Trojan.Win32.IEDummy_ed9033a5ab
not-a-virus:HEUR:Monitor.Win32.Ardamax.gen (Kaspersky), Gen:Variant.FAkeAlert.105 (B) (Emsisoft), Trojan.Win32.IEDummy.FD, GenericInjector.YR (Lavasoft MAS)
Behaviour: Trojan, Monitor
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
| Requires JavaScript enabled! |
|---|
MD5: ed9033a5ab9cd103431c5cbc1d327c3d
SHA1: 638851cb47280957eb1815f1e95c578425e47ff4
SHA256: 8075facfbb75f2e36ef08944733e54e914548f62d3903881ec4f4a38a1279e33
SSDeep: 49152:uIsr3NYGRUaht dRx7CmOZulEDPVuGXmCakEvrHCuQ3TM2VYQrd2WAdnEK9HYPH:uPuWhsP9CmEYETVTJ3ErCuQ1f0BAH
Size: 3599360 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2015-04-12 22:49:14
Analyzed on: WindowsXP SP3 32-bit
Summary:
Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
%original file name%.exe:1932
PRo.exe:1256
LGP.exe:740
The Trojan injects its code into the following process(es):
10.0.exe:164
Mutexes
The following mutexes were created/opened:
No objects were found.
File activity
The process %original file name%.exe:1932 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\All Users\Application Data\GNPHXW\LGP.01 (81 bytes)
%Documents and Settings%\All Users\Application Data\GNPHXW\LGP.00 (2 bytes)
%Documents and Settings%\All Users\Application Data\GNPHXW\LGP.exe (17629 bytes)
%Documents and Settings%\All Users\Application Data\GNPHXW\LGP.02 (55 bytes)
C:\PRo.exe (7386 bytes)
The process PRo.exe:1256 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\PRo\10.0.exe (2694 bytes)
C:\PRo\FapCF2.dll (1084 bytes)
C:\PRo\FapCF.dll (1084 bytes)
The Trojan deletes the following file(s):
C:\PRo\__tmp_rar_sfx_access_check_2447515 (0 bytes)
The process LGP.exe:740 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\All Users\Application Data\TUT\LGP.004 (644 bytes)
The process 10.0.exe:164 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\domainpark[1].htm (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\domainpark[1].com&output=html&drid=as-drid-oo-1750951074443211 (613 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (261 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\cleardot[1].gif (43 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041020140411\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041020140411 (0 bytes)
%System%\drivers\etc\hosts (0 bytes)
Registry activity
The process %original file name%.exe:1932 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EF 27 97 BB 1C A9 E2 72 C2 8B CD 77 5B 9C C9 21"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\All Users\Application Data\GNPHXW]
"LGP.exe" = "LGP"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\c:]
"pro.exe" = "PRo"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process PRo.exe:1256 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD 9D 89 1E CD D6 A2 ED 2A 3C DE C3 FE 1F 1B B7"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\PRo]
"10.0.exe" = "10.0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\WinRAR SFX]
"C%%PRo" = "C:\PRo"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process LGP.exe:740 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6B 3A F9 2D 95 73 47 C0 4B 91 A2 13 9B B5 5D 24"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LGP Start" = "%Documents and Settings%\All Users\Application Data\GNPHXW\LGP.exe"
The process 10.0.exe:164 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016033020160331]
"CacheRepair" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016033020160331]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012016033020160331\"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016033020160331]
"CachePrefix" = ":2016033020160331:"
"CacheLimit" = "8192"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "61 A7 3F CD 59 A3 44 1B 87 B7 88 0B 20 F7 5B 03"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016033020160331]
"CacheOptions" = "11"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following registry key(s):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014041020140411]
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
| MD5 | File path |
|---|---|
| 8b55503bc54186c7592a0a68218ab881 | c:\Documents and Settings\All Users\Application Data\GNPHXW\LGP.01 |
| f9a8dd8f8b38b8a9d03fb66a8d0df4de | c:\Documents and Settings\All Users\Application Data\GNPHXW\LGP.02 |
| 5fa30c535081694f3fce3a298b294b31 | c:\Documents and Settings\All Users\Application Data\GNPHXW\LGP.exe |
| f9b8acd80e64f941d27b5b6dbbb2bd2a | c:\PRo.exe |
| 2c972501cbdb46a23f540f1d75e967d8 | c:\PRo\10.0.exe |
| bbb498665f0fab8f992f13a170d0a0aa | c:\PRo\FapCF.dll |
| bbb498665f0fab8f992f13a170d0a0aa | c:\PRo\FapCF2.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
VersionInfo
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 39972 | 40448 | 4.42322 | d757b5377d52e6b5321b79d7a3a82774 |
| .rdata | 45056 | 9122 | 9216 | 3.83132 | 153268f01def965db6f339c3a76b7fa8 |
| .data | 57344 | 8000 | 3584 | 1.59546 | d74c536cb49fae160bed11f31867c3b7 |
| .rsrc | 65536 | 3539572 | 3539968 | 5.36598 | 2fc3294902aeb12140210b2b172acae8 |
| .reloc | 3608576 | 4742 | 5120 | 2.51978 | 526ef451c025897e25a21986c03c6774 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
URLs
No activity has been detected.
