MD5: f600d1345c68cfb5aa26b0b8f370dcfd
SHA1: 073116dd9f7d6728395d9c0bf37276ecbff3242b
SHA256: 005376777652e45b2f4ef560e6e925ed357e0b7f3f6c60fc132a8fe4eb8dc0ab
SSDeep: 98304:m082d w9oruIht2JuSOu9s30Gz9ooqAl3IzscseD/YiUi9ouz24v9d:mD2d3orpnu9s30Uoof P6XCo62K
Size: 7942144 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2014-06-05 06:14:53
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1276

The Trojan injects its code into the following process(es):

cAOwkf2w3NNi61.exe:1508

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1276 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\B4.tmp (1425 bytes)
%WinDir%\cAOwkf2w3NNi61.exe (53149 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\B2.tmp (4545 bytes)
%System%\Configuration file1.ini (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\B3.tmp (3361 bytes)
%Documents and Settings%\%current user%\Desktop\Æô¶¯Ð¦Ð¦VIP.lnk (535 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\B2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\B3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\B4.tmp (0 bytes)

The process cAOwkf2w3NNi61.exe:1508 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\api[1].htm (447 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\B7.tmp (1425 bytes)
%System%\drivers\etc\hosts (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\B5.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\B6.tmp (3361 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\button_10[1].gif (2 bytes)
%System%\Configuration file1.ini (646 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\qunb[1].htm (258 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\group[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\qq[1].htm (229 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\desktop.ini (67 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021120130218\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013030120130302 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1546828 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\B7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1546828\5421.txt\5421.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021120130218 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1546828\5421.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\B6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013030120130302\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\B5.tmp (0 bytes)

Registry activity

The process %original file name%.exe:1276 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
"NetHood" = "%Documents and Settings%\%current user%\NetHood"
"Fonts" = "%WinDir%\Fonts"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"PrintHood" = "%Documents and Settings%\%current user%\PrintHood"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5c14c4f6-74da-11e2-81b0-000c29ec7fc5}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"SendTo" = "%Documents and Settings%\%current user%\SendTo"
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 9C DA 39 CA 3E B0 6A 1E CF 03 C6 71 A5 CB 47"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Recent" = "%Documents and Settings%\%current user%\Recent"
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

The process cAOwkf2w3NNi61.exe:1508 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014061820140619]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5c14c4f6-74da-11e2-81b0-000c29ec7fc5}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014061820140619]
"CacheLimit" = "8192"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014061820140619]
"CachePrefix" = ":2014061820140619:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014061820140619]
"CacheRepair" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "03 82 59 F4 77 0A 4F CF 95 CB BA 9D 91 97 FB 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014061820140619]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014061820140619\"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013030120130302]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013021120130218]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 1206 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: Www.Hixxg.Com
Product Name: ????-VIP-
Product Version: 1.0.0.0
Legal Copyright: Www.Hixxg.Com ????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ??QQ:1848168177
Comments: Www.Hixxg.Com
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://112.90.83.87/pa?p=2:1848168177:41 &r=0.6772223338484764
hxxp://ssd.tcdn.qq.com/wpa/images/group.png
hxxp://ssd.tcdn.qq.com/qconn/wpa/button/button_10.gif
hxxp://pub.idqqimg.com/qconn/wpa/button/button_10.gif	103.7.30.59
hxxp://wpa.qq.com/pa?p=2:1848168177:41 &r=0.6772223338484764
hxxp://pub.idqqimg.com/wpa/images/group.png	103.7.30.59
hookbug.com	183.60.204.213

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY HTTP Request on Unusual Port Possibly Hostile

Traffic

GET /wpa/images/group.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.hookbug.com:5151/qunb.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pub.idqqimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: NWS_UGC_HY

