MD5: fd9ce9438f978194b379e0b454ac0c14
SHA1: c71750b1c744decd3b578ce99ea3a16f3a44d2e4
SHA256: f8d4d78afba39c76512690c4339224863d3e594c617de831e833a5794234d63a
SSDeep: 3072:ps7AwB5/jwO0oa9knbwxLBHRC0s sout6F:psh9jE9ObwZxSoS6F
Size: 101224 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: no certificate found
Created at: 2012-12-06 15:32:00
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

RUpdate.exe:1792
RUpdate.exe:1512
Zona.exe:1240
Zona.exe:788
%original file name%.exe:1392
%original file name%.exe:772

The Trojan injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process RUpdate.exe:1792 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Rambler\Holdem\assistcookie.tmp (10 bytes)
%Documents and Settings%\%current user%\Application Data\Rambler\Holdem\holdem_scheduler.log (2796 bytes)
%Documents and Settings%\%current user%\Application Data\Rambler\Holdem\ping.tmp (86 bytes)
%Documents and Settings%\%current user%\Application Data\Rambler\Holdem\searcherror.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\p[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\p[1].gif (43 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\del_cookie_assist[1].xml (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Rambler\RamblerUpdater\rupdate.exe (7726 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\setsearch[1].xml (5 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@rambler[1].txt (167 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\p[1].gif (0 bytes)
%Documents and Settings%\%current user%\Application Data\Rambler\Holdem\assistcookie.tmp (0 bytes)
%Documents and Settings%\%current user%\Application Data\Rambler\Holdem\ping.tmp (0 bytes)
%Documents and Settings%\%current user%\Application Data\Rambler\Holdem\searcherror.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\p[1].gif (0 bytes)

The process RUpdate.exe:1512 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Rambler\Holdem\holdem_scheduler.log (570 bytes)

The process Zona.exe:1240 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Zona\launch.log (7639 bytes)

The process Zona.exe:788 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Zona\launch.log (19063 bytes)

The process %original file name%.exe:1392 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Zona\init.xml (255 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\zona.ru\zona.sol (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\appdata.7z (1326784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zon1.tmp (47 bytes)
%Documents and Settings%\%current user%\Start Menu\Zona.lnk (706 bytes)
%Documents and Settings%\%current user%\Desktop\Zona.lnk (706 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Zona.7z (435264 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rambler_r33.7z (27336 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zon2.tmp (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZonaInstall.log (14173 bytes)

The process %original file name%.exe:772 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\Zona\utils.jar (29 bytes)
%Program Files%\Zona\License_uk.rtf (21 bytes)
%Program Files%\Zona\License_en.rtf (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZonaInstall.log (7131 bytes)
%Program Files%\Zona\License_ru.rtf (23 bytes)

Registry activity

The process RUpdate.exe:1792 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{00000000-4EB2-4FC3-BD68-7067448F7A06}]
"URL" = "http://nova.rambler.ru/search?query={searchTerms}&utm_source=r33&utm_medium=distribution&utm_content=e09&utm_campaign=c01"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{00000000-4EB2-4FC3-BD68-7067448F7A06}]
"SuggestionsURL_JSON" = "http://nova.rambler.ru/suggest?v=3&query={searchTerms}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{00000000-4EB2-4FC3-BD68-7067448F7A06}]
"ShowSearchSuggestions" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{00000000-4EB2-4FC3-BD68-7067448F7A06}]
"OSDFileURL" = "http://www.rambler.ru/i/osd.xml"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.rambler.ru/?utm_source=r33&utm_medium=distribution&utm_content=e08&utm_campaign=c01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{00000000-4EB2-4FC3-BD68-7067448F7A06}"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{00000000-4EB2-4FC3-BD68-7067448F7A06}]
"FaviconURL" = "http://i.rl0.ru/favicon.ico"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{00000000-4EB2-4FC3-BD68-7067448F7A06}]
"SortIndex" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "79 09 28 37 6D 9F 8D DC 78 3C 45 71 84 95 5A 29"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.rambler.ru/?utm_source=r33&utm_medium=distribution&utm_content=e08&utm_campaign=c01"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{00000000-4EB2-4FC3-BD68-7067448F7A06}]
"DisplayName" = "Rambler"
"Codepage" = "65001"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Rambler Update RunOnce" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Rambler\RamblerUpdater\rupdate.exe /fromrunonce /standalone r33 /sethome /setsearch"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page"