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Web Traffic was not found.
The Trojan connects to the servers at the folowing location(s):
.text
`.data
.vmp0
.vmp1
.rsrc
SHDocVwCtl.WebBrowser
Facebook: wWw.Facebook.com/fappro
ieframe.dll
WebBrowser
%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB
C:\Windows\System32\ieframe.oca
user32.dll
shell32.dll
ShellExecuteA
kernel32.dll
ntdll.dll
PSAPI.DLL
VBA6.DLL
sKey
@.ihG
%Swuf
y%0XP
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
GetProcessWindowStation
USER32.DLL
operator
activation.php?code=
deactivation.php?hash=
.?AVIUrlBuilderSource@@
C:\PRo\10.0.exe
o.as{K C.jV#9
.PbyE
?`w'.aJw
q".jMS
.VDb9
P-NZ|%f
6CRTr
3B.XF
".jVN
Jz|%f
x.afy
r.PD,
z%DL=
Z1^%X
|%fwxHJ
=.vBZ<
e?%F)r
b.jHo
!e.enD
`9@1UrLl
[%xQ:
F.jvx2
0RXcú
Q.Oaa?_
.sAMwV
PUdP
O%s.{o@a?%X
e;|%f
B.Xp;>6
&).YD
NZ|%f
MSVBVM60.DLL
X%FRtefVX
L:^.YB{P\\?O.OS
l$X
(Ph.vL
.Gfji
{.FryRH)%s
ky.WQ
Lb.SJt
0.qF6
O%UiN
jk.Xx
.lgg|
.GlNj
%SZe@Z
E.cC
%Dr3mr?
u=.Ft
h}Þ
ErE.FW
N.nR/
1.Ke}
%uHq-n
s0%CM
%drpF
v-O}ZW
<F%sn
>5w%c
EiB.nE
6%FNh
q.iY!
