@.?....._.oP..._B>. .!f.1.2.......?Q.Q..P.3..j..&
lt;...l.....UP.FH....E m.\t5U8.../...U...^..j...l..#.Jz..T..E#NV....XT
K.....G..H5..2VX7-.12..s... .#..p....!.......MN....l..({.:..b.J b'....
..S...=J".X3..4H#B.G.....)..VS1..T...Q3 i.x....^.m....ItS..p...5t.....
..r.I.....f.|.....t..)..n7.....5Y.#..^^.d.r.o.#.s.....Z.:....YP.`...Vl
.NTo....4........M..6......j..=.....}..3"\sy........n..h.."...iPk?.o{.
.'7]..w..D......Fj{.P.9..Ve..6}B...defg.l.JU6"v....t3.R1...4e.B@......
.$f.m..>.T..5.O...h,.f).9v_[@...s.N.$X.a!.PG.m.E..f5......i..r0.IK.
..E.v..zH>x..........u..> 1B.>..(Vi..?g..b.......k....z.u.0.=
.B........`.[}..|....!_).B...t....Af\.....{.Y.J9..E.O ....y. u0,..Q=.O
....).,[V....>.5...........~Z..."s...2..&..>...D.(u...."FM.....=
..PWrR.!....g.#.(.....dR..C..\........j.jI0....^.>..A..z.).c.......
3.{....1.?.~..I...o[.3..Z..,.o}?X..0..6..D$...'.?..& %b..X...M9V.F
<<< skipped >>>

GET /client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dl1sw.baidu.com

Range: bytes=2228224-

Referer: hXXp://dl1sw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.0 302 Found

Cache-Control: no-cache

Connection: close

Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb

GET /client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dl1sw.baidu.com

Range: bytes=8257536-

Referer: hXXp://dl1sw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.0 302 Found

Cache-Control: no-cache

Connection: close

Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb

GET /dl1sw.baidu.com/client1/common/patch/16101830722/BDMNet.dll?wsiphost=ipdb HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: 209.170.78.71

Referer: hXXp://dl1sw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.0 200 OK

Expires: Tue, 27 May 2014 09:24:38 GMT

Date: Sun, 27 Apr 2014 09:24:38 GMT

Server: nginx

Content-Type: application/octet-stream

Content-Length: 1176520

Last-Modified: Thu, 27 Mar 2014 06:30:30 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

Age: 270775

Via: 1.0 wzpy200:80 (Cdn Cache Server V2.0), 1.0 fra71:8888 (Cdn Cache Server V2.0)

Connection: keep-alive

Content-Disposition: attachment;filename="BDMNet.dll"
MZ......................@................/............................
..!..L.!This program cannot be run in DOS mode....$..........^.a...a..
.a...a..za...n...a..T....a.......a.......a......ya.......a.......a....
...a.......a..Rich.a..........PE..L.....3S...........!................
................................................O.....................
..............-...0...........................H#......T....9..........
....................X...@............................................t
ext............................... ..`.rdata..-.......................
....@[email protected][email protected]
[email protected]...............................@[email protected]..
.....@[email protected]..........................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: 209.170.78.71

Referer: hXXp://dl1sw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.0 200 OK

Expires: Fri, 30 May 2014 07:17:39 GMT

Date: Wed, 30 Apr 2014 07:17:39 GMT

Server: nginx

Content-Type: application/octet-stream

Content-Length: 30231024

Last-Modified: Mon, 21 Apr 2014 18:43:49 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

Age: 19201

Via: 1.0 wzpy200:80 (Cdn Cache Server V2.0), 1.0 fra71:8888 (Cdn Cache Server V2.0)

Connection: keep-alive

Content-Disposition: attachment;filename="Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe"
[email protected]........................
..!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8
...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8.......
.PE..L.....GO.................p.......B...9............@..............
.............)......w;*[email protected].........$
.pI..............P....................................................
........................................text....o.......p.............
..... ..`.rdata...*.......,...t..............@[email protected]....~...........
...............@....ndata...P...0...........................rsrc...pI.
...$..J..................@[email protected]........)[email protected].
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
[email protected][email protected]...
..@..}[email protected]... M..........M........E...FQ.....NU
..M.......M...VT..U........FP..E...............E.P.M...H.@..E..P.E..E.
[email protected]}[email protected].}.j.W.E......E.....
[email protected][email protected][email protected] [email protected].
u.....@._^3.[.....L$...-G...i. @...T.....tUVW.q.3.;5.-G.sD..i. @...D..
S.....t.G.....t...O..t .....u...3....3...F. @..;5.-G.r.[_^...U..QQ
<<< skipped >>>

GET /client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dl1sw.baidu.com

Range: bytes=1835008-

Referer: hXXp://dl1sw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.0 302 Found

Cache-Control: no-cache

Connection: close

Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb

GET /dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: 209.170.78.71

Range: bytes=8257536-

Referer: hXXp://dl1sw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.0 206 Partial Content

Expires: Fri, 30 May 2014 07:17:39 GMT

Date: Wed, 30 Apr 2014 07:17:39 GMT

Server: nginx

Content-Type: application/octet-stream

Last-Modified: Mon, 21 Apr 2014 18:43:49 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

Content-Range: bytes 8257536-30231023/30231024

Content-Length: 21973488

Age: 19208

Via: 1.0 wzpy200:80 (Cdn Cache Server V2.0), 1.0 fra71:8888 (Cdn Cache Server V2.0)

Connection: keep-alive

Content-Disposition: attachment;filename="Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe"
 "tvkA.....&......j....I..X.d..^.r....t..7a.:.`w.L.Xs....{..........d.
'.d..Y.AE.&.q.<.. ._......)9v.6 '=#........J..%.3...=z...Um..w.....
..)..<.Aw.....sU..U...V..#.V-..H...qr.(y.S......i.t..........M.....
...yP.7nJ-.P.....fN.1.|...Du..$`.X..[.e....(.z............E.3....Az...
.q..f1....S.N.......jk. v.)...v5......W.......WU.g|...EJ..b'3n$.'.....
t..)fP..-;.Cz}>..>.n.:. ,...>u;;....dT.....Y.}...".p.?c../.d.
...d.7....a..8.Q..N..~....~R.O.j.......z...NVOS.]B.ul.A.....k<....}
6$Z...2..bbN3....T.>.eTdx...9.....)..I..\K...m.M...". .*.Q.m/.b^...
{E84...Gm..~.......aB.1n.&v>O/D..x..0.i .x.I^....../{.f.kO..?^.u"./
.wC.hSGy......o..C......t/...QO.Hi\O...3.gTF.\........^..:.r...p.},C..
\N..h...o.{..h|..V.....O.&....[......../.m...`.\/l\w..H....;..7f.F* .{
...'.....'{.M..1..c.uZc-@.......{...p..~nU...'.s..bn.o8......$.<...
 L..>....../...U....;...:u{E..Gb..}d[..=....\..`H $.veF4 s.....Kl..
!q~.....tH......)a....-...A. #..;.......)...)...~...iH...4.C\1.i......
...T.......\..c)M.W.."....RJ.H...E(....u..."..bO..`....:S(...Z.n.....J
.j%..Gwb....X.%...}C.].$lN.>a...&.....V..v..#=J..h..f.1Ol.@Y"....x.
...\.....u.=....1P.'...X.j..L.GC.(|^.f?.9.....N..F~b...X.F..>. 4 Z.
.su0W. ..........S..s..p.z..1MW<.QE.{.....c..ee.......t^.{].q..T,.=
H..q-............&6.\w.ek.........C.P....^I..N^...........8^.].b....H.
..BE.WB....#hj;......Xy....JId...T ._.....K.?..3....C0.......u.K.>.
..`......|.0M...:........t/..LJL..nM...>!..T.TM..\.(...p.k..N..IO.V
E.c..]..T...Q..^,...A.!..63w......Y.S.e.o..;D ........q.%..K.{.2.&
<<< skipped >>>

GET /client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dl1sw.baidu.com

Range: bytes=22937600-

Referer: hXXp://dl1sw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.0 302 Found

Cache-Control: no-cache

Connection: close

Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb

POST / HTTP/1.1

Connection: Keep-Alive

Content-Length: 68

Content-Type: application/octet-stream

Host: s.x.baidu.com

Keep-Alive: timeout=600,max=1000

...8........" f5e712debdc652d438a8c8ba67ccb6f2([email protected].` ......
HTTP/1.1 200 OK

Server: iYuntianSvr

Content-Type: application/octet-stream

Keep-Alive: timeout=30

Connection: Keep-Alive

Content-Length: 124
...p........" f5e712debdc652d438a8c8ba67ccb6f2(.28.y.E.. T..h.<[...
.~....F..B6..aTS.......h..Qz.^.|[email protected].` ........

