Trojan-PSW.Win32.MSNPassword_f484ec4c68

by malwarelabrobot on August 21st, 2015 in Malware Descriptions.

Susp_Dropper (Kaspersky), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, GenericEmailWorm.YR, GenericPhysicalDrive0.YR (Lavasoft MAS)
Behaviour: Trojan-PSW, Trojan, Worm, EmailWorm


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: f484ec4c68597848d9621b91018adbda
SHA1: a95dea1797a6c4ef7f6f1ead1e0a717724078972
SHA256: 4540e4e7750c59d1492640a35560eae2da082be731ef8d214ae3abd9c1cd1e08
SSDeep: 49152:ZEvAaaKGd0gGdZlxeFmrgkjYpLq09POreuqoxVeChrNQfYKOrRV7jaKivcJD:aW9dZSeFigHJq6mr/qEVLQf2/ivAD
Size: 3208304 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: ASPackv212, UPolyXv05_v6
Company: Application Installer
Created at: 2015-01-23 11:18:24
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan-PSW. Trojan program intended for stealing users passwords.

Payload

Behaviour Description
EmailWorm Worm can send e-mails.


Process activity

The Trojan-PSW creates the following process(es):
No processes have been created.
The Trojan-PSW injects its code into the following process(es):

%original file name%.exe:412

Mutexes

The following mutexes were created/opened:

{1B655094-FE2A-433c-A877-FF9793445069}
CTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
ZonesLockedCacheCounterMutex
ZonesCounterMutex
ZonesCacheCounterMutex
WininetProxyRegistryMutex
WininetConnectionMutex
WininetStartupMutex
c:!documents and settings!adm!local settings!history!history.ie5!
c:!documents and settings!adm!cookies!
c:!documents and settings!adm!local settings!temporary internet files!content.ie5!
_!MSFTHISTORY!_
RasPbFile
ShimCacheMutex

File activity

The process %original file name%.exe:412 makes changes in the file system.
The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\2[1].jpg (10248 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\index[1].htm (2261 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\reset[1].css (10585 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CA6J6JMX.htm (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cd[1].gif (1448 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery.min[1].js (30109 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery.cycle.all.min[1].js (14237 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (2024 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@163[1].txt (169 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\2b89_d7fe5f56_eb35_e9fe_8f18_ce641531226b_1[1].jpg (2520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery-a[1].js (5500 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@changyou[1].txt (188 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1[1].jpg (10272 bytes)

Registry activity

The process %original file name%.exe:412 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9D C9 E1 6A 24 F9 DC 34 3E 49 F6 62 67 C2 42 78"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan-PSW modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan-PSW modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan-PSW modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan-PSW deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: Microsoft? Visual Studio .NET
Product Version: 3.14.12.30
Legal Copyright: ????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 3.14.12.30
File Description:
Comments: Microsoft Corporation
Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 2125824 915456 5.54446 3f0cb5a044088dd9379199629a9ba186
.sedata 2129920 1081344 815616 5.54483 2866a1fe1602638ed86de6fb0430a527
.idata 3211264 12288 4608 5.39475 5d4c03e0857fa7de0344f75c8edc01d5
.rsrc 3223552 16384 1024 1.45781 604e4db5568ef26456fc5fa2c8b49d4d
.sedata 3239936 4096 3072 5.16874 65a39a2e5a5fb8f6646ec3004fedbf15
.aspack 3244032 20480 17408 3.9434 e0e9f4c9b8838a28bd03d246f3469919
.adata 3264512 4096 0 0 d41d8cd98f00b204e9800998ecf8427e

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://blog.163.com/blog/static/2488610742015423102631147/
hxxp://aa133051993.blog.163.com/blog/static/2488610742015423102631147/ 115.238.126.134
mon.changyou.com 180.149.155.170


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Unsupported/Fake Windows NT Version 5.0
ET POLICY HTTP Request on Unusual Port Possibly Hostile

