MD5: 60f7a309f9333f3374d81f08d17a51d8
SHA1: 3af9dba4e4b85fe54eb562def12aa545fdc6eb2e
SHA256: 5d159819d4dc27247dd7d6dde85ec98b82d8661ead93285e4f3f572db02c8301
SSDeep: 196608:ubAnVDeGmWr5HHeQePwHdhaEcONpBQgeUwgl6F5QYV8K:ugSG7r5lePwHdh7cO5QgKpF5z8K
Size: 8230280 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:53:18
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

ec5e920d1aa868874c7d7c14aa1e93e8.exe:740
ec5e920d1aa868874c7d7c14aa1e93e8.exe:1680

The Trojan injects its code into the following process(es):

ec5e920d1aa868874c7d7c14aa1e93e8.exe:1232
%original file name%.exe:1936

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process ec5e920d1aa868874c7d7c14aa1e93e8.exe:740 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\e4c10b479f9591588ada7b6020891305\zwmtdy.dll (205023 bytes)
%Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\67ac2c169df245da5a2cc5128d99cf4e (601 bytes)
%WinDir%\Temp\wjm9.tmp (11028 bytes)
%Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\a2907e1759f993476161da5c73029e0d (25 bytes)
%WinDir%\Temp\Ima7.tmp (381 bytes)
%WinDir%\Temp\wjm8.tmp (2500 bytes)

The Trojan deletes the following file(s):

%WinDir%\Temp\Ima7.tmp (0 bytes)
%WinDir%\Temp\wjm9.tmp (0 bytes)
%WinDir%\Temp\wjm8.tmp (0 bytes)

The process ec5e920d1aa868874c7d7c14aa1e93e8.exe:1680 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Ima6.tmp (381 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Ima6.tmp (0 bytes)

The process ec5e920d1aa868874c7d7c14aa1e93e8.exe:1232 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Temp\ImaB.tmp (381 bytes)

The Trojan deletes the following file(s):

%WinDir%\Temp\ImaB.tmp (0 bytes)

The process %original file name%.exe:1936 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\System.dll (11 bytes)
%Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\9c0a1870f7180a5f3bf52ba52a4a5643\33d35aa7f8e478ea507bcd0428d90d9d.ico (3 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@technologiecartier[2].txt (2020 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WIEn\uninstall.lnk (1 bytes)
%Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\9c0a1870f7180a5f3bf52ba52a4a5643\d701bdf3fcc7b2e9297ba15c17fc1144.ico (3 bytes)
%Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\114829fb0b06025af73b8448e11e9052.json (966 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WIEn\Wajam Website.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@technologiecartier[1].txt (2446 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\IpConfig.dll (4992 bytes)
%Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\145cb62a0ba3f8215e60e6a68719211e.dll (11344 bytes)
%Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\67ac2c169df245da5a2cc5128d99cf4e (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\ns5.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\NSISList.dll (3616 bytes)
%Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\4e7c2619fd72b5bc2526185a6544cc7f.exe (32128 bytes)
%Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\9c0a1870f7180a5f3bf52ba52a4a5643\ba10cc111a4eb05d232f15671e53a4b3.ico (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\get_local_output.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\nsC.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl2.tmp (338866 bytes)
%Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\ec5e920d1aa868874c7d7c14aa1e93e8.exe (34561 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\MoreInfo.dll (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\37e71b14cb92186d23ddabe79dcd9a37.exe (5520 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WIEn\SignIn with Twitter.lnk (1 bytes)
%Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\869334498bd71f19578287f35c0d4da5.exe (41699 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\SimpleSC.dll (1856 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WIEn\Settings.lnk (1 bytes)
%WinDir%\4e7c2619fd72b5bc2526185a6544cc7f.exe (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\brh.dll (49631 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\ba10cc111a4eb05d232f15671e53a4b3.ico (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\nsJSON.dll (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\nsA.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\md5dll.dll (8 bytes)
%Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\8191670215e1df4f709d7eb2626fb06a.exe (35507 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (6748 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsfD.tmp (1275 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@technologiecartier[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\nsA.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\urlsLog[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\ns5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@technologiecartier[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\nsC.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsfD.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\downloadsLog[1].htm (0 bytes)

Registry activity

The process ec5e920d1aa868874c7d7c14aa1e93e8.exe:740 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB 25 E9 DB B0 7E C0 84 1F A5 E0 4B E4 0D BB 64"