GET /dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: 209.170.78.71

Range: bytes=22937600-

Referer: hXXp://dl1sw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.0 206 Partial Content

Expires: Fri, 30 May 2014 07:17:39 GMT

Date: Wed, 30 Apr 2014 07:17:39 GMT

Server: nginx

Content-Type: application/octet-stream

Last-Modified: Mon, 21 Apr 2014 18:43:49 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

Content-Range: bytes 22937600-30231023/30231024

Content-Length: 7293424

Age: 19203

Via: 1.0 wzpy200:80 (Cdn Cache Server V2.0), 1.0 fra71:8888 (Cdn Cache Server V2.0)

Connection: keep-alive

Content-Disposition: attachment;filename="Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe"
L..c...SB....J.x.....S].?.rH.l.....6.....i..diL8..B..BC..4...~_J..4*..
Lm~<..B;pQ`K}Z..t.....E6..FMK...F......Z.....M....<A.P..,|....w.
,....^.F{.................U.'.s...[...o.b..T.o.M.R.h<..>5.L.....
...Ihk......".....P.H4.}.6.......m...aT.m..?(.6X3......a..(......!j:.t
.....E..."U...{.G.J..jm/`.._Qu}_.2.........C=.Y...........n....f.Br
.{F._z......fP.F.^=..&....f.B.3. .....s.s?.-....?.{..w....*$A.`.W..G..
i.........g..?Z.0b.$._.^.. ]..$.C.)Q....F..c...............B..b.q .Y,.
..O."..,......f.}..;u...6.qH..2...J^.J7(..v...y[.Q....q...4.N}d.%P[v&.
6../..Ro...g;HB.....&ip.%.).,...`;..4..*<..fA/J..g..d..e...........
..M..G..8.7.........W.f...5......d.}.$8Q...3..6.l..d..v]!..q0.....0.(.
.q..e~.....I.t...... ..K. .1 .MdA..Nh.....G.[/9..z...i.).f..y.v.b..F..
N_...*D,..>.........'..x:..o.g.......u..7< IB ..T........R..}.`.
.!6..N..4.............O..F.}wH`O...........k.\[email protected].
...U....]....U.r..V.....m...Sb/^.....6.....EL..r...z`-v.N<R........
.p-......E.I..e].%....J..De...U...g....c..f=K...?..]M`;l[.y...>..hz
.`Y....[.N.9....Z2.F..0  ....bpf1.r..1.....%[email protected]....&.4N2q...].c.R:..
.?^#upO%5?.!..}1.....9Oh,..S~-.#"v..Z..(ul....h..^..bt..\...Y4.w..M8..
. .......g..UL......4...f...l.5.k)..I..Y8?..J....MuqL...r.M.1.1.y.Rj.t
....q.JMtZ2?i..W.G.....9..h..L..Q..........X..[t....:w.=../.D.E....W..
.q4.f.....){..h._^......s..........W....q.}..f.l.......2...w*.!.F:.dnh
[.G>........Z....x9..`~..nL8.y.lu..>8......eG.D...PF...M....{4..
....s5/...P....C5%.t..........t...Uj...R............XK....Y.;..J.8
<<< skipped >>>

GET /sw-search-shadu/client/dllv4/BDMReport.dll HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dlsw.baidu.com

Range: bytes=393216-

Referer: hXXp://dlsw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.1 206 Partial Content

Server: JSP2/1.0.27

Date: Wed, 30 Apr 2014 12:37:24 GMT

Content-Type: application/x-msdownload

Connection: close

Content-Length: 814304

Content-Range: bytes 393216-1207519/1207520

Access-Control-Allow-Origin: *

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length

Accept-Ranges: bytes

Last-Modified: Tue, 20 Aug 2013 07:03:07 GMT

Expires: Sat, 03 May 2014 07:20:44 GMT

x-bs-version: A65F70E089635AE47A1E2AED4F13B889

ETag: 30cbc602ada7cdfb0346038c05996d84

x-bs-request-id: MTAuMjE1LjE0NC41Nzo4MDgwOjM4MjcwMzQyMDg6MzAvQXByLzIwMTQgMTU6MjA6NDQg

x-bs-meta-crc32: 2965621797

Content-MD5: 30cbc602ada7cdfb0346038c05996d84

x-bs-client-ip: MTE1LjIzMS40Mi4xMjA=
..Q.D$$.E.VP.....E..T$ Q..$VP..........................Q.D$$.E.VP.....
E..T$ .....$VP..........................Q.D$$.E.VP.....T$ ..P.E.VP....
......E.........QVP.L$LQ............P.E.VP....$........|$X...$........
....D$DP.........r...............Q.D$$.E.VP.....T$ P.E.VP.......C...E.
......j.VP.....L$..U..D$ ....4Q.D$(........VR.....T$$.L$ P.....L$....;
L$(.L$........D$...u..L$..D....N....p...........f....$.x........R,..X.
D$(.E.VP.....T$(P.E.VP.......D$...u..L$...........R0..\.D$(.E.VP....R.
T$,P.E.VP.......D$...u..L$...........R4..`...

GET /client1/common/patch/16101830722/BDMNet.dll HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dl1sw.baidu.com

Range: bytes=884736-

Referer: hXXp://dl1sw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.0 302 Found

Cache-Control: no-cache

Connection: close

Location: hXXp://209.170.78.71/dl1sw.baidu.com/client1/common/patch/16101830722/BDMNet.dll?wsiphost=ipdb

GET /client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dl1sw.baidu.com

Range: bytes=2490368-

Referer: hXXp://dl1sw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.0 302 Found

Cache-Control: no-cache

Connection: close

Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb

GET /client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dl1sw.baidu.com

Range: bytes=15597568-

Referer: hXXp://dl1sw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.0 302 Found

Cache-Control: no-cache

Connection: close

Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb

GET /client1/common/patch/16101830722/BDMNet.dll HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dl1sw.baidu.com

Range: bytes=720896-

Referer: hXXp://dl1sw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.0 302 Found

Cache-Control: no-cache

Connection: close

Location: hXXp://209.170.78.71/dl1sw.baidu.com/client1/common/patch/16101830722/BDMNet.dll?wsiphost=ipdb

GET /dl1sw.baidu.com/client/dllqq/BDLogicUtils.dll?wsiphost=ipdb HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: 209.170.78.71

Referer: hXXp://dl1sw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.0 200 OK

Expires: Sat, 24 May 2014 10:41:45 GMT

Date: Thu, 24 Apr 2014 10:41:45 GMT

Server: nginx

Content-Type: application/octet-stream

Content-Length: 926536

Last-Modified: Tue, 18 Mar 2014 11:58:16 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

Age: 525332

Via: 1.0 wzpy233:8080 (Cdn Cache Server V2.0), 1.0 fra71:25001 (Cdn Cache Server V2.0)

Connection: keep-alive

Content-Disposition: attachment;filename="BDLogicUtils.dll"
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......V.h.........
......x.....5.{.....5.k.......Y.......[.............5.h.f...5.t.C...5.
|.....5.z.............5.~.....Rich............................PE..L...
.. S...........!.........0.......6....................................
... .......................................................P..........
........H#...`..hw..@...............................@...@.............
...............................text...x........................... ..`
.rdata..............................@[email protected]...(j.......P............
[email protected].........@....... [email protected]......
.0..............@[email protected]....`.......@[email protected]..........
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dl1sw.baidu.com

Range: bytes=3145728-

Referer: hXXp://dl1sw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.0 302 Found

Cache-Control: no-cache

Connection: close

Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb

GET /sw-search-shadu/client/dllv4/BDMReport.dll HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dlsw.baidu.com

Range: bytes=1146880-

Referer: hXXp://dlsw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.1 206 Partial Content

Server: JSP2/1.0.27

Date: Wed, 30 Apr 2014 12:37:31 GMT

Content-Type: application/x-msdownload

Connection: close

Content-Length: 60640

Content-Range: bytes 1146880-1207519/1207520

Access-Control-Allow-Origin: *

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length

Accept-Ranges: bytes

Last-Modified: Tue, 20 Aug 2013 07:03:07 GMT

Expires: Sat, 03 May 2014 07:20:44 GMT

x-bs-version: A65F70E089635AE47A1E2AED4F13B889

ETag: 30cbc602ada7cdfb0346038c05996d84

x-bs-request-id: MTAuMjE1LjE0NC41Nzo4MDgwOjM4MjcwMzQyMDg6MzAvQXByLzIwMTQgMTU6MjA6NDQg

x-bs-meta-crc32: 2965621797

Content-MD5: 30cbc602ada7cdfb0346038c05996d84

x-bs-client-ip: MTE1LjIzMS40Mi4xMjA=
......................................................................
......................................................................
..........................................abcdefghijklmnopqrstuvwxyz..
....ABCDEFGHIJKLMNOPQRSTUVWXYZ........................................
......................................................................
......................................................................
......................................................                
          ...................................

GET /sw-search-shadu/client/dllv4/BDMReport.dll HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dlsw.baidu.com

Referer: hXXp://dlsw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.1 200 OK

Server: JSP2/1.0.27

Date: Wed, 30 Apr 2014 12:37:20 GMT

Content-Type: application/x-msdownload

Connection: close

Content-Length: 1207520

Access-Control-Allow-Origin: *

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length

Accept-Ranges: bytes

Last-Modified: Tue, 20 Aug 2013 07:03:07 GMT

Expires: Sat, 03 May 2014 07:20:44 GMT

x-bs-version: A65F70E089635AE47A1E2AED4F13B889

ETag: 30cbc602ada7cdfb0346038c05996d84

x-bs-request-id: MTAuMjE1LjE0NC41Nzo4MDgwOjM4MjcwMzQyMDg6MzAvQXByLzIwMTQgMTU6MjA6NDQg

x-bs-meta-crc32: 2965621797

Content-MD5: 30cbc602ada7cdfb0346038c05996d84

x-bs-client-ip: MTE1LjIzMS40Mi4xMjA=
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......M......S...S
...S.Y.S...S.[.S...S.[.S...S...S...S.[.S!..S...S...S...S...S.[.Sd..S.[
.S...S.[.S...S...S...S.[.S...SRich...S........................PE..L...
.!.Q...........!.....P... ......u........`............................
...........................................j.......V..................
[email protected]..@............`
..t............................text....O.......P.................. ..`
.rdata..1....`.......`..............@[email protected][email protected]........
[email protected]...............................@[email protected]..............
[email protected]..................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /sw-search-shadu/client/dllv4/BDMReport.dll HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dlsw.baidu.com

Range: bytes=753664-

Referer: hXXp://dlsw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.1 206 Partial Content

