MD5: 02f734f348c9820e2ccdf21eab2bf24a
SHA1: 607833d0242d19391fb3bcf3eb85bf253f433d1a
SHA256: ffa8d874c7ed7696c8cd3d1c0159bdd4203815d0f3d5c094e83f278eccc50e22
SSDeep: 24576:PyIbHYdndhWJGyYb3MdX1H9zeJW8md9IHHjgVdQOwgPcQDLvU:PJ4dd8TYEXd9zYNyWHHMVVLvU
Size: 1469440 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: no certificate found
Created at: 2015-07-07 18:41:26
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:212

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:212 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Favorites\Íâ¹Ò×÷·»¹Ù·½Õ¾ [www.zuowg.com].url (141 bytes)
C:\SkinH_EL.dll (133 bytes)
C:\%original file name%.exe (7972 bytes)
%Documents and Settings%\%current user%\Favorites\Íâ¹Ò×÷·»×ÊÔ´Õ¾ [42724920.ys168.com].url (110 bytes)

Registry activity

The process %original file name%.exe:212 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Nexon\CStrike-Online\Settings]
"ScreenWindowed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"NetHood" = "%Documents and Settings%\%current user%\NetHood"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Fonts" = "%WinDir%\Fonts"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 28 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"PrintHood" = "%Documents and Settings%\%current user%\PrintHood"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Nexon\CStrike-Online\Settings]
"EngineD3D" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"SendTo" = "%Documents and Settings%\%current user%\SendTo"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 67 C5 A2 01 C5 D1 C0 0C 5A A3 6C EA 76 F0 6E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Recent" = "%Documents and Settings%\%current user%\Recent"
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://aladdin.a.shifen.com/special/time/
hxxp://open.baidu.com/special/time/	123.125.114.102
www.jjfzg.com

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Unsupported/Fake Windows NT Version 5.0

Traffic

GET /special/time/ HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: open.baidu.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sat, 12 Sep 2015 04:35:47 GMT

Server: Apache

X-Powered-By: PHP/5.2.9

Vary: User-Agent

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: text/html
2065..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN
".."hXXp://VVV.w3.org/TR/html4/loose.dtd">..<html>..    <h
ead>..        <meta http-equiv="Content-Type" content="text/html
; charset=gbk">..        <title>........_........</title&g
t;...<style type="text/css">..p,dl,dd,div,h1,h2,table,td,th,ul,o
l,li,img,form{margin:0;padding:0;}div,ul{zoom:1;}a:link{color:#261cdc;
}img{border:none;}body{margin:6px 0 0 0;background-color:#fff;color:#0
00;font-family:arial;}#head{margin-left:0px;width:670px;height:54px;}#
head{padding-left:20px;font-size:12px}.fm{clear:both;position:relative
;z-index:297}.nv a,.nv b,.btn,#page,#more{font-size:14px}.s_nav{height
:45px}.s_nav .s_logo{margin-right:20px;float:left}.s_nav .s_logo img{b
order:0;display:block}.s_nav .s_tab{line-height:18px;padding:20px 0 0;
float:left}.s_nav a{color:#0000cc;font-size:14px}.s_nav b{font-size:14
px}.s_ipt_wr{width:533px;height:30px;display:inline-block;margin-right
:5px;background:url(hXXp://s1.bdstatic.com/r/www/img/i-1.0.0.png) no-r
epeat -304px 0;border:1px solid #b6b6b6;border-color:#7b7b7b #b6b6b6 #
b6b6b6 #7b7b7b;vertical-align:top}.s_ipt{width:520px;height:22px;font:
16px/22px arial;margin:5px 0 0 7px;padding:0;background:#fff;border:0;
outline:none;-webkit-appearance:none}.s_btn{width:95px;height:32px;pad
ding-top:2px\9;font-size:14px;padding:0;background:#ddd url(hXXp://s1.
bdstatic.com/r/www/img/i-1.0.0.png);border:0;cursor:pointer}.s_btn_h{b
ackground-position:-100px 0}.s_btn_wr{width:97px;height:34px;displ
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