Connection: keep-alive

Date: Thu, 19 Jun 2014 01:23:17 GMT

Cache-Control: max-age=2592000

Expires: Sat, 19 Jul 2014 01:23:17 GMT

Last-Modified: Fri, 12 Apr 2013 09:22:21 GMT

Content-Type: image/png

Content-Length: 1827

X-Cache-Lookup: Hit From Disktank
.PNG........IHDR...Z.........w.{'....PLTEV...dE)r.Ip..........F.......
.F..Kyy...r.....~E ......m..c..........d3.....S.....r...S1...#.....c..
......A..l3....d.............ynvc......"..][email protected]..............&..I
...\BH.....................rHh........z4$...X..0.....R.....s@6...{RL(.
......Xs.y......S........%.........vb...4......bW...[%..........L..t..
s..c>'...2..............wsw..i.............yM...WwaR...?-.fU...~K;.
`H...t..V..:..d...........h/#.......Z74..........pt5(...K...vb=......l
M.........N.kr......I A............pVs..k.....f'.p.....c..%...SG.J;..r
6......fBr..o=5...T..J...jB......5.....|......n^....XLm3#......y.f.}X.
...]6...,y....8..........q.D-Mt....^* z= y>#.dK...^...........>.
.s..J..............B....q...................xy...'..t.....7..M...~Re..
......s: .K(.rP`)..^=.........3......G:V......WE..2.....pHYs..........
.......IDAT8....T.U...lCs..It.....5r,*....I.K.].5p.d....2.4Fw.m}.....e
.v7r.........S.D.IVR.&.....y8G;.................N.r...9.t......p9.....
].......,Ko..i.......Mh.|@..hyw..9...n..qo-....C.....s.fpo..:{..vtQQG.
.......'..zmr.......H...m.u4.;..t...7....C.........a...?....{)...W..4.
..u......(....l..Q.|......R.u.3K.;.!..}vy([.e.~YhG[^. y......C...<.
...~.<-^I3......$..B....z...?$......u...S.7....qF$?.wF..G..lkC#...=
...A...C.......#x...Ea.yvS(..P..e..2..*....yD]]d.\.....{..h.....5.UK.@
J....ux7...>5.H_....}...T]2x,EO7SEmf.6.u:sk(..4...-.,...o6;B...Me. 
.\..._.]SSs..._....?g.,.x.$.tL...)..u.<Mv`4..Q<QiU.1O.X%......q.
.-.w.h... **.....e}..E...'...51t...0...0v....)^1.'.^..U.u`| 3.8l.)
<<< skipped >>>

GET /pa?p=2:1848168177:41 &r=0.6772223338484764 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.hookbug.com:5151/qq.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wpa.qq.com

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Server: tws

Date: Thu, 19 Jun 2014 01:23:19 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: close

Location: hXXp://pub.idqqimg.com/qconn/wpa/button/button_10.gif

Pragma: no-cache

Cache-Control: no-cache; must-revalidate
0..

GET /qconn/wpa/button/button_10.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.hookbug.com:5151/qq.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: pub.idqqimg.com

HTTP/1.1 200 OK

Server: NWS_UGC_HY

Connection: keep-alive

Date: Thu, 19 Jun 2014 01:23:16 GMT

Cache-Control: max-age=2592000

Expires: Sat, 19 Jul 2014 01:23:16 GMT

Last-Modified: Mon, 08 Apr 2013 03:15:19 GMT

Content-Type: image/gif

Content-Length: 2997

X-Cache-Lookup: Hit From Disktank
GIF89aM..........me.{l...............`u.jmt......n..sv|.i].c\.....n...
?Xf......nqy~...rf..qSiv.......................t...............y|....@
Yg.~t.....kv..efm.....................Nes......cdn)FVz.....s.......WQT
V._\.i`......'EUdx.`bl*GW^t.dejcdj^`h......<Ve...............;Ud...
......=We|..................2E........................................
....................>Wf.........w..(EV...............r.............
..................................[r........................V.mh......
w{..~m.._......iei..~..s.qh.pn..U.....^...............udh.............
....................gini....x..~...........X......ebk..q.......ub.zh..
.....WX.......fa.ib.ed..p..w..q..e...sv....ty...[.....U.sj..j..v.mkhjs
............sqv........^..k........a.k]...kn{.........................
.................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehi
HzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="A
dobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> <
;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> &
lt;rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1
.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" x
mlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.
did:E41382F2429BE211A018AF641D24CE9C" xmpMM:DocumentID="xmp.did:8AF3F4
679FFA11E2AFECC3046E5C8B96" xmpMM:InstanceID="xmp.iid:8AF3F4669FFA11E2
AFECC3046E5C8B96" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> 
<xmpMM:DerivedFrom stRef:instanceID="xmp.iid:25F0FBA9669BE211A0
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.text

