Trojan.Win32.FlyStudio_a7b84d2f32

by malwarelabrobot on May 24th, 2014 in Malware Descriptions.

Gen:Heur.PWSIME.2 (B) (Emsisoft), Gen:Heur.PWSIME.2 (AdAware), GenericEmailWorm.YR, TrojanFlyStudio.YR (Lavasoft MAS)
Behaviour: Trojan, Worm, EmailWorm


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: a7b84d2f327af8ad33412beaeda61c16
SHA1: f3a5b0414eb35f0453fd2089ee945ac604d23134
SHA256: 1643fc40d180d079df992e6a67d50bb3e1860a6876cac6ba8b441bfbef35ab7f
SSDeep: 12288:Vyzq6/u4z0DwKCxrCkGxUWxrVvLSnIscv:VyvpOwKCxrCkqUWxrViI/
Size: 496351 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MEW11SEv12, MEW11SEv11, UPolyXv05_v6, Mew11SEv12Eng
Company: no certificate found
Created at: 1970-01-01 03:00:00
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Behaviour Description
EmailWorm Worm can send e-mails.


Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:1564

File activity

The process %original file name%.exe:1564 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pixel[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\AClick[1].aspx (372 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\eca1e2f901a17103ab05f7b46c358f6e[1].jpg (5889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bd5463690a93c57a1039c47e11ab0f97[1].jpg (5512 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\22759138[1].htm (1305 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\level_MIN_12.02[1].css (387 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\AClick[2].aspx (372 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[2].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo[2].jpg (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA5K8Z5X.htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\AClick[1].aspx (372 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\button_old_170[1].gif (749 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1013v1395126094590286213[1].jpg (532 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\6[1] (24397 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CA1QKA6Z.htm (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\22759138[1] (4450 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\spacegif[1].gif (60 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\2013.11.261[1].gif (6852 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pic1[1].gif (428 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jump[2].htm (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\level_MIN_12.02[1].css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jump[1].html (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\core[1].php (802 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1013v1399877732267347087[1].jpg (3601 bytes)
%System%\drivers\etc\hosts (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1013v1399981006909062820[1].jpg (916 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@qunge[2].txt (1684 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1013v1399900572153141167[1].jpg (5444 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[3].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\AClick[1].aspx (372 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\button_old_170[1].gif (749 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\6[1].htm (15899 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAW3W1GN.htm (7 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@qunge[1].txt (1249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\firstpay[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pic1[1].gif (428 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[2].txt (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\button_old_170[1].gif (749 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\core[1].php (802 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (963 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (406 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[4].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\idx_share_mood_v1[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b744ef7cf7616402b9cd75cd3b296755[1].jpg (2876 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\dd4a181d99e9ef08ab7d0a6475f7d97f[1].jpg (8051 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (447 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (203 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\close[1].png (286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAOR8DQF.htm (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1013v1400493293416348850[1].jpg (916 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (154 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\logo[1].jpg (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\9aabf98b73[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\spacegif[1].gif (60 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ab7b8d4601229526cb46e315af28c9db[1].jpg (3988 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAMRCLE3.htm (7 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (163 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\975b51f2ce89d444e33414de976c88a0[1].jpg (1075 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (28048 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\135960371121375988[1].jpg (1152 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (167 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\106a779a3e729c20d3b927873b6bdc5b[1].jpg (2034 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\AClick[1].aspx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\AClick[2].aspx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo[2].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\AClick[1].aspx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\button_old_170[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\6[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\button_old_170[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\22759138[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\index_MIN_11.97[1].css (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\level_MIN_12.02[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jump[1].html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\106a779a3e729c20d3b927873b6bdc5b[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CA1QKA6Z.htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\AClick[1].aspx (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@qunge[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pic1[1].gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@qunge[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\22759138[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAOR8DQF.htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\spacegif[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\2013.11.261[1].gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)

Registry activity

The process %original file name%.exe:1564 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 17 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A0 25 31 1A AC FB 95 B0 60 0C 5E 07 8C 6D 6E C6"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\MediaPlayer\Health\{141B2550-F8ED-4370-8AA3-F27478BDE31D}]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 1248 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1 www.cfyuanji.com
127.0.0.1 www.cfyuanji.net
127.0.0.1 www.cfyuanji.cc
127.0.0.1 cfyuanji.com
127.0.0.1 cfyuanji.net
127.0.0.1 cfyuanji.cc
127.0.0.1 www.cfyalan.com
127.0.0.1 www.cfyalan.net
127.0.0.1 www.cfyalan.cc
127.0.0.1 yy.cfyalan.com
127.0.0.1 cc.cfyalan.com
127.0.0.1 cfyalan.com
127.0.0.1 cfyalan.net
127.0.0.1 cfyalan.cc
127.0.0.1 www.cftianyue.com
127.0.0.1 www.cftianyue.net
127.0.0.1 www.cftianyue.cc
127.0.0.1 cftianyue.com
127.0.0.1 cftianyue.net


Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
MEW 4096 1908736 0 0 d41d8cd98f00b204e9800998ecf8427e
 1912832 557056 495839 5.32321 6415dbbcdd6f25b64fd4603891de73d1