`.rsrc

t%SVh

t$(SSh

~%UVW

u$SShe

advapi32.dll

user32.dll

kernel32.dll

SetWindowsHookExA

UnhookWindowsHookEx

MsgWaitForMultipleObjects

hXXp://pl36074337.7958.com/down_8741880.html

cstrike-online.exe

115br.exe

safari.exe

firefox.exe

iexplore.exe

ttraveler.exe

chrome.exe

theworld.exe

saayaa.exe

360se.exe

opera.exe

enjoyie.exe

xbrowser.exe

Maxthon.exe

QQBrowser.exe

IEXPLORE.exe

IEXPLORE.EXE

Safari.exe

Firefox.exe

Iexplore.exe

hXXp://VVV.xxjjg.com/vip.html

\SkinH_EL.dll

.rsrc

`I.UP

%3XCO

7%sI11`Cr

`B$^.Vead

-T%fH&

KQo%uC>

.wlB`

4G.HHIs%'

w$8%x

HotKeyclRbSp

sh.sZr(!h

ized%uTy

0xX

N<%s>

zcÁ

&8.BtX

("%X!

?,/,;..,#

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

USER32.dll

SkinH_EL.dll

hXXp://VVV.jjfzg.com/jiajia.html

hXXp://VVV.jjfzg.com/xxzwg.html

?=42.51.7.143

hXXp://VVV.jjfzg.com/abc.txt

7.3.txt

hXXp://open.baidu.com/special/time/

window.baidu_time(

\hw.dll

\Bin\hw.dll

a3dapi.dll,binkw32.dll,Chall_Ambience.mp3,chn_counterstrikelogo.avi,chn_nexonvalve.avi,chn_segi.avi,client.dll,Core.dll,CSOBanner.exe,CSOLauncher.exe,CSO_Result.mp3,CSOnline.mp3,Chall_Ambience.mp3,Core.dll,BGM_start.mp3,hw.dll,FileSystem_Nar.dll,GameUI.dll,HS_Scenario_Ready.mp3,Mp3dec.asi,Mss32.dll,Mssv12.asi,Mssv29.asi,NMService.exe,cstrike-online.exe,ZB4_start.mp3,Scenario_Normal.mp3,Scenario_Ready.mp3,Scenario_Rush.mp3,Scenario_XMas.mp3,Sedata.dll,Steam.dll,SteamGameUpdater.dll,UpdateDLLWrapper.dll,DemoPlayer.dll,ZE_Ready.mp3,Zombi_Ambience.mp3,motd_temp.html,a3dapi.dll,binkw32.dll,chn_counterstrikelogo.avi,chn_nexonvalve.avi,chn_segi.avi,client.dll,dbg.dll,dbghelp.dll,fmod.dll,libcurl.dll,libeay32.dll,mp.dll,nmcogame.dll,nmconew.dll,particleman.dll,BGM_zombie_attack.mp3,Play_BGM_Rex.mp3,Scen_S4E2_attack.MP3,proxy.dll,ssleay32.dll,steam_api.dll,steamclient.dll,survey1109.dll,tier0.dll,tier0_s.dll,unicows.dll,vgui.dll,vgui2.dll,voice_miles.dll,voice_speex.dll,vstdlib.dll,vstdlib_s.dll,Scen_S4E2_loop.MP3,Scen_S4E2_start.MP3,Zsh_daybgm.mp3,ZE_Ambience.mp3,Zsh_nightbgm.mp3,Zsh_start.mp3,ehsvc.dll,3n.mhe,V3InetGS.dll,V3Hunt.dll,HSUpdate.exe,

