Trojan.Win32.FlyStudio_4d2bd8792b

by malwarelabrobot on August 16th, 2015 in Malware Descriptions.

Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, GenericEmailWorm.YR, TrojanFlyStudio.YR (Lavasoft MAS)
Behaviour: Trojan-PSW, Trojan, Worm, EmailWorm


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 4d2bd8792bb1a4d9deda88d4274ddc88
SHA1: 3c69a2be5ecbf002b94729d90914a36fe9671e07
SHA256: 1424acf78aff67aec9e96a017ab65c93c337689437e9cbe2595dbe9cce919255
SSDeep: 24576:Pdr2WeEFKbc4IvrEEcBSbf3I/wW6i10TCS8PLeRB2YOzUyEGWAQ5nEZTZ1RzVKE1:PM57LeRkLVc2jPK9M9fwEBYZOqDIH
Size: 2818048 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2015-05-01 16:52:49
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Behaviour Description
EmailWorm Worm can send e-mails.


Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:348

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:348 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[1].js (8 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (451 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.xfluoke[1].xml (266 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].php (898 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\core[1].php (760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tghh[1].txt (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\21[1].gif (1 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (187 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bt[1].txt (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tj[1].htm (726 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\banben[1].txt (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\uctc64[1].txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\zuidibanben[1].txt (4 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (205 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[2].js (21 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (5012 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\wz64[1].txt (69 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[1].js (0 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.aaa[1].xml (0 bytes)

Registry activity

The process %original file name%.exe:348 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1024x768x32(BGR 0)" = "31,31,31,31"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CC 8F 01 C5 19 D9 54 C0 D1 EC F6 A4 49 63 D7 17"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: ????????
Product Name: ????????
Product Version: 9.8.0.1
Legal Copyright: ????????
??:www.luokexf.com
??:[email protected]
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 9.8.0.1
File Description: www.luokexf.com
Comments: www.luokexf.com
Language: Language Neutral

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 1675264 1675264 4.51404 42a638a1231f75fdc2ebbf13641d56fb
.rdata 1679360 964570 966656 4.27472 562ceb61e5a658233ce82a1cf3212a28
.data 2646016 333416 110592 3.80958 7a4af5380a97974862235e4cbdf8f654
.rsrc 2981888 61440 61440 4.21394 247373246633bbb5e4fe4f94ae4d4fe7

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://www.xfluoke.com/data/cs.txt 192.225.225.167
hxxp://www.xfluoke.com/data/tjrj/bt.txt 192.225.225.167
hxxp://www.xfluoke.com/data/tjrj/uctc64.txt 192.225.225.167
hxxp://www.xfluoke.com/data/tjrj/wz64.txt 192.225.225.167
hxxp://www.xfluoke.com/data/tjrj/tghh.txt 192.225.225.167
hxxp://www.xfluoke.com/data/tj.html?V9.8 192.225.225.167
hxxp://www.xfluoke.com/data/banben.txt 192.225.225.167
hxxp://www.xfluoke.com/data/zuidibanben.txt 192.225.225.167
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=4369261&web_id=4369261&show=pic1
hxxp://hm.e.shifen.com/h.js?4de4eadcf85ee6dc5ae83132e3429e3f
hxxp://hm.e.shifen.com/hm.gif?cc=1&ck=1&cl=32-bit&ds=1024x768&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=823678787&si=4de4eadcf85ee6dc5ae83132e3429e3f&st=1&v=1.1.2&lv=1
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=5931522
hxxp://static.n.shifen.com/hmt/icon/21.gif
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=5931522&t=z
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=574177603 42.120.219.171
hxxp://cnzz.mmstat.com/app.gif?&cna=lkxVDq3LIhwCAcLyYOPsHJRL 42.120.219.171
hxxp://hm.baidu.com/h.js?4de4eadcf85ee6dc5ae83132e3429e3f 220.181.7.190
hxxp://eiv.baidu.com/hmt/icon/21.gif 115.239.211.92
hxxp://s25.cnzz.com/stat.php?id=4369261&web_id=4369261&show=pic1 1.99.192.16
hxxp://s4.cnzz.com/stat.php?id=5931522 1.99.192.15
hxxp://c.cnzz.com/core.php?web_id=5931522&t=z 212.98.178.235
hxxp://pcookie.cnzz.com/app.gif?&cna=lkxVDq3LIhwCAcLyYOPsHJRL 42.120.219.171
hxxp://hm.baidu.com/hm.gif?cc=1&ck=1&cl=32-bit&ds=1024x768&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=823678787&si=4de4eadcf85ee6dc5ae83132e3429e3f&st=1&v=1.1.2&lv=1 220.181.7.190
17roco.qq.com
oz.cnzz.com


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Unsupported/Fake Windows NT Version 5.0

Traffic

GET /stat.php?id=4369261&web_id=4369261&show=pic1 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.xfluoke.com/data/tj.html?V9.8
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s25.cnzz.com
Connection: Keep-Alive


HTTP/1.1 503 Service Temporarily Unavailable
Server: Tengine
Content-Length: 0
Connection: keep-alive
Via: cache20.l2de1[0,503-0,M], cache5.l2de1[1224,0], cache7.by1[1326,503-0,M], cache6.by1[1320,1327,502001]
Age: 0
X-Cache: MISS TCP_MISS dirn:-2:-2
X-Swift-SaveTime: Fri, 14 Aug 2015 21:32:50 GMT
X-Swift-CacheTime: 1
...



GET /app.gif?&cna=lkxVDq3LIhwCAcLyYOPsHJRL HTTP/1.1
Accept: */*
Referer: hXXp://VVV.xfluoke.com/data/tj.html?V9.8
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: pcookie.cnzz.com


HTTP/1.1 200 OK
Server: Tengine
Date: Fri, 14 Aug 2015 21:33:14 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=lkxVDq3LIhwCAcLyYOPsHJRL; expires=Mon, 11-Aug-25 21:33:14 GMT; path=/; domain=.cnzz.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;..