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://42.156.140.11/core.php?web_id=4693566&show=pic1&t=z
hxxp://42.156.140.23/stat.htm?id=4693566&r=&lg=en-us&ntime=1400856660&repeatip=2&rtime=0&cnzz_eid=781320698-1400856660-&showp=1024x768&st=-17545&sin=&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&rnd=1061278162
hxxp://61.146.152.57/csjs/_/girlfall_5.js
hxxp://119.254.26.35/site/images/new_main/fkr_v2.png
hxxp://119.254.26.35/site/images/ico/icon_dbt.gif
hxxp://14.17.101.18/jump.html?p=20111931&from=offsite&wp=1&sid=214516
hxxp://119.254.26.36/common/hf/arc.png
hxxp://27.195.145.37/live/59/50/80e7dec180.jpg
hxxp://27.195.145.37/live/2014/04/06/05/1003v1396734606998730081.jpg
hxxp://59.151.16.173/hotel_fekit/prd/scripts/[email protected]
hxxp://1st.xdwscache.glb0.lxdns.com/mhjh/42/images/bg1.swf
hxxp://1st.xdwscache.glb0.lxdns.com/stat.js
hxxp://101.226.244.212/Scripts/JScript.js
hxxp://cc00013.h.cncssr.chinacache.net/imges/live2013/base_head_v24.png
hxxp://cc00013.h.cncssr.chinacache.net/imges/live/CSSIMG/base_head_search.png
hxxp://119.254.26.35/hotel/aprice/service_24.png
hxxp://119.254.26.36/common/hf/24h.png
hxxp://119.254.26.35/site/images/n/qn_hotel_home_li.gif
hxxp://42.156.140.23/stat.htm?id=4693566&r=&lg=en-us&ntime=1400856660&repeatip=1&rtime=0&cnzz_eid=781320698-1400856660-&showp=1024x768&st=-17545&sin=&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&rnd=28790409
hxxp://61.146.152.57/js/jquery-1.8.2_v4.js
hxxp://cc00013.h.cncssr.chinacache.net/live/82/93/88f9034248.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/mhjh/42/images/reg.swf
hxxp://icon.cnzz.com/img/pic1.gif
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=755500343
hxxp://115.236.19.58/xm/2013.11.261.gif
hxxp://27.195.145.37/3a/fb/u327191383286771.png
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=838325880
hxxp://1st.xdwscache.glb0.lxdns.com/adstat.php?wsite=snsfun&lq_aid=1398&lq_placeid=14516
hxxp://cc00013.h.cncssr.chinacache.net/f2/9a/v627061383118550.png
hxxp://cc00013.h.cncssr.chinacache.net/b9/f4/9aabf98b73.jpg
hxxp://js.tuigoo.com/pic/spacegif.gif
hxxp://101.226.244.212/iframe/web/images/btn_a.jpg
hxxp://61.146.152.57/js/s/iwt-min.js
hxxp://61.146.152.57/js/s/e6u5-min.js?101016
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=1478286576
hxxp://js.tuigoo.com/AClick.aspx?AID=1805&WebID=14516&DomainID=7292&APID=9756&Auth=090A76F473308619960F4DD5DF43D646EA00369C4C5BA9CA51D1ADDFAE2099A3&Url=&referer=http://www.cfmogu.com/
hxxp://119.254.26.35/site/images/wns/childrenDay_120x20.gif
hxxp://js.tuigoo.com/showcpm.htm?width=270&height=200&SCUrl=http://115.236.19.58/xm/2013.11.261.gif&gourl=http://z.myzwqwe12.com/CPVClick.aspx?AID=1805&PID=9756&Auth=6848383803FF6A60EEF8E83EE457E3DE64592E31F17EDD9090B4CE01E7410865&Url=http%3a%2f%2fv.6.cn%2fevent%2fpromimg%2f%3fsrc%3dpming393
hxxp://www.gm2468.com/68503.html?sid=14516
hxxp://183.60.205.125/Ä¢¹½Í¼Æ¬.gif
hxxp://pcookie.split.cnzz.com/app.gif?&cna=Vk4GDC1h3hcCAbhrJiY/l3vv
hxxp://61.146.152.57/event/promimg/proLiveInfo.php
hxxp://1st.xdwscache.glb0.lxdns.com/mhjh/42/images/ren01.swf
hxxp://119.254.26.35/qui/common/search_sug3.png
hxxp://pcookie.split.cnzz.com/app.gif?&cna=V04GDKPz9hYCAbhrJiat7STg
hxxp://tips.qunar.com/ugcApi/hotel/homepageRecommend.json?callback=_callback&_=1400839117274
hxxp://211.151.112.21/hotelHot.jsp?city=北京
hxxp://119.254.26.35/site/images/2011/icon_calendar.gif
hxxp://61.146.152.57/js/s/login_3.js
hxxp://61.146.152.57/js/mootools_MIN_1.4.5.js
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=1355798310
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=1549908153
hxxp://tuan.qunar.com/api/indextuan_v4.php?callback=jQuery1830349364145548212_1400839115462&_=1400839117962
hxxp://c.split.cnzz.com/stat.php?id=2157618&web_id=2157618
hxxp://61.146.152.57/js/z_MIN_14.68.js
hxxp://42.156.140.23/stat.htm?id=4693566&r=&lg=en-us&ntime=1400856660&repeatip=3&rtime=0&cnzz_eid=781320698-1400856660-&showp=1024x768&st=-17542&sin=&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&rnd=1185980821
hxxp://irs01.net/MTFlashStore.swf
hxxp://pcookie.split.cnzz.com/app.gif?&cna=V04GDN84LS4CAbhrJiazs4pP
hxxp://cc00013.h.cncssr.chinacache.net/live/44/92/93dd3c8238e709a50436a93813334360.jpg
hxxp://27.195.145.37/live/87/77/c4e56405381405cf666068f90ee21405.jpg
hxxp://42.156.140.23/stat.htm?id=4693566&r=&lg=en-us&ntime=1400856660&repeatip=4&rtime=0&cnzz_eid=781320698-1400856660-&showp=1024x768&st=-17541&sin=&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&rnd=1234893777