Traffic

GET /blog/static/2488610742015423102631147/ HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: aa133051993.blog.163.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 20 Aug 2015 00:47:52 GMT
Content-Type: text/html;charset=GBK
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Set-Cookie: NTESBLOGSI=F3E8123E337C19A557F2842D6DCA0B62.blog2-8010; Domain=.blog.163.com; Path=/
Set-Cookie: usertrack=c 5 hlXVI7iVknvaFWw7Ag==; expires=Fri, 19-Aug-16 00:47:52 GMT; domain=.163.com; path=/
P3P: policyref="/w3c/p3p.xml", CP="CUR ADM OUR NOR STA NID"
501..  <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "ht
tp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..  <html xmlns
="hXXp://VVV.w3.org/1999/xhtml" xml:lang="zh" lang="zh">..  <hea
d>..    <meta http-equiv="X-UA-Compatible" content="IE=7" />.
.    <meta http-equiv="content-type" content="text/html;charset=gbk
"/>..    <meta http-equiv="content-style-type" content="text/css
"/>..    <meta http-equiv="content-script-type" content="text/ja
vascript"/>..    <meta name="version" content="neblog-1.0"/>.
.    <script type="text/javascript">..      ..      ..      docu
ment.uniqueID!=document.uniqueID&&!!location.hash&&(location.hash=loca
tion.hash); ..      document.domain = location.hostname.replace(/^.*\.
([\w] \.[\w] )$/,'$1');..      window.focus();..      window.getMusicT
imeStamp=function(){return 'c12bd902b0cec40e1d7e2cdec3182898';};..    
..      //BLOG-647:....OS..............................      (function
(){..        window.setTimeout(function(){..          var _loginUserIc
on = document.getElementById('loginUserIcon');..          var _rsavata
rimg = document.getElementById('rsavatarimg');..          if(!!_loginU
serIcon){..            var _loaded1 = false;..            var _img1 = 
new Image();..            _img1.onload = function(){..                
_loaded1..5a8.. = true;..                _img1.onload = null;..       
     };..            _img1.src = _loginUserIcon.src;..            wind
ow.setTimeout(function(){..              if(!_loaded1){..         
<<< skipped >>>

The Trojan-PSW connects to the servers at the folowing location(s):

%original file name%.exe_412:

.text
`.sedata
h.idata
H.rsrc
@.sedata
@.aspack
`.adata
t%SVh
t$(SSh
~%UVW
t.It It
u$SShe
dbghelp.dll
kernel32.dll
Mem|LzmaLib.dll
LzmaLib_32.dll
ws2_32.dll
shlwapi.dll
Ws2_32.dll
GetProcessHeap
\Bin\System.cfg
\Data\Interface.axp
\Bin\data.axp
.rdata
.data
.idata
.rsrc
.reloc
.adata
>.sLC
%uk>`
3iY#.%s
.sa/y,O
xp.En
Invalid allocation size: %u bytes.
Client hook allocation failure at file %hs line %d.
_CrtCheckMemory()
_CrtIsValidHeapPointer(pUserData)
Allocation too large or negative: %u bytes.
Client hook re-allocation failure at file %hs line %d.
DAMAGE: after %hs block (#%d) at 0xX.
DAMAGE: before %hs block (#%d) at 0xX.
memory check error at 0xX = 0xX, should be 0xX.
%hs located at 0xX is %u bytes long.
%hs allocated at file %hs(%d).
DAMAGE: on top of Free block at 0xX.
Bad memory block found at 0xX.
_CrtMemCheckPoint: NULL state pointer.
_CrtMemDifference: NULL state pointer.
crt block at 0xX, subtype %x, %u bytes long.
normal block at 0xX, %u bytes long.
client block at 0xX, subtype %x, %u bytes long.
%hs(%d) :
#File Error#(%d) :
Data: <%s> %s
%s(%d) : %s
_CrtDbgReport: String too long or IO Error
Second Chance Assertion Failed: File %s, Line %d
user32.dll
Debug %s!
Program: %s%s%s%s%s%s%s%s%s%s%s
__MSVCRT_HEAP_SELECT
portuguese-brazilian
LZMA.dll
The procedure entry point %s could not be located in the dynamic link library %s
The ordinal %u could not be located in the dynamic link library %s
E:\Lzma465-Good\LzmaLib\Debug\LZMA.pdb
LzmaLib.dll
\Data\Model.axp
1.yF&p:j
3%cQ:,7k
.DB$e2&
%xB-\B-
$0.jCD
tj%SI
Z\.vM
K.YJl
\Bin\lpk.dll
\lpk.dll
\DirectX9\lpk.dll
\Bin\USP10.DLL
\USP10.DLL
\DirectX9\USP10.DLL
tConfig.exe
,WepSpy,WpASpy,WpeSpy.dll,monitor.dll,theworld.dll,tcp-z.dll,dutool.dll,alchemy.dll,cmdial32.dll,cyshock.dll,kUserHook.dll,xiprad.dll
,127.0.0.1:
,1,201,3,1,0,
\Patch\LoginServer.txt
Bin\Game.exe
Function Getcpuid()
Set cpuSet = GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_Processor")
getcpuid=cpu.ProcessorId
Getcpuid
\\.\PhysicalDrive0
0.0.0.0
127.0.0.1
\Bin\Game.log
[email protected],
,.!-0!/3
DG"FI&CI&?K&=L'>O(?Q)@R*AT*CW-EX.FX-GV*KR&MS"MS#OV)LZ,J].I^1J^4M\5QZ1W_ \c,Y` T^.O`0Lb0Kc1Lc1Ne3Oe4Pf4Rh3Tk4Tm5Tn6Tk8Ti;Ui=Xk;Wm:Xo9Yq9Yr8Yt9Zu:\v9_w7et7ju7nx:g{<b|<_|<^x>]v?^w@_wBayBcyBh}@d
j CrT1
[email protected]
.exe|.rar|.zip|.gif|.jpg|.mp3|.rm
Y.pon)-m
\%f./1
1F>=.LA:Zk><<3eF13
8 .  .=}
8 8 8 8 8..8[=8=}
08.[..8 8
88=[[..88[8
6588.Sd
4%uEhZ
.JJJT
;; ;; . .2..22}
8),.025>
~?841002?
%d@@9@@:(U
?841002?
pmc.qUUeqeqo
)* )* ).5:
   ,  ,,26
--..-..03<
}=62/..0=
?$)-035>
<##"""##";
2222221
"("" (""
5>95>...)
`[email protected]:
s.%..%sU
;==???<@3/0##
=??@<78/800"
?<@8@8/00*"
1111111
<@88//00*#
@88//***""#
78///** #"
""**3376<=;;;
733/*##8
@@<@@<<6@
 .  -((<
15.01.30 - KDD|
t^.cI
?1/)/-&/,&/,%. $-*#.,%0-&. $/,&0-&,)"0-'/,%. $0-&-*#0-&-*#,(!. %/,&.,%.,%0-'0.'0.'0.'0.'0-'0-'0-'0.'0-&/,&/,&/,&. %,)" ( /,%0-'. $. %/-&. $. $/-&.,%/,&/,&/,&,)". $0-'-*#. %/-&. $*&
@game.sohu.com
%d&&'
123456789
00003333
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
1.2.18
%*.*f
CNotSupportedException
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
COMCTL32.DLL
CCmdTarget
MSWHEEL_ROLLMSG
ole32.dll
Broken pipe
Inappropriate I/O control operation
Operation not permitted
iphlpapi.dll
SHLWAPI.dll
MPR.dll
VERSION.dll
.PAVCException@@
Shell32.dll
Mpr.dll
Advapi32.dll
User32.dll
Gdi32.dll
Kernel32.dll
(&07-034/)7 '
?? / %d]
%d / %d]
.PAVCFileException@@
: %d]
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
\\.\Scsi0:
%s:%d
windows
.PAVCNotSupportedException@@
out.prn
(*.prn)|*.prn|
%d.%d
%d/%d
1.6.9
unsupported zlib version
png_read_image: unsupported transformation
%d / %d
Bogus message code %d
libpng error: %s
libpng warning: %s