GET /stat.php?id=5931522 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.xfluoke.com/data/tj.html?V9.8
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s4.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Date: Fri, 14 Aug 2015 21:33:05 GMT
Last-Modified: Fri, 14 Aug 2015 21:33:05 GMT
Cache-Control: max-age=5400,s-maxage=5400
Via: cache8.l2de1[679,200-0,M], cache52.l2de1[681,0], cache3.by1[809,200-0,M], cache4.by1[809,0]
X-Cache: MISS TCP_REFRESH_MISS dirn:11:822725449
X-Swift-SaveTime: Fri, 14 Aug 2015 21:33:05 GMT
X-Swift-CacheTime: 5400
1f77..(function(){function k(){this.c="5931522";this.R="z";this.N="";t
his.K="";this.M="";this.r="1439587985";this.P="oz.cnzz.com";this.L="";
this.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_C
V" this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.
la()}function g(a,b){try{var c=.[];c.push("siteid=5931522");c.push("na
me=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer))
;c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.user
Agent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.ra
ndom()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}
catch(d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURICom
ponent,n=unescape;k.prototype={la:function(){try{this.U(),this.J(),thi
s.ia(),this.H(),this.o(),this.ga(),.this.fa(),this.ja(),this.j(),this.
ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.pa(),e[thi
s.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},na:f
unction(){try{var a=this;e._czc={push:function(){return a.B.apply(a,ar
guments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=e._czc;
if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b 
 ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[object S
tring]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case "_setAu
toPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}}}catch
(d){g(d,"cS failed")}},pa:function(){try{if("undefined"===typeof e._cz
_account||e._cz_account===this.c){e._cz_account=this.c;if("[object
<<< skipped >>>


GET /hmt/icon/21.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.xfluoke.com/data/tj.html?V9.8
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: eiv.baidu.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=311040000
Content-Length: 1119
Content-Type: image/gif
Date: Fri, 14 Aug 2015 21:33:05 GMT
Etag: "762990053"
Expires: Sun, 22 Jun 2025 21:33:05 GMT
Last-Modified: Tue, 13 Apr 2010 09:38:40 GMT
Server: BWS/1.0
GIF89a........s..E.....M...................ZS.2-.YS.......2,.c[..D....
...0'..:..0.&..]Z..8..>..D.TM.................C................._..
^.....u..w........~........k.4......X..d.......=1.....a.c[.PH.h_.....b
..........PH........A..9....h`..J..1.......g`..W........2........z.#..
.p..m....jd........*.............[Q...........6..G..............6..t..
........... ..TL.....!....$....."..;0.....h.7-..............Z.........
....%..:.....H@....^W.QJ..'. !..........70.._. %.'...T.0'..Q.G?.ws....
-$........h.}w.....>...........L.....#.......:0.............\S.....
........*".....Q..............<..T.!...p.$...}........N..........d_
...........j.......VN.....o.....e........[............................
......................................................................
....................!.......,............u...,..>6.T.T..&T.".H. ...
.3^.PQ.G..:^..H.-.T....2#!........K..iP.&..03%X..x.P/^.$...`...G>Xd
....!..d.T...j.,..fQ..8l<..U%..G|.h.......$p..f......R..b.....*R@W"
2y..8..V3.LV`t.e..7.>.........\D..O.H.....$...^.]..).. ...9..E...d\
...V.U1..i......B]......c.P<0.i...v.]D..G .?p-.CD.Fi;>..v....r`.
.&........./.dp....`.....;HTTP/1.1 200 OK..Accept-Ranges: bytes..Cache
-Control: max-age=311040000..Content-Length: 1119..Content-Type: image
/gif..Date: Fri, 14 Aug 2015 21:33:05 GMT..Etag: "762990053"..Expires:
 Sun, 22 Jun 2025 21:33:05 GMT..Last-Modified: Tue, 13 Apr 2010 09:38:
40 GMT..Server: BWS/1.0..GIF89a........s..E.....M...................ZS
.2-.YS.......2,.c[..D.......0'..:..0.&..]Z..8..>..D.TM.........
<<< skipped >>>


GET /h.js?4de4eadcf85ee6dc5ae83132e3429e3f HTTP/1.1
Accept: */*
Referer: hXXp://VVV.xfluoke.com/data/tj.html?V9.8
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: hm.baidu.com
Connection: Keep-Alive
Cookie: HMACCOUNT=AD4692A2C64DD9D0


HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 8132
Content-Type: application/javascript
Date: Fri, 14 Aug 2015 21:32:59 GMT
Etag: 8b48cdb64fbfffc707d2e5f18c17239e
Server: apache
...............(function(){var h={},mt={},c={id:"4de4eadcf85ee6dc5ae83
132e3429e3f",dm:["luokexf.com"],js:"tongji.baidu.com/hm-web/js/",etrk:
[],icon:'/hmt/icon/21|gif|20|20',ctrk:false,align:-1,nv:-1,vdur:180000
0,age:31536000000,rec:0,rp:[],trust:0,vcard:0,qiao:0,lxb:0,conv:0,comm
:0,apps:''};.;kw..... h4 ..LI.....]....$.I..]Y..IHb..LR.]I.}g..%)...9.
.....=.f.Sc..v.../....a..rk..6....;.(..a^..k....X..r3..`..$...H.&"..Z.
%.,./c...w.y.~5.3_....^S...x...Q.Ut..U..&w..o{...,....Ec.!.b..........
T.....|.^wi......T..i.....$}!...iN..`2.UdA...oV&rg...<Hb.3...Z..\[X
.Z-.ubqg...`.N..D.t..n.6L....o..g. .M.......$.A< ..Z._t...8e..)N._9
..5.b......`.....7.?.i.OLZl...i.... ........HW...)...b..~n.......8..O.
......%....3..F...OG.[..V.......b...........>...^....j.....p.?.s.&g
t;.....t9.%[email protected].`lr ...<...S...................69...t.
.gn#*(...e.q.P..|j.....m....I7.r...U.>..C..}rx...I..$..........]i.J
......Xo...b ....p.&..q.....o.(\,...~.rZ*.d).3M.....I.c_.}..6a)..\....
..........D.P..8@.....>..,0.".(.1I..I.N..`........p...y!.....o...a"
...K.H#...}[email protected]....\....Z..Ha...S5,jK...6..[..q.R...qn.X.t...
(.Zn....S..;.d./Ua..}../.).l6., w..,.Am.d..v.)[email protected]..\..&g
t;.!|....J#.... <...}!.|.6- ...lw..W..O..@...?..~FK...Bh....U.{..i.
.md."[email protected] ..<.?|.(...!.....vO..{.QG...l..............Y......
r.....].../}...*/e..Zt....\.5..0.n.wA..k../...c.oC.-...8.x.-d..z......
.sm.V....u.OF.s.....f...l....fJ....]_.#........f..w..F.>#......1.".
.8.A....U.......i1n... .r...@......].B..\.a..q.$.<......_I`....
<<< skipped >>>

GET /hm.gif?cc=1&ck=1&cl=32-bit&ds=1024x768&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=823678787&si=4de4eadcf85ee6dc5ae83132e3429e3f&st=1&v=1.1.2&lv=1 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.xfluoke.com/data/tj.html?V9.8
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: hm.baidu.com
Connection: Keep-Alive
Cookie: HMACCOUNT=AD4692A2C64DD9D0


HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Fri, 14 Aug 2015 21:33:00 GMT
Pragma: no-cache
Server: apache
X-Content-Type-Options: nosniff
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Cache-Cont
rol: private, max-age=0, no-cache..Content-Length: 43..Content-Type: i
mage/gif..Date: Fri, 14 Aug 2015 21:33:00 GMT..Pragma: no-cache..Serve
r: apache..X-Content-Type-Options: nosniff..GIF89a.............!......
.,...........L..;..