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Rambler Update Assistant"

The process RUpdate.exe:1512 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "97 DE 72 7D BC 2E 14 61 61 50 E3 35 FE 40 63 DF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process Zona.exe:1240 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C1 88 60 B1 12 63 ED 14 0A 7A 28 E8 CE E9 C4 85"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process Zona.exe:788 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1C 03 D7 65 24 E3 3E 14 6B 02 0D A0 16 6D 57 8D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process %original file name%.exe:1392 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\.zona]
"(Default)" = "Zona"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Zona]
"DisplayName" = "Zona"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Zona]
"InstallDate" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.torrent\OpenWithProgids]
"Zona" = ""

[HKCU\Software\Zona]
"PID" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Zona]
"DisplayIcon" = "%Program Files%\Zona\Zona.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Zona)]
"DisplayName" = "Zona"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Zona]
"Guid" = "C0560306-7F41-4CA6-878C-8CA6FF61642B"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Zona]
"NoRepair" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\Zona\DefaultIcon]
"(Default)" = "%Program Files%\Zona\torrent.ico"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Zona]
"UninstallString" = "%Program Files%\Zona\uninstall.exe"
"Publisher" = "Zona Team"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\.zona]
"(Default)" = "Zona"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Zona]
"NoModify" = "1"
"EstimatedSize" = "30720"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Classes\.torrent]
"(Default)" = "Zona"

[HKCU\Software\Zona]
"DownloadsDir" = "%Documents and Settings%\%current user%\My Documents\Zona Download"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\c:]
"%original file name%.exe" = "fd9ce9438f978194b379e0b454ac0c14"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Classes\Zona\shell\open\command]
"(Default)" = "%Program Files%\Zona\Zona.exe %1"

[HKCU\Software\Zona]
"InstallLang" = "1033"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Classes\Zona]
"URL Protocol" = ""

[HKCR\Applications\Zona.exe\shell\open\command]
"(Default)" = "%Program Files%\Zona\Zona.exe %1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BE 4E 69 6A FE C6 03 20 70 AC 62 D4 92 14 71 BB"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Zona]
"Zona.exe" = "Zona"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Zona]
"Path" = "%Program Files%\Zona"

[HKCR\.torrent]
"(Default)" = "Zona"

[HKCU\Software\Zona]
"exec" = "%Program Files%\Zona\Zona.exe"

[HKCU\Software\Classes\Zona\shell]
"(Default)" = "open"

[HKCU\Software\Zona]
"pinstall" = "rambler"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Zona" = "%Program Files%\Zona\Zona.exe /MINIMIZED"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Program Files%\Zona]
"Zona.exe" = "%Program Files%\Zona\Zona.exe:*:Enabled:Zona"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:772 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EF 47 CE 75 51 39 0F A6 45 FE 45 0C C6 39 CB 58"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 8
86fd03030ee25e4059214002cc1103cd
a44dcc564fa758f6961abb0c91d4d1b6
7aa37f40187649f0af3cbe90474ccef5
592af76bd80d76e8ccf63e36f132bc49
32a11d7abd9916129401e7cf62ad6f94
b9fc7cee4d906c89a92c8b1093ddb1d1
9d63565736cc22069b79213fccf230d7
187319dbbf64c9d7adb89d22de8d1c5e

