Trojan.SalityStub.F_0f967beeac
Trojan.Win32.Small.cox (Kaspersky), Trojan.SalityStub.F (B) (Emsisoft), Trojan.SalityStub.F (AdAware), Virus.Win32.Sality.FD, Virus.Win32.Sality.2.FD, VirusSality.YR, GenericAutorunWorm.YR, GenericInjector.YR (Lavasoft MAS)
Behaviour: Trojan, Worm, Virus, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
| Requires JavaScript enabled! |
|---|
MD5: 0f967beeac769e17646674569e216c40
SHA1: 3b15dafbe296d5398a8548165efed17e886965b7
SHA256: 7ca703714d12f2a65e22b3ec06b4af123f5a5a7384399bac33956369b7ceb787
SSDeep: 3072:nnKHk3T8UKWKINbElULR9WLjJ NgatNANhsx7:iMO7gvLRcLMbtKmx7
Size: 99328 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2010-11-05 02:25:00
Analyzed on: WindowsXP SP3 32-bit
Summary:
Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Payload
| Behaviour | Description |
|---|---|
| WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):
%original file name%.exe:348
Explorer.EXE:888
Mutexes
The following mutexes were created/opened:
HGFSMUTEX000000000002146e
ShimCacheMutex
Ap1mutx7
%original file name%.exeM_348_
wmiprvse.exeM_312_
wuauclt.exeM_1792_
vmtoolsd.exeM_1740_
jqs.exeM_1592_
spoolsv.exeM_1436_
svchost.exeM_1104_
svchost.exeM_936_
vmacthlp.exeM_924_
lsass.exeM_768_
services.exeM_756_
winlogon.exeM_712_
csrss.exeM_688_
smss.exeM_524_
uxJLpe1m
File activity
The process %original file name%.exe:348 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\system.ini (70 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\AdobeARM.exe (4 bytes)
C:\xong.exe (99 bytes)
C:\autorun.inf (243 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xtbn.exe (561 bytes)
C:\totalcmd\TOTALCMD.EXE (1728 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\winqdoj.exe (561 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\xtbn.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\winqdoj.exe (0 bytes)
%WinDir%\43370 (0 bytes)
Registry activity
The process %original file name%.exe:348 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Stvncyfrlda]
"m2_8" = "997418918"
"m2_9" = "2732719865"
"m1_17" = "2056916711"
[HKCU\Software\Stvncyfrlda\168128873]
"-1648771660" = "30"
[HKCU\Software\Stvncyfrlda]
"m3_14" = "2835971551"
"m2_2" = "3470577475"
"m2_3" = "910908883"
"m2_0" = "5545"
"m2_1" = "1735292545"
"m2_6" = "1821803824"
"m2_7" = "3557102417"
"m2_4" = "2646191246"
"m2_5" = "86521762"
"m1_19" = "3944205357"
"m2_49" = "3424862897"
"m2_19" = "2905755981"
"m2_47" = "4249252034"
"m2_46" = "2513969062"
"m2_45" = "778668009"
"m2_44" = "3338354408"
"m2_43" = "1603055317"
"m2_42" = "4162739775"
"m2_41" = "2427441143"
"m2_40" = "692155593"
"m4_74" = "3857462658"
"m4_12" = "3643619612"
[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"
[HKCU\Software\Stvncyfrlda]
"m4_70" = "1211267022"
"m3_71" = "2929954066"
"m4_72" = "386881192"
"m1_4" = "2478047645"
"m2_32" = "3989700116"
"m2_33" = "1430014295"
"m2_30" = "519117636"
"m2_31" = "2254397603"
"m2_36" = "2340929273"
"m1_7" = "1824075426"
"m2_34" = "3165314339"
"m2_35" = "605627241"