hxxp://61.146.152.57/event/promimg/?src=pming393
hxxp://61.146.152.57/api/liveInfoCk.php
hxxp://42.156.140.11/core.php?web_id=2157618&t=z
hxxp://cc00013.h.cncssr.chinacache.net/live/2014/05/15/22/1003v1400164908911825873.jpg
hxxp://myconf6room.dtwscache.glb0.lxdns.com/?src=tuiga834
hxxp://101.226.244.212/iframe/web/images/right_bg.jpg
hxxp://z12.cnzz.com/stat.htm?id=2157618&r=&lg=en-us&ntime=none&repeatip=0&rtime=0&cnzz_eid=1831153373-1400856664-&showp=1024x768&st=0&sin=&t=undefinedundefinedundefinedundefinedundefinedundefinedundefined&rnd=38415145
hxxp://101.226.244.212/iframe/web/images/p1_bg.png
hxxp://enop007.tlgslb.com/live.6.cn/e6u2/r.php?location=v.6.cn/event/promimg/?src=pming393&referer=&browser=mozilla/4.0 (compatible; msie 6.0; windows nt 5.1; sv1; .net clr 2.0.50727; .net clr 3.0.04506.648; .net clr 3.5.21022; .net4.0c)&flash=10.0&msr=1024,768&uid=0&pro=4&stamp=1400839118009
hxxp://cc00013.h.cncssr.chinacache.net/live/09/70/0c975ca66621d39583489482d041ee1f.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/28/40/700d9d36f15a76d00706af5830588487.jpg
hxxp://cc00013.h.cncssr.chinacache.net/imges/live/IMGSRC/logo_foot_v1.png
hxxp://cc00013.h.cncssr.chinacache.net/live/62/11/bac3177e34cf864ef0a77c8ca27f43ff.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/20/75/bc01b4cd6153ceccfb52087c4063fdc8.jpg
hxxp://history.qunar.com/history/newhistory.html?v=20121012
hxxp://1st.xdwscache.glb0.lxdns.com/mhjh/wm/mhjh_42.flv
hxxp://101.226.244.212/iframe/web/images/p2_bg.png
hxxp://qhs.qunar.com/collect?&QHFP=&QHP=ZSI0A8280375&ex_track=auto_533a6e98&http_referer=
hxxp://cc00013.h.cncssr.chinacache.net/imges/live2013/logo.jpg
hxxp://7.ecoma.glb0.lxdns.com/p/20111931?from=offsite&sid=214516&wp=1&cps=&r=9120
hxxp://tuan.qunar.com/tuijian/index.html?v=1400839120055
hxxp://7.ecoma.glb0.lxdns.com/jump.html?p=50110004&from=offsite&wp=1&sid=14516
hxxp://www.qunar.com/twell/cookie/allocateCookie.jsp
hxxp://history.qunar.com/ips.jcp?callback=QNR.ips.callback&_=1400839119962
hxxp://119.254.26.35/hotel/ugc/user_spic.png
hxxp://119.254.26.35/hotel/hotel_default_77_77.jpg
hxxp://cc00013.h.cncssr.chinacache.net/b7/aa/h199941397100951.jpg
hxxp://history.qunar.com/avatar/vmlINR4GkJKFO_VZj.png?l
hxxp://27.195.145.11/Mediafile/webgame/Flvs/20140519/438300.flv
hxxp://userimg.qunar.ccgslb.net/hotel/city_guid/jt_h.png
hxxp://userimg.qunar.ccgslb.net/site/images/new_main/m_loading.gif
hxxp://cc00013.h.cncssr.chinacache.net/live/07/01/106a779a3e729c20d3b927873b6bdc5b.jpg
hxxp://userimg.qunar.ccgslb.net/imgs/201404/23/QvMa33SoHnO-fFKZ576.jpg
hxxp://7.ecoma.glb0.lxdns.com/9120?p=20111931
hxxp://userimg.qunar.ccgslb.net/site/images/2011/QN1HP2.png
hxxp://userimg.qunar.ccgslb.net/hotel/ugc/review_titlebg.png
hxxp://irs01.com/irt?_iwt_UA=UA-6cn-000001&p=value1,value2&jsonp=_3SHB9
hxxp://userimg.qunar.ccgslb.net/hotel/ugc/review_homev3.png
hxxp://userimg.qunar.ccgslb.net/hotel/aprice/icon_weih.png
hxxp://www.qunar.com/vataframe/b.html?_=20120808&rnd=homeadSy
hxxp://xnop012.tlgslb.com/tuan/team/2013/0716/3_13739689082565_index.jpg
hxxp://xnop012.tlgslb.com/tuan/team/2013/1108/3_13839002496162_index.jpg
hxxp://myconf6room.dtwscache.glb0.lxdns.com/css/level_MIN_12.02.css
hxxp://xnop012.tlgslb.com/tuan/team/2012/0327/3_13328131311111_index.jpg
hxxp://xnop012.tlgslb.com/tuan/team/2014/0401/3_13963288578315_index.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/2014/05/19/17/1013v1400493293416348850.jpg
hxxp://myconf6room.dtwscache.glb0.lxdns.com/css/index_MIN_11.97.css
hxxp://cc00013.h.cncssr.chinacache.net/live/2014/05/12/21/1013v1399900572153141167.jpg
hxxp://cc00013.h.cncssr.chinacache.net/imges/live/index/firstpay.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/2014/05/12/14/1013v1399877732267347087.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/2014/03/18/15/1013v1395126094590286213.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/15/38/975b51f2ce89d444e33414de976c88a0.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/63/67/b744ef7cf7616402b9cd75cd3b296755.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/69/59/eca1e2f901a17103ab05f7b46c358f6e.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/33/84/bd5463690a93c57a1039c47e11ab0f97.jpg
hxxp://7.ecoma.glb0.lxdns.com/p/50110004?from=offsite&sid=14516&wp=1&cps=&r=22759138
hxxp://cc00013.h.cncssr.chinacache.net/live/50/05/ab7b8d4601229526cb46e315af28c9db.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/2014/05/13/19/1013v1399981006909062820.jpg
