MD5: ad3f7a0d2ddc504b1e66065478e773b0
SHA1: 039f4d239688e0bc232aad701815756a40e7c10e
SHA256: 0680a5019b6e83ee5fe5e0fa17ba38543cad0698d328931bcaf1cceb6ee0bf77
SSDeep: 98304:AdXUwUgjoOslUHhonYR/sW4tO1gaancuyipyLpAXs/qYT5v8Z73ZVBkb:q EbGmho/xckylqm5gNVqb
Size: 5371224 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2014-09-04 08:19:34
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:1392

Mutexes

The following mutexes were created/opened:

CTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
ZonesLockedCacheCounterMutex
ZonesCounterMutex
ZonesCacheCounterMutex
RasPbFile
WininetProxyRegistryMutex
WininetConnectionMutex
WininetStartupMutex
c:!documents and settings!adm!local settings!history!history.ie5!
_!MSFTHISTORY!_
c:!documents and settings!adm!local settings!temporary internet files!content.ie5!
c:!documents and settings!adm!cookies!
ShimCacheMutex

File activity

The process %original file name%.exe:1392 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\data.txt (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\button.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\close.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp (429478 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\KPTool.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsp4.tmp (1446 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\bg.bmp (22552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\Banner.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\LinkConfig[1].htm (299 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\data.xml (299 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\shrltj1[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsisXML.dll (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\check.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\browse.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\sndsock.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\ToolTips.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\Button.dll (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\EmbedWeb.dll (784 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\data.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\data.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsk1.tmp (0 bytes)

Registry activity

The process %original file name%.exe:1392 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B2 D2 A9 E8 AD 95 E2 61 84 FA 99 53 2B EE B8 0A"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Internet Explorer\LinksBar]
"Enabled" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: ????
Product Version: 1.2.3.0
Legal Copyright: (C)????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.2.3.0
File Description: ????????
Comments:
Language: Chinese (Simplified, PRC)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 36
86d84b83df2d44e91f1a7b24b68064ba
c92036160c25fa5484663cfaf789c339
16bd8eead4b10d7b078ebaa65d68dd6a
12f3fba390c048301f59fe2a36bf2da8
12858e2eb5cfd4266bc8cb2d94d469de
ea57ef02ac0f05fb4c559b89e23cc840
e6425e446169d6e2a2d90fb6590ec67f
3cc71968574c406e90099f956cf97f94
d2d86c816db9dc3e758e23ae500cf459
90d1d3f2ad56ce4123941b5991753d21
33756f8aac0008508fbc50d61ed70ee2
a44b5dc5b995b3271caed5727f7224c2
75dd697af0567832ec4eec5b0d312331
3ff2ae1c97b170fb972008d81dd9bc94
b0b7076d95f8d5c595b0df77667b14c8
2de0b8c03cc7b55d6ea5938c544903f2
29a94ec5f185b98da32b574b09d794cb
155f280897d92aebc1e465508c035ba1
585c902fea61c606c7a555a253454c48
7c6014c2942fb5ed3375a9281526cb95
26c739d9e4e14056634374b83a9c468d
caa37ffc95c53156c36600939026e7fe
95a8c39ebf5aab4f448b61a2f544fd16
e295f96ad974dcf08e7a20865c322519
7f285691ea72ae5347e8bf1d63ce01a2

URLs

URL	IP
hxxp://aly.ys.dns-vip.net/20141128/14.html
hxxp://c01.i07.rpnic.lv3.cloudglb.com/xml/LinkConfig.xml
hxxp://aly.ys.dns-vip.net/xml/LinkConfig.php
hxxp://xiazai.rilibiao.com.cn/xml/LinkConfig.xml	113.207.30.140
hxxp://confignew.3lsoft.com/20141128/14.html	112.124.60.81
hxxp://confignew.3lsoft.com/xml/LinkConfig.php	112.124.60.81
downcdn1.shgaoxin.net

