MD5: fa5a6dbbf98e65209fbdb6b463d97244
SHA1: 668d082a6b48138ea15a80d2d2f45cfbd26380d2
SHA256: b46756f05bf9c0620331565e931fc81bd6bb9f0310c78247a96d467d238c7627
SSDeep: 6144:NfZnC7DkuDaZtM/1uBfHOLVyTiw2OfMbboWTpjYlM7:NfZF6uNTN2l3Fj M7
Size: 269564 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2015-09-24 17:10:49
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:204
ping.exe:1384
ping.exe:1652
ping.exe:1596
ping.exe:284
ping.exe:508

The Trojan injects its code into the following process(es):

explorer.exe:1924
csrss.exe:692
winlogon.exe:724
services.exe:768
lsass.exe:780
Explorer.EXE:884
svchost.exe:952
svchost.exe:1056
svchost.exe:1144
svchost.exe:1244
svchost.exe:1364
spoolsv.exe:1468
jqs.exe:1620
imapi.exe:1992

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:204 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Start Menu\Programs\Startup\netfix.exe (196 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\netfix.exe (196 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Startup\netfix.exe (196 bytes)

Registry activity

The process %original file name%.exe:204 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "62 5D 93 52 4B 75 E6 26 50 60 72 08 EB 71 93 FB"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\D:]
"delme.bat" = "delme"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList]
"NetAdmin" = "0"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\D:]
"netfix.exe" = "FloorFresh"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"disable_nasty_checks" = "setx SEE_MASK_NOZONECHECKS 1"

The process ping.exe:1384 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E 01 58 BA 43 C5 7E 07 8E E1 B8 C6 94 32 2B 1A"

The process ping.exe:1652 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AE 14 08 E7 79 F1 2B 3F 70 71 5A 83 97 AD 35 43"

The process ping.exe:1596 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0A 1C 4C A7 FA 11 D9 24 7B B7 05 64 9C 9F 70 F7"

The process ping.exe:284 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AE B5 54 F5 CE EC 19 8A 96 80 D0 4D 20 A4 17 C6"

The process ping.exe:508 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D5 6E 6D AF CB 47 3E E4 5D E9 1A 3C 54 C1 6C F2"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Trojan installs the following user-mode hooks in ntdll.dll:

NtResumeThread
NtQueryDirectoryFile
NtEnumerateValueKey
NtCreateThread
NtCreateProcessEx

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

.text

`.data

.rsrc

@.reloc

ADVAPI32.dll

BROWSEUI.dll

GDI32.dll

KERNEL32.dll

NTDLL.DLL

msvcrt.dll

ole32.dll

OLEAUT32.dll

SHDOCVW.dll

SHELL32.dll

SHLWAPI.dll

USER32.dll

UxTheme.dll

FTSSh

t0SSh

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system

SShwk

98~%SP

ExplorerStartMsgLoop

PSSh;

6SSSSh

SSSSh

SPSSSShL

u%SSh

t.WWWW

xpsp2res.dll

xpsp3res.dll

tbSSh

Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartMenu

Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartPanel

kernel32.dll

GetSystemWindowsDirectoryW

NetGetJoinInformation

WINMM.dll

SETUPAPI.dll

WINSTA.dll

OLEACC.dll

USERENV.dll

ntdll.dll

RegEnumKeyExW

RegNotifyChangeKeyValue

RegOpenKeyExA

RegEnumKeyW

RegCloseKey

RegCreateKeyW

RegQueryInfoKeyW

RegOpenKeyExW

RegCreateKeyExW

OffsetViewportOrgEx

GetViewportOrgEx

SetViewportOrgEx

SetProcessShutdownParameters

GetProcessHeap

GetWindowsDirectoryW

CreateIoCompletionPort

ShellExecuteExW

SHRegCloseUSKey

SHRegCreateUSKeyW

AssocQueryKeyW

SHRegOpenUSKeyW

SHDeleteKeyW

TileWindows

ExitWindowsEx

RegisterHotKey

UnregisterHotKey

EnumChildWindows

GetKeyState

GetAsyncKeyState

CascadeWindows

MsgWaitForMultipleObjects

EnumWindows

explorer.pdb

name="Microsoft.Windows.Shell.explorer"

version="5.1.0.0"