GET /9.gif?abc=1&rnd=574177603 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.xfluoke.com/data/tj.html?V9.8
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cnzz.mmstat.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Server: Tengine
Date: Fri, 14 Aug 2015 21:33:10 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=lkxVDq3LIhwCAcLyYOPsHJRL; expires=Mon, 11-Aug-25 21:33:10 GMT; path=/; domain=.mmstat.com
Set-Cookie: sca=e5eda8bb; path=/; domain=.cnzz.mmstat.com
Set-Cookie: atpsida=6f4e345be57ddf80b14160e3_1439587990; expires=Mon, 11-Aug-25 21:33:10 GMT; path=/; domain=.cnzz.mmstat.com
Location: hXXp://pcookie.cnzz.com/app.gif?&cna=lkxVDq3LIhwCAcLyYOPsHJRL
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;..



GET /data/cs.txt HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: VVV.xfluoke.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Length: 1
Content-Type: text/plain
Last-Modified: Fri, 20 Jun 2014 18:23:20 GMT
Accept-Ranges: bytes
ETag: "6fa6a3b6b48ccf1:2970"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Fri, 14 Aug 2015 21:32:39 GMT
1....


GET /data/tjrj/bt.txt HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: hXXp://VVV.xfluoke.com/data/tjrj/bt.txt
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Host: VVV.xfluoke.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Length: 42
Content-Type: text/plain
Last-Modified: Tue, 15 Apr 2014 22:41:15 GMT
Accept-Ranges: bytes
ETag: "c39032cffb58cf1:2970"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Fri, 14 Aug 2015 21:32:39 GMT
....2345..........2345......(............)....


GET /data/tjrj/uctc64.txt HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: hXXp://VVV.xfluoke.com/data/tjrj/uctc64.txt
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Host: VVV.xfluoke.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Length: 1
Content-Type: text/plain
Last-Modified: Fri, 22 Aug 2014 20:04:39 GMT
Accept-Ranges: bytes
ETag: "a27cff4d44becf1:2970"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Fri, 14 Aug 2015 21:32:39 GMT
1....


GET /data/tjrj/wz64.txt HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: hXXp://VVV.xfluoke.com/data/tjrj/wz64.txt
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Host: VVV.xfluoke.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Length: 69
Content-Type: text/plain
Last-Modified: Fri, 15 Aug 2014 02:41:57 GMT
Accept-Ranges: bytes
ETag: "83be827b32b8cf1:2970"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Fri, 14 Aug 2015 21:32:39 GMT
|K|....UCBUG...... ........................|Z|hXXp://VVV.ucbug.com|W|<
/font>....


GET /data/tjrj/tghh.txt HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: hXXp://VVV.xfluoke.com/data/tjrj/tghh.txt
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Host: VVV.xfluoke.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Length: 1
Content-Type: text/plain
Last-Modified: Wed, 20 Aug 2014 01:15:18 GMT
Accept-Ranges: bytes
ETag: "3fa1df3414bccf1:2970"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Fri, 14 Aug 2015 21:32:39 GMT
0....


GET /data/tj.html?V9.8 HTTP/1.1


Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.xfluoke.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Length: 726
Content-Type: text/html
Last-Modified: Fri, 13 Jun 2014 21:45:01 GMT
Accept-Ranges: bytes
ETag: "86b972ba5087cf1:2970"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Fri, 14 Aug 2015 21:32:41 GMT
<script src="hXXp://s25.cnzz.com/stat.php?id=4369261&web_id=4369261
&show=pic1" language="JavaScript"></script>..<script type=
"text/javascript">..var _bdhmProtocol = (("https:" == document.loca
tion.protocol) ? " hXXps://" : " hXXp://");..document.write(unescape("
"));..</s
cript>..<script type="text/javascript">var cnzz_protocol = ((
"https:" == document.location.protocol) ? " hXXps://" : " hXXp://");do
cument.write(unescape("3E"));</script>.
...


GET /data/zuidibanben.txt HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: hXXp://VVV.xfluoke.com/data/zuidibanben.txt
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Host: VVV.xfluoke.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Length: 4
Content-Type: text/plain
Last-Modified: Sat, 25 Oct 2014 17:00:19 GMT
Accept-Ranges: bytes
ETag: "244c312875f0cf1:2970"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Fri, 14 Aug 2015 21:32:41 GMT
V2.9..



GET /core.php?web_id=5931522&t=z HTTP/1.1
Accept: */*
Referer: hXXp://VVV.xfluoke.com/data/tj.html?V9.8
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Content-Length: 760
Connection: keep-alive
Date: Fri, 14 Aug 2015 21:33:05 GMT
Last-Modified: Fri, 14 Aug 2015 21:33:05 GMT
Expires: Fri, 14 Aug 2015 21:48:05 GMT
Via: cache12.l2de1[324,200-0,M], cache61.l2de1[341,0], cache6.by1[395,200-0,M], cache3.by1[396,0]
X-Cache: MISS TCP_REFRESH_MISS dirn:3:687567441
X-Swift-SaveTime: Fri, 14 Aug 2015 21:33:06 GMT
X-Swift-CacheTime: 899
!function(){var p,q,r,a=encodeURIComponent,b="5931522",c="",d="",e="on
line_v3.php",f="z3.cnzz.com",g="1",h="text",i="z",j="站长&
#32479;计",k=window["_CNZZDbridge_" b]["bobject"],l="http:",m="0
",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f
),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k["
callRequest"]([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k["creat
eScriptIcon"](n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.p
hp?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.c
om/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'>
;<img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<
;a href='" q "' target=_blank title='" j "'>" j "</a>",k["cre
ateIcon"]([p])))}();..



GET /data/banben.txt HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: hXXp://VVV.xfluoke.com/data/banben.txt
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Host: VVV.xfluoke.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Length: 5
Content-Type: text/plain
Last-Modified: Fri, 14 Aug 2015 13:09:55 GMT
Accept-Ranges: bytes
ETag: "48f3b98392d6d01:2970"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Fri, 14 Aug 2015 21:32:41 GMT
V11.3..