The process ec5e920d1aa868874c7d7c14aa1e93e8.exe:1680 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "34 DD 4D 2E 4E EB C4 EF D0 65 7C 1E 28 67 DC BA"

[HKCR\AppID\3045035B-3C14-4698-8AC4-ADB18CC42C1E]
"LocalService" = "4eef0577ed872fd93972df584a3c8b77"

The Trojan deletes the following value(s) in system registry:

[HKCR\AppID\3045035B-3C14-4698-8AC4-ADB18CC42C1E]
"LocalService"

The process ec5e920d1aa868874c7d7c14aa1e93e8.exe:1232 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "73 1E 6A 2A 9D 24 CA 8F A8 07 63 10 F7 41 38 61"

The process %original file name%.exe:1936 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCR\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\NumMethods]
"(Default)" = "20"

[HKCR\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\InProcServer32]
"ThreadingModel" = "Both"

[HKCU\Software\WajIEnhance]
"install_timestamp2" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCR\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}\VersionIndependentProgID]
"(Default)" = "wajam.WajamBHO"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\AppID\priam_bho.DLL]
"AppID" = "{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634}"

[HKCR\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}\VersionIndependentProgID]
"(Default)" = "wajam.WajamDownloader"

[HKCR\wajam.WajamBHO\CLSID]
"(Default)" = "{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCR\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\InProcServer32]
"(Default)" = "%Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\145cb62a0ba3f8215e60e6a68719211e.dll"

[HKCU\Software\WajIEnhance]
"affiliate_id2" = "none"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCR\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\WIEn]
"AID" = "3673"

"ts2" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCR\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}\1.0\FLAGS]
"(Default)" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCR\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}]
"(Default)" = "PSFactoryBuffer"

[HKCR\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}\TypeLib]
"(Default)" = "{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}"

[HKCR\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}\1.0]
"(Default)" = "wajam 1.0 Type Library"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\159ba3f3ec760db4c9ef2b9817891cd0]
"DisplayName" = "Wajam"

[HKCR\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "54 42 F4 52 E5 E1 27 BF A5 A2 08 DD 4E 3D 18 16"

[HKCR\wajam.WajamDownloader.1]
"(Default)" = "WajamDownloader Class"

[HKCU\Software\WajIEnhance]
"unique_id" = "D1259E7D959CC9BA12AC13A4532F4469"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\TypeLib]
"(Default)" = "{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}"

[HKLM\SOFTWARE\WIEn]
"UID" = "D1259E7D959CC9BA12AC13A4532F4469"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\159ba3f3ec760db4c9ef2b9817891cd0]
"Publisher" = "Wajam"

[HKCU\Software\WajIEnhance]
"affiliate_id" = "3673"

[HKCR\wajam.WajamDownloader.1\CLSID]
"(Default)" = "{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}"

[HKCR\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}\ProgID]
"(Default)" = "wajam.WajamBHO.1"

[HKCR\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}\InprocServer32]
"(Default)" = "%Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\145cb62a0ba3f8215e60e6a68719211e.dll"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCR\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}]
"(Default)" = "Wajam"

[HKCR\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}]
"(Default)" = "WajamDownloader Class"

[HKCR\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCR\wajam.WajamBHO.1\CLSID]
"(Default)" = "{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCR\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}]
"(Default)" = "IWajamBHO"

[HKCR\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}\ProgID]
"(Default)" = "wajam.WajamDownloader.1"

[HKLM\SOFTWARE\WIEn]
"mid" = "8980cb5387fe91f28253f744f6a689f4"

[HKCR\wajam.WajamBHO.1]
"(Default)" = "Wajam"

[HKCR\wajam.WajamDownloader\CLSID]
"(Default)" = "{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCR\wajam.WajamBHO\CurVer]
"(Default)" = "wajam.WajamBHO.1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\WIEn]
"aid2" = "none"

[HKCR\wajam.WajamDownloader]
"(Default)" = "WajamDownloader Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCR\wajam.WajamBHO]
"(Default)" = "Wajam"

[HKCR\AppID\{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634}]
"(Default)" = "Wajam"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\159ba3f3ec760db4c9ef2b9817891cd0]
"URLInfoAbout" = "http://www.technologiecartier.com"

[HKLM\SOFTWARE\WIEn]
"TS" = "1470937954"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCR\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}\1.0\0\win32]
"(Default)" = "%Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\145cb62a0ba3f8215e60e6a68719211e.dll"