1.1.3
bad keyword
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
(%d-%d):
%ld%c
(*.htm;*.html)|*.htm;*.html
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
%s <%s>
Reply-To: %s
From: %s
To: %s
Subject: %s
Date: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
SMTP
VVV.dywt.com.cn
x86 Family %s Model %s Stepping %s
X-X-X-X
\\.\Smartvsd
\\.\PhysicalDrive%d
\\.\Scsi%d:
[%s:%d]
Range: bytes=%s-
[%s:%d]
PASS %s
PASS ******
USER %s
E:\e5\dev\e\static_link\static_libs\source\downlib\mystrlib.cpp
SIZE %s
PORT
User-Agent: %s
Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)
Referer: %s
Host: %s
GET %s HTTP/1.1
HTTP/1.1
hXXp://
Cookie: %s
%d, %s
\\192.168.0.129\TCP\1037
NSPlayer/9.0.0.2980; {%s}; Host: %s
rmff_fix_header: assuming data.size=%i
rmff_fix_header: assuming data.num_packets=%i
rmff_fix_header: assuming prop.num_packets=%i
rmff_fix_header: setting prop.data_offset from %i to %i
rmff_fix_header: correcting prop.num_streams from %i to %i
rmff_fix_header: correcting prop.size from %i to %i
%s %s %s
Session: %s
Cseq: %u
%*s %s
%*s %u
CSeq: %u
rtsp://%s:%i
rtsp://%s:%i/%s
ClientID: Linux_2.4_6.0.9.1235_play32_RN01_EN_586
GUID: 00000000-0000-0000-0000-000000000000
[%s:%d]
User-Agent: RealMedia Player Version 6.0.9.1235 (linux-2.0-libc6-i386-gcc2.95)
Range: npt=%s-
%s/streamid=1
%s/streamid=0
Transport: x-pn-tng/tcp;mode=play,rtp/avp/tcp;unicast;mode=play
If-Match: %s
RealChallenge2: %s, sd=%s
Title: %s
Copyright: %s
Author: %s
real: Content-length for description too big (> %uMB)!
Require: com.real.retain-entity-for-setup
SupportsMaximumASMBandwidth: 1
Bandwidth: %u
Challenge1: %s
hash output: %x %x %x %x
hash input: %x %x %x %x
stream=%u;rule=%u,
Illegal character '%c' in input.
;3 #>6.&
'2, / 0&7!4-)1#
(*.avi)|*.avi
WPFT532.CNV
WPFT632.CNV
EXCEL32.CNV
write32.wpc
Windows Write
mswrd632.wpc
Word for Windows 6.0
wword5.cnv
Word for Windows 5.0
mswrd832.cnv
mswrd632.cnv
Word 6.0/95 for Windows & Macintosh
html32.cnv
.PAVCOleException@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCOleDispatchException@@
.PAVCArchiveException@@
zcÁ
c:\%original file name%.exe
9.oTec
8%Se*E
ntdll.dll
advapi32.dll
hid.dll
mscoree.dll
mscorwks.dll
mscorsvr.dll
KernelBase.dll
mscoreei.dll
clr.dll
diasymreader.dll
SEGetNumExecUsed
SEGetNumExecLeft
SESetNumExecUsed
SEGetExecTimeUsed
SEGetExecTimeLeft
SESetExecTime
SEGetTotalExecTimeUsed
SEGetTotalExecTimeLeft
SESetTotalExecTime
SECheckExecTime
SECheckTotalExecTime
&&&&6666????
""""****
2222::::
$$$$\\\\
00006666
####====
MSVCRT.dll
IPHLPAPI.DLL
PSAPI.DLL
KERNEL32.dll
USER32.dll
RegOpenKeyExA
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
ADVAPI32.dll
SHELL32.dll
n\JqYQ7%x
)Qh%X~
..Qe:
Lw%c)
`tQI%X
mh%X~
%Fz;Pc
%Fz&=~Y
&%U|M^
c.AM (
1).Uk
Id.DB_
.Rv/ 6
""
m-U}k*
i.ck~
.lAubH
V.Ss^v)
FtpLK
y:.Vm
Tly
&R.ts
%SBb'
4'N.OA
.PYF`
OmZRG?%Se
?.Jza
R.Jx7y
.LjQ 1
WS2_32.dll
OLEAUT32.dll
GDI32.dll
WINMM.dll
WINSPOOL.DRV
COMCTL32.dll
RASAPI32.dll
WININET.dll
AVIFIL32.dll
MSVFW32.dll
comdlg32.dll
oledlg.dll
Safengine Shielden v2.3.3.0
GetCPInfo
GetWindowsDirectoryA
WinExec
SetWindowsHookExA
UnhookWindowsHookEx
CreateDialogIndirectParamA
GetKeyState
GetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
ShellExecuteA
InternetCanonicalizeUrlA
InternetCrackUrlA
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
rasapi32.dll
winmm.dll
msvfw32.dll
avifil32.dll
gdi32.dll
winspool.drv
shell32.dll
oleaut32.dll
comctl32.dll
wininet.dll
msvcrt.dll
psapi.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity name="E.App" processorArchitecture="x86" version="5.2.0.0" type="win32"/><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency></assembly>
3.14.12.30
Microsoft? Visual Studio .NET