The Trojan connects to the servers at the folowing location(s):

%original file name%.exe_348:

.text
.rdata
@.data
.rsrc
t$(SSh
~%UVW
u.hpzg
u$SShe
ws2_32.dll
wininet.dll
shell32.dll
kernel32.dll
shlwapi.dll
ntdll.dll
OLEACC.DLL
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
MsgWaitForMultipleObjects
ShellExecuteA
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindCloseUrlCache
EnumChildWindows
GetAsyncKeyState
{A068799B-7551-46b9-8CA8-EEF8357AFEA4}
00000000000
9527000000030004
hXXp://res.17roco.qq.com/res/
/scene.swf
hXXp://res.17roco.qq.com/res/scene/
hXXp://17roco.qq.com/cgi-bin/buy_items?id=
hXXp://web2.17roco.qq.com/fcgi-bin/login2
&skey=
&angel_key=
pskey=
z>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
http=
HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Content-Type: application/x-www-form-urlencoded
hXXp://
]]></msg>
<msg><![CDATA[
hXXp://17roco.qq.com/cgi-bin/lovely_ruila?cmd=1&uin=
9527000000120002
0000000000000033
9527000000120017
9527000000120406
9527000000120005
0000000000000034
9527000000120007
0000006600000000
9527000000032342
0000006700000000
9527000000032343
0000006800000000
0000006900000000
0000007000000000
0000007100000000
0000007200000000
0000007300000000
0000007400000000
0000007500000000
00000076000000020800
9527000000032340
00000031000000020800
9527000000032341
0000003200000000
9527000000032346
00000000000000020101
#hXXp://17roco.qq.com
hXXp://res.17roco.qq.com/swf/night.swf
hXXp://17roco.qq.com/cgi-bin/shadow?cmd=0&id=1
hXXp://17roco.qq.com/cgi-bin/shadow?cmd=2&id=
hXXp://17roco.qq.com/cgi-bin/shadow?cmd=3
hXXp://17roco.qq.com/cgi-bin/scene_game_award?id=109&condition=1&type=1
0000003900000000
9527000000032191
9527000000032287
hXXp://17roco.qq.com/cgi-bin/vipweeklyaward?cmd=1
hXXp://17roco.qq.com/cgi-bin/vip_gift_of_month?cmd=0
hXXp://17roco.qq.com/cgi-bin/vip_gift_of_month?cmd=1
0000003000000000
hXXp://17roco.qq.com/cgi-bin/mining?cmd=2&type=
hXXp://17roco.qq.com/cgi-bin/hitmonster?cmd=0
hXXp://17roco.qq.com/cgi-bin/hitmonster?cmd=1
hXXp://17roco.qq.com/cgi-bin/scene_game_award?id=
hXXp://17roco.qq.com/cgi-bin/career_work?cmd=1&type=
hXXp://17roco.qq.com/cgi-bin/weektaskwork?cmd=1&type=14
hXXp://17roco.qq.com/cgi-bin/experience_tree?cmd=2
hXXp://17roco.qq.com/cgi-bin/experience_tree?cmd=3
9527000000120404
hXXp://17roco.qq.com/cgi-bin/pet_training?cmd=2&type=
9527000000170004
00000034000000020801
00000034000000020800
9527000000170005
00000036000000020801
00000038000000020802
0000000000000000
9527000000120022
hXXp://17roco.qq.com/cgi-bin/scene_game_award?id=133&condition=1&type=1
hXXp://17roco.qq.com/cgi-bin/scene_game_award?id=134&condition=1&type=1
hXXp://17roco.qq.com/cgi-bin/samul_belt?cmd=2
hXXp://17roco.qq.com/cgi-bin/new_shoot_machine?cmd=1
hXXp://17roco.qq.com/cgi-bin/weektaskwork?cmd=3&type=86&step=0
hXXp://17roco.qq.com/cgi-bin/weektaskwork?cmd=3&type=86&step=1
hXXp://17roco.qq.com/cgi-bin/career_get?cmd=0
hXXp://17roco.qq.com/cgi-bin/career_get?cmd=1
hXXp://17roco.qq.com/cgi-bin/newhorizons?cmd=4
hXXp://17roco.qq.com/cgi-bin/newhorizons?cmd=2&ship=4
hXXp://17roco.qq.com/cgi-bin/newhorizons?cmd=3&ship=4&address=8
hXXp://17roco.qq.com/cgi-bin/roco_shortcut_fourth?cmd=1
hXXp://17roco.qq.com/cgi-bin/week_reward_3366?cmd=1&blue=1
hXXp://17roco.qq.com/cgi-bin/week_reward_3366?cmd=1&blue=0
hXXp://17roco.qq.com/cgi-bin/freedom_gift?cmd=1&src=0
hXXp://17roco.qq.com/cgi-bin/freedom_gift?cmd=1&src=1
0000002400000000
9527000000032231
hXXp://17roco.qq.com/cgi-bin/challenge_lewei?cmd=0
hXXp://17roco.qq.com/cgi-bin/daily_sales?cmd=1&item=50397209&num=2
00000000000000040000
9527000000030025
hXXp://17roco.qq.com/cgi-bin/lulumagiclampgame?cmd=0
hXXp://17roco.qq.com/cgi-bin/angel_stat?cmd=1&id=67
hXXp://17roco.qq.com/cgi-bin/lulumagiclampgame?cmd=1&score=1900
hXXp://17roco.qq.com/cgi-bin/normaldigtreasure?cmd=0
hXXp://17roco.qq.com/cgi-bin/normaldigtreasure?cmd=1&gamestr=
hXXp://17roco.qq.com/cgi-bin/digtreasuregeneral?cmd=0&type=1
hXXp://17roco.qq.com/cgi-bin/digtreasuregeneral?cmd=1&type=1&str=
hXXp://17roco.qq.com/cgi-bin/treasure_hunter?cmd=1
hXXp://17roco.qq.com/cgi-bin/treasure_hunter?cmd=3
hXXp://17roco.qq.com/cgi-bin/treasure_hunter?cmd=5&id=
hXXp://17roco.qq.com/
hXXp://17roco.qq.com/login.html
9527000000030005
hXXp://res.17roco.qq.com/res/item/
VVV.luokeby.com
hXXp://VVV.ucbug.com/
VVV.luokeby.com
hXXp://VVV.2345.com/?11054
data/tjrj/dz.txt
000000000000000907
02000000000001
00000000000000020201
000000000000000902
00000000000000010
9527000000030040
hXXp://17roco.qq.com/cgi-bin/hurdle_game_award?id=
@hXXp://17roco.qq.com/cgi-bin/god_of_cookery?cmd=2&win=0&score=5000&rabit=0
17170444
hXXp://17roco.qq.com/cgi-bin/reclaim_goods?cmd=0&type=1
hXXp://17roco.qq.com/cgi-bin/reclaim_goods?cmd=1&type=1&goodsid=16842756&goodsnum=
hXXp://17roco.qq.com/cgi-bin/buy_items?id=67305489&num=1&ran=0
hXXp://17roco.qq.com/cgi-bin/compound_game_award?gameId=4000&cmd=2&id=2
hXXp://17roco.qq.com/cgi-bin/reclaim_goods?cmd=1&type=2&goodsid=33751051&goodsnum=1
hXXp://17roco.qq.com/cgi-bin/run_cow?cmd=1&unkown=
hXXp://17roco.qq.com/cgi-bin/run_cow?cmd=2&game_time=15&unkown=
hXXp://17roco.qq.com/cgi-bin/run_cow?cmd=3&unkown=
9527000000030009
[email protected]
G|Z%d
user32.dll
GetKeyboardType,MessageBoxA,CharNextA
advapi32.dll
RegQueryValueExA,RegOpenKeyExA,RegCloseKey
hXXp://17roco.qq.com/cgi-bin/hero_treasure?cmd=0
hXXp://17roco.qq.com/cgi-bin/hero_treasure?cmd=2
[email protected]
00000000000000020
&time=&cmd=1&skey=
hXXp://17roco.qq.com/cgi-bin/go_super_man?skey=&angel_uin=
&time=&cmd=2&skey=
000000000000
9527000000030010
hXXp://17roco.qq.com/cgi-bin/run_baby?cmd=2&flag=3&unkown=
hXXp://17roco.qq.com/cgi-bin/run_baby?cmd=3&unkown=
0000002600000004
9527000000030015
hXXp://VVV.baidu.com/s?wd=flash
00000000000000050
9527000000030029
VVV.luokexf.com
hXXp://17roco.qq.com/cgi-bin/star_guide?cmd=2&step=
hXXp://17roco.qq.com/cgi-bin/buy_items?id=100728839&num=
9527000000120004
0000000000000001
9527000000120006