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers

Traffic

GET /20141128/14.html HTTP/1.0

Host: confignew.3lsoft.com

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: text/html

Server: Microsoft-IIS/7.5

X-Powered-By: PHP/5.3.28

X-Powered-By: ASP.NET

Date: Wed, 23 Sep 2015 21:43:59 GMT

Connection: close

Content-Length: 8385
[rec]..N_4=360..........Z_4=46..O_4=1..B_4=0..D_4=..............I_4=ht
tp://downcdn1.shgaoxin.net/shichangbu/ico/360sd.ico..U_4=hXXp://downcd
n1.shgaoxin.net/ysqd/20140415/qh.gif..F_4=Setup_oemyinsudz1.exe..P_4=/
S..C_4=..R_4=..S_4=..V_4=..M_4=..X_4=..FN_4=..FU_4=..N_1=..........Z_1
=171..O_1=1..B_1=0..D_1=..............I_1=hXXp://downcdn1.shgaoxin.net
/shichangbu/ico/game_cqby.ico..U_1=hXXp://downcdn1.shgaoxin.net/sc/37c
s_wd_916217.gif..F_1=37cs_wd_916217.exe..P_1=..C_1=..R_1=..S_1=..V_1=.
.M_1=..X_1=1..Y_1=1..L_1=1..FN_1=..FU_1=..N_2=........Z_2=145..O_2=1..
B_2=0..D_2=..............I_2=hXXp://downcdn1.shgaoxin.net/shichangbu/i
co/ttk.ico..U_2=hXXp://downcdn1.shgaoxin.net/shichangbu2/TTK_802001002
0140313_setup.gif..F_2=TTK_8020010020140313_setup.exe..P_2=/S..C_2=2..
R_2=1..S_2=Software\TaoTaoSou\TTK..V_2=Installed..M_2=..X_2=1..Y_2=..N
_3=..........Z_3=150..O_3=1..B_3=0..D_3=................I_3=hXXp://dow
ncdn1.shgaoxin.net/shichangbu/ico/game_thdrawal.ico..U_3=hXXp://downcd
n1.shgaoxin.net/shichangbu/thdrawal.gif..F_3=thdrawal.exe..Y_3=..X_3=1
..N_5=......Z_5=123..O_5=1..B_5=0..U_5=hXXp://downcdn1.shgaoxin.net/sh
ichangbu2/HY_Setup_gaoxin.gif..F_5=HY_Setup_gaoxin.exe..P_5=/S /A..C_5
=2..R_5=2..S_5=SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Hao
Ying..V_5=UninstallString..N_6=..........Z_6=130..O_6=1..B_6=0..D_6=..
............I_6=hXXp://downcdn1.shgaoxin.net/shichangbu/ico/youxun.ico
..U_6=hXXp://downcdn1.shgaoxin.net/shichangbu2/gaoxintg.gif..F_6=gaoxi
ntg.exe..P_6=..C_6=2..R_6=1..S_6=Software\Microsoft\Windows\Curren
<<< skipped >>>

GET /xml/LinkConfig.php HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: confignew.3lsoft.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/html

Server: Microsoft-IIS/7.5

X-Powered-By: PHP/5.3.28

X-Powered-By: ASP.NET

Date: Wed, 23 Sep 2015 21:44:02 GMT

Content-Length: 299
<?xml version="1.0" encoding="utf-8" standalone="yes" ?>..<In
foconfig>...<Date>20150729</Date>..  <LinkUrl>htt
p://ai.taobao.com?pid=mm_47495283_4270322_35440572</LinkUrl>...&
lt;IconUrl>hXXp://downcdn1.shgaoxin.net/shichangbu/ico/tao.ico</
IconUrl>...<IconLabel>...............</IconLabel>..<
/Infoconfig>HTTP/1.1 200 OK..Content-Type: text/html..Server: Micro
soft-IIS/7.5..X-Powered-By: PHP/5.3.28..X-Powered-By: ASP.NET..Date: W
ed, 23 Sep 2015 21:44:02 GMT..Content-Length: 299..<?xml version="1
.0" encoding="utf-8" standalone="yes" ?>..<Infoconfig>...<
Date>20150729</Date>..  <LinkUrl>hXXp://ai.taobao.com?p
id=mm_47495283_4270322_35440572</LinkUrl>...<IconUrl>http:
//downcdn1.shgaoxin.net/shichangbu/ico/tao.ico</IconUrl>...<I
conLabel>...............</IconLabel>..</Infoconfig>..