hxxp://xnop012.tlgslb.com/tuan/team/2012/0507/3_13363693818011_index.jpg
hxxp://xnop012.tlgslb.com/tuan/team/2012/1218/3_13558027643047_index.jpg
hxxp://www.qunar.com/vataframe/b.html?_=20120808&rnd=hotel_active_dynamic
hxxp://xnop012.tlgslb.com/tuan/team/2013/1101/3_13832759326386_index.jpg
hxxp://webproxy-sz.qplus.com/pa?p=1:1305643224:17
hxxp://webproxy-sz.qplus.com/pa?p=1:494666586:17
hxxp://xnop012.tlgslb.com/tuan/team/2012/0702/3_13412052702424_index.jpg
hxxp://cc00013.h.cncssr.chinacache.net/imges/live2013/idx_share_mood_v1.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/74/92/dd4a181d99e9ef08ab7d0a6475f7d97f.jpg
hxxp://xnop012.tlgslb.com/tuan/team/2013/0816/3_13766448177438_index.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/script/static/xiu/v5/main_play_v.7.js?20140515
hxxp://xnop012.tlgslb.com/tuan/team/2013/0724/3_13746619079861_index.jpg
hxxp://myconf6room.dtwscache.glb0.lxdns.com/event/promimg/proLiveInfo.php
hxxp://webproxy-sz.qplus.com/pa?p=1:2473590371:17
hxxp://xnop012.tlgslb.com/tuan/team/2013/0609/3_13707460758353_index.jpg
hxxp://webproxy-sz.qplus.com/pa?p=1:1712482633:17
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/lib/jquery/jquery-1.4.4.min.js
hxxp://7.ecoma.glb0.lxdns.com/play/22759138?p=50110004
hxxp://enop007.tlgslb.com/live.6.cn/e6u2/r.php?location=v.6.cn/event/promimg/?src=pming393&referer=www.cfmogu.com/&browser=mozilla/4.0 (compatible; msie 6.0; windows nt 5.1; sv1; .net clr 2.0.50727; .net clr 3.0.04506.648; .net clr 3.5.21022; .net4.0c)&flash=10.0&msr=1024,768&uid=0&pro=4&stamp=1400839124071
hxxp://xnop012.tlgslb.com/tuan/team/2013/1128/3_13856334572103_index.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/public_v.1.js?20140212v1
hxxp://ssd.tcdn.qq.com/qconn/wpa/button/button_old_170.gif
hxxp://xnop012.tlgslb.com/tuan/team/2014/0219/3_13927960623356_index.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/59/88/135960371121375988.jpg
hxxp://myconf6room.dtwscache.glb0.lxdns.com/api/liveInfoCk.php
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/sns_v.5.js?20131231
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/base/v1/css/common_v.1.css
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/base/v1/css/gift_v.1.css?20130918v1
hxxp://xnop012.tlgslb.com/tuan/team/2013/0427/3_13670378697730_index.jpg
hxxp://xnop012.tlgslb.com/tuan/team/2012/1106/3_13521927362776_index.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/game_v.5.js?20131104v2
hxxp://xnop012.tlgslb.com/tuan/team/2013/1105/3_13836364398589_index.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/css/xiu_base_v.2.css?2012v5
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/css/sub/xiu_guide_v.8.css?v20140224
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/common.js?20140417
hxxp://xnop012.tlgslb.com/tuan/team/2013/0805/3_13756834771498_index.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/global.js?2013v6
hxxp://xnop012.tlgslb.com/tuan/team/2013/0923/3_13799281774557_index.jpg
hxxp://xnop012.tlgslb.com/tuan/team/2013/1219/3_13874395125075_index.jpg
hxxp://a.qunar.com/vataplan?framId=rightMiddleAd_QAD&adposition=QNR_Yw==_CN&tag=1&rows=10&cur_page_num=0&rep=1&f=s&callback=QNR._AD.rightMiddleAd_QAD&tile=140083911550977635&city=北京
hxxp://www.qunar.com/vataframe/b.html?_=20120808&rnd=couplet_load
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/css/sub/xiu_login_v.2.css?20131212
hxxp://59.151.16.173/jquery/prd/jquery-1.7.2.min.js
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/swfobject.js
hxxp://xnop012.tlgslb.com/tuan/team/2014/0108/3_13891704116644_index.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/css/xiu_v.12.css?20140312
hxxp://xnop012.tlgslb.com/tuan/team/2014/0107/3_13890927387789_index.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/css/sub/xiu_sns_v.1.css?20140415
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/shafa_v_1.js?v=201311v1
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/play_flv_v.8.js?20140421
hxxp://xnop012.tlgslb.com/tuan/team/2012/1012/3_13500402225397_index.jpg
hxxp://xnop012.tlgslb.com/tuan/team/2012/1213/3_13553713466676_index.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/css/topic/xiu_activity.css?v20140429
hxxp://www.qunar.com/vataframe/b.html?_=20120808&rnd=leftMiddleAd
hxxp://qhs.qunar.com/render/googlesem.jsp?lable=iV1oCMbP0AUQ-vPg1wM&params={"AccessPage":"home"}&referer=
hxxp://www.qunar.com/vataframe/b.html?_=20120808&rnd=leftMiddleAd2