%original file name%.exe_412_rwx_00401000_0030F000:

t%SVh
t$(SSh
~%UVW
t.It It
u$SShe
dbghelp.dll
kernel32.dll
Mem|LzmaLib.dll
LzmaLib_32.dll
ws2_32.dll
shlwapi.dll
Ws2_32.dll
GetProcessHeap
\Bin\System.cfg
\Data\Interface.axp
\Bin\data.axp
.text
.rdata
.data
.idata
.rsrc
.reloc
.adata
>.sLC
%uk>`
3iY#.%s
.sa/y,O
xp.En
Invalid allocation size: %u bytes.
Client hook allocation failure at file %hs line %d.
_CrtCheckMemory()
_CrtIsValidHeapPointer(pUserData)
Allocation too large or negative: %u bytes.
Client hook re-allocation failure at file %hs line %d.
DAMAGE: after %hs block (#%d) at 0xX.
DAMAGE: before %hs block (#%d) at 0xX.
memory check error at 0xX = 0xX, should be 0xX.
%hs located at 0xX is %u bytes long.
%hs allocated at file %hs(%d).
DAMAGE: on top of Free block at 0xX.
Bad memory block found at 0xX.
_CrtMemCheckPoint: NULL state pointer.
_CrtMemDifference: NULL state pointer.
crt block at 0xX, subtype %x, %u bytes long.
normal block at 0xX, %u bytes long.
client block at 0xX, subtype %x, %u bytes long.
%hs(%d) :
#File Error#(%d) :
Data: <%s> %s
%s(%d) : %s
_CrtDbgReport: String too long or IO Error
Second Chance Assertion Failed: File %s, Line %d
user32.dll
Debug %s!
Program: %s%s%s%s%s%s%s%s%s%s%s
__MSVCRT_HEAP_SELECT
portuguese-brazilian
LZMA.dll
The procedure entry point %s could not be located in the dynamic link library %s
The ordinal %u could not be located in the dynamic link library %s
E:\Lzma465-Good\LzmaLib\Debug\LZMA.pdb
LzmaLib.dll
\Data\Model.axp
1.yF&p:j
3%cQ:,7k
.DB$e2&
%xB-\B-
$0.jCD
tj%SI
Z\.vM
K.YJl
\Bin\lpk.dll
\lpk.dll
\DirectX9\lpk.dll
\Bin\USP10.DLL
\USP10.DLL
\DirectX9\USP10.DLL
tConfig.exe
,WepSpy,WpASpy,WpeSpy.dll,monitor.dll,theworld.dll,tcp-z.dll,dutool.dll,alchemy.dll,cmdial32.dll,cyshock.dll,kUserHook.dll,xiprad.dll
,127.0.0.1:
,1,201,3,1,0,
\Patch\LoginServer.txt
Bin\Game.exe
Function Getcpuid()
Set cpuSet = GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_Processor")
getcpuid=cpu.ProcessorId
Getcpuid
\\.\PhysicalDrive0
0.0.0.0
127.0.0.1
\Bin\Game.log
[email protected],
,.!-0!/3
DG"FI&CI&?K&=L'>O(?Q)@R*AT*CW-EX.FX-GV*KR&MS"MS#OV)LZ,J].I^1J^4M\5QZ1W_ \c,Y` T^.O`0Lb0Kc1Lc1Ne3Oe4Pf4Rh3Tk4Tm5Tn6Tk8Ti;Ui=Xk;Wm:Xo9Yq9Yr8Yt9Zu:\v9_w7et7ju7nx:g{<b|<_|<^x>]v?^w@_wBayBcyBh}@d
j CrT1
[email protected]
.exe|.rar|.zip|.gif|.jpg|.mp3|.rm
Y.pon)-m
\%f./1
1F>=.LA:Zk><<3eF13
8 .  .=}
8 8 8 8 8..8[=8=}
08.[..8 8
88=[[..88[8
6588.Sd
4%uEhZ
.JJJT
;; ;; . .2..22}
8),.025>
~?841002?
%d@@9@@:(U
?841002?
pmc.qUUeqeqo
)* )* ).5:
   ,  ,,26
--..-..03<
}=62/..0=
?$)-035>
<##"""##";
2222221
"("" (""
5>95>...)
`[email protected]:
s.%..%sU
;==???<@3/0##
=??@<78/800"
?<@8@8/00*"
1111111
<@88//00*#
@88//***""#
78///** #"
""**3376<=;;;
733/*##8
@@<@@<<6@
 .  -((<
15.01.30 - KDD|
t^.cI
?1/)/-&/,&/,%. $-*#.,%0-&. $/,&0-&,)"0-'/,%. $0-&-*#0-&-*#,(!. %/,&.,%.,%0-'0.'0.'0.'0.'0-'0-'0-'0.'0-&/,&/,&/,&. %,)" ( /,%0-'. $. %/-&. $. $/-&.,%/,&/,&/,&,)". $0-'-*#. %/-&. $*&
@game.sohu.com
%d&&'
123456789
00003333
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
1.2.18
%*.*f
CNotSupportedException
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
COMCTL32.DLL
CCmdTarget
MSWHEEL_ROLLMSG
ole32.dll
Broken pipe
Inappropriate I/O control operation
Operation not permitted
iphlpapi.dll
SHLWAPI.dll
MPR.dll
VERSION.dll
.PAVCException@@
Shell32.dll
Mpr.dll
Advapi32.dll
User32.dll
Gdi32.dll
Kernel32.dll