[HKCR\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}\TypeLib]
"(Default)" = "{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCR\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\159ba3f3ec760db4c9ef2b9817891cd0]
"DisplayVersion" = "4.71.1.10 (i1.0)"

[HKCR\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}\InprocServer32]
"(Default)" = "%Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\145cb62a0ba3f8215e60e6a68719211e.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCR\wajam.WajamDownloader\CurVer]
"(Default)" = "wajam.WajamDownloader.1"

[HKCR\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}\1.0\HELPDIR]
"(Default)" = "%Program Files%\159ba3f3ec760db4c9ef2b9817891cd0"

[HKCU\Software\WajIEnhance]
"install_timestamp" = "1470937954"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}]
"NoExplorer" = "1"

"(Default)" = "Wajam IE BHO"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

GetAsyncKeyState

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

logging set to %d

settings logging to %d

created uninstaller: %d, "%s"

WriteReg: error creating key "%s\%s"

WriteReg: error writing into "%s\%s" "%s"

WriteRegBin: "%s\%s" "%s"="%s"

WriteRegDWORD: "%s\%s" "%s"="0xx"

WriteRegExpandStr: "%s\%s" "%s"="%s"

WriteRegStr: "%s\%s" "%s"="%s"

DeleteRegKey: "%s\%s"

DeleteRegValue: "%s\%s" "%s"

WriteINIStr: wrote [%s] %s=%s in %s

CopyFiles "%s"->"%s"

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d

Error registering DLL: Could not load %s

Error registering DLL: %s not found in %s

Exec: failed createprocess ("%s")

Exec: success ("%s")

Exec: command="%s"

ExecShell: success ("%s": file:"%s" params:"%s")

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d

Exch: stack < %d elements

RMDir: "%s"

MessageBox: %d,"%s"

Delete: "%s"

File: wrote %d to "%s"

File: skipped: "%s" (overwriteflag=%d)

File: error creating "%s"

File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"

Rename failed: %s

Rename on reboot: %s

Rename: %s

IfFileExists: file "%s" does not exist, jumping %d

IfFileExists: file "%s" exists, jumping %d

CreateDirectory: "%s" created

CreateDirectory: can't create "%s" - a file already exists

CreateDirectory: can't create "%s" (err=%d)

CreateDirectory: "%s" (%d)

SetFileAttributes: "%s":X

Sleep(%d)

detailprint: %s

Call: %d

Aborting: "%s"

Jump: %d

verifying installer: %d%%

unpacking data: %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

~nsu.tmp

install.log

%u.%u%s%s

Skipping section: "%s"

Section: "%s"

New install of "%s" to "%s"

RegDeleteKeyExA

RMDir: RemoveDirectory failed("%s")

RMDir: RemoveDirectory on Reboot("%s")

RMDir: RemoveDirectory("%s")

RMDir: RemoveDirectory invalid input("%s")

Delete: DeleteFile failed("%s")

Delete: DeleteFile on Reboot("%s")

Delete: DeleteFile("%s")

%s=%s

*?|<>/":

invalid registry key

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

x%c

OCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr3.tmp\inetc.dll

02&v=d4.71.1.10&tv=1.0-10000&unique_id=D1259E7D959CC9BA12AC13A4532F4469&mid=8980cb5387fe91f28253f744f6a689f4&aid=3673&aid2=none&ts=1470937954&ts2=&brw=iexplore&mi=1&ma=5

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr3.tmp\inetc.dll

line=1&v=d4.71.1.10&tv=1.0-10000&unique_id=D1259E7D959CC9BA12AC13A4532F4469&mid=8980cb5387fe91f28253f744f6a689f4&aid=3673&aid2=none&ts=1470937954&ts2=&brw=iexplore&mi=1&ma=5

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr3.tmp

{FE2F6A2C-196E-4210-9C04-2B1BC21F07EF}

1&v=d4.71.1.10&tv=1.0-10000&unique_id=D1259E7D959CC9BA12AC13A4532F4469&mid=8980cb5387fe91f28253f744f6a689f4&aid=3673&aid2=none&ts=1470937954&ts2=&brw=iexplore&mi=1&ma=5

:|7Ò

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v19-Mar-2012.cvs</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency></assembly>

2 2'2F2P2V2\2c2h2z2

3,3034383

> >$>(>,>

1 1$1(1,1014181<1@1

0"11161=1

9 9.979|9

3%3-32383C3N3Y3c3n3w3}3

1 1$1(1,10141

P4.Nl~

b%Xk$,!