.rdata

@.data

.rsrc

t%SVh

t$(SSh

|$D.tm

~%UVW

u$SShe

kernel32.dll

Kernel32.dll

ntdll.dll

user32.dll

NTDLL.DLL

psapi.dll

advapi32.dll

ole32.dll

Shlwapi.dll

shlwapi.dll

wininet.dll

atl.dll

OLE32.DLL

gdiplus.dll

MsgWaitForMultipleObjects

EnumWindows

RegOpenKeyA

RegEnumKeyA

RegCloseKey

RegOpenKeyExA

ShellExecuteA

GetProcessHeap

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

RtlFormatCurrentUserKeyPath

SetWindowsHookExA

GdiplusShutdown

{93910B27-95F1-4674-BB94-B251B958642A}

Result=MsgBox ("

!(*^__^*)

%System%\XXTS.vbs

%System%\Configuration file1.ini

gdi32.dll

# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

# 102.54.94.97 rhino.acme.com # source server

# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

127.0.0.1 52jwyy.com

127.0.0.1 www.52jwyy.com

127.0.0.1 bbs.52jwyy.com

127.0.0.1 au2014.com

127.0.0.1 www.au2014.com

127.0.0.1 92ausf.com

127.0.0.1 www.92ausf.com

127.0.0.1 92jwyy.taobao.com

127.0.0.1 shop105942574.taobao.com

127.0.0.1 jwyywg.d131.tqxq.com

127.0.0.1 www.jwyywg.d131.tqxq.com

127.0.0.1 audition0538.i.sohu.com

127.0.0.1 www.vdisk.cn/au2012fuzhu

127.0.0.1 audition0538.blog.sohu.com

127.0.0.1 9421mm.com

127.0.0.1 www.9421mm.com

5B3838F5-0C81-46D9-A4C0-6EA28CA3E942_

275816125

2286585953

1149544

*.bak

*.rar

1970-1-1 00:00:01

001A2B3C4D5Ec:\kss.ini

SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\

ServiceName\\.\

MSXML2.XMLHTTP.6.0

MSXML2.XMLHTTP.5.0

MSXML2.XMLHTTP.4.0

MSXML2.XMLHTTP.3.0

MSXML2.XMLHTTP

Microsoft.XMLHTTP.1.0

Can't create XMLHTTP connection object

Mozilla/4.0 (compatible; MSiE 6.0; Windows NT 5.1;)

application/x-www-form-urlencoded

errmsg_s

x.yvr

x.yvkd

\UpData.exe

\unrar.dll

\.pL.

Windows

0,8999($

.SCK_LINES/9

.jJ^\

.ERZDLL$

%fLH^A

n.ef"

g%s_%d

=.Xh"

.Hjsp"