HSUpdate.env,hslogmgr.exe,HSInst.dll,hshield.dat,bldinfo.ini,AhnUpGS.dll,AhnUpCtl.dll,ahnrpt.ini,ahnrpt.exe,asc_main.dll,brinicle.dll,hei.msd,autosave01.sav,autosave.sav,

.comp

aspinet.log

Error.log

hshield.log

HSUpChk.log

supdate.log

WScript.Shell

krnln.fnr

krnln.fne

hXXp://

USER32.DLL

GDI32.DLL

WINMM.DLL

WINSPOOL.DRV

ADVAPI32.DLL

SHELL32.DLL

OLE32.DLL

OLEAUT32.DLL

COMCTL32.DLL

WS2_32.DLL

COMDLG32.DLL

RegCloseKey

ShellExecuteA

.XM#U

|I%Dw

v%d=E

$q.Xa

I7%Cj

M?G%5U

.UP;E

x.VUe

%c;FH

bFSql

0Z.EIB

%cO/P

Xac?R.tZtD

.Uujb

Q7%Cz

#u.Ij

{<c.vI\

c<.Xs

%U*\)

2.ot 

5;@GQO%s

<`$.HB

r.qyw

|.Yhy

z.xWZ

)m.QsY!U

xgi_.zZ

{9*%x0

^m%cq

#$%cY

N.GN,

%U({}

o-6}[S

Fc.vG

1]D%X

&`.RJu

L.QJxU]`

.qu^<I

g.NmT_

\?.zdv

7XK.Wf

9dYe.QbzT

t.R%d

i".das

C.ZSjd[Q

.AV\<zR&A:

tX.Sli

.nWHS

Y<.vTG

;.ysN

$'.Kk

B.VuI

ZH%cP~

DiaoyongPanDuan^^$#\cstrike-online.exe

\CSOLauncher.exe

hXXp://VVV.2345.com/?k36074337\

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity name="E.App" processorArchitecture="x86" version="5.1.0.0" type="win32"/><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency></assembly>

RASAPI32.DLL

WININET.DLL

zG.Ngp/s

3W|U.hZ

O&)õ

%c#xN3s

BoK%u

L&M.wUE

%u]z>

L\.KT

7\%Uynxs

l2%%x@

h>6.YOU

g.My$

6f%fy

fo.Kk

.SLUD$

CBi.GNP

".qua

v%C_I

o'CM.gO

.GZS8

.nfx{J

:k.Wz

GV2iXH%d

r]%F)

}`ÄRe

], %u~qy

.Pu*]'

:VVV.jjfzg.com

hXXp://VVV.xxjjg.com/up.txt

F%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

CCmdTarget

ole32.dll

__MSVCRT_HEAP_SELECT

iphlpapi.dll

SHLWAPI.dll

MPR.dll

VERSION.dll

WSOCK32.dll

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

(%d-%d):

%ld%c

(*.htm;*.html)|*.htm;*.html

its:%s::%s

VVV.dywt.com.cn

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.0

%s <%s>

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

<Msg%s>%ld</Msg%s>

0000%d

</Msg0000>

<Msg0000>

EMSG

Recv Sub Packet(%s)..

Recv Packet (%s)...

.PAVCOleException@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

GetCPInfo

GetWindowsDirectoryA

WinExec

GetProcessHeap

RegOpenKeyExA

RegCreateKeyA

RegCreateKeyExA

GetViewportExtEx

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportOrgEx

GetKeyState

CreateDialogIndirectParamA

InternetCanonicalizeUrlA

InternetCrackUrlA

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

.text

`.rdata

@.data

-V*tü

ADVAPI32.dll

comdlg32.dll

OLEAUT32.dll

oledlg.dll

RASAPI32.dll

SHELL32.dll

WININET.dll

WINMM.dll

WS2_32.dll

VVV.skinsharp.com

0, 4, 1, 0

Copyright 2008-2080 VVV.skinsharp.com

(*.*)