"m4_11" = "1908328879"
"m3_62" = "230528591"
"m4_16" = "1994847952"
"m4_17" = "3730138685"
[HKCU\Software\Stvncyfrlda\168128873]
"910904903" = "0"
[HKCU\Software\Stvncyfrlda]
"m1_68" = "875459790"
[HKCU\Software\Stvncyfrlda\168128873]
"-737866757" = "136D8E80FC46AFAF3B557428098B3EAC1FE884624FEB3624A8280870DFC1F44F00D70CEDB4C152C649CA40DBCE2BFD9D371CC1585458FB4501457F9785C05A9205A7C1A2ACDFBF1978BF3B605645A99D28FD40CA23F4AFBEC7F47F4DDB67AB87105B2F74B434CA5CCDE2A63809DB954483B8E78A8274DA40AE8F3E67B0A4A9A3636E512F5839D67DDC8FEC120806D624A3D94A90AEF0C01FCB9FCF70B690BB0EF07C487FB6F690FDEE23622722374EBEF6CC72D852410670D0DBE85B5242D747B80166C57BC1A16FF03BA1CF1FE3E431B06446BD52329561FA79664402A87924288EE50B1B2282A7544481E63F0F72638985BBF5E586F3577238227E1FA54E56"
[HKCU\Software\Stvncyfrlda]
"m4_14" = "2819233782"
"m1_69" = "2651615542"
"m3_65" = "1107894404"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"
[HKCU\Software\Stvncyfrlda]
"m4_15" = "259557219"
"m4_58" = "1862614706"
"m2_58" = "1862604208"
"m2_59" = "3597909924"
"m2_54" = "3511392059"
"m2_55" = "951708454"
"m2_56" = "2686995744"
"m2_57" = "127327439"
"m2_50" = "865196866"
"m2_51" = "2600480355"
"m2_52" = "40811454"
"m2_53" = "1776092216"
"m4_41" = "2427443317"
"m4_40" = "692152584"
"m4_43" = "1603057487"
"m4_42" = "4162734050"
"m4_45" = "778671657"
"m4_44" = "3338348220"
"m4_47" = "4249253123"
"m4_46" = "2513962390"
"m4_49" = "3424867293"
"m1_62" = "3082074813"
"m1_63" = "3597308909"
"m1_64" = "1632100187"
"m4_59" = "3597905439"
"m1_66" = "2577077959"
"m3_35" = "622481870"
[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"
[HKCU\Software\Stvncyfrlda]
"m3_37" = "4092948712"
"m3_36" = "2323956093"
"m3_31" = "2270958618"
"m3_30" = "535979247"
"m3_33" = "1413429028"
"m3_32" = "3972958089"
"m3_39" = "3234960306"
"m3_38" = "1533534215"
"m4_0" = "0"
"m4_1" = "1735290733"
"m4_2" = "3470581466"
"m4_3" = "910904903"
"m4_4" = "2646195636"
"m4_5" = "86519073"
"m4_6" = "1821809806"
"m4_7" = "3557100539"
"m4_8" = "997423976"
"m4_9" = "2732714709"
"m2_48" = "1689582382"
"m2_71" = "2946561267"
"m1_65" = "3945719255"
"m2_69" = "3770949091"
"m2_68" = "2035650373"
"m3_54" = "3494439639"
"m3_53" = "1759411128"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"
[HKCU\Software\Stvncyfrlda]
"m2_61" = "2773526835"
"m2_60" = "1038222134"
"m2_63" = "1949135401"
"m2_62" = "213837398"
"m2_65" = "1124750753"
"m2_64" = "3684418852"
"m2_67" = "300365879"
"m3_18" = "1153482627"
"m1_55" = "1249442128"
"m1_54" = "1206420709"
"m1_57" = "692789100"
"m1_56" = "57127522"
"m1_51" = "2871586573"
"m1_50" = "766584430"
"m1_53" = "1534559274"
"m3_34" = "3182011987"
"m1_59" = "1578391928"
"m1_58" = "1272726905"
"m3_22" = "3799972215"
"m3_23" = "1273981154"
"m3_20" = "363060909"
"m3_21" = "2097957336"
"m3_26" = "2150906683"
"m3_27" = "3920013910"
"m3_24" = "3008960529"
"m3_25" = "415992716"
"m4_56" = "2687000536"
"m4_57" = "127323973"
"m3_28" = "1360479685"
"m3_29" = "3061970288"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"