hxxp://xnop012.tlgslb.com/tuan/team/2014/0107/3_13890853993991_index.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/hd.js?v20140515
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/liver.js?2012v1
hxxp://xnop012.tlgslb.com/ucenter/portrait/201405/16/12d8a69d8cbdb8d0811889c4.png_r_150x150_1d6667f5.png
hxxp://a.qunar.com/js.ng/framId=homeadSy&chan=hotel&pg=home&pos=right_top&site=qunar&size=230x200&type=Tear_angle&tile=140083911550977635&city=北京
hxxp://xnop012.tlgslb.com/tuan/team/2014/0506/13993458443799.jpeg
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/broadcast_v.1.js?20131107v1
hxxp://a.qunar.com/js.ng/framId=hotel_active_dynamic&chan=hotel&pg=home&site=qunar&type=dynamic_skinned&tile=140083911550977635&city=北京
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/park.js?201311v1
hxxp://userimg.qunar.ccgslb.net/imgs/201111/22/OSh_kbSQcSLTtsuEOnormal.jpg
hxxp://xnop012.tlgslb.com/tuan/team/2014/0522/14007330351187.jpeg
hxxp://a.qunar.com/js.ng/framId=couplet_load&chan=hotel&pg=home&pos=right&site=qunar&size=120x300&type=couplet&TransactionID=2698212&tile=140083911550977635&city=北京
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/lothario_v.1.js?20140425
hxxp://xnop012.tlgslb.com/tuan/team/2014/0519/14004736313837.jpeg
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/signin_v.1.js?2014v6
hxxp://www.qunar.com/vataframe/b.html?_=20120808&rnd=leftBottomAd
hxxp://xnop012.tlgslb.com/tuan/team/2014/0520/14005843779565.jpeg
hxxp://a.qunar.com/js.ng/framId=leftMiddleAd&chan=hotel&pg=home&pos=top&site=qunar&size=728x90&tile=140083911550977635&city=北京
hxxp://a.qunar.com/js.ng/framId=leftMiddleAd2&chan=hotel&pg=home&pos=left_mid&site=qunar&size=728x90&tile=140083911550977635&city=北京
hxxp://pagead.l.doubleclick.net/pagead/conversion.js
hxxp://stats.l.doubleclick.net/dc.js
hxxp://xnop012.tlgslb.com/tuan/team/2014/0421/13980791694562.jpeg
hxxp://stats.l.doubleclick.net/__utm.gif?utmwv=5.5.1dc&utms=1&utmn=1290891466&utmhn=hotel.qunar.com&utme=8(AccessPage)9(home)&utmcs=utf-8&utmsr=1024x768&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmhid=1444891789&utmr=-&utmp=/render/googlesem.jsp?lable=iV1oCMbP0AUQ-vPg1wM&params=%257B%2522AccessPage%2522%253A%2522home%2522%257D&referer=&utmht=1400839129524&utmac=UA-33334231-1&utmcc=__utma=183398822.1637817787.1400839129.1400839129.1400839129.1;+__utmz=183398822.1400839129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmu=qRAAAAAAC~
hxxp://history.qunar.com/h?utmwv=0.1&t=0.31577474853062076&utmsr=1024*740&utmr=-1&utmp=http://hotel.qunar.com/?ex_track=auto_533a6e98&utmhn=hotel.qunar.com&s=167
hxxp://www.qunar.com/vataframe/b.html?_=20120808&rnd=rightTopAd
hxxp://www.qunar.com/vataframe/b.html?_=20120808&rnd=rightMiddleBottomAd
hxxp://a.qunar.com/js.ng/framId=leftBottomAd&chan=hotel&pg=home&pos=bottom&site=qunar&size=728x90&tile=140083911550977635&city=北京
hxxp://xnop012.tlgslb.com/tuan/team/2014/0507/13994555365849.jpeg
hxxp://pagead.l.doubleclick.net/pagead/conversion/989346298/?random=1400839129696&cv=7&fst=1400839129696&num=1&fmt=3&value=0&label=iV1oCMbP0AUQ-vPg1wM&bg=ffffff&hl=en&guid=ON&u_h=768&u_w=1024&u_ah=740&u_aw=1024&u_cd=32&u_his=0&u_tz=180&u_nplug=0&u_nmime=0&frm=1&url=http://hotel.qunar.com/?ex_track=auto_533a6e98&ref=http://hotel.qunar.com/?ex_track=auto_533a6e98
hxxp://dart.l.doubleclick.net/adj/N9447.138294QUNAR.COM/B8124379.108774938;sz=728x90;ord=[timestamp]?
hxxp://pagead.l.doubleclick.net/pagead/viewthroughconversion/989346298/?random=881729412&cv=7&fst=1400839129696&num=1&fmt=3&value=0&label=iV1oCMbP0AUQ-vPg1wM&bg=ffffff&hl=en&guid=ON&u_h=768&u_w=1024&u_ah=740&u_aw=1024&u_cd=32&u_his=0&u_tz=180&u_nplug=0&u_nmime=0&frm=1&url=http://hotel.qunar.com/?ex_track=auto_533a6e98&ref=http://hotel.qunar.com/?ex_track=auto_533a6e98&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0
hxxp://userimg.qunar.ccgslb.net/site/images/wns/20140521_allban_black_4661_728x90.jpg
hxxp://www.google.com/ads/user-lists/989346298/?label=iV1oCMbP0AUQ-vPg1wM&fmt=3&bg=ffffff&num=1&ct_cookie_present=false&cv=7&frm=1&url=http://hotel.qunar.com/?ex_track=auto_533a6e98&ref=http://hotel.qunar.com/?ex_track=auto_533a6e98&random=921560081
hxxp://www.qunar.com/vataframe/b.html?_=20120808&rnd=rightBottomAd
hxxp://xnop012.tlgslb.com/qs/201405/23/e0c5f8ee69806b626886324a.png
hxxp://a.qunar.com/js.ng/framId=rightTopAd&chan=hotel&pg=home&pos=top&site=qunar&size=230x200&tile=140083911550977635&city=北京