Server: JSP2/1.0.27

Date: Wed, 30 Apr 2014 12:37:28 GMT

Content-Type: application/x-msdownload

Connection: close

Content-Length: 453856

Content-Range: bytes 753664-1207519/1207520

Access-Control-Allow-Origin: *

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length

Accept-Ranges: bytes

Last-Modified: Tue, 20 Aug 2013 07:03:07 GMT

Expires: Sat, 03 May 2014 07:20:44 GMT

x-bs-version: A65F70E089635AE47A1E2AED4F13B889

ETag: 30cbc602ada7cdfb0346038c05996d84

x-bs-request-id: MTAuMjE1LjE0NC41Nzo4MDgwOjM4MjcwMzQyMDg6MzAvQXByLzIwMTQgMTU6MjA6NDQg

x-bs-meta-crc32: 2965621797

Content-MD5: 30cbc602ada7cdfb0346038c05996d84

x-bs-client-ip: MTE1LjIzMS40Mi4xMjA=
..................D$.,0..:........................D$.,0..:............
...........D$.<0|.<9~.<a|.<f~.,A<.w.......3............
....D$.<a|.<z~.<A|.<Z~.<_t.3........................D$.
<a|.<z~.<A|.<Z~.<0|.<9~.<_t.3................D$.&
lt;at <bt'<ft#<nt.<rt.<tt.<vt.<\t.<?t.<'t.&
lt;"t.3................D$.....0...w......0.....a...w......W.....A...w.
.....7............D$......Tw,........$...........................\..'.
."..?.................{...~...........................................
......................................................................
................8...............A`,0..:........A`<a|.<z~.<A|.
<Z~.<_t.3..........A`,...:[email protected]...............
.V...~..r..F.P..`.....3..F......F..F.^...........j.h32..d.....PQSVW..v
..3.P.D$.d........t$..Fh.Vl;..D$.....~..NX.9 .P.G....~H.r..N4Q.._.....
3.......~H.^D.^4.~..r..V.R.}_......~..^..^..L$.d......Y_^[...........j
.h.2..d.....P..\SUVW..v..3.P.D$pd.......$....3......3..\$.9W.r..G....G
..80.D$..D$ ....u".H...xt...Xt..D$ ..........T$ .D$......l$$.l$(u7..$.
....L$$.T$(...P....L$pd......Y_^][..h..\$...$....3.....0...w......0.'.
...a...w......W......A...w......7.....;.|.;t$ |h.T$,WR.D$............h
N...ht......j..L$T..$.....\$$..4..W...h........$.........\$ ..8......8
..P.L$...C......l$xt.....L$H.\$..|4......D$x....t.....|$D..\$.r..D$0P.
.].......$.........;...wkr.;.$....w`.D$ .....$....W ...V..QR......L$(;
.w;r.9D$$w3.D$$QPWV........D$$.D$.......D$......T$(.......`...2..L
<<< skipped >>>

GET /sw-search-shadu/client/dllv4/BDMReport.dll HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dlsw.baidu.com

Range: bytes=622592-

Referer: hXXp://dlsw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.1 206 Partial Content

Server: JSP2/1.0.27

Date: Wed, 30 Apr 2014 12:37:24 GMT

Content-Type: application/x-msdownload

Connection: close

Content-Length: 584928

Content-Range: bytes 622592-1207519/1207520

Access-Control-Allow-Origin: *

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length

Accept-Ranges: bytes

Last-Modified: Tue, 20 Aug 2013 07:03:07 GMT

Expires: Sat, 03 May 2014 07:20:44 GMT

x-bs-version: A65F70E089635AE47A1E2AED4F13B889

ETag: 30cbc602ada7cdfb0346038c05996d84

x-bs-request-id: MTAuMjE1LjE0NC41Nzo4MDgwOjM4MjcwMzQyMDg6MzAvQXByLzIwMTQgMTU6MjA6NDQg

x-bs-meta-crc32: 2965621797

Content-MD5: 30cbc602ada7cdfb0346038c05996d84

x-bs-client-ip: MTE1LjIzMS40Mi4xMjA=
V.1.0.q..p.......;.u.^...........T$..L$.;..D$.t.V.q.......;..0.q..p.u.
^............L$...4....H...................................D$..V......
..t.V.1b.......^.....D$..V........t.V..b.......^....V.t$..F.=....s....
....^.P........F......^.......j.h....d.....P..0..v..3.P.D$4d.....3..T$
...A....h.........wF.$........A..L$4d......Y..<....B..L$4d......Y..
<[email protected]$4d......Y..<.h....h<...j..L$..T$...7..h.......D$@..
....<..P.L$...F...L$..D$<......7..3..L$4d......Y..<.3...H...]
...3...]...H...3...H...]...3...............V.....N.;.t.P.sj......D$..t
.V..`.......^........V.....N.;.t.P.Cj......D$..t.V.u`.......^........V
.....N.;.t.P..j......D$..t.V.E`.......^........V.....N.;.t.P..i......D
$..t.V..`.......^........V.....N.;.t.P..i......D$..t.V.._.......^.....
...V.....N.;.t.P..i......D$..t.V.._.......^........V.....N.;.t.P.Si...
...D$..t.V.._.......^.........A....D$..P......................D$..Q..P
[email protected]$..............D$..............A.............
..D$.VW.|$............F.u...j...>_..^............V...>.u...i....
.N.;H.u...i...F....^.............V...>.u...i...F..x1.t.^..i...H..y1
.u....x1.u..I......x1.t..N.^[email protected].;H.u..F....B..x1.t..F.^......
.........................T$..B.V.0.r..0.~1.u..V..r..p..I.;Q.^u..A....B
.....J.;.u......B.....A....B.......T$...V.p..2.p..~1.u..V..r..p..I.;Q.
^u..A..P..B.....J.;Q.u..A..P..B.......P..B............................
......V...8.....^......D$.j.P.........................................
.................................................D$...t..L$.......
<<< skipped >>>

GET /client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dl1sw.baidu.com

Range: bytes=2883584-

Referer: hXXp://dl1sw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.0 302 Found

Cache-Control: no-cache

Connection: close

Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb

GET /client1/common/patch/16101830722/BDMNet.dll HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dl1sw.baidu.com

Referer: hXXp://dl1sw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.0 302 Found

Cache-Control: no-cache

Connection: close

Location: hXXp://209.170.78.71/dl1sw.baidu.com/client1/common/patch/16101830722/BDMNet.dll?wsiphost=ipdb

GET /sw-search-shadu/client/dllv4/BDMReport.dll HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dlsw.baidu.com

Range: bytes=983040-

Referer: hXXp://dlsw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.1 206 Partial Content

Server: JSP2/1.0.27

Date: Wed, 30 Apr 2014 12:37:28 GMT

Content-Type: application/x-msdownload

Connection: close

Content-Length: 224480

Content-Range: bytes 983040-1207519/1207520

Access-Control-Allow-Origin: *

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length

Accept-Ranges: bytes

Last-Modified: Tue, 20 Aug 2013 07:03:07 GMT

Expires: Sat, 03 May 2014 07:20:44 GMT

x-bs-version: A65F70E089635AE47A1E2AED4F13B889

ETag: 30cbc602ada7cdfb0346038c05996d84

x-bs-request-id: MTAuMjE1LjE0NC41Nzo4MDgwOjM4MjcwMzQyMDg6MzAvQXByLzIwMTQgMTU6MjA6NDQg

x-bs-meta-crc32: 2965621797

Content-MD5: 30cbc602ada7cdfb0346038c05996d84

x-bs-client-ip: MTE1LjIzMS40Mi4xMjA=
.J.3..C..........................M..H....T$..B..J.3............|......
...........M.......T$..B..J.3.......H....L.................M...!...M..
.....T$..B..J.3.......|..............M..(#...M.......T$..B..J.3..|....
...............M.......M......4...T$..B..J.3..I................M..X...
.M.....m4...T$..B..J.3...................M..8....M......4...T$..B..J.3
.......L....Q......M.......M.....m4...M...... ...T$..B..J.3...........
.............M.......M......8...T$..B..J.3..y................M.......M
.....m8...T$..B..J.3..I................M..h....M.....M9...T$..B..J.3..
.....$...........M..8....M......9...M......*...T$..B..J.3.......`....F
...........M...y...T$..B..J.3..............................E..........
.e...M........T$..B..J.3..s..........................T$..B..J.3..L....
\..............E...........e...M..H.....T$..B..J.3............{.......
[email protected]$..B..J.3............;.............
...M..(M...E...........e...M........T$..B..J.3.....................M..
.L...T$..B..J.3..d...........................M...L...T$..B..J.3..4....
H......................M...L...T$..B..J.3.......|....l................
.M..XL...T$..B..J.3............<..................|..............|.
....M.........|..............|.....M.........|..............|.....M...
......|..............|.....M...>....T$...t.....p...3..*.......J.3..
.....................M...>...M...>...M..x>...T$..B..J.3......
.0....L.................M.......T$..B..J.3.......l....................
..M.......T$..B..J.3..............................M.......T$..B..J
<<< skipped >>>

GET /client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dl1sw.baidu.com

Range: bytes=8781824-

Referer: hXXp://dl1sw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.0 302 Found

Cache-Control: no-cache

Connection: close

Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb

GET /sw-search-shadu/client/dllv4/BDMReport.dll HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dlsw.baidu.com

Range: bytes=720896-

Referer: hXXp://dlsw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.1 206 Partial Content