(&07-034/)7 '
?? / %d]
%d / %d]
.PAVCFileException@@
: %d]
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
\\.\Scsi0:
%s:%d
windows
.PAVCNotSupportedException@@
out.prn
(*.prn)|*.prn|
%d.%d
%d/%d
1.6.9
unsupported zlib version
png_read_image: unsupported transformation
%d / %d
Bogus message code %d
libpng error: %s
libpng warning: %s
1.1.3
bad keyword
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
(%d-%d):
%ld%c
(*.htm;*.html)|*.htm;*.html
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
%s <%s>
Reply-To: %s
From: %s
To: %s
Subject: %s
Date: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
SMTP
VVV.dywt.com.cn
x86 Family %s Model %s Stepping %s
X-X-X-X
\\.\Smartvsd
\\.\PhysicalDrive%d
\\.\Scsi%d:
[%s:%d]
Range: bytes=%s-
[%s:%d]
PASS %s
PASS ******
USER %s
E:\e5\dev\e\static_link\static_libs\source\downlib\mystrlib.cpp
SIZE %s
PORT
User-Agent: %s
Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)
Referer: %s
Host: %s
GET %s HTTP/1.1
HTTP/1.1
hXXp://
Cookie: %s
%d, %s
\\192.168.0.129\TCP\1037
NSPlayer/9.0.0.2980; {%s}; Host: %s
rmff_fix_header: assuming data.size=%i
rmff_fix_header: assuming data.num_packets=%i
rmff_fix_header: assuming prop.num_packets=%i
rmff_fix_header: setting prop.data_offset from %i to %i
rmff_fix_header: correcting prop.num_streams from %i to %i
rmff_fix_header: correcting prop.size from %i to %i
%s %s %s
Session: %s
Cseq: %u
%*s %s
%*s %u
CSeq: %u
rtsp://%s:%i
rtsp://%s:%i/%s
ClientID: Linux_2.4_6.0.9.1235_play32_RN01_EN_586
GUID: 00000000-0000-0000-0000-000000000000
[%s:%d]
User-Agent: RealMedia Player Version 6.0.9.1235 (linux-2.0-libc6-i386-gcc2.95)
Range: npt=%s-
%s/streamid=1
%s/streamid=0
Transport: x-pn-tng/tcp;mode=play,rtp/avp/tcp;unicast;mode=play
If-Match: %s
RealChallenge2: %s, sd=%s
Title: %s
Copyright: %s
Author: %s
real: Content-length for description too big (> %uMB)!
Require: com.real.retain-entity-for-setup
SupportsMaximumASMBandwidth: 1
Bandwidth: %u
Challenge1: %s
hash output: %x %x %x %x
hash input: %x %x %x %x
stream=%u;rule=%u,
Illegal character '%c' in input.
;3 #>6.&
'2, / 0&7!4-)1#
(*.avi)|*.avi
WPFT532.CNV
WPFT632.CNV
EXCEL32.CNV
write32.wpc
Windows Write
mswrd632.wpc
Word for Windows 6.0
wword5.cnv
Word for Windows 5.0
mswrd832.cnv
mswrd632.cnv
Word 6.0/95 for Windows & Macintosh
html32.cnv
.PAVCOleException@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCOleDispatchException@@
.PAVCArchiveException@@
zcÁ
c:\%original file name%.exe
9.oTec
8%Se*E
ntdll.dll
advapi32.dll
hid.dll
mscoree.dll
mscorwks.dll
mscorsvr.dll
KernelBase.dll
mscoreei.dll
clr.dll
diasymreader.dll
SEGetNumExecUsed
SEGetNumExecLeft
SESetNumExecUsed
SEGetExecTimeUsed
SEGetExecTimeLeft
SESetExecTime
SEGetTotalExecTimeUsed
SEGetTotalExecTimeLeft
SESetTotalExecTime
SECheckExecTime
SECheckTotalExecTime
&&&&6666????
""""****
2222::::
$$$$\\\\
00006666
####====
MSVCRT.dll
IPHLPAPI.DLL
PSAPI.DLL
KERNEL32.dll
USER32.dll
RegOpenKeyExA
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
ADVAPI32.dll
SHELL32.dll
n\JqYQ7%x
)Qh%X~
..Qe:
Lw%c)
`tQI%X
mh%X~
%Fz;Pc
%Fz&=~Y
&%U|M^
c.AM (
1).Uk
Id.DB_
.Rv/ 6
""
m-U}k*
i.ck~
.lAubH
V.Ss^v)
FtpLK
y:.Vm
Tly
&R.ts
%SBb'
4'N.OA
.PYF`
OmZRG?%Se
?.Jza
R.Jx7y
.LjQ 1
WS2_32.dll
OLEAUT32.dll
GDI32.dll
WINMM.dll
WINSPOOL.DRV
COMCTL32.dll
RASAPI32.dll
WININET.dll
AVIFIL32.dll
MSVFW32.dll
comdlg32.dll
oledlg.dll
Safengine Shielden v2.3.3.0