<description>Windows Shell</description>

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

]]"```^]]\

3333333330

3333330

333333334

)@.   '5 !*

.DEHHF>?/

2<===@@=

&$%Uooqkezs

['$$#%&(4

3333333333333333333

33333333333330

7'''')) 

3'')))33.

222`444(555

%%%{///-

000000000

00000000

`[66...00

0000000

`]66./.000

/./././././././.

66///0000

0000000000000

0000000000

6666,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,0.010.010.010.010.010.010.010.010.010.010.001

4366666666K,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6.010.010.010.010.010.010.010.010.010.010.000

:;<;:;<;:;<;:;<;:;<0

)   )   )   )   )

|2222'2'2'2'2'2'2'2'2'2'2'2'2'2'2'2',),),),),),),),),),),),),),),),),),),),),),, 

22222222222

3333333

.SB99;;;99twv}ut{oxt~

.SB;;;:::2:w}{{qddgghg

" """ """ """ """ "" #

""" """ """ "#

.SG>''';;9::p

:5:5:5:5:5:5:5:5:5:5#"

# # # # # # # # # # # # # # # # # # # # # ##$

( # # # # # # # # # # # # # # # # # # # # ###

1232123212321232123

(&(((&(((&(((&(((&((&&)

&(((&(((&(((&()

`,''')))

'4,4'4,4'4,4'4,4'4,4)(

55///0000

5555-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-0

555555555

55555555

5555555

14441444144414441

4343434343434343

5555555555555

5555555555

-,-,-,-,-,-,-,-,-,-,-*.

..............................JFJFJFJFJFJFJFJFJFJFJ.-

{22*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-../

|ujjjjuhF..BBBBBBBBBBBBT

~j|F.BB*BBB*BBB*Bwop

&!!!&!!!&

44466666

44444444416

4446666

66666666

|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= 

|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= 

DDDDE%CTDD@

A%US$

%UUUU

%%UUU

33U

""2222!!

!"!"%UUR""

!""!"#2"""

"!!"#3"!"

dnnnnn:n.nfCnmddddd

////;/;;88

;888;;!/

!//!!;;^

:;:!::!!!

.88.88.8

.N.NN.M

::8.8...

:::!;;:!

//!!;888

.8.8.88...

:;!::!!;!//!;

!!;:!!::

.88..8..

!!:::/^!

!;/;!;;;!!!:

.8:!!!!^

!!:;:::..

/:!^^!;{8{../

...:::.-

**6***66*6**6566*5666 ,

6*6666*6*6 655*65

6*65 56*5 55  555 *5  6

555( 55 (5 5(  

76 5   66  555*677

6*6 5 5(5 (55( '5((5 (556 ('5

665**6(('S((((((S(((]('((@('SS((S(((((((6C-.NEC66S5sU

555(555(5((5(5(5(

5 5 5 5555 (555(555'(((5(5('55(((

((''('5'5(5('('('('('((''('(((@(((('&(((&

%&&%&&&&3>&3&3&33&3&3333&&3>3333

'(3&'&3&

3&33&&((

3323>33>%>3%>3>33>3%3&%

*5'(('((&@3(

,63%3>323>3%>&>33323>>%>

3(3'(((@@'5('@(@(&('(

>2>323%>3

75((((@3&333&3&&&%&3&&3&33>33%3>23%>3

>2%$32%>2>%>2$3>

3&%&&3&33>3>33

3>%>3%&3$23>23$2>2%$>2>

)4433((&(&('*

('((((''(**6(('' *

32323>3>

2$%>22%>%3' (

&(&''((5(5 *

'(&(&((&('''