Server: JSP2/1.0.27

Date: Wed, 30 Apr 2014 12:37:29 GMT

Content-Type: application/x-msdownload

Connection: close

Content-Length: 486624

Content-Range: bytes 720896-1207519/1207520

Access-Control-Allow-Origin: *

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length

Accept-Ranges: bytes

Last-Modified: Tue, 20 Aug 2013 07:03:07 GMT

Expires: Sat, 03 May 2014 07:20:44 GMT

x-bs-version: A65F70E089635AE47A1E2AED4F13B889

ETag: 30cbc602ada7cdfb0346038c05996d84

x-bs-request-id: MTAuMjE1LjE0NC41Nzo4MDgwOjM4MjcwMzQyMDg6MzAvQXByLzIwMTQgMTU6MjA6NDQg

x-bs-meta-crc32: 2965621797

Content-MD5: 30cbc602ada7cdfb0346038c05996d84

x-bs-client-ip: MTE1LjIzMS40Mi4xMjA=
.u....P...R...._.......W......._.PV............]....F..V. ....|..8.u..
x.>u.....F...;F........~ ........F......^._^]..[Y...QV.............
.......j.hK!..d.....P...SUVW..v..3.P.D$.d........|$,......G.;G.s......
s........G..O.........6...G.............. .t] .tS......u..............
[email protected]........`...QWP.M...#......v...2........t]....
u..G.;G.s......s........L$,.G....T$,R...95....t..|$,.....]<.E4.G.;G
........8...........G..G.;G.s......s........L$..G....T$.R....4......f.
...|$......M<..E5.G..O. ...........8........x.>..........G..u..F
..N.;.}..........F....M.F.;.u....P........^.jX.........D$....D$$....t.
...O.....3..N.......^..D$$....PW.q...............G..O. ....|..8.u..x.&
gt;u.....G..e.....;W......... ........G......_....L$.d......Y_^][.....
.PW.5.......A................V........D$..t.V..........^.....SV...N...
....FD3.:.t ......^..^..^.t..N...`...t...]...N .3y...^D9^..N.^[t......
.j.h{!..d.....P...SUVW..v..3.P.D$.d........D$......|$,......G.;G.s....
..s........G..O.........3...G...................\......... .tI .u.....
[email protected]... ......u...2..l.....u..
O.;O.s...<.s........D$,.O....T$,R...G2....t..D$,..|.......]D.E....R
PS.M.......G.;G........8...........G..E.PW.M..........w....MD..G.;G...
.....8...........G............G.;G.s......s........L$..G....T$.R....1.
..........|$......MD..E..G.;G...v....8J..m.......G..2...t.............
..................................MD..}.`...u'j...........t..@......@.
[email protected]. ...........8........x.&
<<< skipped >>>

GET /sw-search-shadu/client/dllv4/BDMReport.dll HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dlsw.baidu.com

Range: bytes=884736-

Referer: hXXp://dlsw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.1 206 Partial Content

Server: JSP2/1.0.27

Date: Wed, 30 Apr 2014 12:37:30 GMT

Content-Type: application/x-msdownload

Connection: close

Content-Length: 322784

Content-Range: bytes 884736-1207519/1207520

Access-Control-Allow-Origin: *

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length

Accept-Ranges: bytes

Last-Modified: Tue, 20 Aug 2013 07:03:07 GMT

Expires: Sat, 03 May 2014 07:20:44 GMT

x-bs-version: A65F70E089635AE47A1E2AED4F13B889

ETag: 30cbc602ada7cdfb0346038c05996d84

x-bs-request-id: MTAuMjE1LjE0NC41Nzo4MDgwOjM4MjcwMzQyMDg6MzAvQXByLzIwMTQgMTU6MjA6NDQg

x-bs-meta-crc32: 2965621797

Content-MD5: 30cbc602ada7cdfb0346038c05996d84

x-bs-client-ip: MTE1LjIzMS40Mi4xMjA=
3.9n.W..1...h.....D$.UPf.l$..?h.....h.....L$.Q..<a...D$..P....I.f..
...f;.u. ...;.~.f.|D.\t.f.DD.\.f.lD.h......$....URf..$$.....g..j..D$ P
..$,...h....Q.....j.hhN....$<...h....R.R......a....,..$....P..;..F.
..z....= a..h.N..P..;..F...a...j..L$.Q..$ ...h....R.....j.h.N....$0...
h....P....... ..$....Q..;..F.......h.N..P...V.h.N..R.F....F..F.h.N..P.
..N.h.N..Q.F ...V.h.O..R.F$...F(.F.h.O..P...N.h,O..Q.F,[email protected].
..F4.F.h\O..P...N.hxO..Q.F8...V.h.O..R.F<[email protected].
FD..9n..FHt_9n.tZ9n tU9n$tP9n(tK9n,tF9n0tA.N4;.t:9n8t59n<t09n@t 9nD
t&;.t"UU.VLR....t..F....._^]3.[..........F.;..=<b..t.P...n..F.;.t.P
...n.j8U...V..e....._^]..@..[.............D$..@[email protected]
VW3.3.j,.D$H.D$L.D$P.D$XWP.D$4.@...|$L.|$\..e.....h........$....WQ.D$&
lt;[email protected]$B...D$D..D$E.D$F..D$G..D$HO.D$I.D$J..D$K.f..$.....(e
...].3....3.9{..|$..D$..D$..D$..D$ .D$$.|$,.......M.;.......9}.......9
}.t.Q.................M.Q3.h.P....$....h.....D$LR.D$T.D$X.D$\.D$P.....
..b..j0.L$d..$....WQ.D$`..d......D$PP.L$4.T$DQ.T$p.S......W.D$\0....|$
`.|$d.D$h.....|$l.t$p.|$x.|$|..$......$..........$......;.t.=.........
.9}.......9}.......3..L$,Q.M..T$.R.D$..D$..D$ .D$$.D$(.D$,...P.QS.....
......D$ [email protected][email protected]$,...D$..D$....Qj@...|$$..D$...|....|$
....q.......|......D$,P.E..L$.Q.J.PS......K....E...}........O.........
.G.;D$ ..........T$$r..2;1u.............s...t]..2... .uE...........tF.
.2... .u............t/..2... .u............t...2... .t...............3
..........p..E.........O...........;D$...k.......T$.r..2;1u.......
<<< skipped >>>

POST / HTTP/1.1

Connection: Keep-Alive

Content-Length: 77

Content-Type: application/octet-stream

Host: p.x.baidu.com

Keep-Alive: timeout=600,max=1000

...A........." f5e712debdc652d438a8c8ba67ccb6f2([email protected].` ......
HTTP/1.1 200 OK

Server: iYuntianSvr

Content-Type: application/octet-stream

Keep-Alive: timeout=30

Connection: Keep-Alive

Content-Length: 133
...y........." f5e712debdc652d438a8c8ba67ccb6f2(.........28....`:.....
[email protected].` ......
....


POST / HTTP/1.1

Connection: Keep-Alive

Content-Length: 157

Content-Type: application/octet-stream

Host: p.x.baidu.com

Keep-Alive: timeout=600,max=1000

...y........." f5e712debdc652d438a8c8ba67ccb6f2(.........28....`:.......f..o.......t2....S4ST....gh...Z..

[email protected].` ......t&......q...{..O.
......
HTTP/1.1 200 OK

Server: iYuntianSvr

Content-Type: application/octet-stream

Keep-Alive: timeout=30

Connection: Keep-Alive

Content-Length: 845
...y........." f5e712debdc652d438a8c8ba67ccb6f2(.........28....`:.....
[email protected].` ......s."j...
..JN.......d..N?...I-R.{..x........9... o0....0#vehz....Z.E..;.....;1.
M.V..R.k............[...4.......W.S..F.}..#.4Q...W.]. .RT.-tO..$`.H.^.
..0.|..3..z...}..y.2...b..U.[.X..l.#>.u.H'..a.K.......gr.....Z.5..0
..yju[.....nR..2.,.....".:'....{..........,z..RO..F.L...(O2..Ox..f.kB)
.][email protected]..../....k9...gT.. ..4.B....GsO.3...i/u.....%....']..
.[4s.W.<?......8Sv.uT.b..l.I...........\g.4..E.......X.[;t..*..F5?C
n....)1#DA.IAa..M(.....8.:{;..h7L5..f./.....}..K.4)Rr...\.^x...{.>]
..m.n.V.:.....C. .t...0 )...S...f.tS.v<.......$.....22C..r......B..
)... .....~.......s...6.pK..V....l..e*N..C..V...n..u2.-......9.na.p...
...%."A.J.\.p{-.....t.....,U.....H....3... .B<.).5.......0....3.)K.
.V..dkn...!R..........

GET /sw-search-shadu/client/dllv4/BDMReport.dll HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dlsw.baidu.com

Range: bytes=327680-

Referer: hXXp://dlsw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.1 206 Partial Content

Server: JSP2/1.0.27

Date: Wed, 30 Apr 2014 12:37:22 GMT

Content-Type: application/x-msdownload

Connection: close

Content-Length: 879840

Content-Range: bytes 327680-1207519/1207520

Access-Control-Allow-Origin: *

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length

Accept-Ranges: bytes

Last-Modified: Tue, 20 Aug 2013 07:03:07 GMT

Expires: Sat, 03 May 2014 07:20:44 GMT

x-bs-version: A65F70E089635AE47A1E2AED4F13B889

ETag: 30cbc602ada7cdfb0346038c05996d84

x-bs-request-id: MTAuMjE1LjE0NC41Nzo4MDgwOjM4MjcwMzQyMDg6MzAvQXByLzIwMTQgMTU6MjA6NDQg