hXXp://17roco.qq.com/cgi-bin/digtreasure?cmd=1&gamestr=
hXXp://17roco.qq.com/cgi-bin/digtreasureinmine?cmd=1&gamestr=
hXXp://17roco.qq.com/cgi-bin/digtreasure?cmd=0
hXXp://17roco.qq.com/cgi-bin/digtreasureinmine?cmd=0
000000000000000901
(*.txt)|*.txt|
(*.*)|*.*
).txt
00000000000000090
0000000000000006010
0000000
0000000000000006020
hXXp://17roco.qq.com/cgi-bin/crazy_sale?cmd=1
hXXp://17roco.qq.com/cgi-bin/crazy_sale?cmd=3&npc=
hXXp://17roco.qq.com/cgi-bin/crazy_sale?cmd=4&npc=
0000000000000010
9527000000030018
hXXp://17roco.qq.com/cgi-bin/login
hXXp://17roco.qq.com/default.html
WS2_32.DLL
9527000100070001
9527000000030001
luokexf.com
luokexf.com
GET /cgi-bin/reclaim_goods?cmd=1&
222.73.78.102
angel_key=
0000000000000044
9527000000070003
00000000000000
0000000000000002
9527000000030003
-.png
hXXp://res.17roco.qq.com/res/combat/icons/
00000069
00100001
9527000000030041
09000000000000010000
09000000000000001388
9527000000030011
8@030015
00000026000000
0000000000000017
0000000000000027
00030003
hXXp://17roco.qq.com/cgi-bin/discovery?cmd=1&page=
(1,3,1000)
[email protected]
hXXp://17roco.qq.com/cgi-bin/hurdle_game_award?id=2087&score=9000&type=2
hXXp://17roco.qq.com/cgi-bin/roco_legends?cmd=1&chapter=
hXXp://17roco.qq.com/cgi-bin/heaven_treasure?cmd=1&unkown=
) 9.VIP
?cmd=0&index=
hXXp://17roco.qq.com/cgi-bin/spirit_evo_
?cmd=1&index=
?cmd=2&index=
:VVV.luokexf.com
k%UPp
fg.VG
%C',@
>Ùd
FpUdP
:t6.dB
s.ftlZ 
Y.dlh
oLQP.xL
0244>" `
%U{&X
ComboLBox%SHE_
otkeyScrol;r[MDIClil
#3276870
l5k%x-l h
9p%s m)t4`#
&y1`Ð<
f`c%US.
KERNEL32.DLL
COMCTL32.dll
GDI32.dll
MSIMG32.dll
MSVCRT.dll
MSVFW32.dll
USER32.dll
SkinH_EL.dll
9527000000032282
0000003700000003
9527000000032283
0000002100000002
0000002200000000
0000002300000000
9527000000032281
hXXp://VVV.xfluoke.com/
data/cs.txt
hXXp://VVV.17luoke.com/
hXXp://VVV.luokexf.com/
data/tjrj/bt.txt
data/tjrj/uctc64.txt
data/tjrj/wz64.txt
data/tjrj/tghh.txt
data/tj.html?V
data/banben.txt
data/zuidibanben.txt
VVV.luokexf.com
data/bossyc.txt
data/llzyc.txt
data/gonggao/gglx.txt
data/gonggao/tcgg.txt
data/gonggao/wbgg.txt
! VVV.luokexf.com
data/gonggao/wygg.html
data/tjrj/bytsn.txt
VVV.luokexf.com
data/gengxinneirong.txt
data/zidonggengxin.txt
data/bdwjm.txt
hXXp://VVV.luokeby.com/
data/rj/banben.txt
data/rj/gxnr.txt
data/rj/zdgx.txt
00000087000000020801
9527000000032263
9527000000032264
0000003300000000
9527000000032268
0000003400000000
00000087000000020802
0000005600000005
0000003800000000
00000039000000020803
00000000000000020400
9527000000030023
9527000000032288
hXXp://17roco.qq.com/cgi-bin/dungeon?cmd=0
hXXp://17roco.qq.com/cgi-bin/dungeon?cmd=1
0000008600000000
00000000000000090200
hXXp://17roco.qq.com/cgi-bin/angel_befall?cmd=1&index=
hXXp://17roco.qq.com/cgi-bin/buy_items?id=67371070&num=1&ran=
hXXp://17roco.qq.com/cgi-bin/assemble_robot?cmd=0
hXXp://17roco.qq.com/cgi-bin/assemble_robot?cmd=1
hXXp://17roco.qq.com/cgi-bin/buy_items?id=67371073&num=1&ran=
hXXp://17roco.qq.com/cgi-bin/general_assemble?cmd=0&game=2085
hXXp://17roco.qq.com/cgi-bin/general_assemble?cmd=1&game=2085
hXXp://17roco.qq.com/cgi-bin/buy_items?id=67371096&num=1&ran=
hXXp://17roco.qq.com/cgi-bin/general_assemble?cmd=0&game=2110
hXXp://17roco.qq.com/cgi-bin/general_assemble?cmd=1&game=2110
hXXp://17roco.qq.com/cgi-bin/general_assemble?cmd=1&game=2116
data/zdgxMD5.txt
hXXp://VVV.luokeby.com/data/rj/md5.txt
VVV.xfluoke.com
[email protected]
hXXp://17roco.qq.com/cgi-bin/reclaim_goods?cmd=1&type=
0000006200000002
hXXp://res.17roco.qq.com/res/game/2051/game.swf
hXXp://17roco.qq.com/cgi-bin/weekend_exp?cmd=1&unkown=
hXXp://17roco.qq.com/cgi-bin/weekend_exp?cmd=2&exp=40000&diamondnum=0&unkown=
/game.swf
hXXp://res.17roco.qq.com/res/game/
VVV.luokeby.com
data/tikubanben.txt
data/tikugengxinneirong.txt
data/tikugengxindizhi.txt
hXXp://17roco.qq.com/cgi-bin/buy_items?id=67305517&num=1&ran=0
hXXp://17roco.qq.com/cgi-bin/alchemy?cmd=1&id=3&id0=67305517&count0=1&id1=67239970&count1=1&id2=67239975&count2=1
hXXp://17roco.qq.com/cgi-bin/alchemy?cmd=1&id=3&id0=67305517&count0=1&id1=67239960&count1=1&id2=67239974&count2=1
hXXp://17roco.qq.com/cgi-bin/alchemy?cmd=1&id=3&id0=67305517&count0=1&id1=67239962&count1=1&id2=67239970&count2=1
9527000000030033
hXXp://17roco.qq.com/creat.html
hXXp://17roco.qq.com/cgi-bin/monkeyalchemy?cmd=3&id=
hXXp://17roco.qq.com/cgi-bin/monkeyalchemy?cmd=9&id=
hXXp://17roco.qq.com/cgi-bin/monkeyalchemy?cmd=4&id=
hXXp://17roco.qq.com/cgi-bin/monkeyalchemy?cmd=10&id=
hXXp://17roco.qq.com/cgi-bin/ivincibel_boxer?cmd=3&level=
hXXp://17roco.qq.com/cgi-bin/gongfu_rabbit?cmd=7&skillId=
hXXp://17roco.qq.com/cgi-bin/gongfu_rabbit?cmd=8&skillId=
00000033000000020821
00000027000000020820
00000026000000021025
00000029000000021025
00000026000000021022
00000030000000021022
00000029000000020819
00000042000000020817
00000031000000021019
00000039000000021019
00000029000000020816
00000025000000020815
00000023000000021015
00000033000000020814
00000022000000021014
00000032000000021014
00000026000000020813
00000035000000020812
00000045000000020811
00000020000000020810
00000024000000021009
00000054000000021008
00000053000000021007
00000053000000021006
00000062000000021006
00000034000000021002
00000047000000021000
00000023000000020807
(642,538) 
(565,442) 
(454,66) 
0000013300000000
9527000000032409
0000013400000000
0000013500000000
9527000000032408
0000013600000000
hXXp://17roco.qq.com/cgi-bin/roco_diamond_5_1?cmd=0&unkown=
hXXp://17roco.qq.com/cgi-bin/roco_diamond_5_1?cmd=1&unkown=
hXXp://17roco.qq.com/cgi-bin/roco_diamond_5_1?cmd=2&which_one=
00000035000000020049
hXXp://17roco.qq.com/cgi-bin/hurdle_game_award?id=2001&score=4000&type=2
hXXp://17roco.qq.com/cgi-bin/scene_game_award?id=55&condition=1&type=1
hXXp://bangbang.qq.com/php/login?game=
luokexf.com(
[email protected]
.exe|.rar|.zip|.gif|.jpg|.mp3|.rm
V9.8 VVV.luokexf.com
[email protected]
Adobe Photoshop CS Windows
2014:05:31 01:19:52
urlTEXT
MsgeTEXT
4hXXp://ns.adobe.com/xap/1.0/