hxxp://www.google.ca/ads/user-lists/989346298/?label=iV1oCMbP0AUQ-vPg1wM&fmt=3&bg=ffffff&num=1&ct_cookie_present=false&cv=7&frm=1&url=http://hotel.qunar.com/?ex_track=auto_533a6e98&ref=http://hotel.qunar.com/?ex_track=auto_533a6e98&random=921560081&ipr=y
hxxp://a.qunar.com/js.ng/framId=rightMiddleBottomAd&chan=hotel&pg=home&pos=top&site=qunar&size=230x90&tile=140083911550977635&city=北京
hxxp://userimg.qunar.ccgslb.net/site/images/zhuanti/131122/s.gif
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/activity/newie/n5_ledbean.png
hxxp://a.qunar.com/qadjs8.nghtml?framId=rightBottomAd&chan=hotel&pg=home&pos=right_bottom&site=qunar&qnum=8&qtype=js&type=textlink&tile=140083911550977635&city=北京
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/rev_h.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/bg/rev_marquee.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/lnt_bg1.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/topic/Satyr_Game/Satyr_Game_icon.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/bg/rev_light_on.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/bg.png?v=0531
hxxp://qhs.qunar.com/timetrack.htm?action=HH|load|21.188&t=1400839131000
hxxp://1st.xdwscache.glb0.lxdns.com/photo/10/60/shiang2345_56.com_.jpg?134?t=2014052322
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/icon/face_vip_static.png
hxxp://1st.xdwscache.glb0.lxdns.com/photo/4/3/lili1987422_b_56.com_.jpg?052322
hxxp://1st.xdwscache.glb0.lxdns.com/photo/72/26/taihang330_56.com_.jpg?789?t=2014052322
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/sub/ph_flower.png?v=0910
hxxp://1st.xdwscache.glb0.lxdns.com/photo/9/14/qq-zxltfiqayy_56.com_.jpg?653?t=2014052322
hxxp://xnop012.tlgslb.com/huodong/29/27/channel_20140504104628_44039.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/photo/48/85/shiang245_56.com_.jpg?433?t=2014052322
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/sub/ph_flower.png
hxxp://08913.xdwscache.glb0.lxdns.com/flashApp/vshow/seabed_treasure.11.07.29.a.swf
hxxp://08913.xdwscache.glb0.lxdns.com/flashApp/vshow_player_woxiu.14.04.24.a.swf
hxxp://1st.xdwscache.glb0.lxdns.com/photo/66/84/qq-rnskajoctj_56.com_.jpg?377?t=2014052322
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/woxiu_logo_play.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/rev_icon.png
hxxp://1st.xdwscache.glb0.lxdns.com/admin/images/no_userhead_s.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/bg/rev_icon_h.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/icon_mm.png?v=0821
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/icon_mm.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/rev_sprite.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/bg_white.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/gift_small_v_1.png?v=1226
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/h_gift_small_v_1.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/gift/gs_v_2.png?v=07012
hxxp://xiu.stat.corp.v-56.com/play_conn?room_user_id=lili1987422&user_id=&ts=8275&try=1&cdn=ws
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/rev_gift.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/rev_sprite.png?v=0930
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/ug/icon_user_v_3.png?v=1130
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/tmp/gift_star_bg.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/ico_sp.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/gift_big_v_1.png?v=0902
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/icon/face_static.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/col/peihua.png?v=0813
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/bg/bg_car.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/bg/car_ivaca.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/bg/player_woxiu.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/col/peihua.png
hxxp://08913.xdwscache.glb0.lxdns.com/flashApp/vshow/gift_shape/gift.13.10.18.a.swf
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/rev_uhd.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/airing_sprite.gif
hxxp://xiu.stat.corp.v-56.com/jump1stat?roomid=lili1987422&pid=20111931&sid=214516&uuid=83915535286571
hxxp://7.ecoma.glb0.lxdns.com/index.php?action=Game/Lothario&do=Init&room_user_id=lili1987422&t=0.2922568222814131
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/base/v1/img/gift/game_icon/lock.gif
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/topic/Satyr_Game/timer_bg.gif