x-bs-meta-crc32: 2965621797

Content-MD5: 30cbc602ada7cdfb0346038c05996d84

x-bs-client-ip: MTE1LjIzMS40Mi4xMjA=
.......C._^[....Q.T$...$...$P.D$.R.T$.Q.L$.PQR..................Q.T$..
.$...$P.D$.R.T$.Q.L$.PQR..................j.h9...d.....P...V..v..3.P.D
$.d......t$ .D$$.L$(3..T$..F......V..t$..V.VQP.T$$.D$.......^........L
$.d......Y^[email protected][email protected]$.j.j..F..
....F.....P...F....:....^...............j.h....d.....P..\SUVW..v..3.P.
D$pd........s,.........$....P.k0U.,...........D$x...........t....r....
.$.....G..H..L$......9D$........G....x..r..P..T$.......D$..D$.P...S...
.........ueh....h....j..L$,..$...../.......?Wh........$.........r.....
.K...P..$.....>....L$ .D$x.........3.........L$........$....QU..$..
.......2..........u{.G...P....$....RU............u\h$...h....j..L$T.D$
'........Wh....h........$........................P.L$.......L$H.D$x..n
....L$..D$x.....M......L$pd......Y_^][..h........V...F...t.P.........F
......F......F.....^.......V...F...t.P.W.......F......F......F.....^..
.....j.h....d.....P..D..v..3.P.D$Hd.....j.h.>...L$..D$$.....D$ ....
.D$...8>...D$.P.L$$.D$T......2..h.>...L$$Q.D$(`e................
..j.h....d.....P..D..v..3.P.D$Hd.....j.h.>...L$..D$$.....D$ .....D$
....=...D$.P.L$$.D$T.....b2..h.>...L$$Q.D$(`e...#..............j.h.
...d.....P..DV..v..3.P.D$Ld......A..T$\..... .;.sRj.h.e...L$..D$(.....
D$$.....D$...%=...D$.P.L$(.D$X......1..h.>...L$(Q.D$,`e..........A.
.L$Ld......Y^..P...U..j.h0...d.....P...SVW..v..3.P.E.d......e....E....
P..F....M..U.u.3....~. .....U...........u.3....N. ......... .;.s......
..u.3....N. ......;................ .;.s.3.......u.3....N. ......;
<<< skipped >>>

GET /client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dl1sw.baidu.com

Referer: hXXp://dl1sw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.0 302 Found

Cache-Control: no-cache

Connection: close

Location: hXXp://209.170.78.71/dl1sw.baidu.com/client/v1196/0422/Baidusd_Setup_1.0.616.70_Sid_11111_Silent_Defense.exe?wsiphost=ipdb

GET /client1/common/patch/16101830722/BDMNet.dll HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dl1sw.baidu.com

Range: bytes=589824-

Referer: hXXp://dl1sw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.0 302 Found

Cache-Control: no-cache

Connection: close

Location: hXXp://209.170.78.71/dl1sw.baidu.com/client1/common/patch/16101830722/BDMNet.dll?wsiphost=ipdb

GET /sw-search-shadu/client/dllv4/BDMReport.dll HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dlsw.baidu.com

Range: bytes=819200-

Referer: hXXp://dlsw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.1 206 Partial Content

Server: JSP2/1.0.27

Date: Wed, 30 Apr 2014 12:37:30 GMT

Content-Type: application/x-msdownload

Connection: close

Content-Length: 388320

Content-Range: bytes 819200-1207519/1207520

Access-Control-Allow-Origin: *

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length

Accept-Ranges: bytes

Last-Modified: Tue, 20 Aug 2013 07:03:07 GMT

Expires: Sat, 03 May 2014 07:20:44 GMT

x-bs-version: A65F70E089635AE47A1E2AED4F13B889

ETag: 30cbc602ada7cdfb0346038c05996d84

x-bs-request-id: MTAuMjE1LjE0NC41Nzo4MDgwOjM4MjcwMzQyMDg6MzAvQXByLzIwMTQgMTU6MjA6NDQg

x-bs-meta-crc32: 2965621797

Content-MD5: 30cbc602ada7cdfb0346038c05996d84

x-bs-client-ip: MTE1LjIzMS40Mi4xMjA=
$.................u.2.Y....L$.P.|.....Y..........D$.P..........u.2....
.L$.P.P.......................T$...$PR...Q.D$......D$......K......@...
...u.2.......PQ.L$...-................3..H..H..H......3..H..H..H....S.
\$..C.VW..3.;.u.3....s. ....;..O..O..O.tb.....?v..h...QV......G..G....
.G..s....9s.v...l..U.k.;k.v...l...O. ............4.t.PUPQ..]......w.].
._^[..............QSU.l$.V..W.~...t..F... ....u.3...;.v..Ql....t.;.t..
Dl...\$  .....T$$.D$ Rj.PU........~.;~.v...l...|$ .<.;~.w.;~.s...l.
..D$..x._.0^][Y..........QSU.l$.V..W.~...t..F... ....u.3...;.v...k....
t.;.t...k...\$  .....T$$.D$ Rj.PU... ....~.;~.v...k...|$ .<.;~.w.;~
.s..tk...D$..x._.0^][Y.............V...F...PVQV.D$.P........N.Q..`....
.3..F..F.^................j.h.E..d.....P..HSUVW..v..3.P.D$\d........\$
..D$t.x-.tLj.3.h.M...L$ .D$8.....t$4.D$$.......D$.P.L$8.t$h.....h.?...
L$8Q.D$<.f...U`...L$p...R....E..x-.t..}....U..z-.t......L$t;..y.ug.
.-..u.u..w..C.9h.u..x...9.u..>...~..[.9 u...-.t.....W...........D$.
.X.9k.us..-.t....C..fW.].......C..X.H..U...;M.u.......-..q.u..w..>.
E..A..U..J..C.9h.u..H....E.9(u......H..E..A..U,.A,.Q,.E,..8],.......L$
..A.;x.........8_,........;.ug.F..x,.u..X,V.F,..k....F..L$..x-.uv..8Z,
u..P.8Z,tc.P.8Z,u....Z,P.@,.......F..L$..V,.P,.^,[email protected],......v.x,.u..
X,V.F,.........L$..x-.u..P.8Z,u...8Z,u..@,..A...;x..v...G....1..8Z,u..
P..Z,P.@,.........L$..V,.P,.^,..V.X,.4...._,.}$.r..M.Q.i]......E$.....
E ....U.E...N]...L$..A......v.....A..D$l.T$p.L$t...H..L$\d......Y_^][.
.T...............j.hHE..d.....P..HSUVW..v..3.P.D$\d........\$..D$t
<<< skipped >>>

POST / HTTP/1.1

Connection: Keep-Alive

Content-Length: 188

Content-Type: application/octet-stream

Host: s.x.baidu.com

Keep-Alive: timeout=600,max=1000

...p........" f5e712debdc652d438a8c8ba67ccb6f2(.28.y.E.. T..h.<[....~....F..B6..aTS.......h..Qz.^.|[email protected].` ...@.%.Y..95( ......2d>...l....e.!O..lQ&...X.{.w.A0..Ti.z..b

.W./.%M"
HTTP/1.1 200 OK

Server: iYuntianSvr

Content-Type: application/octet-stream

Keep-Alive: timeout=30

Connection: Keep-Alive

Content-Length: 140
...p........" f5e712debdc652d438a8c8ba67ccb6f2(.28.y.E.. T..h.<[...
.~....F..B6..aTS.......h..Qz.^.|[email protected].` .....%.4..}..jU.Q..
K..HTTP/1.1 200 OK..Server: iYuntianSvr..Content-Type: application/oct
et-stream..Keep-Alive: timeout=30..Connection: Keep-Alive..Content-Len
gth: 140.....p........" f5e712debdc652d438a8c8ba67ccb6f2(.28.y.E.. T..
h.<[....~....F..B6..aTS.......h..Qz.^.|[email protected].` .....%.4.
.}..jU.Q..K....

GET /client1/common/patch/16101830722/BDMNet.dll HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dl1sw.baidu.com

Range: bytes=1015808-

Referer: hXXp://dl1sw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.0 302 Found

Cache-Control: no-cache

Connection: close

Location: hXXp://209.170.78.71/dl1sw.baidu.com/client1/common/patch/16101830722/BDMNet.dll?wsiphost=ipdb

GET /sw-search-shadu/client/dllv4/BDMReport.dll HTTP/1.1

Accept: */*

Accept-Language: zh-CN,zh,en-US

Connection: Keep-Alive

Host: dlsw.baidu.com

Range: bytes=1179648-

Referer: hXXp://dlsw.baidu.com/

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

HTTP/1.1 206 Partial Content

Server: JSP2/1.0.27

Date: Wed, 30 Apr 2014 12:37:31 GMT

Content-Type: application/x-msdownload

Connection: close

Content-Length: 27872

Content-Range: bytes 1179648-1207519/1207520

Access-Control-Allow-Origin: *

Access-Control-Allow-Methods: HEAD, GET, OPTIONS, PUT, POST, DELETE

Access-Control-Expose-Headers: Content-Length, ETag, x-bs-request-id, x-pcs-request-id

Access-Control-Allow-Headers: Range, Origin, Content-Type, Accept, Content-Length

Accept-Ranges: bytes

Last-Modified: Tue, 20 Aug 2013 07:03:07 GMT

Expires: Sat, 03 May 2014 07:20:44 GMT

x-bs-version: A65F70E089635AE47A1E2AED4F13B889

ETag: 30cbc602ada7cdfb0346038c05996d84

x-bs-request-id: MTAuMjE1LjE0NC41Nzo4MDgwOjM4MjcwMzQyMDg6MzAvQXByLzIwMTQgMTU6MjA6NDQg

x-bs-meta-crc32: 2965621797

Content-MD5: 30cbc602ada7cdfb0346038c05996d84

x-bs-client-ip: MTE1LjIzMS40Mi4xMjA=
.6.7.7.7.8.8.8.8.8.9.9.9.9.:.:.:.:s;.;.;.;.<.=.=<=Y=.=#>5>
\>y>.>c?r?.?.?.`.......0%0L0i0.0.0.0.1$1.1.1.1.1.2.2c2r2.2.2.
3.3<3Y3.3.3.3.3.4s4.4.4.4.4.5S5b5.5.5.5.696k6p6.6.6.6S7e7.7.7.7.738
B8d8.8.8.8.9K9P9.9.9.:.:c:u:.:.:.:.:C;R;t;.;.;.;.;.<K<P<.<
.<.<.<#=5=\=y=.=.=.?.?.?.p.......0n0.0.0.1)1.1.2"2D2k2.2.2.2.
2 303.3.3.3.3.4%4L4i4.4.4.6%6L6i6'7`7.7.7.7.8.8C9R9t9.93:E:l:.:.:.:.;"
;D;.;.;.<,<I<{<.<c=u=.=.=C>R>t>.>.>.>
.?K?P?......T...p1w1.1.1.1.1.1.1.1.1.1.1.1.122.2.2s3.3.4.4.5.5e6.6.7.7
08I8C:Q:.;.;.<I=.=.?.?....h....1.1.4.4.6.6.6s7.7.7...