<rdf:RDF xmlns:rdf='hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#' xmlns:iX='hXXp://ns.adobe.com/iX/1.0/'>
<rdf:Description rdf:about='uuid:62daa5f3-e81e-11e3-9f80-e32458687af0'
xmlns:exif='hXXp://ns.adobe.com/exif/1.0/'>
xmlns:pdf='hXXp://ns.adobe.com/pdf/1.3/'>
xmlns:photoshop='hXXp://ns.adobe.com/photoshop/1.0/'>
xmlns:tiff='hXXp://ns.adobe.com/tiff/1.0/'>
xmlns:xap='hXXp://ns.adobe.com/xap/1.0/'>
<xap:CreatorTool>Adobe Photoshop CS Windows</xap:CreatorTool>
xmlns:stRef='hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#'
xmlns:xapMM='hXXp://ns.adobe.com/xap/1.0/mm/'>
<stRef:instanceID>uuid:62daa5ef-e81e-11e3-9f80-e32458687af0</stRef:instanceID>
<stRef:documentID>adobe:docid:photoshop:62daa5ee-e81e-11e3-9f80-e32458687af0</stRef:documentID>
<xapMM:DocumentID>adobe:docid:photoshop:62daa5f2-e81e-11e3-9f80-e32458687af0</xapMM:DocumentID>
xmlns:dc='hXXp://purl.org/dc/elements/1.1/'>
IEC hXXp://VVV.iec.ch
.IEC 61966-2.1 Default RGB colour space - sRGB
CRT curv
s%5xH_
g.mk^Y2.
.rlE2
s.TkY
7.cS[
lT.uj
a6.jB
)_.Ps
A.sW8
ui%c(M
}GH.lnZ
,(.ob
AQ.ASk
c3A.DL
I.of]
u.wwD
4v%Su
[email protected]
23:00-6:00
:100794372
1(12000)
:17039362
00000000
hXXp://17roco.qq.com/login.htmls
ûZQ&
hXXp://VVV.xfluoke.com/webhtm/zdsc.htm
hXXp://bangbang.qq.com/php/login?game=roco&H#
123 / 999
>0123456789ABCDEF deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
F%*.*f
CNotSupportedException
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
COMCTL32.DLL
CCmdTarget
ole32.dll
__MSVCRT_HEAP_SELECT
RASAPI32.dll
GetProcessHeap
WinExec
KERNEL32.dll
GetKeyState
RegisterHotKey
UnregisterHotKey
ExitWindowsEx
GetViewportOrgEx
WINMM.dll
WINSPOOL.DRV
RegCloseKey
RegOpenKeyExA
RegCreateKeyA
ADVAPI32.dll
SHELL32.dll
OLEAUT32.dll
oledlg.dll
WS2_32.dll
InternetCrackUrlA
InternetCanonicalizeUrlA
WININET.dll
GetCPInfo
CreateDialogIndirectParamA
UnhookWindowsHookEx
SetWindowsHookExA
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
comdlg32.dll
RegCreateKeyExA
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.*)|*.*||
Shell32.dll
Mpr.dll
Advapi32.dll
User32.dll
Gdi32.dll
Kernel32.dll
(&07-034/)7 '
?? / %d]
%d / %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
%s:%d
windows
out.prn
%d.%d
%d / %d
%d/%d
Bogus message code %d
(%d-%d):
%ld%c
(*.htm;*.html)|*.htm;*.html
1.0.6
\shell32.dll
%d%d%d
rundll32.exe shell32.dll,
[%s:%d]
Range: bytes=%s-
[%s:%d]
PASS %s
PASS ******
USER %s
E:\dev\e\static_link\static_libs\source\downlib\mystrlib.cpp
SIZE %s
PORT
User-Agent: %s
Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)
Referer: %s
Host: %s
GET %s HTTP/1.1
HTTP/1.0
Cookie: %s
%d, %s
\\192.168.0.129\TCP\1037
NSPlayer/9.0.0.2980; {%s}; Host: %s
rmff_fix_header: assuming data.size=%i
rmff_fix_header: assuming data.num_packets=%i
rmff_fix_header: assuming prop.num_packets=%i
rmff_fix_header: setting prop.data_offset from %i to %i
rmff_fix_header: correcting prop.num_streams from %i to %i
rmff_fix_header: correcting prop.size from %i to %i
%s %s %s
Session: %s
Cseq: %u
%*s %s
%*s %u
CSeq: %u
rtsp://%s:%i
rtsp://%s:%i/%s
ClientID: Linux_2.4_6.0.9.1235_play32_RN01_EN_586
GUID: 00000000-0000-0000-0000-000000000000
[%s:%d]
User-Agent: RealMedia Player Version 6.0.9.1235 (linux-2.0-libc6-i386-gcc2.95)
Range: npt=%s-
%s/streamid=1
%s/streamid=0
Transport: x-pn-tng/tcp;mode=play,rtp/avp/tcp;unicast;mode=play
If-Match: %s
RealChallenge2: %s, sd=%s
Title: %s
Copyright: %s
Author: %s
real: Content-length for description too big (> %uMB)!
Require: com.real.retain-entity-for-setup
SupportsMaximumASMBandwidth: 1
Bandwidth: %u
Challenge1: %s
hash output: %x %x %x %x
hash input: %x %x %x %x
stream=%u;rule=%u,
Illegal character '%c' in input.
1.1.3
;3 #>6.&
'2, / 0&7!4-)1#
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
%s <%s>
Reply-To: %s
From: %s
To: %s
Subject: %s
Date: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
SMTP
Corrupt JPEG data: found marker 0xx instead of RST%d
Warning: unknown JFIF revision number %d.d
Corrupt JPEG data: %u extraneous bytes before marker 0xx
Inconsistent progression sequence for component %d coefficient %d
Unknown Adobe color transform code %d
Obtained XMS handle %u
Freed XMS handle %u
Unrecognized component IDs %d %d %d, assuming YCbCr
JFIF extension marker: RGB thumbnail image, length %u
JFIF extension marker: palette thumbnail image, length %u
JFIF extension marker: JPEG-compressed thumbnail image, length %u
Opened temporary file %s
Closed temporary file %s
Ss=%d, Se=%d, Ah=%d, Al=%d
Component %d: dc=%d ac=%d
Start Of Scan: %d components
Component %d: %dhx%dv q=%d
Start Of Frame 0xx: width=%u, height=%u, components=%d
Smoothing not supported with nonstandard sampling ratios
RST%d
At marker 0xx, recovery action %d
Selected %d colors for quantization
Quantizing to %d colors
Quantizing to %d = %d*%d*%d colors
%4u %4u %4u %4u %4u %4u %4u %4u
Unexpected marker 0xx
Miscellaneous marker 0xx, length %u
with %d x %d thumbnail image
JFIF extension marker: type 0xx, length %u
Warning: thumbnail image size does not match data length %u
JFIF APP0 marker: version %d.d, density %dx%d %d
= = = = = = = =
Obtained EMS handle %u
Freed EMS handle %u
Define Restart Interval %u
Define Quantization Table %d precision %d
Define Huffman Table 0xx
Define Arithmetic Table 0xx: 0xx
Unknown APP14 marker (not Adobe), length %u
Unknown APP0 marker (not JFIF), length %u
Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d
Unsupported marker type 0xx
Failed to create temporary file %s
Unsupported JPEG process: SOF type 0xx
Cannot quantize to more than %d colors
Cannot quantize to fewer than %d colors
Cannot quantize more than %d color components
Insufficient memory (case %d)
Not a JPEG file: starts with 0xx 0xx
Quantization table 0xx was not defined
Huffman table 0xx was not defined
Backing store not supported
Arithmetic table 0xx was not defined
Cannot transcode due to multiple use of quantization table %d
Maximum supported image dimension is %u pixels