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Outdated Windows Flash Version IE
SURICATA STREAM ESTABLISHED packet out of window
SURICATA STREAM Packet with invalid ack
SURICATA STREAM ESTABLISHED invalid ack
SURICATA STREAM SHUTDOWN RST invalid ack
SURICATA STREAM FIN out of window

Traffic

The Trojan connects to the servers at the folowing location(s):

%original file name%.exe_1564:

t$(SSh
~%UVW
u$SShe
kernel32.dll
user32.dll
imm32.dll
imedllhost09.ime
GetAsyncKeyState
EnumWindows
UnloadKeyboardLayout
RegOpenKeyExA
RegCloseKey
API.dll
.text
`.rdata
@.data
.rsrc
@.reloc
winmm.dll
crossfire.exe
[email protected]
www.cfmogu.com
smtp.126.com
[email protected]
http://open.baidu.com/special/time/
window.baidu_time(
?user32.dll
F%*.*f
CNotSupportedException
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
COMCTL32.DLL
CCmdTarget
__MSVCRT_HEAP_SELECT
iphlpapi.dll
SHLWAPI.dll
MPR.dll
WINMM.dll
WS2_32.dll
VERSION.dll
RASAPI32.dll
GetProcessHeap
WinExec
GetWindowsDirectoryA
KERNEL32.dll
GetKeyState
USER32.dll
GetViewportOrgEx
GDI32.dll
WINSPOOL.DRV
RegDeleteKeyA
RegCreateKeyExA
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
ole32.dll
OLEAUT32.dll
COMCTL32.dll
WSOCK32.dll
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetCrackUrlA
InternetCanonicalizeUrlA
WININET.dll
GetCPInfo
CreateDialogIndirectParamA
UnhookWindowsHookEx
SetWindowsHookExA
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
comdlg32.dll
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.*)|*.*||
Shell32.dll
Mpr.dll
Advapi32.dll
User32.dll
Gdi32.dll
Kernel32.dll
(&07-034/)7 '
?? / %d]
%d / %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
%s:%d
windows
out.prn
%d.%d
%d / %d
%d/%d
Bogus message code %d
(%d-%d):
%ld%c
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
%s <%s>
Reply-To: %s
From: %s
To: %s
Subject: %s
Date: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
HELO %s
SMTP
AUTH LOGIN
LOGIN
AUTH=LOGIN
EHLO %s
Content-Type: application/octet-stream; name=%s
Content-Disposition: attachment; filename=%s
MAIL FROM:<%s>
RCPT TO:<%s>
.PAVCObject@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
zcÁ
#include "l.chs\afxres.rc" // Standard components
9 9Ÿ9K9s9
= =$=(=,=0=4=8=
3 4$4(4,404
4"565=5}5
4$4(4,4044484<4@4
;$<)<6
http://www.cfmogu.com/index.html
www.cfmogu.cc
Y@http://www.cfmogu.com/0.htm
%System%\drivers\etc\hosts
127.0.0.1 www.cfyuanji.com
127.0.0.1 www.cfyuanji.net
127.0.0.1 www.cfyuanji.cc
127.0.0.1 cfyuanji.com
127.0.0.1 cfyuanji.net
127.0.0.1 cfyuanji.cc
127.0.0.1 www.cfyalan.com
127.0.0.1 www.cfyalan.net
127.0.0.1 www.cfyalan.cc
127.0.0.1 yy.cfyalan.com
127.0.0.1 cc.cfyalan.com
127.0.0.1 cfyalan.com
127.0.0.1 cfyalan.net
127.0.0.1 cfyalan.cc
127.0.0.1 www.cftianyue.com
127.0.0.1 www.cftianyue.net
127.0.0.1 www.cftianyue.cc
127.0.0.1 cftianyue.com
127.0.0.1 cftianyue.net
127.0.0.1 cftianyue.cc
%System%\drivers\etc\
^}•D
IMM32.dll
imehost.dll
ImeProcessKey
Windows
:):3:9:|:
? ?$?(?,?
Keyboard Layout\Preload\
Keyboard Layout\Preload\1
Keyboard Layout\Preload\2
Keyboard Layout\Preload\3
Keyboard Layout\Preload\4
Keyboard Layout\Preload\5
Keyboard Layout\Preload\6
Keyboard Layout\Preload\7
Keyboard Layout\Preload\8
Keyboard Layout\Preload\9
Keyboard Layout\Preload\10
Keyboard Layout\Preload\11
Keyboard Layout\Preload\12
Keyboard Layout\Preload\13
Keyboard Layout\Preload\14
Keyboard Layout\Preload\15
Keyboard Layout\Preload\16
Keyboard Layout\Preload\17
Keyboard Layout\Preload\18
Keyboard Layout\Preload\19
Keyboard Layout\Preload\20
%*.*f
www.dywt.com.cn
(*.htm;*.html)|*.htm;*.html
.PAVCOleException@@
.PAVCOleDispatchException@@
c:\%original file name%.exe
RegCreateKeyA
oledlg.dll
L.DRV
%&.VlG
.Gy$o
M3.fg
.Ghkc
1f.Xp
S;.aJ
.WRCub)
%sA#e
YW?D%Sp
t.GYeA
4.mn}l
<.sQK
V-r}g
%uvCz
z.pKun
awU.Wr
.bv$P
.isW,~
Z*>*%D&
k}.te
4.Fb"
.wW*)
%SE9K
$^|';58<
?.Tkzza
Wj%fZ7
B`F%c
>^"%X
$U%x9
p=ü
?.SX_
:Ur=b%S)
%fuXg
%_.XE
3%%d|
%D[,:
W.lLj
.sbSP
-vadh}
:3-h}
][.Xt
(õ'
(*.*)
1.0.0.0
(http://www.eyuyan.com)
1, 0, 0, 1