&&%&3&&%3%

2%>22>22

5''3(((3(('&(&'&

3%%3%3%2#$

22$22$2%$22$2%2%$2%$2$222%$22

&>2$2$2$222$22$%%

:7'((('(3('(3(&(&

222222222222

22222222222222

222222222222222

22$22$22$22$

&(%3%&&&&3&&&3%3

222222222222222222

&&(&3(&(&'('((3'(&&

2222222

22$<$$2$22$%

&&(3(3('(&'

222"2212

22<2<22"

(&(3(3((

((565 ((( 6

333&33(&&

'(('('(('( 

 '&%%"$

2"2"22"2

2222<2"222

"2"22<2<22

2%('(3'32222?&'

2"2"2"121212<

2"2"2$"?

%%22%2

&3(3(3((&

"2"<"2<2<

<2<"<"<"<

1"?((&21

<?<?22<$2

2%""22&&

2<2$$2222

'&('(3(''

((%%%"

5(3%"%

"2%5*67

))) ))))

""**<****"""

"*<<<<*"

#2#---2222-222442-

--&#-(-%

$/222(--444222!

#&-221269924999;

&$-22-($2%

#(2---222622212-

#2221299629968

#&--%#(2##!

-222422422426662-%

"2-##&

!##-#&#-&&#%---#---#&-219662%

$&-(151,44.9

&1242662-

-(..19.19

,4492.12

12-$-,-,

-, $$----

#%#-15/-&

-,(,,(,(,

$$11651566/,$&&

,2592&&&-

2466/!$$

""*<*"****""

) '????[

&&&$-556>>61,,5994511-

$(//$$$(6>6/,$,-$

#$-22692/,,$,-&

-266661..4514#

&,2-&&##

&-222,22--#

#&&---2-,-&$&(,,291.566..BNNNTNNNNNAABIAA88

&!#&!-##

&#--//11468>885882&

$266961$&--$&%

,1661,!-((#

&$,4255$,92

&$,44..&

""**""***""

"****<*<<**"

"**""""*""""

&-569./-,16522$

.BAA=86546888=AAAEAAEMNRMQQSWZZ\]gk__m__\

bTRHHHHHQQHQJQWJSSSSSSSSSSSSSSSSWWSSSS\\V]VZW8,.FW]\\]\]\]\\ZZ\\WFR>38(

.BTTkgn]ktvgmvvvvvmvvvsvzzzyzyzyzyyyzmkkkkkZSRA816;F87

yzyzyzym^Z]WN3   $&$.Wt\

""*"""****""""

"***"**""**<**"

$5612,.2,

&$$,,,5]

$]t.Ft

7%8U8

3 303<3]3

2<3

8 8$8(8,8084888<8}8

5%5,575{6

<,<0<4<8<

7 7$7(7,70747

rundll32.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage

Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

::{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}

::{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}

::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}

::{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}

::{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}

::{D20EA4E1-3957-11d2-A40B-0C5020524153}

::{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}

{208D2C60-3AEA-1069-A2D7-08002B30309D}

{20D04FE0-3AEA-1069-A2D8-08002B30309D}

Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites

{450D8FBA-AD25-11D0-98A8-0800361B1103}

CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}

Software\Microsoft\Windows\CurrentVersion\RunOnce

Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad

Software\Microsoft\Windows\CurrentVersion\Explorer\DontShowMeThisDialogAgain

Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\CleanupWiz

\\.\WMIDataDevice

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Software\Microsoft\Windows NT\CurrentVersion\Windows

