MD5: ea97d7626feffb61aa112063dd1ccb09
SHA1: 55bb2326db28443cfbe1676f5dc85adc1541cf64
SHA256: 4114bceca3c5192e721971f2d56a17101bc214274c08d9675976300289355384
SSDeep: 393216:ZSKB8ce08EnwChbQyILbq4hhaLD3UrKu8NN4degn/:ZSKCT08WwefJD3UiN4L/
Size: 17761867 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Softonic
Created at: 2013-12-25 07:01:35
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:1276

Mutexes

The following mutexes were created/opened:

ZonesLockedCacheCounterMutex
ZonesCounterMutex
ZonesCacheCounterMutex
RasPbFile
WininetProxyRegistryMutex
WininetConnectionMutex
WininetStartupMutex
c:!documents and settings!adm!local settings!history!history.ie5!
c:!documents and settings!adm!cookies!
c:!documents and settings!adm!local settings!temporary internet files!content.ie5!
_!MSFTHISTORY!_
ShimCacheMutex

File activity

The process %original file name%.exe:1276 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nseB5.tmp (52569 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsbB3.tmp (929386 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\BiTool[1].dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\xml.dll (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\spltmp.bmp (19096 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\md5dll.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\modern-header.bmp (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\binsis142.xml (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\binsischeck654.xml (4214 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\Banner.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\Math.dll (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\Aero.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\advsplash.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nslB6.tmp (13784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\setup[1].exe (13784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\modern-wizard.bmp (11040 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bitool.xxx (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nseB5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\spltmp.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsgB2.tmp (0 bytes)

Registry activity

The process %original file name%.exe:1276 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5F 23 51 4F 71 92 8D 01 03 AE D6 40 F4 AB 15 01"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://78.138.127.15/binsis/xml?uid=F9C7ACFAC14B44F29B14094F884B3419&v=2.1.0&affid=lionskin&sid=lionskin&s=0
hxxp://dsxvs27jt6tf7.cloudfront.net/installers/bi_downloader/1407685440407/setup.exe
hxxp://www.reiltas.info/installers/bi_downloader/1407685440407/setup.exe	54.230.39.163
hxxp://nsis.bisrv.com/binsis/xml?uid=F9C7ACFAC14B44F29B14094F884B3419&v=2.1.0&affid=lionskin&sid=lionskin&s=0

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers

Traffic

POST /binsis/xml?uid=F9C7ACFAC14B44F29B14094F884B3419&v=2.1.0&affid=lionskin&sid=lionskin&s=0 HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Filename: nseB5.tmp

User-Agent: NSIS_Inetc (Mozilla)

Host: nsis.bisrv.com

Content-Length: 3288

Connection: Keep-Alive

Cache-Control: no-cache

installer_data={"uid":"F9C7ACFAC14B44F29B14094F884B3419","muid":"b080d217e8686332192370cb80bf6e80","affid":"lionskin","sid":"lionskin","installerVersion":"2.1.0","osVersion":"5.1.2600 32bit","ieVersion":"6.0.2900.5512","ff_installed":"0","ff_version":"","ff_default_homepage":"not_found","ff_is_default":"0","ie_installed":"1","ie_version":"6.0.2900.5512","ie_default_homepage":"about:blank","ie_is_default":"1","chrome_installed":"0","chrome_version":"","chrome_default_homepage":"not_found","chrome_is_default":"0","opera_installed":"0","opera_version":"","opera_default_homepage":"not_found","opera_is_default":"0","safari_installed":"0","safari_version":"","safari_default_homepage":"not_found","safari_is_default":"0","check_586":"false","check_1842":"false","check_1820":"false","check_1822":"false","check_1826":"false","check_1488":"false","check_1650":"false","check_423":"false","check_2720":"false","check_2722":"false","check_1680":"false","check_1682":"false","check_175":"false","check_391":"true","check_514":"false","check_606":"false","check_680":"false","check_720":"true","check_4":"false","check_2182":"false","check_2226":"null","check_2246":"false","check_2366":"false","check_2372":"false","check_2450":"false"
HTTP/1.1 200 OK