rP%x(

:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr3.tmp\inetc.dll

=1&v=d4.71.1.10&tv=1.0-10000&unique_id=D1259E7D959CC9BA12AC13A4532F4469&mid=8980cb5387fe91f28253f744f6a689f4&aid=3673&aid2=none&ts=1470937954&ts2=&brw=iexplore&mi=1&ma=5

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsfD.tmp

?B~nsfD.tmp

adm\LOCALS~1\Temp\nsr3.tmp\inetc.dll

File: skipped: "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr3.tmp\inetc.dll" (overwriteflag=1)

3.tmp\inetc.dll"

f15671e53a4b3.ico,0, sw=0, hk=0

x86 9.0.30729.4148

gram Files\Internet Explorer\iexplore.exe

:\Program Files\Internet Explorer\iexplore.exe

\\Program Files\\159ba3f3ec760db4c9ef2b9817891cd0\\37e71b14cb92186d23ddabe79dcd9a37.exe

Program Files\\159ba3f3ec760db4c9ef2b9817891cd0\\37e71b14cb92186d23ddabe79dcd9a37.exe

37e71b14cb92186d23ddabe79dcd9a37.exe

7e71b14cb92186d23ddabe79dcd9a37.exe

1b14cb92186d23ddabe79dcd9a37.exe

79dcd9a37.exe

c:\%original file name%.exe

%Program Files%\159ba3f3ec760db4c9ef2b9817891cd0

%original file name%.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsb1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

2359584

755631384

2031936

2490706

2621676

2687298

2031856

2490686

2097430

2621696

2359520

1470937954

%Program Files%\Internet Explorer\iexplore.exe

75ed9567-aa58-4c8e-a8ea-3cad7c47ab03

hXXp://VVV.technologiecartier.com/web/log

hXXp://VVV.technologiecartier.com/web/log?evt=10002&v=d4.71.1.10&tv=1.0-10000&unique_id=D1259E7D959CC9BA12AC13A4532F4469&mid=8980cb5387fe91f28253f744f6a689f4&aid=3673&aid2=none&ts=1470937954&ts2=&brw=iexplore&mi=1&ma=5

"%Program Files%\Internet Explorer\iexplore.exe" -nohome

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nss4.tmp

FE2F6A2C-196E-4210-9C04-2B1BC21F07EF}

83951616

E1070104-F404-44CE-B556-0622F9D63EE5}

C:\\Program Files\\159ba3f3ec760db4c9ef2b9817891cd0\\37e71b14cb92186d23ddabe79dcd9a37.exe

-2063532032

-2147284440

f68c4eb1ae975d89c718ab51af6279e4.sys

f68c4eb1ae975d89c718ab51af6279e4.inf

f68c4eb1ae975d89c718ab51af6279e4.cfg

5.1.2600.5512 (xpsp.080413-2111)

%Documents and Settings%\All Users\Start Menu\Programs

4e7c2619fd72b5bc2526185a6544cc7f.exe

%Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\9c0a1870f7180a5f3bf52ba52a4a5643

ba10cc111a4eb05d232f15671e53a4b3.ico

33d35aa7f8e478ea507bcd0428d90d9d.ico

d701bdf3fcc7b2e9297ba15c17fc1144.ico

ec5e920d1aa868874c7d7c14aa1e93e8.exe

35d3f4908afde11a7295e9468109da9e.exe

8191670215e1df4f709d7eb2626fb06a.exe

8843d433e5e0bcf543a41a18dd661bd8.exe

869334498bd71f19578287f35c0d4da5.exe

fcd873bba4fb5a7c81f865c0e6eb3c6b.exe

%WinDir%\4e7c2619fd72b5bc2526185a6544cc7f.exe

hXXp://wajam.com/index.php?firstrun=1&lp=1&inline=1&v=d4.71.1.10&tv=1.0-10000&unique_id=D1259E7D959CC9BA12AC13A4532F4469&mid=8980cb5387fe91f28253f744f6a689f4&aid=3673&aid2=none&ts=1470937954&ts2=&brw=iexplore&mi=1&ma=5

)-.Yln

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>

%Documents and Settings%\All Users\Start Menu\Programs\WIEn\uninstall.lnk

itter.lnk

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

lorer\iexplore.exe" -nohome

%original file name%.exe_1936_rwx_01BA1000_00008000:

0x%c%c%c%c

.text

`.rdata

@.data

.rsrc

@.reloc

f?0x%c

noexpandkey/typ

ye %d

oc .Kx

} .rd

%original file name%.exe_1936_rwx_10004000_00001000:

callback%d

ec5e920d1aa868874c7d7c14aa1e93e8.exe_740:

.text

`.rdata

@.data

.rsrc

@.reloc

Failed to get export function address

1.2.8

deflate 1.2.8 Copyright 1995-2013 Jean-loup Gailly and Mark Adler

inflate 1.2.8 Copyright 1995-2013 Mark Adler

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

Operation not permitted

Inappropriate I/O control operation

Broken pipe

operator

GetProcessWindowStation

NtYieldExecution

NtDelayExecution

.data

D:\jenkins\workspace\stable-4.71\src\Release\wajam.pdb

KERNEL32.dll

USER32.dll

RegOpenKeyExW

RegCloseKey

ADVAPI32.dll

SHDeleteKeyW

SHLWAPI.dll

GetWindowsDirectoryW

CreateNamedPipeW

GetProcessHeap

GetCPInfo

RegOpenKeyW

RegCreateKeyW

ole32.dll

<fd:%d>

%s%s%s

zcÁ

.?AV?$_Ref_count_del@PAUHKEY__@@V<lambda_c2547fa6d62c87180fd655c78bd4cfcb>@@@std@@

<requestedExecutionLevel level='asInvoker' uiAccess='false' />

8(8-82878

5 5$5(5,50545~5

2 303:3}3

2 2$2(2,2

? ?$?\?`?

5 5(50585@5

6 64989<9@9\9

.patcher

wajam.dll

Hkernel32.dll

HADVAPI32.DLL

mscoree.dll

- floating point support not loaded

- CRT not initialized

- Attempt to initialize the CRT more than once.

USER32.DLL

kernel32.dll

ntdll.dll

tntdll.dll

\BaseNamedObjects\_MMapEvent_0x%x_0x%x

pntdll.dll

entdll.dll

\\.\BlackBone

BlackBoneDrv10.sys

BlackBoneDrv81.sys

BlackBoneDrv8.sys

BlackBoneDrv7.sys

BlackBoneDrv.sys

\??\%s

\\.\pipe\

nntdll.dll

Ntdll.dll

%Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\ec5e920d1aa868874c7d7c14aa1e93e8.exe

4.71.1.10

ec5e920d1aa868874c7d7c14aa1e93e8.exe_1232:

.text

`.rdata

@.data

.rsrc

@.reloc

Failed to get export function address

1.2.8

deflate 1.2.8 Copyright 1995-2013 Jean-loup Gailly and Mark Adler

inflate 1.2.8 Copyright 1995-2013 Mark Adler

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

Operation not permitted

Inappropriate I/O control operation

Broken pipe

operator

GetProcessWindowStation

NtYieldExecution

NtDelayExecution

.data

D:\jenkins\workspace\stable-4.71\src\Release\wajam.pdb

KERNEL32.dll

USER32.dll

RegOpenKeyExW

RegCloseKey

ADVAPI32.dll

SHDeleteKeyW

SHLWAPI.dll

GetWindowsDirectoryW

CreateNamedPipeW

GetProcessHeap

GetCPInfo

RegOpenKeyW

RegCreateKeyW

ole32.dll

<fd:%d>

%s%s%s

zcÁ

.?AV?$_Ref_count_del@PAUHKEY__@@V<lambda_c2547fa6d62c87180fd655c78bd4cfcb>@@@std@@

<requestedExecutionLevel level='asInvoker' uiAccess='false' />

8(8-82878

5 5$5(5,50545~5

2 303:3}3

2 2$2(2,2

? ?$?\?`?

5 5(50585@5

6 64989<9@9\9

.patcher

wajam.dll

Hkernel32.dll

HADVAPI32.DLL

mscoree.dll

- floating point support not loaded

- CRT not initialized

- Attempt to initialize the CRT more than once.