URLs

URL	IP
hxxp://zona.ru/installer.html?guid=C0560306-7F41-4CA6-878C-8CA6FF61642B&mode=installStart&version=wDec__6_2012_19_31_55&os=5.1.2600&installId=E3E8062A-1506-4C0C-B22D-C964EAD17524&pid=1&torrentHash=c440c85b665b94fdc8054f69e63a2c2176181fcc&pinstall=rambler&md5=fd9ce9438f978194b379e0b454ac0c14	5.35.172.6
hxxp://dl.zona.ru/appdata.7z	46.254.16.107
hxxp://dl.zona.ru/Zona.7z	46.254.16.107
hxxp://stat.miniload.org/installer.html?guid=C0560306-7F41-4CA6-878C-8CA6FF61642B&mode=installStart&version=wDec__6_2012_19_31_55&os=5.1.2600&installId=E3E8062A-1506-4C0C-B22D-C964EAD17524&pid=1&torrentHash=c440c85b665b94fdc8054f69e63a2c2176181fcc&pinstall=rambler&md5=fd9ce9438f978194b379e0b454ac0c14	46.254.17.199
hxxp://zona.ru/img/no-cover.jpg	5.35.172.6

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /appdata.7z HTTP/1.1

User-Agent: ZONA_httpget

Host: dl.zona.ru

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 22 Mar 2016 11:09:24 GMT

Content-Type: application/x-7z-compressed

Content-Length: 20696765

Last-Modified: Thu, 24 Dec 2015 05:58:18 GMT

Connection: keep-alive

Content-MD5: caa8ecbd2704a23b18d8430bbc9e6b11

ETag: "567b897a-13bcebd"

Accept-Ranges: bytes
].............(..`(...;.Z)..ML.x....;.[...$&..7..^.....4.L.Y\|..=.....
....q7...P1E..d.. $.qEW.;..t...&...3{..?.....#.K.@<.^......sj.Pk.c.
e..Oc..........w.!...V7.......u~.{.o..H.S.e(.&.:{.A.W...bf.\..4.K0$.Y.
... z.v.J...g.V\LT.*Z9.C.AV.}K...={:"..n.....s&...K]9....v.....Y......
...n/...t.Im..].Q...4~..V..'%}).....].#|?.ed..6..1..o.E....H....s@>
......O....0L...(.:[email protected]....!PQ....}.\ ..b.]N.v.K..?.....
y...}.X.HS.../yuXdt......U.!.I6SgLZ.3~..i.H.:........7&.f&.G...;......
.1..B{zI.l..."H)'..8...kn..%...s*G.._..g..........h,uj_De..n(.R:..,._.
...<..pd.{.Y.\[email protected][email protected]. .|.h.N./..
....q.P..U<.X:m.........M..../...C[.`.....D1.._-.G...4..~.Yh;?.."..
g..;.....Va..i.&n.;....zx.C......E.%..p.q5.9C.GT.....iMg.7.'}6..S..S..
..Bp.c.EQ._.}.H..... {..._f..}A..O....J,&.. [email protected].]s...U9R<...>
;...)O....%....E.}'b...h!..-.B.....e.m......f./..T.i..*...s2bY.%....`.
Ed...u.w.uN..D....8Yt.g..|.J..Q.]\.#..Y9......:......P|vB3.j.....~..t#
^y.....9.....c....jQ....>@F.....?,[email protected]|...u..3ovqT.}.[..
..M...9.r.....J.Y~.;.....:[email protected]@.....u.[..*k}...*c...
!.T...'0\..L....K.v=..........J..:w..........r.&...a....xNPP*v..I..mSN
....f..k..'...d....0u...^.U.w$.z.*..1..I..x.z.M=.<.....=.B7H..anD..
n|..Em..Q..~X%.d....z.......L.g.wo\H...4f.AI.Q..3.p..]S...x/....TE.C.y
....n..d]x..,..4k._..i s.......^v.\o..[.....y(K/.[qk...5W.[...M..1.u..
F=...v...r.~...&.....8..2./T....8......Jy.....>.foy|H..)F.G.,A....o
&.pE..t..~'...h.M.Id.=...X.... ....\.N....8..Qs....,......m"!.....
<<< skipped >>>