.FQ@*b
.oBP<
%xN/L
siyZ%x
.hML%
s.ZEb
n:\a&
Xy.eU
USER32.dll
zd{%%sh=s.Bpc
.vLy3
X%F;\!Br
KERNEL32.dll
Sm.oi
J*,.Zik;
hXXp:///
C:\Users
*\AE:\srouce\modznc\Project1.vbp
C:\aim1
C:\aim2.dat
\system32\Drivers\etc\hosts.ics
crossfire.dat
HGWC.exe
iexplore.exe
hXXp://tenlua-fapcf.googlecode.com/svn/trunk/active.html
\Desktop\Google Chrome.htm
\Desktop\Google Chrome.html
\Desktop\Google Chrome.lnk
\Desktop\Mozilla Firefox.htm
\Desktop\Mozilla Firefox.html
\Desktop\Mozilla Firefox.lnk
hXXp://wm.sumohit.com/cf.html
C:\*.dll
InternetExplorer.Application
\ddraw.dll
0123456789
\???.dll
\FapCF.dll
Windows Internet Explorer
Web Browser
iexplore.exe - Application Error
crossfire.exe
\CShell.dll
LocationURL
adf.ly
Chrome_RenderWidgetHostHWND
Chrome_WidgetWin_1
MozillaWindowClass
hXXp://6b188f15.linkbucks.com
hXXp://e96c08fe.linkbucks.com
hXXp://197290c7.linkbucks.com
hXXp://863ffe29.linkbucks.com
hXXp://adf.ly/Wo4hu
hXXp://adf.ly/Wo4pL
hXXp://adf.ly/XX1H9
hXXp://adf.ly/XX1JN
hXXp://adf.ly/XX1FB
hXXp://adf.ly/ruqY2
hXXp://adf.ly/ruqZ7
hXXp://adf.ly/ruqdu
hXXp://adf.ly/ruqbS
@*\AE:\srouce\modznc\Project1.vbp
KERNEL32.DLL
mscoree.dll
Error at initialization of bundled DLL: %s
Error at hooking API "%S"
Dumping first %d bytes:
9.5.exe
10.0.exe_164_rwx_0040D000_00090000:
@.ihG
%Swuf
y%0XP
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
GetProcessWindowStation
USER32.DLL
operator
activation.php?code=
deactivation.php?hash=
.?AVIUrlBuilderSource@@
C:\PRo\10.0.exe
o.as{K C.jV#9
.PbyE
?`w'.aJw
q".jMS
.VDb9
P-NZ|%f
6CRTr
3B.XF
".jVN
Jz|%f
x.afy
r.PD,
z%DL=
Z1^%X
|%fwxHJ
=.vBZ<
e?%F)r
b.jHo
!e.enD
`9@1UrLl
[%xQ:
F.jvx2
0RXcú
Q.Oaa?_
.sAMwV
PUdP
O%s.{o@a?%X
e;|%f
B.Xp;>6
&).YD
NZ|%f
KERNEL32.DLL
mscoree.dll
Error at initialization of bundled DLL: %s
Error at hooking API "%S"
Dumping first %d bytes:
10.0.exe_164_rwx_0051D000_00001000:
Xy.eU
USER32.dll
10.0.exe_164_rwx_0051F000_00001000:
zd{%%sh=
iexplore.exe_664:
%?9-*09,*19}*09
.text
`.data
.rsrc
msvcrt.dll
KERNEL32.dll
NTDLL.DLL
USER32.dll
SHLWAPI.dll
SHDOCVW.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
rsabase.dll
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
watson.microsoft.com
IEWatsonURL
%s -h %u
iedw.exe
Iexplore.XPExceptionFilter
jscript.DLL
mshtml.dll
mlang.dll
urlmon.dll
wininet.dll
shdocvw.DLL
browseui.DLL
comctl32.DLL
IEXPLORE.EXE
iexplore.pdb
ADVAPI32.dll
MsgWaitForMultipleObjects
IExplorer.EXE
IIIIIB(II<.Fg
7?_____ZZSSH%
)z.UUUUUUUU
,....Qym
````2```
{.QLQIIIKGKGKGKGKGKG;33;33;0
8888880
8887080
browseui.dll
shdocvw.dll
6.00.2900.5512 (xpsp.080413-2105)
Windows
Operating System
6.00.2900.5512
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1932
PRo.exe:1256
LGP.exe:740 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\All Users\Application Data\GNPHXW\LGP.01 (81 bytes)
%Documents and Settings%\All Users\Application Data\GNPHXW\LGP.00 (2 bytes)
%Documents and Settings%\All Users\Application Data\GNPHXW\LGP.exe (17629 bytes)
%Documents and Settings%\All Users\Application Data\GNPHXW\LGP.02 (55 bytes)
C:\PRo.exe (7386 bytes)
C:\PRo\10.0.exe (2694 bytes)
C:\PRo\FapCF2.dll (1084 bytes)
C:\PRo\FapCF.dll (1084 bytes)
%Documents and Settings%\All Users\Application Data\TUT\LGP.004 (644 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\domainpark[1].htm (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\domainpark[1].com&output=html&drid=as-drid-oo-1750951074443211 (613 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (261 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\cleardot[1].gif (43 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LGP Start" = "%Documents and Settings%\All Users\Application Data\GNPHXW\LGP.exe" - Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