[HKCU\Software\Stvncyfrlda]
"m1_42" = "2596488287"
"m4_50" = "865190730"
"m4_51" = "2600481463"
"m4_54" = "3511386366"
"m2_72" = "386888546"
"m4_68" = "2035652852"
"m2_38" = "1516543391"
"m3_63" = "1965949434"
"m1_37" = "4274599320"
"m1_36" = "4160685690"
"m1_35" = "2653208123"
"m1_34" = "2370185139"
"m1_33" = "3956823484"
"m1_32" = "4174036241"
"m1_31" = "1983522586"
"m1_30" = "2160659677"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Stvncyfrlda]
"m1_70" = "1263519359"
"m1_39" = "461531941"
"m1_38" = "453701752"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4F CE 50 88 4B 33 31 ED 7D B9 64 4F 8A 1A BB A4"
[HKCU\Software\Stvncyfrlda]
"m1_43" = "4003238534"
"m1_40" = "2602022848"
"m1_41" = "2988539844"
"m1_46" = "4175871939"
"m1_47" = "4001904989"
"m1_44" = "1308241853"
"m1_45" = "554140935"
"m1_48" = "2822834187"
"m1_49" = "3371240969"
"m4_53" = "1776095633"
"m3_59" = "3614491702"
"m3_50" = "848472419"
"m1_73" = "4174309288"
"m4_29" = "3078791001"
"m4_28" = "1343500268"
"m1_72" = "956173153"
"m4_23" = "1256981195"
"m4_22" = "3816657758"
"m4_21" = "2081367025"
"m4_27" = "3903176831"
"m4_26" = "2167886098"
"m4_25" = "432595365"
"m4_24" = "2992271928"
"m3_3" = "927474798"
"m4_52" = "40804900"
"m2_70" = "1211263348"
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Stvncyfrlda]
"m4_60" = "1038228876"
"m1_60" = "4292301893"
"m2_37" = "4076208353"
"m1_24" = "4045266315"
"m1_25" = "2693533150"
"m1_26" = "3910600810"
"m1_27" = "701368257"
"m1_20" = "3398019392"
"m1_21" = "1861845127"
"m1_22" = "3031086816"
"m1_23" = "2727579761"
"m1_52" = "3398910183"
"m1_74" = "2307246908"
"m1_28" = "4236811814"
"m1_29" = "1840415787"
"m3_44" = "3354938517"
"m3_45" = "795540480"
"m3_46" = "2497408959"
"m3_47" = "4232388394"
"m3_40" = "675414817"
"m3_41" = "2444014172"
"m3_42" = "4179439051"
"m3_43" = "1586486630"
"m3_48" = "1706528345"
"m3_49" = "3441441268"
"m3_74" = "3840892843"
"m4_38" = "1516538414"
"m4_39" = "3251829147"
"m2_17" = "3730141501"
"m1_71" = "686988916"
[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"
[HKCU\Software\Stvncyfrlda]
"m1_61" = "3443226691"
"m4_48" = "1689576560"
"m4_30" = "519114438"
"m4_31" = "2254405171"
"m4_32" = "3989695904"
"m4_33" = "1430019341"
"m4_34" = "3165310074"
"m4_35" = "605633511"
"m4_36" = "2340924244"
"m4_37" = "4076214977"
"m2_39" = "3251822922"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"
[HKCU\Software\Stvncyfrlda]
"m3_56" = "2703963633"
[HKCU\Software\Stvncyfrlda\168128873]
"-824385830" = "0"
[HKCU\Software\Stvncyfrlda]
"m3_69" = "3787940424"
"m3_55" = "968530498"
[HKCU\Software\Stvncyfrlda\168128873]
"1821809806" = "0200687474703A2F2F7061647275702E636F6D2E64732F736F62616B61312E67696600687474703A2F2F706161616161642E66642E66642F736F62616B61766F6C6F732E676966"
[HKCU\Software\Stvncyfrlda]
"m2_10" = "173034609"
"m1_10" = "3764390671"
"m2_12" = "3643613304"
"m1_12" = "1790429863"
"m2_14" = "2819227656"
"m1_14" = "2544925602"
"m2_16" = "1994845041"
"m1_16" = "3691118177"
"m2_18" = "1170460670"
"m1_18" = "596624599"