ANSI_CHARSE.Dc

O7E(AL("%s

KeywnF

.cu%t

\-ú

.NDFR8P

 Ix.Lv?h]#

keysK<

A.DHq*-

8X%Fx

L.@%u

.QunW

.da]o

.PP` 

.pas8

6.Pob

oOV?.DD@

.ChS-v

#yfP.re

KERNEL32.DLL

comctl32.dll

oleaut32.dll

version.dll

wsock32.dll

rsadll.dll

User password

http://www.hookbug.com:5151/viplogo/logo

.jpg.tmp

http://www.hookbug.com:5151/vip/

~%Fgr

~%Fgv

~%Fgj

.EHa=

1F.TH

!EL%sE

"..He

2.fJv

i=9W".BHh

.ZH#$

}2.GQ

0}yC.Hy

!-M}(

.FB!0

17C%F

!.KHv

a.iHh2

uHx.MHh*N

-bGu}

!.FHp

%sMXv

=1.EB

.GJozN'^

%.ZH($

óCN

[F.JX

u2%CU

!sU%u

urlmon.dll

unrar.dll

URLDownloadToCacheFileA

URLDownloadToFileA

RARSetPassword

.iqW>

"3/%F

http://hookbug.com:5151/new_vip.html

`.rdata

@.reloc

t-f9}

%.*s(%d)%s

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

d:\Projects\WinRAR\rar\build\unrardll32\Release\unrar.pdb

GetCPInfo

KERNEL32.dll

USER32.dll

ADVAPI32.dll

GetConsoleOutputCP

vip.rar

vip.exe

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

SkinH_EL.dll

ws2_32.dll

-WWW.HIXXG.COM

F%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

__MSVCRT_HEAP_SELECT

iphlpapi.dll

SHLWAPI.dll

MPR.dll

WINMM.dll

WS2_32.dll

VERSION.dll

WinExec

GetKeyState

GetViewportOrgEx

WINSPOOL.DRV

RegCreateKeyExA

SHELL32.dll

OLEAUT32.dll

WININET.dll

CreateDialogIndirectParamA

UnhookWindowsHookEx

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

comdlg32.dll

#include "l.chs\afxres.rc" // Standard components

=f%7s

http://www.hookbug.com:5151/

\update.exe

::>_<::)

VIP-Www.Hixxg.Com

:|:czkey:|:

Login configuration

.prsrc

B.redlo

 Ÿ!<

%Xx%3

hs\[email protected]"

0$0*0006

Fuck_bb.dll

.data

8})*9|)*?

8})*8})*

#8})*(.(

)*8})*8})

9})*9|)*

9|)*9|)* 

8})*8})*?

9|)*9|)*(

9|)*9|)*

2 8})*(3

#8})*(&(

8})*9|)*

9|)*8})*?

9|)*8})*

*9|)*9|)

)*9|)*9|)*

2 9|)*( 

8})*9|)*8})

9|)*8})* 

2 8})*9|)*(

gd%xl?

_d%xl?

.KGPq

-0Tq}3[

~.TX~*N

odÂ

}.FEa

m%cN4

[email protected]

%*.*f

RegCreateKeyA

({?)({?)';@

I8k-M>_"@QZ%CGq ]Mn3FCf9_Hp<\Ji@HB@

B!*3B!*3B%*7B%D

*7B%*7B%F

F".4F".4F?.QF?