Empty JPEG image (DNL not supported)
Bogus DQT index %d
Bogus DHT index %d
Bogus DAC value 0x%x
Bogus DAC index %d
Unsupported color conversion request
Too many color components: %d, max %d
Buffer passed to JPEG library is too small
JPEG parameter struct mismatch: library thinks size is %u, caller expects %u
Improper call to JPEG library in state %d
Invalid scan script at entry %d
Invalid progressive parameters at scan script entry %d
Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d
Unsupported JPEG data precision %d
Invalid memory pool code %d
Wrong JPEG library version: library is %d, caller expects %d
Component index %d: mismatching sampling ratio %d:%d, %d:%d, %c
DCT scaled block size %dx%d not supported
Invalid component ID %d in SOS
NULL row buffer for row %ld, pass %d
libpng error: %s
libpng warning: %s
Unknown zTXt compression type %d
gamma = (%d/100000)
gx=%f, gy=%f, bx=%f, by=%f
wx=%f, wy=%f, rx=%f, ry=%f
incorrect gamma=(%d/100000)
%s: Cannot open
%s: Write error at scanline %lu
%s: Seek error at scanline %lu
%u: Sample out of range, max %u
%s: Cannot modify tag "%s" while writing
%s: Unknown %stag %u
%f: Bad value for "%s"
%s: Invalid %stag "%s" (not supported by codec)
TIFFVSetField ... pass by value not imp.
%ld: Bad value for "%s"
%d: Bad value for "%s"
Nonstandard tile length %d, convert file
Nonstandard tile width %d, convert file
Bad value %ld for "%s" tag ignored
%s: Invalid InkNames value; expecting %d names, found %d
TIFFVGetField ... pass by value not imp.
Sorry, can not handle images with %d-bit samples
Sorry, can not handle LogLuv images with %s=%d
Sorry, LogLuv data must have %s=%d or %d
Sorry, can not handle image with %s=%d
Sorry, LogL data must have %s=%d
Sorry, can not handle separated image with %s=%d
Sorry, can not handle RGB image with %s=%d
Sorry, can not handle YCbCr images with %s=%d
Sorry, can not handle contiguous data with %s=%d, and %s=%d and Bits/Sample=%d
Missing needed %s tag
Sorry, can not image with %d-bit samples
"%s": Bad mode
Not a TIFF file, bad version number %d (0x%x)
Not a TIFF file, bad magic number %d (0x%x)
%s: Out of memory (TIFF structure)
Sample %d out of range, max %u
Internal error, unknown tag 0x%x
Tag %d
%s: Read error at scanline %lu, strip %lu; got %lu bytes, expected %lu
%s: Read error at scanline %lu; got %lu bytes, expected %lu
%s: Seek error at scanline %lu, strip %lu
%s: Data buffer too small to hold strip %lu
%s: Read error on strip %lu; got %lu bytes, expected %lu
%s: Read error at row %ld, col %ld, tile %ld; got %lu bytes, expected %lu
%s: Read error at row %ld, col %ld; got %lu bytes, expected %lu
%s: Seek error at row %ld, col %ld, tile %ld
%s: Data buffer too small to hold tile %ld
%s: No space for data buffer at scanline %ld
Compression scheme %u %s encoding is not implemented
%s %s encoding is not implemented
%s %s encoding is no longer implemented due to Unisys patent enforcement
Compression scheme %u %s decoding is not implemented
%s %s decoding is not implemented
Compression algorithm does not support random access
Bogus "%s" field, ignoring and calculating from imagelength
TIFF directory is missing required "%s" field, calculating from imagelength
wrong data type %d for "%s"; tag ignored
unknown field with tag %d (0x%x) encountered
No space %s
TIFF directory is missing required "%s" field
incorrect count for field "%s" (%lu, expecting %lu); tag ignored
Error fetching data for field "%s"
%s: Rational with zero denominator (num = %lu)
Cannot handle different per-sample values for field "%s"
cannot read TIFF_ANY type %d for field "%s"
"%s": Information lost writing value (%g) as (unsigned) RATIONAL
Error writing data for field "%s"
%s: Error writing SubIFD directory link
%s compression support is not configured
?%s: No space for LogLuv state block
Inappropriate photometric interpretation %d for SGILog compression; %s
LogL16Decode: Not enough data at row %d (short %d pixels)
LogLuvDecode24: Not enough data at row %d (short %d pixels)
LogLuvDecode32: Not enough data at row %d (short %d pixels)
%s: No space for SGILog translation buffer
No support for converting user data format to LogL
No support for converting user data format to LogLuv
SGILog compression supported only for %s, or raw data
Unknown data format %d for LogLuv compression
Unknown encoding %d for LogLuv compression
%s: No space for state block
%s: Bad code word at scanline %d (x %lu)
%s: %s at scanline %d (got %lu, expected %lu)
%s: Premature EOF at scanline %d (x %lu)
%s: No space for Group 3/4 reference line
%s: No space for Group 3/4 run arrays
%s: Uncompressed data (not supported) at scanline %d (x %lu)
Fax SubAddress: %s
(%u = 0x%x)
%suncompressed data
%sEOL padding
%s2-d encoding
Improper JPEG sampling factors %d,%d
Apparently should be %d,%d,decompressor will try reading with sampling %d,%d
Improper JPEG strip/tile size, expected %dx%d, got %dx%d
RowsPerStrip must be multiple of %d for JPEG
JPEG tile width must be multiple of %d
JPEG tile height must be multiple of %d
BitsPerSample %d not allowed for JPEG
PhotometricInterpretation %d not allowed for JPEG
ThunderDecode: %s data at scanline %ld (%lu != %lu)
PackBitsDecode: discarding %d bytes to avoid buffer overrun
LZWDecode: Not enough data at scanline %d (short %d bytes)
LZWDecode: Strip %d not terminated with EOI code
LZWDecode: Bogus encoding, loop in the code table; scanline %d
LZWDecodeCompat: Not enough data at scanline %d (short %d bytes)
DumpModeDecode: Not enough data for scanline %d
Horizontal differencing "Predictor" not supported with %d-bit samples
"Predictor" value %d not supported
%u (0x%x)
.PAVCOleException@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCOleDispatchException@@
.PAVCArchiveException@@
zcÁ
xfluoke.com
|Z|hXXp://VVV.ucbug.com|W|
c:\%original file name%.exe
#include "l.chs\afxres.rc" // Standard components
_^$###!$'
.Zfggfghfg_!!!$UX_]0
123456789
1, 0, 6, 6
(*.*)
9.8.0.1
:[email protected]