iexplore.exe_1860:




%?9-*09,*19}*09
.text
`.data
.rsrc
msvcrt.dll
KERNEL32.dll
NTDLL.DLL
USER32.dll
SHLWAPI.dll
SHDOCVW.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
rsabase.dll
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
watson.microsoft.com
IEWatsonURL
%s -h %u
iedw.exe
Iexplore.XPExceptionFilter
jscript.DLL
mshtml.dll
mlang.dll
urlmon.dll
wininet.dll
shdocvw.DLL
browseui.DLL
comctl32.DLL
IEXPLORE.EXE
iexplore.pdb
ADVAPI32.dll
MsgWaitForMultipleObjects
IExplorer.EXE
IIIIIB(II<.Fg
7?_____ZZSSH%
)z.UUUUUUUU
,....Qym
````2```
{.QLQIIIKGKGKGKGKGKG
;33;33;0
8888880
8887080
browseui.dll
shdocvw.dll
6.00.2900.5512 (xpsp.080413-2105)
Windows
Operating System
6.00.2900.5512


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pixel[1].gif (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\AClick[1].aspx (372 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\eca1e2f901a17103ab05f7b46c358f6e[1].jpg (5889 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bd5463690a93c57a1039c47e11ab0f97[1].jpg (5512 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\22759138[1].htm (1305 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\level_MIN_12.02[1].css (387 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\AClick[2].aspx (372 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@cnzz[2].txt (163 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo[2].jpg (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].gif (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA5K8Z5X.htm (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\AClick[1].aspx (372 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\button_old_170[1].gif (749 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1013v1395126094590286213[1].jpg (532 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\6[1] (24397 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CA1QKA6Z.htm (7 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\spacegif[1].gif (60 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\2013.11.261[1].gif (6852 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pic1[1].gif (428 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (457 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jump[2].htm (36 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[1].gif (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\level_MIN_12.02[1].css (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jump[1].html (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\core[1].php (802 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1013v1399877732267347087[1].jpg (3601 bytes)
    %System%\drivers\etc\hosts (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1013v1399981006909062820[1].jpg (916 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@qunge[2].txt (1684 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1013v1399900572153141167[1].jpg (5444 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (168 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[3].gif (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\AClick[1].aspx (372 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\button_old_170[1].gif (749 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\6[1].htm (15899 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAW3W1GN.htm (7 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@qunge[1].txt (1249 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\firstpay[1].jpg (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pic1[1].gif (428 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@mmstat[2].txt (168 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\button_old_170[1].gif (749 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\core[1].php (802 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (963 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (406 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[4].gif (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\idx_share_mood_v1[1].jpg (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b744ef7cf7616402b9cd75cd3b296755[1].jpg (2876 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\dd4a181d99e9ef08ab7d0a6475f7d97f[1].jpg (8051 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (447 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (203 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\close[1].png (286 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAOR8DQF.htm (7 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1013v1400493293416348850[1].jpg (916 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (154 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (166 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\logo[1].jpg (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\9aabf98b73[1].jpg (776 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (312 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\spacegif[1].gif (60 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ab7b8d4601229526cb46e315af28c9db[1].jpg (3988 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAMRCLE3.htm (7 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (163 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (321 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\975b51f2ce89d444e33414de976c88a0[1].jpg (1075 bytes)
    %Documents and Settings%\%current user%\Cookies\index.dat (28048 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\135960371121375988[1].jpg (1152 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (167 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\106a779a3e729c20d3b927873b6bdc5b[1].jpg (2034 bytes)

  4. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
    127.0.0.1 localhost
  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now