Server: nginx

Date: Sun, 17 Aug 2014 02:18:04 GMT

Content-Type: text/xml; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding
1fcf..<?xml version="1.0" encoding="windows-1252"?>.<sponsore
d_data><downloader><url>hXXp://VVV.reiltas.info/install
ers/bi_downloader/1407685440407/setup.exe</url><downloadOnIni
t>1</downloadOnInit><args>/silent /initurl hXXp://bi.bi
srv.com/downloader/:affid:/:sid:/:uid:? -uid="%UID%" -sid="%SoftwareID
%" -affid="¯filiateID%" -muid="%MUID%"</args></downloader&g
t;<offers><offer id="shoppinghelper"><remote_resources/
><downloader><args>_!delimiter!_ -offerId="%OfferID%" -
softwareName="ShoppingHelper"</args></downloader><title
>Special Offer</title><sub_title>To go along with your 
Skin Pack</sub_title><download_url>hXXp://d1tcmkms7lcod.cl
oudfront.net/mirror/shoppinhelper/ShoppinHelper2_Setup1-7.exe</down
load_url><execution_arguments>/PID=184</execution_argument
s><options><option type="v_space" height="5"/><optio
n type="text" width="100"><id>descriptionElement</id>&l
t;text><decor type="text">Install ShoppingHelper Smartbar, se
t homepage and default search. You can easily remove</decor><
decor type="line_break"></decor><decor type="text">the 
smartbar from Windows add/remove programs menu in Control Panel.</d
ecor></text></option><option type="v_space" height="
5"/><option type="text" width="100"><id>footerEelement&
lt;/id><text><decor type="text">By clicking Next, I
<<< skipped >>>

GET /installers/bi_downloader/1407685440407/setup.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.reiltas.info

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 207440

Connection: keep-alive

Server: nginx

Date: Sat, 16 Aug 2014 04:02:06 GMT

Last-Modified: Sun, 10 Aug 2014 15:44:01 GMT

ETag: "53e79341-32a50"

Expires: Sat, 16 Aug 2014 04:12:06 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 2

X-Cache: Hit from cloudfront

Via: 1.1 5a3929ad09d50b03a5fc9b827efa57b6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: skn3si3Zc03nNhNhxqS9qGpU-4WU2eFXXtMh5NbpB32AUg6sHMKnkQ==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................^..........^2.......p....@.........
.................................................................t....
..................(...(...............................................
.............p...............................text....].......^........
.......... ..`.rdata.......p.......b..............@[email protected]....\......
.....v..............@....ndata...................................rsrc.
...............z..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G...
..t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

unpacking data: %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|<>/":

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsxB4.tmp\nsDialogs.dll

ll\PodoWeb

-7394-4906-AAFF-D6AB64FF7C38}

"lionskin","installerVersion":"2.1.0","osVersion":"5.1.2600 32bit","ieVersion":"6.0.2900.5512"

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsxB4.tmp\nsDialogs.dll

":"lionskin","installerVersion":"2.1.0","osVersion":"5.1.2600 32bit","ieVersion":"6.0.2900.5512"

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsxB4.tmp

n Data\Opera\Opera\operaprefs.ini

2014 skinpacks.com

@.reloc

GetProcessHeap

comdlg32.dll

nsDialogs.dll

All Files|*.*

xml.dll

.?AVexecution_error@TinyXPath@@

Assertion failed: %s, file %s, line %d

zcÁ

*.zoU

q#.vM

wa.ZG

ZX.vpj

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nseB5.tmp

nseB5.tmp

76730183

turl hXXp://bi.bisrv.com/downloader/:affid:/:sid:/:uid:? -uid="%UID%" -sid="%SoftwareID%" -affid="¯filiateID%" -muid="%MUID%"

b09.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PodoWeb

efs.js

Family PCI Ethernet Adapter - Packet Scheduler Miniport

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PodoWeb

n\Uninstall\PodoWeb

7394-4906-AAFF-D6AB64FF7C38}

t\Windows\CurrentVersion\Uninstall\PodoWeb

FTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PodoWeb

4-4906-AAFF-D6AB64FF7C38}

c:\%original file name%.exe

C:\SkinPack\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

%original file name%.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsgB2.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

-1911946831

1179874

1179972

1442062

1179806

1179988

1114360

podoweb_b2b

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nslB6.tmp

/silent /initurl hXXp://bi.bisrv.com/downloader/:affid:/:sid:/:uid:? -uid="%UID%" -sid="%SoftwareID%" -affid="¯filiateID%" -muid="%MUID%"

hXXp://VVV.reiltas.info/installers/bi_downloader/1407685440407/setup.exe

1311004

-1576730183

1376514

1779041272

1310952

-2063532032

-2147284440

...lM

Ux.vv

%x_Rk[

.LYXd

|\.Lk`

R_e%.F

O:\S&|

lo%d:D

T.sOj

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="*" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v3.0a2</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/></application></compatibility></assembly>

%original file name%.exe_1276_rwx_10004000_00001000:

callback%d

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\nseB5.tmp (52569 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsbB3.tmp (929386 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\BiTool[1].dll (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\xml.dll (4992 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\spltmp.bmp (19096 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\nsDialogs.dll (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\md5dll.dll (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\modern-header.bmp (3312 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\inetc.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\binsis142.xml (964 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\binsischeck654.xml (4214 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\Banner.dll (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\Math.dll (2392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\Aero.dll (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\advsplash.dll (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nslB6.tmp (13784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\setup[1].exe (13784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsxB4.tmp\modern-wizard.bmp (11040 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\bitool.xxx (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.