"m1_67" = "48180793"
"m3_52" = "57526285"
"m3_70" = "1227955687"
"m3_73" = "2139008060"
"m3_72" = "369900673"
"m3_51" = "2583910558"
"m3_68" = "2018964189"
"m4_73" = "2122171925"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Stvncyfrlda]
"m2_66" = "2860036078"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"
[HKCU\Software\Stvncyfrlda]
"m4_63" = "1949133779"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"
[HKCU\Software\Stvncyfrlda]
"m3_2" = "3487544563"
"m3_1" = "1718420804"
"m3_0" = "17001001"
"m3_7" = "3573965266"
"m3_6" = "1838544551"
"m3_5" = "69945096"
"m3_4" = "2629490589"
"m4_71" = "2946557755"
"m3_9" = "2749530364"
"m3_8" = "980422977"
"m2_20" = "346073413"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"
[HKCU\Software\Stvncyfrlda]
"m4_69" = "3770943585"
[HKCU\Software\Stvncyfrlda\168128873]
"1735290733" = "85"
[HKCU\Software\Stvncyfrlda]
"m3_58" = "1845908635"
"m2_74" = "3857458966"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"
[HKCU\Software\Stvncyfrlda]
"m4_64" = "3684424512"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Stvncyfrlda]
"m1_5" = "1661498457"
"m4_13" = "1083943049"
"m4_10" = "173038146"
"m1_6" = "3630321479"
"m1_1" = "1418181700"
"m1_0" = "2949871197"
"m1_3" = "3843870098"
"m1_2" = "3195467651"
"m3_66" = "2877018163"
"m3_67" = "283394990"
"m4_18" = "1170462122"
"m4_19" = "2905752855"
"m1_9" = "2683943708"
"m1_8" = "4111787993"
"m3_60" = "1021409189"
"m3_61" = "2756962000"
"m4_55" = "951709803"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Stvncyfrlda]
"m4_66" = "2860038682"
"m2_73" = "2122178476"
[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"
[HKCU\Software\Stvncyfrlda]
"m3_12" = "3626914613"
"m4_62" = "213843046"
"m3_64" = "3667439977"
"m4_67" = "300362119"
"m1_11" = "2103798629"
"m4_65" = "1124747949"
"m4_20" = "346076292"
"m2_29" = "3078784526"
"m2_28" = "1343501090"
"m4_61" = "2773519609"
"m2_11" = "1908334491"
"m2_25" = "432599411"
"m2_24" = "2992269965"
"m2_27" = "3903181399"
"m2_26" = "2167885478"
"m2_21" = "2081372075"
"m1_13" = "237742082"
"m2_23" = "1256987556"
"m2_22" = "3816666772"
"m3_19" = "2888904510"
"m2_13" = "1083948256"
[HKCU\Software\Stvncyfrlda\168128873]
"86519073" = "72"
[HKCU\Software\Stvncyfrlda]
"m3_57" = "110470508"
"m3_13" = "1100530336"
"m1_15" = "502767019"
"m3_11" = "1891476358"
"m3_10" = "190001259"
"m3_17" = "3746958356"
"m3_16" = "2011536633"
"m3_15" = "243002698"
"m2_15" = "259560292"
Firewall notifications are disabled:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"
A firewall is disabled:
"EnableFirewall" = "0"
Adds a rule to the firewall Windows which allows any network activity:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"%original file name%.exe" = "c:\%original file name%.exe:*:Enabled:ipsec"
Antivirus notifications are disabled:
[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"
Dropped PE files
| MD5 | File path |
|---|---|
| d801362ee2912c9de869169e1cb7f944 | c:\xong.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.