%original file name%.exe_412_rwx_00718000_00002000:

kernel32.dll
user32.dll
The procedure entry point %s could not be located in the dynamic link library %s
The ordinal %u could not be located in the dynamic link library %s
rasapi32.dll
winmm.dll
ws2_32.dll
msvfw32.dll
avifil32.dll
gdi32.dll
winspool.drv
comdlg32.dll
advapi32.dll
shell32.dll
ole32.dll
oleaut32.dll
comctl32.dll
oledlg.dll
wininet.dll
msvcrt.dll
iphlpapi.dll
psapi.dll
RegCreateKeyExA
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity name="E.App" processorArchitecture="x86" version="5.2.0.0" type="win32"/><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency></assembly>
3.14.12.30
Microsoft? Visual Studio .NET


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
  2. Delete the original Trojan-PSW file.
  3. Delete or disinfect the following files created/modified by the Trojan-PSW:

    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\2[1].jpg (10248 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\index[1].htm (2261 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\reset[1].css (10585 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CA6J6JMX.htm (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cd[1].gif (1448 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery.min[1].js (30109 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery.cycle.all.min[1].js (14237 bytes)
    %Documents and Settings%\%current user%\Cookies\index.dat (2024 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@163[1].txt (169 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\2b89_d7fe5f56_eb35_e9fe_8f18_ce641531226b_1[1].jpg (2520 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery-a[1].js (5500 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@changyou[1].txt (188 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1[1].jpg (10272 bytes)

  4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  5. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now