%original file name%.exe_212_rwx_00401000_00218000:

t%SVh

t$(SSh

~%UVW

u$SShe

advapi32.dll

user32.dll

kernel32.dll

SetWindowsHookExA

UnhookWindowsHookEx

MsgWaitForMultipleObjects

hXXp://pl36074337.7958.com/down_8741880.html

cstrike-online.exe

115br.exe

safari.exe

firefox.exe

iexplore.exe

ttraveler.exe

chrome.exe

theworld.exe

saayaa.exe

360se.exe

opera.exe

enjoyie.exe

xbrowser.exe

Maxthon.exe

QQBrowser.exe

IEXPLORE.exe

IEXPLORE.EXE

Safari.exe

Firefox.exe

Iexplore.exe

hXXp://VVV.xxjjg.com/vip.html

\SkinH_EL.dll

.rsrc

`I.UP

%3XCO

7%sI11`Cr

`B$^.Vead

-T%fH&

KQo%uC>

.wlB`

4G.HHIs%'

w$8%x

HotKeyclRbSp

sh.sZr(!h

ized%uTy

0xX

N<%s>

zcÁ

&8.BtX

("%X!

?,/,;..,#

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

USER32.dll

SkinH_EL.dll

hXXp://VVV.jjfzg.com/jiajia.html

hXXp://VVV.jjfzg.com/xxzwg.html

?=42.51.7.143

hXXp://VVV.jjfzg.com/abc.txt

7.3.txt

hXXp://open.baidu.com/special/time/

window.baidu_time(

\hw.dll

\Bin\hw.dll

a3dapi.dll,binkw32.dll,Chall_Ambience.mp3,chn_counterstrikelogo.avi,chn_nexonvalve.avi,chn_segi.avi,client.dll,Core.dll,CSOBanner.exe,CSOLauncher.exe,CSO_Result.mp3,CSOnline.mp3,Chall_Ambience.mp3,Core.dll,BGM_start.mp3,hw.dll,FileSystem_Nar.dll,GameUI.dll,HS_Scenario_Ready.mp3,Mp3dec.asi,Mss32.dll,Mssv12.asi,Mssv29.asi,NMService.exe,cstrike-online.exe,ZB4_start.mp3,Scenario_Normal.mp3,Scenario_Ready.mp3,Scenario_Rush.mp3,Scenario_XMas.mp3,Sedata.dll,Steam.dll,SteamGameUpdater.dll,UpdateDLLWrapper.dll,DemoPlayer.dll,ZE_Ready.mp3,Zombi_Ambience.mp3,motd_temp.html,a3dapi.dll,binkw32.dll,chn_counterstrikelogo.avi,chn_nexonvalve.avi,chn_segi.avi,client.dll,dbg.dll,dbghelp.dll,fmod.dll,libcurl.dll,libeay32.dll,mp.dll,nmcogame.dll,nmconew.dll,particleman.dll,BGM_zombie_attack.mp3,Play_BGM_Rex.mp3,Scen_S4E2_attack.MP3,proxy.dll,ssleay32.dll,steam_api.dll,steamclient.dll,survey1109.dll,tier0.dll,tier0_s.dll,unicows.dll,vgui.dll,vgui2.dll,voice_miles.dll,voice_speex.dll,vstdlib.dll,vstdlib_s.dll,Scen_S4E2_loop.MP3,Scen_S4E2_start.MP3,Zsh_daybgm.mp3,ZE_Ambience.mp3,Zsh_nightbgm.mp3,Zsh_start.mp3,ehsvc.dll,3n.mhe,V3InetGS.dll,V3Hunt.dll,HSUpdate.exe,

HSUpdate.env,hslogmgr.exe,HSInst.dll,hshield.dat,bldinfo.ini,AhnUpGS.dll,AhnUpCtl.dll,ahnrpt.ini,ahnrpt.exe,asc_main.dll,brinicle.dll,hei.msd,autosave01.sav,autosave.sav,