VersionInfo
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 69632 | 66048 | 5.53652 | 6f66ceac9d837b77fa3682a089a7f55c |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 659
0fd1d5b37f2181ebedd1e9470041a4bd
a6e30760fb814c4a54bd0a1e99e2de5f
f08b2465e76293da22d54f7b2aac8700
f9d73fb131520db0fa7eb2d6572071e3
3bb20f3520ea6a081c2f136a8763e89c
2df20898a726871cc1f43656f8b874ed
1a424b7942ed3392b3a4ca3757436748
34c6f8637ee490b1f2a80576cea10cca
00e7216668017b0a8209157f650b4d5f
287040ba1816c43b2dd0d320e2d52a6c
000907e3d78a5ac8a4343a84d801b538
0d1f143b7d353eb2a73b94f8f2a3108b
ccf8ae789c941a6b52d1dd5f4f50d97a
60be05b34d958a00deba4afe88b4b783
1fd92e329d531d2f8ff87838b81e8cca
ec394475a4baf3da85be86798316e310
02cd84cfec5af38b6c721509c8c4a66a
34e091b3f43aa15a301a674bd0f1ba14
b70ace7dec2c8994d9bb5aecc0839527
14501a085483e25f9446c0828384d14d
e61e119a0fd331c8879653f77edf8251
3630d059c4fafdabe131687db01f2b29
094fde1c2e11f2525df66bded9da9096
08b669034f20bebdc2ad7941a26e738b
579d9cc363873e184bec77f99e6650cc
URLs
No activity has been detected.
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Web Traffic was not found.
The Trojan connects to the servers at the folowing location(s):
.text
KERNEL32.dll
SHELL32.DLL
ShellExecuteA
KERNEL32.DLL
%original file name%.exe
f967beeac769e17646674569e216c40.exe
hXXp://padrup.com.ds/sobaka1.gif
hXXp://paaaaad.fd.fd/sobakavolos.gif
hXXp://89.11
.info/home.gifIh
bW.text
JKERNEL32.dll
%x.exe
h.rdla&
mH.MN8
T4.At%
S.twa
.klkjw:9fqwiBumW
.sysa
Zc.pBTa
~%s:*:yd:
.!.VF*
.d&?%x=
GUrlA'
"\'Web%w}
HTTP)s'PS
2GUARDCMD
o.ENHCDM
wWEBWUPD
MM.PF
%xn'[
>>?456789:;
!"#$%&'()* ,-./4
qn%CXf
UP*dB.PPd@.
%FoAN-x
ÄEW
%F" *" a
ADVAPI32.dll
MSVCRT.dll
SHELL32.dll
USER32.dll
WS2_32.dll
RegCloseKey
SHFileOperationA
%original file name%.exe_348_rwx_00401000_00011000:
KERNEL32.dll
SHELL32.DLL
ShellExecuteA
KERNEL32.DLL
%original file name%.exe
.text
f967beeac769e17646674569e216c40.exe
hXXp://padrup.com.ds/sobaka1.gif
hXXp://paaaaad.fd.fd/sobakavolos.gif
hXXp://89.11
.info/home.gifIh
bW.text
JKERNEL32.dll
%x.exe
h.rdla&
mH.MN8
T4.At%
S.twa
.klkjw:9fqwiBumW
.sysa
Zc.pBTa
~%s:*:yd:
.!.VF*
.d&?%x=
GUrlA'
"\'Web%w}
HTTP)s'PS
2GUARDCMD
o.ENHCDM
wWEBWUPD
MM.PF
%xn'[
>>?456789:;
!"#$%&'()* ,-./4
qn%CXf
UP*dB.PPd@.