.QF?.QF5.GF5.GF5.G

.GF5.FF4.FF4.FF4.FF4.JF8.LF:.LF:.LF:.BF0.BF0.BF0.IF .=F 

[email protected]@[email protected]@[email protected]@[email protected]@2<

)RA@)RA@)RA@)RA@)RA@)OA%d

.RR(>RE?>QL&1CI>2Q

H?;QE5.=H!=RC?.QA,7GS(8FO9>5A#*:@

A?:HQ5*3T18LW@8GP? 5D52BM&>QF 45E83CD*.RO@:5P0*QG@3BJ4>LF%>BP/.L

4?N69IV?-6M20PO?.JF?)7QG";>J>.FK:)E

U>66I1*QE)3;T%-FP?>BD"=8H?.QE"7KK4-R

Q;)4K6U1>5L@9FL>5CO9:CV%?;S$?;V@
V17BP4*CB@3LF"1GN6 EV#?;N1.LM!15P@8KN,1GP9
P?=QB*/4V3.RF5
9EE#1PN1.LO06EW)3JO<):V:6HA@7QQ@
5>C,.3V0-RK?:RI*6MD?9IG@13E!.BN->BQ435T%6R
4HH!.QV&*:J08GP5?RK48GN37GO5(
L&1
3BP?/;C!4MH> 8K78EW#;QM,9@I?.FN6=Q
48A6.LO:):R@47K?>QO5,LE4.5K)
F:7KM,3CH506E .LO
*QO40RH8>8V34PV9?=R16?O0:EI$4CA;25M2=-7W#2FO0
G)>RS10BO5<8J#.GW*K
Q9.FO?45H!
W 8QH6,;H0*:A&7JH?9ED5)>L;=3P08RH;04O.<EV?=HS?*QF&36O50QU>>
4
,QJ?-QH>57K%F
>[email protected]
U%*QF ,5O?6?D43PV0)6K1>LB&,5K$>QH5-QH58RV?=CQ?8AA;,GVH&5>V@
48K?=QI47ND5*QM&,QQ5>5P3)4O; QL!-P8)RP58GI>,QH#5CV39FA(5HN-68L&/;K?,QB?=RF808K@0EL60GS#04D 36A&>RV@*CQ?2JJ@*EC#>QD?)CD#/3L,3RA@;>Q? 7W).4C&<7B1.4P:2FO<8IC*,QH?8@U>7JI!9QQ5.QD*3QI49QS?<5K:;CU#68S#V?.QA?8Q
P7/RN-,GU%D
P?17K,,FQ9.5F:>CL6 5S;3QH*>3H*8FF#7GO@:8L&,;O818M@4RH?68L,5>D?38P<5ED:0RF),CD45MF%:5I47QS?9IP37ID:6EK8.>[email protected]?D
.QF)(
.QD?(
C@
.GC"(
.FF&(
CŸ@
\5%cm
.KY9ZK
S-A%S
;.Nh
.Kg9[K
O;=.OQ=COc=VO|=
R8A%S
.KY9aK
A.UaCzU
R)A%SQAESqAmS
R:@[email protected]@
Qzone.dll
g8.Ss
.GLD|
.CLT*
g8.os
S8.ws
.WLH~
w8.ss
.CL8j}c
'8.Ss
_8.ss
_8.gs
.sL ${c
.OLhzyc
.cLhbyc
^wLj.xc
^wL"%xc
.oL,ywc
.KLp=wc
[email protected]
g8.ws
.KL@wvcg
cRtG
[8.ss
W8.os
;8.ws
sQLNC
sQLx
#-k}<
sQLm
sQLk
sQLDS
sQLw
cRtPLc
cRtQL
cRtQ
cRtQLO
cRtsL
;:.Ws
sQLNl
#%cm#
sQLbU
sQLW
.Oldg
.Rldg
sQLP6
sQLK
sQL/B
.KLQW
sQL9F
cRtPL
sQLd
sQLT
cRtQL|
sQLg
sQLFW
cRtRL
.tRL3r
.wOmt
.wOEt
.wOdl~
.vODi
h .wO
.sLMi
cRts
sQLE
.oOQt
mswsock.dll
MapVirtualKeyA
GetAsyncKeyState
{B6F7542F-B8FE-46a8-9605-98856A687097}
@Configuration file1.ini
Audition.exe
chinese.slk
5B3838F5-0C81-46D9-A4C0-6EA28CA3E942
*.dll
xxxxxxxx.exe
Audition.exe -
Stand Alone game trainer builder:Filename.exe
csrss.exe
http://www.hookbug.com:5151/js/ll/
s.asp?yzsj=s&z=
183.60.204.213
0000000000000000
0000000
#in_password
http://www.hookbug.com:5151/jiezhi/
dttz.vbs
Result=MsgBox (""&vbCrlf&"
gxtz.vbs
qttz.vbs
\sound\ringclick.wav
00 00 00
http://www.hookbug.com:5151/js/fangfeng/
ffjc.vbs
Result=MsgBox ("
:197774811 E-mail:[email protected]",0, "
61 31 31
61 31 32
61 31 33
61 31 34
61 31 35
61 31 36
61 31 37
61 31 38
62 31 31
62 31 32
62 31 33
62 31 34
62 31 35
62 31 36
62 31 37
62 31 38
63 31 31
63 31 32
63 31 33
63 31 34
63 31 35
63 31 36
63 31 37
63 31 38
64 31 31
64 31 32
64 31 33
64 31 34
64 31 35
64 31 36
64 31 37
64 31 38
65 31 31
65 31 32
65 31 33
65 31 34
65 31 35
65 31 36
65 31 37
65 31 38
26 00 00 00 00 00 00 00 00
2.Perfect 10
00 00 17 01
*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*
8527999
,50,100,150
À-#R4d
/'*w4l%X89
%s)l)*%
%d%V&
%U3e)
Www.Hixxg.Com
WWW.HIXXG.COM
d-WWW.HIXXG.COM
W WWW.HIXXG.COM
W www.hixxg.com
-WWW.HIXXG.COM-
windows
MSWHEEL_ROLLMSG
RASAPI32.dll
GetWindowsDirectoryA
EnumChildWindows
oledlg.dll
InternetCrackUrlA
InternetCanonicalizeUrlA
H@d-)%d H2d
d).gd49jd&/~d33vd6;~d
w.eDI
Uc..zc56~c'
%uc!&pc
_c-.ec
gc/.ic
5cSD1c4-Cc3.Ic,)Jc?8JcK@?cp`?c
|c).uc
b-)%c.5cc
~c).tc
ic&.vc
explorer.exe
taskmgr.exe