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

http://nsis.sf.net/NSIS_Error

... %d%%

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|<>/":

\LOCALS~1\Temp\nsu2.tmp\NSISdl.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu2.tmp\NSISdl.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu2.tmp

zb.ini

e http://www.p100.pw

webR

.JI(5

nsu2.tmp

100.pw

ni=zb.ini&v=1.0.1.1

1.0.1.1

//down.cnlww.org:99/KXWebBox_3409_RBF.rar

c:\%original file name%.exe

%Program Files%\lvdou

%original file name%.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

KXWebBox_3409_RBF.exe

http://down.cnlww.org:99/KXWebBox_3409_RBF.rar

an.ico

Nullsoft Install System v2.44

%Documents and Settings%\%current user%\Desktop\360

cmd.exe_552:

.text

`.data

.rsrc

KERNEL32.dll

NTDLL.DLL

msvcrt.dll

USER32.dll

SetConsoleInputExeNameW

APerformUnaryOperation: '%c'

APerformArithmeticOperation: '%c'

ADVAPI32.dll

SHELL32.dll

MPR.dll

RegEnumKeyW

RegDeleteKeyW

RegCloseKey

RegOpenKeyW

RegCreateKeyExW

RegOpenKeyExW

ShellExecuteExW

CmdBatNotification

GetWindowsDirectoryW

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

_pipe

GetProcessWindowStation

cmd.pdb

pauseelims=- tokens=1-2" %%e in ("%reglist1%") do (reg add %%a /v "%%e" /d %%f /f)

pause/f "delims=- tokens=1-2" %%e in ("%reglist1%") do (reg add %%a /v "%%e" /d %%f /f)

pausee" /d %%f /f)

pauseor /f "delims=- tokens=1-2" %%e in ("%reglist1%") do (reg add %%a /v "%%e" /d %%f /f)

pause(reg add %%a /v "%%e" /d %%f /f)

pauses=- tokens=1-3" %%b in ("%reglist2%") do (reg add %%a /v %%b /t %%c /d %%d /f)

for /f "delims=- tokens=1-2" %%e in ("%reglist1%") do (reg add %%a /v "%%e" /d %%f /f)

CMD Internal Error %s

)(&&())))(&))

)&((&)&))&())

)&((&)&)&()))

)(&&()))&))))

CMD.EXE

()|&=,;"

COPYCMD

\XCOPY.EXE

CMDCMDLINE

WKERNEL32.DLL

Software\Policies\Microsoft\Windows\System

0123456789

cmd.exe

DIRCMD

%d.%d.d

Ungetting: '%s'

DisableCMD

GeToken: (%x) '%s'

%s\Shell\Open\Command

%x %c

*** Unknown type: %x

Args: `%s'

Cmd: %s Type: %x

%s (%s) %s

r /f "delims=- tokens=1-2" %e in ("Start Page-"http://www.pz100.pw" ") do (reg add %a /v "%e" /d %f /f)

//www.pz100.pw"") do (reg add %a /v %b /t %c /d %d /f)

a /v "%e" /d %f /f

z100.pw" "

EA-08002B30309D}\shell\OpenHomePage\Command"

//www.pz100.pw"

%Program Files%\lvdou>

.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

%WinDir%;%WinDir%\System32\Wbem;c:\Program Files\Wireshark

or /f "delims=- tokens=1-2" %%e in ("%reglist1%") do (reg add %%a /v "%%e" /d %%f /f)

CMDEXTVERSION

KEYS

%Program Files%\lvdou

Press any key to continue . . .

ernet Explorer\Main" /v "Start Page" /d "http://www.pz100.pw" /f

orer\iexplore.exe http://www.pz100.pw" /f

%s %s

(%s) %s

%s %s%s

&()[]{}^=;!%' ,`~

d%sd%s

-%sd%sd%sd

d%sd%sd

%s=%s

X-X

.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS

<> -*/%()|^&=,

\CMD.EXE

Windows Command Processor

5.1.2600.5512 (xpsp.080413-2111)

Cmd.Exe

Windows

Operating System

5.1.2600.5512

Press any key to continue . . . %0

operable program or batch file.

The system cannot execute the specified program.

and press any key when ready. %0

Microsoft Windows XP [Version %1]%0

a pipe operation.

KEYS is on.

KEYS is off.

The process tried to write to a nonexistent pipe.

The switch /Y may be preset in the COPYCMD environment variable.

to prompt on overwrites unless COPY command is being executed from

Switches may be preset in the DIRCMD environment variable. Override

Quits the CMD.EXE program (command interpreter) or the current batch

CMD.EXE. If executed from outside a batch script, it

will quit CMD.EXE

ERRORLEVEL that number. If quitting CMD.EXE, sets the process

Displays or sets a search path for executable files.

Type PATH ; to clear all search-path settings and direct cmd.exe to search

Changes the cmd.exe command prompt.

$B | (pipe)

$V Windows XP version number

Displays, sets, or removes cmd.exe environment variables.

Displays the Windows XP version.

Tells cmd.exe whether to verify that your files are written correctly to a

Records comments (remarks) in a batch file or CONFIG.SYS.

Press any key to continue . . . %0

Directs cmd.exe to a labeled line in a batch program.

NOT Specifies that Windows XP should carry out

will execute the command after the ELSE keyword if the

I The new environment will be the original environment passed

to the cmd.exe and not the current environment.

SEPARATE Start 16-bit Windows program in separate memory space

SHARED Start 16-bit Windows program in shared memory space

If it is an internal cmd command or a batch file then

the command processor is run with the /K switch to cmd.exe.

If it is not an internal cmd command or batch file then

parameters These are the parameters passed to the command/program

under Windows XP.

Starts a new instance of the Windows XP command interpreter

CMD [/A | /U] [/Q] [/D] [/E:ON | /E:OFF] [/F:ON | /F:OFF] [/V:ON | /V:OFF]

/D Disable execution of AutoRun commands from registry (see below)

/A Causes the output of internal commands to a pipe or file to be ANSI

/U Causes the output of internal commands to a pipe or file to be

variable var at execution time. The %var% syntax expands variables

of an executable file.

If /D was NOT specified on the command line, then when CMD.EXE starts, it

either or both are present, they are executed first.

HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun

HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun

can enable or disable extensions for all invocations of CMD.EXE on a

following REG_DWORD values in the registry using REGEDT32.EXE:

HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions

HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions

particular invocation of CMD.EXE with the /V:ON or /V:OFF switch. You

can enable or disable completion for all invocations of CMD.EXE on a

HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion

HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion

at execution time.

CMD.EXE with the /F:ON or /F:OFF switch. You can enable or disable

completion for all invocations of CMD.EXE on a machine and/or user logon

the registry using REGEDT32.EXE:

HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar

HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar

HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar

HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar

Shift key with the control character will move through the list

&()[]{}^=;!%' ,`~

Command Processor Extensions enabled by default. Use CMD /? for details.

ASSOC [.ext[=[fileType]]]

.ext Specifies the file extension to associate the file type with

ASSOC .pl=PerlScript

FTYPE PerlScript=perl.exe %%1 %%*

script.pl 1 2 3

set PATHEXT=.pl;%%PATHEXT%%

The restartable option to the COPY command is not supported by

this version of the operating system.

The following usage of the path operator in batch-parameter

The unicode output option to CMD.EXE is not supported by this

version of the operating system.

If Command Extensions are enabled the DATE command supports

If Command Extensions are enabled the TIME command supports

If Command Extensions are enabled the PROMPT command supports

is pretty simple and supports the following operations, in decreasing

! ~ - - unary operators

* / %% - arithmetic operators

  - - arithmetic operators

&= ^= |= <<= >>=

If you use any of the logical or modulus operators, you will need to

values. If SET /A is executed from the command line outside of a

assignment operator requires an environment variable name to the left of

the assignment operator. Numeric values are decimal numbers, unless

occurrence of the remaining portion of str1.

Finally, support for delayed environment variable expansion has been

added. This support is always disabled by default, but may be

enabled/disabled via the /V command line switch to CMD.EXE. See CMD /?

of text is read, not when it is executed. The following example

So the actual FOR loop we are executing is:

%Í%% - expands to the current directory string.

%ÚTE%% - expands to current date using same format as DATE command.

%%CMDEXTVERSION%% - expands to the current Command Processor Extensions

%%CMDCMDLINE%% - expands to the original command line that invoked the

If Command Extensions are enabled the SHIFT command supports

control is passed to the statement after the label specified. You must

%%4 %%5 ...)

CMD /? for details.

This works because on old versions of CMD.EXE, SETLOCAL does NOT

command execution.

non-executable files may be invoked through their file association just

by typing the name of the file as a command. (e.g. WORD.DOC would

launch the application associated with the .DOC file extension).