%FoAN-x
ÄEW
%F" *" a
ADVAPI32.dll
MSVCRT.dll
SHELL32.dll
USER32.dll
WS2_32.dll
RegCloseKey
SHFileOperationA
%original file name%.exe_348_rwx_00520000_010BA000:
hXXp://89.11
.info/home.gifIh
bW.text
JKERNEL32.dll
%x.exe
hXXp://89.119.67.154/testo5/
hXXp://kukutrustnet777.info/home.gif
hXXp://kukutrustnet888.info/home.gif
hXXp://kukutrustnet987.info/home.gif
.text
KERNEL32.dll
.reloc
USER32.dll
h.rdata
H.data
ntoskrnl.exe
Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0)
Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion
hXXp://VVV.klkjwre9fqwieluoi.info/
hXXp://kukutrustnet777888.info/
Software\Microsoft\Windows\CurrentVersion\policies\system
Software\Microsoft\Windows\ShellNoRoam\MUICache
%s:*:Enabled:ipsec
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
GdiPlus.dll
hXXp://
ipfltdrv.sys
VVV.microsoft.com
?%x=%d
&%x=%d
SYSTEM.INI
USER32.DLL
.%c%s
\\.\amsint32
NTDLL.DLL
autorun.inf
ADVAPI32.DLL
win%s.exe
%s.exe
WININET.DLL
InternetOpenUrlA
avast! Web Scanner
Avira AntiVir Premium WebGuard
cmdGuard
cmdAgent
Eset HTTP Server
ProtoPort Firewall service
SpIDer FS Monitor for Windows NT
Symantec Password Validation
WebrootDesktopFirewallDataService
WebrootFirewall
%d%d.tmp
SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
%s\%s
%s\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
Software\Microsoft\Windows\CurrentVersion\Ext\Stats
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
KERNEL32.DLL
Explorer.exe
A2CMD.
ASHWEBSV.
AVGCC.AVGCHSVX.
DRWEB
DWEBLLIO
DWEBIO
FSGUIEXE.
MCVSSHLD.
NPFMSG.
SYMSPORT.
WEBSCANX.
%c%d_%d
purity_control_%x
.adata
M_%d_
?456789:;<=
!"#$%&'()* ,-./0123
mong%WinDir%\
%WinDir%\hywjfubtsnl.log
hXXp://padrup.com.ds/sobaka1.gif
hXXp://paaaaad.fd.fd/sobakavolos.gif
%System%\drivers\mpgjk.sys
2757031507
SHELL32.DLL
ShellExecuteA
GetProcessHeap
GetWindowsDirectoryA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegCreateKeyA
RegCloseKey
SHFileOperationA
&3&3&3&389
%F" *" a
ADVAPI32.dll
MSVCRT.dll
SHELL32.dll
WS2_32.dll
%original file name%.exe_348_rwx_020C0000_00002000:
SHELL32.DLL
ShellExecuteA
KERNEL32.DLL
.text
%original file name%.exe_348_rwx_021D0000_00001000:
|%original file name%.exeM_348_
Explorer.EXE_888_rwx_00FF0000_00002000:
SHELL32.DLL
ShellExecuteA
KERNEL32.DLL
.text
Explorer.EXE_888_rwx_01FA0000_00001000:
|explorer.exeM_888_
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%WinDir%\system.ini (70 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\AdobeARM.exe (4 bytes)
C:\xong.exe (99 bytes)
C:\autorun.inf (243 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xtbn.exe (561 bytes)
C:\totalcmd\TOTALCMD.EXE (1728 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\winqdoj.exe (561 bytes) - Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