GET /xml/LinkConfig.xml HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: xiazai.rilibiao.com.cn

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 302 Redirect

Date: Wed, 23 Sep 2015 21:44:06 GMT

Content-Length: 169

Location: hXXp://confignew.3lsoft.com/xml/LinkConfig.php

Content-Type: text/html; charset=UTF-8

Connection: Keep-Alive

X-Powered-By: ASP.NET

Fw-Via: Combine HIT from CTL_ZJ_091_146.fcd, Configured MISS from CTL_ZJ_091_142.fcd, Combine MISS from 113.207.30.159, Configured MISS from 113.207.30.143
<head><title>...............</title></head>.&l
t;body><h1>...............</h1>......<a HREF="http:/
/confignew.3lsoft.com/xml/LinkConfig.php">......</a>.........
......</body>..

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

verifying installer: %d%%

unpacking data: %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

~nsu.tmp

%u.%u%s%s

.DEFAULT\Control Panel\International

RegDeleteKeyExA

Software\Microsoft\Windows\CurrentVersion

*?|<>/":

%s=%s

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegDeleteKeyA

RegCloseKey

RegEnumKeyA

RegOpenKeyExA

RegCreateKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nse3.tmp\nsDialogs.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nse3.tmp\nsDialogs.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nse3.tmp

nsp4.tmp

Yu.ky%

OLEAUT32.dll

MSVCRT.dll

nsisXML.dll

{88d96a05-f192-11d4-a65f-0040963251e5}

{88d969c0-f192-11d4-a65f-0040963251e5}

{f5078f32-c551-11d3-89b9-0000f81fe221}

{f5078f1b-c551-11d3-89b9-0000f81fe221}

{f6d90f11-9c73-11d3-b32e-00c04f990bb4}

{2933bf90-7b36-11d2-b20e-00c04f983e60}

.Class 3 Public Primary Certification Authority0

<VeriSign Class 3 Public Primary Certification Authority - G50

hXXp://crl.verisign.com/pca3.crl0

hXXps://VVV.verisign.com/cps0

#hXXp://logo.verisign.com/vslogo.gif04

hXXp://ocsp.verisign.com0>

2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,

/hXXp://csc3-2010-crl.verisign.com/CSC3-2010.crl0D

hXXps://VVV.verisign.com/rpa0

hXXp://ocsp.verisign.com0;

/hXXp://csc3-2010-aia.verisign.com/CSC3-2010.cer0

hXXps://VVV.verisign.com/cps0*

#hXXp://crl.verisign.com/pca3-g5.crl04

hXXp://ocsp.verisign.com0

hXXp://VVV.usertrust.com1

@.reloc

CabDLL.dll

SHLWAPI.dll

Cabinet.dll

bddll.dll

bdmzip.dll

bdimesetup.dll

.reloc

GetProcessHeap

ToolTips.dll

PluginA.dll

MSIMG32.dll

GdiplusShutdown

gdiplus.dll

All Files|*.*

0 0$0(0,0

\resource\EmbedWeb\nsweb.h

n%D,3

user32.dll

kernel32.dll

invalid executable code

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nse3.tmp\data.txt

data.txt

1048876

\LOCALS~1\Temp\nse3.tmp

1048896

1179918

1114304

c:\%original file name%.exe

%Program Files%\shanhurili

%original file name%.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsk1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nse3.tmp\nsp4.tmp

-2147483647

Software\Microsoft\Windows\CurrentVersion\Uninstall\YouXunBox

4899916664210980926

-2063532032

-2147284440

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>

hXXp://nsis.sf.net/

{"supply_id":"%s"}

1202000063

1.2.3.0

%original file name%.exe_1392_rwx_003E4000_00001000:

callback%d

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\data.txt (16 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\button.png (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\close.png (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\inetc.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp (429478 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\KPTool.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsp4.tmp (1446 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\NSISdl.dll (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\bg.bmp (22552 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsDialogs.dll (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\Banner.dll (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\LinkConfig[1].htm (299 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\data.xml (299 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\shrltj1[1].htm (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsisXML.dll (12 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\check.png (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\browse.png (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\sndsock.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\ToolTips.dll (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\Button.dll (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\EmbedWeb.dll (784 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.