ExplorerIsShellMutex

desk.cpl

Software\Microsoft\Windows\CurrentVersion\Explorer

tourstart.exe

tourstart.exe,0

Microsoft.OfferTour

WINWORD.EXE

Software\Microsoft\Windows\CurrentVersion\Applets

Software\Microsoft\Windows\CurrentVersion\Applets\Tour

explorer.exe,9

Microsoft.FixScreenResolution

shell:::{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}

Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation

Software\Microsoft\Windows NT\CurrentVersion

shell:::{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}

Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

DDEEXECUTESHORTCIRCUIT

http\shell

IEXPLORE.EXE

Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop

Software\Microsoft\Windows\CurrentVersion\RunOnceEx

comctl32.dll

Software\Microsoft\Windows\Internet Settings

AutoConfigURL

system.ini

AppEvents\Schemes\Apps\.Default\%s\.current

Software\Microsoft\Windows\CurrentVersion\Explorer\TrayNotify

MSShellRunDlgReady

res://mys.dll/mys.hta /explorer

mshta.exe

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\Welcome

Software\Microsoft\Windows\CurrentVersion\Explorer\Tips

SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\MYS

cys.exe

SOFTWARE\Microsoft\Windows NT\CurrentVersion\srvWiz

install.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel

OUTLOOK.EXE

explorer.exe,16

iernonce.dll

WININET.DLL

UpdateURL

WindowsUpdate

HWND%x

Software\Microsoft\Windows\CurrentVersion\OemStartMenuData

fldrclnr.dll,Wizard_RunDLL

iexplore.exe

winbrand.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\Remote\%d

shell32.dll

nusrmgr.cpl ,initialTask=ChangePicture

NewExeName

Windows

ediskeer.dll

timedate.cpl

Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\LastVisitedMRU

Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\OpenSaveMRU

Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU

Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Software\Microsoft\Internet Explorer\TypedURLs

%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Calculator.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Games\Solitaire.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Paint.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\WordPad.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Files and Settings Transfer Wizard.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Windows Movie Maker.lnk

%USERPROFILE%\Start Menu\Programs\Accessories\Tour Windows XP.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Windows Messenger.lnk

%USERPROFILE%\Start Menu\Programs\Windows Media Player.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\MSN.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Get Online with MSN.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Get Going with Tablet PC.lnk

%ALLUSERSPROFILE%\Start Menu\Set Program Access and Defaults.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Windows Journal.lnk

%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Media Center\Media Center.lnk

%USERPROFILE%\Start Menu\Programs\Internet Explorer.lnk

Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel

TSAppCMP.DLL

netapi32.dll

%SystemRoot%\system32\restore\rstrui.exe

RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL ?0x%X?%s

RunDLL32.EXE

%s%d%s

Software\Microsoft\Windows\CurrentVersion\Policies\System

settings.dll

explorer.exe "

explorer.exe /e, "

WindowsLogon

WindowsLogoff

%s %s

Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count

uAppWiz.Cpl

\explorer.exe

Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu

::{20D04FE0-3AEA-1069-A2D8-08002B30309D}

taskmgr.exe

ShellExecute

Software\Microsoft\Windows\CurrentVersion\Explorer\AppKey\%d

\WindowsShell.Manifest

Get Online with MSN.lnk

Set Program Access and Defaults.lnk

Link%d

OEM%d

Software\Microsoft\Windows\CurrentVersion\SMDEn

::{D20EA4E1-3957-11d2-A40B-0C5020524152}

There is a file or folder on your computer called "%s" which could cause certain applications to not function correctly. Renaming it to "%s" would solve this problem. Would you like to rename it now?

Ca&scade Windows

Tile Windows &Horizontally

Tile Windows V&ertically

&Windows Security...

&Help and Support

&Log Off %s...

Windows Explorer

6.00.2900.5512 (xpsp.080413-2105)

EXPLORER.EXE

Windows

Operating System

6.00.2900.5512

Keep the &taskbar on top of other windows

To remove records of recently accessed documents, programs, and Web sites, click Clear.

Windows displays icons for active and urgent notifications, and hides inactive ones. You can change this behavior for items in the list below.