C:/windows/explorer.exe
\Audition.exe /T3ENTER
libAuLanderHook.dll
http://shop.9you.com/au/cart/confirmSign?DiscountId=请选择您拥有的商城抵用券&special=100&item_key[]=
http://shop.9you.com/au/cart/confirmSign?DiscountId=请选择您拥有的商城抵用券&item_key[]=
http://shop.9you.com/au/cart/buyresultSign
http://
https://
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
http=
HTTP/1.1
Accept: image/gif, image/bmp, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Content-Type: application/x-www-form-urlencoded
\Audition.exe
\data\001.acv
WScript.Shell
https://login.passport.9you.com/identifyingCode.jsp
{557CF400-1A04-11D3-9A73-0000F81EF32E}
{557CF401-1A04-11D3-9A73-0000F81EF32E}
{557CF402-1A04-11D3-9A73-0000F81EF32E}
{557CF405-1A04-11D3-9A73-0000F81EF32E}
{557CF406-1A04-11D3-9A73-0000F81EF32E}
https://login.passport.9you.com/checkCode
&password=%
id=SSO_AUSHOP&continue=http://shop.9you.com/au/login/checkstat/&r=
http://shop.9you.com/au/
Super-EChttp://www.super-ec.cnhttp://www.eyybc.com/forum-17-1.html/forum-12-1.html/memcp.php/ip.asp/time.asp/gonggao.txt/ec-user6.php/ec-bd.php/ec-jh.php
http://www.super-ec.cn
" class="txt" />Function Getcpuid()
Set cpuSet = GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_Processor")
getcpuid=cpu.ProcessorId
h.rdata
H.data
.reloc
\ddk\ange\bin\i386\aNgE.pdb
ntoskrnl.exe
HAL.dll
W.Ogc
http://www.hookbug.com:5151/qunb.html|
http://www.hookbug.com:5151/qq.htmlr
Adobe Photoshop CS3 Windows
2013:05:12 02:11:36
urlTEXT
MsgeTEXT
http://ns.adobe.com/xap/1.0/
" id="W5M0MpCehiHzreSzNTczkc9d"?>        
~.XPY
;t.Ge
http://www.hookbug.com:5151/qq.html
-Www.Hixxg.Com
<4,$?7/'
(3-!0,1'8"5.*2$
WSOCK32.dll
WLDAP32.dll
.PAVCException@@
Shell32.dll
Mpr.dll
Advapi32.dll
User32.dll
Gdi32.dll
(&07-034/)7 '
?? / %d]
%d / %d]
.PAVCFileException@@
: %d]
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
\\.\Scsi0:
\\.\PhysicalDrive0
%s:%d
.PAVCNotSupportedException@@
out.prn
(*.prn)|*.prn|
%d.%d
%d/%d
%d / %d
Bogus message code %d
(%d-%d):
%ld%c
(*.htm;*.html)|*.htm;*.html
%s%s%s
temp0921.vxd
~#@^&*%Xy
Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CMyString class.
20000921
X-X-X-X-X-X
\\.\PhysicalDrive%d
\\.\Scsi%d:
\\.\DiskSerial.vxd
DiskSerial.VXD
\DiskSerial.VXD
\\.\SMARTVSD
SMARTVSD.VXD
IOSUBSYS\SMARTVSD.VXD
\SMARTVSD.VXD
\IOSUBSYS\SMARTVSD.VXD
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
%s <%s>
Reply-To: %s
From: %s
To: %s
Subject: %s
Date: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
SMTP
www.dywt.com.cn
1.1.3
;3 #>6.&
'2, / 0&7!4-)1#
.PAVCOleException@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCOleDispatchException@@
.PAVCArchiveException@@
zcÁ
right-curly-bracket
left-curly-bracket
00000000000000000001
%WinDir%\cAOwkf2w3NNi61.exe
rtmp%d
Crypt32.dll
mscoree.dll
4.20.0
Unrar.dll
1, 0, 6, 6
- Skin.dll
(*.*)
1.0.0.0
-WWW.HIXXG.COM
{"{$|%~%
DBUNg[yg
00>BLTWebuk
%'%5%D%P%['d,l4r
 y%r$i$^%U N.G4B7<;9<5<0;)5"0
g~\tPiD^9T.K%D
@"<)7,20 2$2
9$5)0, .$.
9"5'0 )."0
2$,%'' '
0",%')" 
\e5.0\e.exe
SELECT SerialNumber FROM Win32_PhysicalMedia WHERE TAG='\\\\.\\PHYSICALDRIVE3'
SELECT SerialNumber FROM Win32_PhysicalMedia WHERE TAG='\\\\.\\PHYSICALDRIVE2'
SELECT SerialNumber FROM Win32_PhysicalMedia WHERE TAG='\\\\.\\PHYSICALDRIVE1'
SELECT SerialNumber FROM Win32_PhysicalMedia WHERE TAG='\\\\.\\PHYSICALDRIVE0'
Www.Hixxg.Com
Www.Hixxg.Com