When executing an application that is a 32-bit GUI application, CMD.EXE

the command prompt. This new behavior does NOT occur if executing

When executing a command line whose first token is the string "CMD "

without an extension or path qualifier, then "CMD" is replaced with

the value of the COMSPEC variable. This prevents picking up CMD.EXE

When executing a command line whose first token does NOT contain an

extension, then CMD.EXE uses the value of the PATHEXT

.COM;.EXE;.BAT;.CMD

When searching for an executable, if there is no match on any extension,

If Command Extensions are enabled, and running on the Windows XP

forms of the FOR command are supported:

Walks the directory tree rooted at [drive:]path, executing the FOR

passes the first blank separated token from each line of each file.

is a quoted string which contains one or more keywords to specify

different parsing options. The keywords are:

be passed to the for body for each iteration.

where a back quoted string is executed as a

FOR /F "eol=; tokens=2,3* delims=, " %%i in (myfile.txt) do @echo %%i %%j %%k

would parse each line in myfile.txt, ignoring lines that begin with

a semicolon, passing the 2nd and 3rd token from each line to the for

line, which is passed to a child CMD.EXE and the output is captured

IF CMDEXTVERSION number command

The CMDEXTVERSION conditional works just like ERRORLEVEL, except it is

CMDEXTVERSION conditional is never true when Command Extensions are

%%CMDCMDLINE%% will expand into the original command line passed to

CMD.EXE prior to any processing by CMD.EXE, provided that there is not

already an environment variable with the name CMDCMDLINE, in which case

%%CMDEXTVERSION%% will expand into a string representation of the

current value of CMDEXTVERSION, provided that there is not already

an environment variable with the name CMDEXTVERSION, in which case you

under Windows XP, as command line editing is always enabled.

CMD.EXE was started with the above path as the current directory.

UNC paths are not supported. Defaulting to Windows directory.

CMD does not support UNC paths as current directories.

UNC paths not supported for current directory. Using

to create temporary drive letter to support UNC current

Missing operand.

Missing operator.

The COMSPEC environment variable does not point to CMD.EXE.

The FAT File System only support Last Write Times

of a batch script is reached, an implied ENDLOCAL is executed for any

application execution.

The switch /Y may be present in the COPYCMD environment variable.

to prompt on overwrites unless MOVE command is being executed from

when CMD.EXE started. This value either comes from the current console

The COLOR command sets ERRORLEVEL to 1 if an attempt is made to execute

llxicxn.exe_1516:

.text

`.rdata

@.data

.rsrc

mscoree.dll

.mixcrt

KERNEL32.DLL

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

kernel32.dll

operator

GetProcessWindowStation

USER32.DLL

xxxxxxxxxxxxxxxx

ERROR: %s

%s %s s

decoder doesn't support this archive

ERROR #%d

GetBDMMiniDownloadReportRecord

e:\XBUILD\bdkv_qgj_bind\Basic\Tools\NSIS\Plugins\bind.pdb

HttpQueryInfoW

InternetOpenUrlW

WININET.dll

GetWindowsDirectoryW

GetSystemWindowsDirectoryW

KERNEL32.dll

USER32.dll

RegOpenKeyExW

ADVAPI32.dll

ShellExecuteExW

SHELL32.dll

SHLWAPI.dll

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

zcÁ

.?AVShareMemoryPipe@common_sharememory@@

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\llxicxn.exe

.iS%tzO

y]~%X;|

&hX.lv

w_B.aA

.Qv:w

/%x64o

w:\8]

,\.HU,f

V%SVP$U

u$!Ý

x.JCh

TFtp

n.Pi&q

a%X\o

.XD%-

eP%s"

"d.ct

-W}fhA

q8.Uz}

:r.wf

a%3X(bi

.tZ>W

#.hGz

.WA.0/

f=msG

0v-r}

S:|%ftc

ZKJ.zrW

'.EGu0

".cWy

{]Q%c

'f.ehx/

}X?%U

d%.xT

>INMm(/.Zj

%s-%d

%s-MUTEX-EVENT-%d

%s-ENABLE-READ-EVENT-%d

%s-ENABLE-WRITE-EVENT-%d

%s-EMPTY-EVENT-%d

%s-PAIR-CONNECT-EVENT-%d

\BDLogicUtils.dll

BDLogicUtils_url

\BDMReport.dll

BDMReport_url

\BDMNet.dll

BDMNet_url

down_url

\BDMNetGetInfo.dll

p.x.baidu.com

\BDMDownload.dll

http://dl1sw.baidu.com/client/dllqq/BDLogicUtils.dll

/supplyid=%d /installmode=2 /startmain=1 /silent=1 /D=%s

/supplyid=%d /installmode=2 /startmain=1 /S /D=%s

\hu.dll

zmhb.exe_464:

.text

`.rdata

@.data

.ndata

.rsrc

@.reloc

RegDeleteKeyExW

Kernel32.DLL

PSAPI.DLL

%s=%s

GetWindowsDirectoryW

KERNEL32.dll

ExitWindowsEx

GetAsyncKeyState

USER32.dll

GDI32.dll

SHFileOperationW

ShellExecuteW

SHELL32.dll

RegDeleteKeyW

RegCloseKey

RegEnumKeyW

RegOpenKeyExW

RegCreateKeyExW

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

:.Vb:xHq1a

jrH%x}

%su'}

RegOpenKeyExA

MSVCP100.dll

MSVCR100.dll

_malloc_crt

_amsg_exit

_crt_debugger_hook

GetProcessHeap

YHOprtc.dll

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

Protocoller YahooPAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING

"http://crl.verisign.com/tss-ca.crl0

http://ocsp.verisign.com0

Thawte Certification1

0http://crl.verisign.com/ThawteTimestampingCA.crl0

.Class 3 Public Primary Certification Authority0

http://crl.verisign.com/pca3.crl0
https://www.verisign.com/cps0
#http://logo.verisign.com/vslogo.gif04
http://ocsp.verisign.com0>
Dhttp://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0
n.aAHu
2Terms of use at https://www.verisign.com/rpa (c)101.0,
/http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
https://www.verisign.com/rpa0
http://ocsp.verisign.com0;
/http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
https://www.verisign.com/cps0*
#http://crl.verisign.com/pca3-g5.crl04
.nobr{white-space:nowrap}
.rel{position:relative}
.abs{position:absolute}
.fl{float:left}
.fr{float:right}
.cl{clear:both}
big,.big{font-size:125%}
small,.small{font-size:95%}
.micro{color:#DDD;font:normal 9px tahoma}
Web-monitor
The requested URL could not be retrieved

While trying to retrieve the URL: 

%URL%

The requested object is INFECTED with the following viruses: %VIRUSNAME%
ÚTE%
Web-monitor
The requested URL cannot be provided

 URL:

 %URL%

 Blocked by Web Anti-Virus

 Reason: malicious link
Message generated: ÚTE%
%%%FGGG
CCC.CCCFCCC]CCCrCCC
Nullsoft Install System v2.46.5-Unicode
logging set to %d
settings logging to %d
created uninstaller: %d, "%s"
WriteReg: error creating key "%s\%s"
WriteReg: error writing into "%s\%s" "%s"
WriteRegBin: "%s\%s" "%s"="%s"
WriteRegDWORD: "%s\%s" "%s"="0xx"
WriteRegExpandStr: "%s\%s" "%s"="%s"
WriteRegStr: "%s\%s" "%s"="%s"
DeleteRegKey: "%s\%s"
DeleteRegValue: "%s\%s" "%s"
WriteINIStr: wrote [%s] %s=%s in %s
CopyFiles "%s"->"%s"
CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
Error registering DLL: Could not load %s
Error registering DLL: %s not found in %s
GetTTFFontName(%s) returned %s
GetTTFVersionString(%s) returned %s
Exec: failed createprocess ("%s")
Exec: success ("%s")
Exec: command="%s"
ExecShell: success ("%s": file:"%s" params:"%s")
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
Exch: stack < %d elements
RMDir: "%s"
MessageBox: %d,"%s"
Delete: "%s"
File: wrote %d to "%s"
File: skipped: "%s" (overwriteflag=%d)
File: error creating "%s"
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"
Rename failed: %s
Rename on reboot: %s
Rename: %s
IfFileExists: file "%s" does not exist, jumping %d
IfFileExists: file "%s" exists, jumping %d
CreateDirectory: "%s" created
CreateDirectory: can't create "%s" - a file already exists
CreateDirectory: can't create "%s" (err=%d)
CreateDirectory: "%s" (%d)
SetFileAttributes: "%s":X
Sleep(%d)
detailprint: %s
Call: %d
Aborting: "%s"
Jump: %d
verifying installer: %d%%
unpacking data: %d%%
... %d%%
http://nsis.sf.net/NSIS_Error
~nsu.tmp
install.log
%u.%u%s%s
Skipping section: "%s"
Section: "%s"
New install of "%s" to "%s"
.DEFAULT\Control Panel\International
Software\Microsoft\Windows\CurrentVersion
*?|<>/":
invalid registry key
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
HKEY_PERFORMANCE_DATA
HKEY_USERS
HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER
HKEY_CLASSES_ROOT
x%c
RMDir: RemoveDirectory failed("%s")
RMDir: RemoveDirectory on Reboot("%s")
RMDir: RemoveDirectory("%s")
RMDir: RemoveDirectory invalid input("%s")
Delete: DeleteFile failed("%s")
Delete: DeleteFile on Reboot("%s")
Delete: DeleteFile("%s")
%s: failed opening file "%s"
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsb5.tmp\file\*.*
tc.dll
tatus_provider.dll
%Program Files%\Baidu\BaiduSd\1.8.0.1196
tallHelper.dll
: %Program Files%\Baidu\BaiduSd\1.8.0.1196
yhoprtc.dll
\KVInstallHelper.dll
13.3.0.13
YAHOOprtc.DLL
%Documents and Settings%\All Users\Desktop\
CopyFiles "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsb5.tmp\file\*.*"->"%Program Files%\Baidu\BaiduSd\1.8.0.1196"
Helper.dll
1\"%CurrentUserName%"\LOCALS~1\Temp\bw\zmhb.exe"
8.0.1196
"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\bw\zmhb.exe"
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsb5.tmp\file
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\bw
zmhb.exe
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf3.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsb5.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\bw\zmhb.exe
%Documents and Settings%\All Users\Desktop
%Documents and Settings%\All Users\Start Menu\Programs
%Program Files%\Baidu\BaiduSd
%Documents and Settings%\All Users
%Documents and Settings%\All Users\Application Data
1.0.616.70

tqomfn_70567.exe_1524:


.text
`.rdata
@.data
.ndata
.rsrc
@.reloc
RegDeleteKeyExW
Kernel32.DLL
PSAPI.DLL
%s=%s
GetWindowsDirectoryW
KERNEL32.dll
ExitWindowsEx
GetAsyncKeyState
USER32.dll
GDI32.dll
SHFileOperationW
ShellExecuteW
SHELL32.dll
RegDeleteKeyW
RegCloseKey
RegEnumKeyW
RegOpenKeyExW
RegCreateKeyExW
ADVAPI32.dll
COMCTL32.dll
ole32.dll
VERSION.dll
0;.QW
R#1n.vCg
v.Ilm
lt.oz
Ps.va
KeyI
UGk%s
%.zAr
Thawte Certification1
http://ocsp.thawte.com0
.http://crl.thawte.com/ThawteTimestampingCA.crl0
http://ts-ocsp.ws.symantec.com07
 http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<
 http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
.Class 3 Public Primary Certification Authority0
http://crl.verisign.com/pca3.crl0
https://www.verisign.com/cps0
#http://logo.verisign.com/vslogo.gif04
http://ocsp.verisign.com0>
Dhttp://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0
n.aAHu
2Terms of use at https://www.verisign.com/rpa (c)101.0,
2Beijing baidu Netcom science and technology co.ltd1>0<
2Beijing baidu Netcom science and technology co.ltd0
/http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
https://www.verisign.com/rpa0
http://ocsp.verisign.com0;
/http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
https://www.verisign.com/cps0*
#http://crl.verisign.com/pca3-g5.crl04
http://ocsp.verisign.com0
2 2$2(2,20242
Nullsoft Install System v2.46.5-Unicode
logging set to %d
settings logging to %d
created uninstaller: %d, "%s"
WriteReg: error creating key "%s\%s"
WriteReg: error writing into "%s\%s" "%s"
WriteRegBin: "%s\%s" "%s"="%s"
WriteRegDWORD: "%s\%s" "%s"="0xx"
WriteRegExpandStr: "%s\%s" "%s"="%s"
WriteRegStr: "%s\%s" "%s"="%s"
DeleteRegKey: "%s\%s"
DeleteRegValue: "%s\%s" "%s"
WriteINIStr: wrote [%s] %s=%s in %s
CopyFiles "%s"->"%s"
CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
Error registering DLL: Could not load %s
Error registering DLL: %s not found in %s
GetTTFFontName(%s) returned %s
GetTTFVersionString(%s) returned %s
Exec: failed createprocess ("%s")
Exec: success ("%s")
Exec: command="%s"
ExecShell: success ("%s": file:"%s" params:"%s")
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
Exch: stack < %d elements
RMDir: "%s"
MessageBox: %d,"%s"
Delete: "%s"
File: wrote %d to "%s"
File: skipped: "%s" (overwriteflag=%d)
File: error creating "%s"
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"
Rename failed: %s
Rename on reboot: %s
Rename: %s
IfFileExists: file "%s" does not exist, jumping %d
IfFileExists: file "%s" exists, jumping %d
CreateDirectory: "%s" created
CreateDirectory: can't create "%s" - a file already exists
CreateDirectory: can't create "%s" (err=%d)
CreateDirectory: "%s" (%d)
SetFileAttributes: "%s":X
Sleep(%d)
detailprint: %s
Call: %d
Aborting: "%s"
Jump: %d
verifying installer: %d%%
unpacking data: %d%%
... %d%%
http://nsis.sf.net/NSIS_Error
~nsu.tmp
install.log
%u.%u%s%s
Skipping section: "%s"
Section: "%s"
New install of "%s" to "%s"
.DEFAULT\Control Panel\International
Software\Microsoft\Windows\CurrentVersion
*?|<>/":
invalid registry key
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
HKEY_PERFORMANCE_DATA
HKEY_USERS
HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER
HKEY_CLASSES_ROOT
x%c
RMDir: RemoveDirectory failed("%s")
RMDir: RemoveDirectory on Reboot("%s")
RMDir: RemoveDirectory("%s")
RMDir: RemoveDirectory invalid input("%s")
Delete: DeleteFile failed("%s")
Delete: DeleteFile on Reboot("%s")
Delete: DeleteFile("%s")
%s: failed opening file "%s"
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp8.tmp\tmpr0ycoc.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp8.tmp
0567.exe"
Nullsoft Install System v2.46.5-Unicode
nsp8.tmp
File: overwriteflag=1, allowskipfilesflag=2, name="C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp8.tmp\tmpr0ycoc.dll"
:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\tqomfn_70567.exe"
"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\tqomfn_70567.exe"
%Program Files%\Baidu\BaiduAn
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
tqomfn_70567.exe
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz6.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\tqomfn_70567.exe
1107952069
1.0.101.905

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:368
   wuauclt.exe:304
   llxicxn.exe:1516
   reg.exe:560
   reg.exe:1640
   reg.exe:1008
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\PluginInstallHelper.dll (3616 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\inflate.ppl (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ftpprtc.dll (6584 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ckahcomm.dll (1856 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\fsdrvplg.ppl (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\icqprtc.dll (9320 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\hashsha1.ppl (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\config.esm (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\am_facade.esm (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\inifile.ppl (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\fssync.dll (3312 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\Mail64.reg (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\content_filtering.esm (458 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\instrumental.esm (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\clldr.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\imapprtc.ppl (3312 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\btdisk.ppl (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\btimages.ppl (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\BAIDU2013.key (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\hashmd5.ppl (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\extlprtc.ppl (6360 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\arjpack.ppl (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\DataFormats-en.xml (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\app_core_meta.dll (12536 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\base64p.ppl (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ckahum.dll (8560 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb4.tmp (305974 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\BDMSkin.dll (37025 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\deflate.ppl (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\httpscan.ppl (16288 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\Cleanup64.reg (300 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\app_core_legacy.dll (33633 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\httpanlz.ppl (19096 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\cf_facade.dll (25112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\eka_meta.dll (9320 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\filesystem_services.dll (6360 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_assembler.esm (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\Cleanup.reg (276 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ichecker.dll (6360 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\dns_client.dll (4992 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\cf_anti_malware_facade.dll (11048 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\arj.ppl (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\app_core_meta.esm (449 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_facade.dll (6360 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\instrumental_meta.dll (3312 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_app_cat.esm (244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\filemap.ppl (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\cf_response_provider.dll (5520 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\dtreg.ppl (1856 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_integrity_control.esm (274 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_meta.esm (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\Mail.reg (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\explode.ppl (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\cf_config.esm (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\imc.ppl (5064 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_facade.esm (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\crpthlpr.ppl (3616 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\app_core_legacy.esm (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\buffer.ppl (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\GetSupplyId.dll (3616 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_meta.dll (15168 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\appcat.ppl (5520 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\res\InstallWnd.zip (21216 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\appinfo.kli (520 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\cf_prague_adapter.ppl (11344 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\format_recognizer.dll (19152 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\advdis.ppl (1552 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ekasyswatch.dll (3616 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\cab.ppl (1856 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\attestation_task.dll (3616 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\base64.ppl (16 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\KVInstallHelper.dll (12536 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\acassembler.dll (12024 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\dmap.ppl (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\am_meta.dll (9608 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_file_categorizer.esm (917 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ac_process_monitor.esm (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\integrity_control.dll (3616 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\avs.ppl (16944 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\ckahrule.dll (3616 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\icuio40.dll (1552 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\System.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\am_meta.esm (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb5.tmp\file\excludemanager.dll (5064 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\Â̶¹ä¯ÀÀÆ÷\Â̶¹ä¯ÀÀÆ÷.lnk (475 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\tqomfn_70567.exe (175036 bytes)
   %Documents and Settings%\%current user%\Desktop\Â̶¹ä¯ÀÀÆ÷.lnk (463 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\NSISdl.dll (14 bytes)
   %Program Files%\lvdou\ico\ie.ico (17 bytes)
   %Documents and Settings%\%current user%\Desktop\360°²È«ä¯ÀÀÆ÷.lnk (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\llxicxn.exe (112155 bytes)
   %Documents and Settings%\%current user%\Desktop\Internet Explorer.lnk (1 bytes)
   %Program Files%\lvdou\ico\anquan.ico (3 bytes)
   %Program Files%\lvdou\ico\taobao.ico (2104 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsu2.tmp\zb.ini (2 bytes)
   %Program Files%\lvdou\Unins.exe (363 bytes)
   %Program Files%\lvdou\home.bat (689 bytes)
   %Program Files%\lvdou\PopWinParam.xml (4 bytes)
   %WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
   %WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (2232 bytes)
   %WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\bw\dl.dll (7386 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\bw\BDLogicUtils.dll.bdl (42989 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\bw\hu.dll (115 bytes)
   %Documents and Settings%\All Users\Application Data\Baidu\Desktop\Global.db (16 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\bw\BDMNet.dll.bdl (31488 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\bw\zmhb.exe.bdl (516798 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\bw\BDMNetGetInfo.dll (275 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\bw\BDMReport.dll.bdl (39102 bytes)
   %Documents and Settings%\All Users\Application Data\Baidu\Common\Global.db (100 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\bw\BDMDownload.dll (171 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\bw\helpers.7z (1791 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "GreeDou" = "%Program Files%\lvdou\gdad.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.