Select this option to use the menu style from earlier versions of Windows.

6There is not enough memory to complete this operation.8Unable to run command.

The folder '%1' has been removed.WMy Computer or Windows Explorer has not been properly initialized yet. Try again later.

&Undo %s

Windows is running in safe mode.

This special diagnostic mode of Windows enables you to fix a problem which may be caused by your network or hardware settings. Make sure these settings are correct in Control Panel, and then try starting Windows again. While in safe mode, some of your devices may not be available.

startRThere was an internal error and one of the windows you were using has been closed.

Restrictions{This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.

&Show Open Windows

Windows was unable to change the display settings for the new configuration. Return the computer to the previous state, shut down Windows, and restart the computer in the desired configuration.

There may be a problem with your display settings if you continue. To safely change to a new configuration, you should shut down Windows and restart the computer in the desired configuration. Do you want to continue anyway?

This pre-release version of "Internet Explorer 4.0" Desktop/Explorer has expired. Please update to the latest release of "Internet Explorer 4.0" from WWW.MICROSOFT.COM

helpctr.exe>-FromStartHelp

Take a tour of Windows XP

NOpens a window where you can pick search options and work with search results.aOpens a central location for Help topics, tutorials, troubleshooting, and other support services.

/Opens a program, folder, document, or Web site.

Provides options for closing your programs and logging off, or for leaving your programs running and switching to another user.lProvides options for turning off or restarting your computer, or for activating Stand By or Hibernate modes.RDisconnects your session. You can reconnect to the session when you log on again.

&Windows Security

iOpens the My Documents folder, where you can store letters, reports, notes, and other kinds of documents./Displays recently opened documents and folders.KOpens the My Music folder, where you can store music and other audio files.]Opens the My Pictures folder, where you can store digital photos, images, and graphics files.zGives access to, and information about, the disk drives, cameras, scanners, and other hardware connected to your computer.MGives access to, and information about, folders and files on other computers.8Connects to other computers, networks, and the Internet.

explorer.exe_1924_rwx_00970000_00006000:

RegCreateKeyExA

RegEnumKeyExA

RegCloseKey

CryptDestroyKey

CryptImportPublicKeyInfo

NtEnumerateValueKey

t%x#;E

ijjnehxchgde.in

/c D:\netfix.exe

DeleteUrlCacheEntryA

GetUrlCacheEntryInfoA

HttpQueryInfoA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpSendRequestA

HttpSendRequestW

h.rda

>HTTP

8HTTP

g0jdy3826yenz63om.cc

-----BEGIN PUBLIC KEY-----

-----END PUBLIC KEY-----

explorer.exe_1924_rwx_00A50000_00006000:

RegCreateKeyExA

RegEnumKeyExA

RegCloseKey

CryptDestroyKey

CryptImportPublicKeyInfo

NtEnumerateValueKey

t%x#;E

g0jdy3826yenz63om.cc

/c D:\netfix.exe

DeleteUrlCacheEntryA

GetUrlCacheEntryInfoA

HttpQueryInfoA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpSendRequestA

HttpSendRequestW

h.rda

>HTTP

8HTTP

-----BEGIN PUBLIC KEY-----

-----END PUBLIC KEY-----

explorer.exe_1924_rwx_0101A000_00001000:

Software\Microsoft\Windows\Internet Settings

AutoConfigURL

system.ini

csrss.exe_692_rwx_027F0000_00006000:

RegCreateKeyExA

RegEnumKeyExA

RegCloseKey

CryptDestroyKey

CryptImportPublicKeyInfo

NtEnumerateValueKey

t%x#;E

g0jdy3826yenz63om.cc

/c D:\netfix.exe

DeleteUrlCacheEntryA

GetUrlCacheEntryInfoA

HttpQueryInfoA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpSendRequestA

HttpSendRequestW

h.rda

>HTTP

8HTTP

-----BEGIN PUBLIC KEY-----

-----END PUBLIC KEY-----

winlogon.exe_724_rwx_00AC0000_00006000:

RegCreateKeyExA

RegEnumKeyExA

RegCloseKey

CryptDestroyKey

CryptImportPublicKeyInfo

NtEnumerateValueKey

t%x#;E

g0jdy3826yenz63om.cc

/c D:\netfix.exe

DeleteUrlCacheEntryA

GetUrlCacheEntryInfoA

HttpQueryInfoA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpSendRequestA

HttpSendRequestW

h.rda

>HTTP

8HTTP

-----BEGIN PUBLIC KEY-----

-----END PUBLIC KEY-----

services.exe_768_rwx_00760000_00006000:

RegCreateKeyExA

RegEnumKeyExA

RegCloseKey

CryptDestroyKey

CryptImportPublicKeyInfo

NtEnumerateValueKey

t%x#;E

g0jdy3826yenz63om.cc

/c D:\netfix.exe

DeleteUrlCacheEntryA

GetUrlCacheEntryInfoA

HttpQueryInfoA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpSendRequestA

HttpSendRequestW

h.rda

>HTTP

8HTTP

-----BEGIN PUBLIC KEY-----

-----END PUBLIC KEY-----

lsass.exe_780_rwx_00C60000_00006000:

RegCreateKeyExA

RegEnumKeyExA

RegCloseKey

CryptDestroyKey

CryptImportPublicKeyInfo

NtEnumerateValueKey

t%x#;E

g0jdy3826yenz63om.cc

/c D:\netfix.exe

DeleteUrlCacheEntryA

GetUrlCacheEntryInfoA

HttpQueryInfoA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpSendRequestA

HttpSendRequestW

h.rda

>HTTP

8HTTP

-----BEGIN PUBLIC KEY-----

-----END PUBLIC KEY-----

Explorer.EXE_884_rwx_014D0000_00006000:

RegCreateKeyExA

RegEnumKeyExA

RegCloseKey

CryptDestroyKey

CryptImportPublicKeyInfo

NtEnumerateValueKey

t%x#;E

g0jdy3826yenz63om.cc

/c D:\netfix.exe

DeleteUrlCacheEntryA

GetUrlCacheEntryInfoA

HttpQueryInfoA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpSendRequestA

HttpSendRequestW

h.rda

>HTTP

8HTTP

-----BEGIN PUBLIC KEY-----

-----END PUBLIC KEY-----

svchost.exe_952_rwx_009B0000_00006000:

RegCreateKeyExA

RegEnumKeyExA

RegCloseKey

CryptDestroyKey

CryptImportPublicKeyInfo

NtEnumerateValueKey

t%x#;E

g0jdy3826yenz63om.cc

/c D:\netfix.exe

DeleteUrlCacheEntryA

GetUrlCacheEntryInfoA

HttpQueryInfoA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpSendRequestA

HttpSendRequestW

h.rda

>HTTP

8HTTP

-----BEGIN PUBLIC KEY-----

-----END PUBLIC KEY-----

svchost.exe_1056_rwx_009F0000_00006000:

RegCreateKeyExA

RegEnumKeyExA

RegCloseKey

CryptDestroyKey

CryptImportPublicKeyInfo

NtEnumerateValueKey

t%x#;E

g0jdy3826yenz63om.cc

/c D:\netfix.exe

DeleteUrlCacheEntryA

GetUrlCacheEntryInfoA

HttpQueryInfoA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpSendRequestA

HttpSendRequestW

h.rda

>HTTP

8HTTP

-----BEGIN PUBLIC KEY-----

-----END PUBLIC KEY-----

svchost.exe_1144_rwx_01990000_00006000:

RegCreateKeyExA

RegEnumKeyExA

RegCloseKey

CryptDestroyKey

CryptImportPublicKeyInfo

NtEnumerateValueKey

t%x#;E

g0jdy3826yenz63om.cc

/c D:\netfix.exe

DeleteUrlCacheEntryA

GetUrlCacheEntryInfoA

HttpQueryInfoA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpSendRequestA

HttpSendRequestW

h.rda

>HTTP

8HTTP

-----BEGIN PUBLIC KEY-----

-----END PUBLIC KEY-----

svchost.exe_1244_rwx_007E0000_00006000:

RegCreateKeyExA

RegEnumKeyExA

RegCloseKey

CryptDestroyKey

CryptImportPublicKeyInfo

NtEnumerateValueKey

t%x#;E

g0jdy3826yenz63om.cc

/c D:\netfix.exe

DeleteUrlCacheEntryA

GetUrlCacheEntryInfoA

HttpQueryInfoA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpSendRequestA

HttpSendRequestW

h.rda

>HTTP

8HTTP

-----BEGIN PUBLIC KEY-----

-----END PUBLIC KEY-----

svchost.exe_1364_rwx_00B70000_00006000:

RegCreateKeyExA

RegEnumKeyExA

RegCloseKey

CryptDestroyKey

CryptImportPublicKeyInfo

NtEnumerateValueKey

t%x#;E

g0jdy3826yenz63om.cc

/c D:\netfix.exe

DeleteUrlCacheEntryA

GetUrlCacheEntryInfoA

HttpQueryInfoA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpSendRequestA

HttpSendRequestW

h.rda

>HTTP

8HTTP

-----BEGIN PUBLIC KEY-----

-----END PUBLIC KEY-----

spoolsv.exe_1468_rwx_00AE0000_00006000:

RegCreateKeyExA

RegEnumKeyExA

RegCloseKey

CryptDestroyKey

CryptImportPublicKeyInfo

NtEnumerateValueKey

t%x#;E

g0jdy3826yenz63om.cc

/c D:\netfix.exe

DeleteUrlCacheEntryA

GetUrlCacheEntryInfoA

HttpQueryInfoA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpSendRequestA

HttpSendRequestW

h.rda

>HTTP

8HTTP

-----BEGIN PUBLIC KEY-----

-----END PUBLIC KEY-----

jqs.exe_1620_rwx_010B0000_00006000:

RegCreateKeyExA

RegEnumKeyExA

RegCloseKey

CryptDestroyKey

CryptImportPublicKeyInfo

NtEnumerateValueKey

t%x#;E

g0jdy3826yenz63om.cc

/c D:\netfix.exe

DeleteUrlCacheEntryA

GetUrlCacheEntryInfoA

HttpQueryInfoA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpSendRequestA

HttpSendRequestW

h.rda

>HTTP

8HTTP

-----BEGIN PUBLIC KEY-----

-----END PUBLIC KEY-----

imapi.exe_1992_rwx_005C0000_00006000:

RegCreateKeyExA

RegEnumKeyExA

RegCloseKey

CryptDestroyKey

CryptImportPublicKeyInfo

NtEnumerateValueKey

t%x#;E

g0jdy3826yenz63om.cc

/c D:\netfix.exe

DeleteUrlCacheEntryA

GetUrlCacheEntryInfoA

HttpQueryInfoA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpSendRequestA

HttpSendRequestW

h.rda

>HTTP

8HTTP

-----BEGIN PUBLIC KEY-----

-----END PUBLIC KEY-----

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:204
   ping.exe:1384
   ping.exe:1652
   ping.exe:1596
   ping.exe:284
   ping.exe:508
   

3. Delete the original Trojan file.
   
4. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Start Menu\Programs\Startup\netfix.exe (196 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\Startup\netfix.exe (196 bytes)
   %Documents and Settings%\Default User\Start Menu\Programs\Startup\netfix.exe (196 bytes)
   

5. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "disable_nasty_checks" = "setx SEE_MASK_NOZONECHECKS 1"

6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.