cAOwkf2w3NNi61.exe_1508_rwx_00401000_0012F000:


t%SVh
t$(SSh
|$D.tm
~%UVW
u$SShe

cAOwkf2w3NNi61.exe_1508_rwx_012C0000_00072000:


`.rsrc
kernel32.dll
Windows
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
USER32.DLL
oleaut32.dll
EVariantBadIndexError
ssShift
htKeyword
EInvalidOperation
u%CNu
%s_%d
EInvalidGraphicOperation
comctl32.dll
uxtheme.dll
MAPI32.DLL
!"#$%xi.
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
ssHotTrack
TWindowState
poProportional
TWMKey
KeyPreview
WindowState
OnKeyDown
OnKeyPressl
OnKeyUp
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
User32.dll
AutoHotkeys
TMainMenuDp/
TKeyEvent
TKeyPressEvent
HelpKeyword,
crSQLWait
%s (%s)
imm32.dll
readnowid.mtx
D:\ksreg_delphi\V9\_rsa_delphi_dll\UnitSock.pas
333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
3333333
33333333
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
KWindows
UrlMon
GetCPInfo
RegOpenKeyExA
RegCloseKey
SetViewportOrgEx
UnhookWindowsHookEx
SetWindowsHookExA
MapVirtualKeyA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
EnumWindows
EnumThreadWindows
ActivateKeyboardLayout
GetKeyboardType
38000=344
.idata
.edata
P.reloc
P.rsrc
#yfP.re
KERNEL32.DLL
advapi32.dll
gdi32.dll
user32.dll
version.dll
wsock32.dll
rsadll.dll
No help keyword specified.
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Alt  Clipboard does not support Icons/Menu '%s' is already being used by another form
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Unsupported clipboard format
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
Invalid stream format$''%s'' is not a valid component name
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Ancestor for '%s' not found
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Interface not supported
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value
I/O error %d
Integer overflow Invalid floating point operation

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:1276
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\B4.tmp (1425 bytes)
   %WinDir%\cAOwkf2w3NNi61.exe (53149 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\B2.tmp (4545 bytes)
   %System%\Configuration file1.ini (19 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\B3.tmp (3361 bytes)
   %Documents and Settings%\%current user%\Desktop\Æô¶¯Ð¦Ð¦VIP.lnk (535 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\api[1].htm (447 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\B7.tmp (1425 bytes)
   %System%\drivers\etc\hosts (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\B5.tmp (4545 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\B6.tmp (3361 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\button_10[1].gif (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\qunb[1].htm (258 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\group[1].png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\qq[1].htm (229 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\desktop.ini (67 bytes)

4. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
   127.0.0.1 localhost
   
5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.