.comp

aspinet.log

Error.log

hshield.log

HSUpChk.log

supdate.log

WScript.Shell

krnln.fnr

krnln.fne

hXXp://

USER32.DLL

GDI32.DLL

WINMM.DLL

WINSPOOL.DRV

ADVAPI32.DLL

SHELL32.DLL

OLE32.DLL

OLEAUT32.DLL

COMCTL32.DLL

WS2_32.DLL

COMDLG32.DLL

RegCloseKey

ShellExecuteA

.XM#U

|I%Dw

v%d=E

$q.Xa

I7%Cj

M?G%5U

.UP;E

x.VUe

%c;FH

bFSql

0Z.EIB

%cO/P

Xac?R.tZtD

.Uujb

Q7%Cz

#u.Ij

{<c.vI\

c<.Xs

%U*\)

2.ot 

5;@GQO%s

<`$.HB

r.qyw

|.Yhy

z.xWZ

)m.QsY!U

xgi_.zZ

{9*%x0

^m%cq

#$%cY

N.GN,

%U({}

o-6}[S

Fc.vG

1]D%X

&`.RJu

L.QJxU]`

.qu^<I

g.NmT_

\?.zdv

7XK.Wf

9dYe.QbzT

t.R%d

i".das

C.ZSjd[Q

.AV\<zR&A:

tX.Sli

.nWHS

Y<.vTG

;.ysN

$'.Kk

B.VuI

ZH%cP~

DiaoyongPanDuan^^$#\cstrike-online.exe

\CSOLauncher.exe

hXXp://VVV.2345.com/?k36074337\

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity name="E.App" processorArchitecture="x86" version="5.1.0.0" type="win32"/><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency></assembly>

RASAPI32.DLL

WININET.DLL

zG.Ngp/s

3W|U.hZ

O&)õ

%c#xN3s

BoK%u

L&M.wUE

%u]z>

L\.KT

7\%Uynxs

l2%%x@

h>6.YOU

g.My$

6f%fy

fo.Kk

.SLUD$

CBi.GNP

".qua

v%C_I

o'CM.gO

.GZS8

.nfx{J

:k.Wz

GV2iXH%d

r]%F)

}`ÄRe

], %u~qy

.Pu*]'

:VVV.jjfzg.com

hXXp://VVV.xxjjg.com/up.txt

F%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

CCmdTarget

ole32.dll

__MSVCRT_HEAP_SELECT

iphlpapi.dll

SHLWAPI.dll

MPR.dll

VERSION.dll

WSOCK32.dll

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

(%d-%d):

%ld%c

(*.htm;*.html)|*.htm;*.html

its:%s::%s

VVV.dywt.com.cn

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.0

%s <%s>

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

<Msg%s>%ld</Msg%s>

0000%d

</Msg0000>

<Msg0000>

EMSG

Recv Sub Packet(%s)..

Recv Packet (%s)...

.PAVCOleException@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

GetCPInfo

GetWindowsDirectoryA

WinExec

GetProcessHeap

RegOpenKeyExA

RegCreateKeyA

RegCreateKeyExA

GetViewportExtEx

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportOrgEx

GetKeyState

CreateDialogIndirectParamA

InternetCanonicalizeUrlA

InternetCrackUrlA

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

.text

`.rdata

@.data

VVV.skinsharp.com

0, 4, 1, 0

Copyright 2008-2080 VVV.skinsharp.com

(*.*)

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Favorites\Íâ¹Ò×÷·»¹Ù·½Õ¾ [www.zuowg.com].url (141 bytes)
   C:\SkinH_EL.dll (133 bytes)
   C:\%original file name%.exe (7972 bytes)
   %Documents and Settings%\%current user%\Favorites\Íâ¹Ò×÷·»×ÊÔ´Õ¾ [42724920.ys168.com].url (110 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.