%original file name%.exe_348_rwx_010A0000_0003D000:

`.rsrc
L$(h%f
SSh0j
msctls_hotkey32
TVCLHotKey
THotKey
\skinh.she
}uo,x6l5k%x-l h
9p%s m)t4`#b
e"m?c&y1`Ð<
SetViewportOrgEx
SetViewportExtEx
SetWindowsHookExA
UnhookWindowsHookEx
EnumThreadWindows
EnumChildWindows
`c%US.4/
!#$<#$#=
.text
`.rdata
@.data
.rsrc
@.UPX0
`.UPX1
`.reloc
f`c%US.
KERNEL32.DLL
COMCTL32.dll
GDI32.dll
MSIMG32.dll
MSVCRT.dll
MSVFW32.dll
USER32.dll
SkinH_EL.dll
1, 0, 6, 6


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[1].js (8 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (451 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\UserData\2Z89WTQV\www.xfluoke[1].xml (266 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].php (898 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\core[1].php (760 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tghh[1].txt (1 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (165 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\21[1].gif (1 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (187 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bt[1].txt (42 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tj[1].htm (726 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (170 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\banben[1].txt (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\uctc64[1].txt (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\zuidibanben[1].txt (4 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (205 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[2].js (21 bytes)
    %Documents and Settings%\%current user%\Cookies\index.dat (5012 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\wz64[1].txt (69 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

  4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  5. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now