USER32.DLL

kernel32.dll

ntdll.dll

tntdll.dll

\BaseNamedObjects\_MMapEvent_0x%x_0x%x

pntdll.dll

entdll.dll

\\.\BlackBone

BlackBoneDrv10.sys

BlackBoneDrv81.sys

BlackBoneDrv8.sys

BlackBoneDrv7.sys

BlackBoneDrv.sys

\??\%s

\\.\pipe\

nntdll.dll

Ntdll.dll

c:\program files\159ba3f3ec760db4c9ef2b9817891cd0\ec5e920d1aa868874c7d7c14aa1e93e8.exe

4.71.1.10

ec5e920d1aa868874c7d7c14aa1e93e8.exe_1232_rwx_10001000_00002000:

zcÁ

REPORT

HPE_CB_url

the on_url callback failed

invalid HTTP status code

invalid HTTP method

invalid HTTP version

HPE_INVALID_PORT

invalid port

HPE_INVALID_URL

invalid URL

ec5e920d1aa868874c7d7c14aa1e93e8.exe_1232_rwx_10004000_00001000:

Expected: %s

Got: %s

1.2.8

ec5e920d1aa868874c7d7c14aa1e93e8.exe_1232_rwx_103B2000_00013000:

c:\program files\159ba3f3ec760db4c9ef2b9817891cd0\ec5e920d1aa868874c7d7c14aa1e93e8.exe

Chrome

chrome

Firefox

firefox

Opera

opera

application/x-www-form-urlencoded

Microsoft-Windows-Kernel-General

Microsoft-Windows-Kernel-Power

chrome.exe

chrome.dll

firefox.exe

iexplore.exe

opera.exe

opera.dll

microsoftedgecp.exe

crossbrowse.exe

crossbrowse.dll

bobrowser.exe

browserair.exe

mybrowser.exe

browser.exe

browser.dll

ucbrowser.exe

amigo.exe

torch.exe

iexplore.exe_2456:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.Fg

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   ec5e920d1aa868874c7d7c14aa1e93e8.exe:740
   ec5e920d1aa868874c7d7c14aa1e93e8.exe:1680
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\e4c10b479f9591588ada7b6020891305\zwmtdy.dll (205023 bytes)
   %Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\67ac2c169df245da5a2cc5128d99cf4e (601 bytes)
   %WinDir%\Temp\wjm9.tmp (11028 bytes)
   %Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\a2907e1759f993476161da5c73029e0d (25 bytes)
   %WinDir%\Temp\Ima7.tmp (381 bytes)
   %WinDir%\Temp\wjm8.tmp (2500 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Ima6.tmp (381 bytes)
   %WinDir%\Temp\ImaB.tmp (381 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\System.dll (11 bytes)
   %Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\9c0a1870f7180a5f3bf52ba52a4a5643\33d35aa7f8e478ea507bcd0428d90d9d.ico (3 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@technologiecartier[2].txt (2020 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\WIEn\uninstall.lnk (1 bytes)
   %Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\9c0a1870f7180a5f3bf52ba52a4a5643\d701bdf3fcc7b2e9297ba15c17fc1144.ico (3 bytes)
   %Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\114829fb0b06025af73b8448e11e9052.json (966 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\nsExec.dll (6 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\WIEn\Wajam Website.lnk (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\inetc.dll (784 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@technologiecartier[1].txt (2446 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\IpConfig.dll (4992 bytes)
   %Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\145cb62a0ba3f8215e60e6a68719211e.dll (11344 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\ns5.tmp (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\NSISList.dll (3616 bytes)
   %Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\4e7c2619fd72b5bc2526185a6544cc7f.exe (32128 bytes)
   %Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\9c0a1870f7180a5f3bf52ba52a4a5643\ba10cc111a4eb05d232f15671e53a4b3.ico (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\get_local_output.tmp (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\nsC.tmp (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsl2.tmp (338866 bytes)
   %Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\ec5e920d1aa868874c7d7c14aa1e93e8.exe (34561 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\MoreInfo.dll (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\37e71b14cb92186d23ddabe79dcd9a37.exe (5520 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\WIEn\SignIn with Twitter.lnk (1 bytes)
   %Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\869334498bd71f19578287f35c0d4da5.exe (41699 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\SimpleSC.dll (1856 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\WIEn\Settings.lnk (1 bytes)
   %WinDir%\4e7c2619fd72b5bc2526185a6544cc7f.exe (4992 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\brh.dll (49631 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
   %Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\ba10cc111a4eb05d232f15671e53a4b3.ico (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\nsJSON.dll (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\nsA.tmp (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\md5dll.dll (8 bytes)
   %Program Files%\159ba3f3ec760db4c9ef2b9817891cd0\8191670215e1df4f709d7eb2626fb06a.exe (35507 bytes)
   %Documents and Settings%\%current user%\Cookies\index.dat (6748 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsfD.tmp (1275 bytes)

4. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.