GET /installer.html?guid=C0560306-7F41-4CA6-878C-8CA6FF61642B&mode=installStart&version=wDec__6_2012_19_31_55&os=5.1.2600&installId=E3E8062A-1506-4C0C-B22D-C964EAD17524&pid=1&torrentHash=c440c85b665b94fdc8054f69e63a2c2176181fcc&pinstall=rambler&md5=fd9ce9438f978194b379e0b454ac0c14 HTTP/1.1

User-Agent: ZONA_httpget

Host: stat.miniload.org

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 22 Mar 2016 11:09:23 GMT

Content-Type: text/html;charset=UTF8

Content-Length: 47

Connection: keep-alive
<response time="1458644963847" idState="free"/>HTTP/1.1 200 OK..
Server: nginx..Date: Tue, 22 Mar 2016 11:09:23 GMT..Content-Type: text
/html;charset=UTF8..Content-Length: 47..Connection: keep-alive..<re
sponse time="1458644963847" idState="free"/>..

GET /installer.html?guid=C0560306-7F41-4CA6-878C-8CA6FF61642B&mode=installStart&version=wDec__6_2012_19_31_55&os=5.1.2600&installId=E3E8062A-1506-4C0C-B22D-C964EAD17524&pid=1&torrentHash=c440c85b665b94fdc8054f69e63a2c2176181fcc&pinstall=rambler&md5=fd9ce9438f978194b379e0b454ac0c14 HTTP/1.1

User-Agent: ZONA_httpget

Host: zona.ru

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently

Server: nginx

Date: Tue, 22 Mar 2016 11:09:20 GMT

Content-Type: text/html

Content-Length: 178

Connection: keep-alive

Location: hXXp://stat.miniload.org/installer.html?guid=C0560306-7F41-4CA6-878C-8CA6FF61642B&mode=installStart&version=wDec__6_2012_19_31_55&os=5.1.2600&installId=E3E8062A-1506-4C0C-B22D-C964EAD17524&pid=1&torrentHash=c440c85b665b94fdc8054f69e63a2c2176181fcc&pinstall=rambler&md5=fd9ce9438f978194b379e0b454ac0c14
<html>..<head><title>301 Moved Permanently</title
></head>..<body bgcolor="white">..<center><h1&
gt;301 Moved Permanently</h1></center>..<hr><cent
er>nginx</center>..</body>..</html>..HTTP/1.1 301
 Moved Permanently..Server: nginx..Date: Tue, 22 Mar 2016 11:09:20 GMT
..Content-Type: text/html..Content-Length: 178..Connection: keep-alive
..Location: hXXp://stat.miniload.org/installer.html?guid=C0560306-7F41
-4CA6-878C-8CA6FF61642B&mode=installStart&version=wDec__6_2012_19_31_5
5&os=5.1.2600&installId=E3E8062A-1506-4C0C-B22D-C964EAD17524&pid=1&tor
rentHash=c440c85b665b94fdc8054f69e63a2c2176181fcc&pinstall=rambler&md5
=fd9ce9438f978194b379e0b454ac0c14..<html>..<head><title
>301 Moved Permanently</title></head>..<body bgcolor
="white">..<center><h1>301 Moved Permanently</h1>
</center>..<hr><center>nginx</center>..</bo
dy>..</html>....

GET /Zona.7z HTTP/1.1

User-Agent: ZONA_httpget

Host: dl.zona.ru

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 22 Mar 2016 11:09:27 GMT

Content-Type: application/x-7z-compressed

Content-Length: 6841699

Last-Modified: Thu, 24 Dec 2015 06:09:23 GMT

Connection: keep-alive

Content-MD5: 1000528de212b75d1e98e1b79f725681

ETag: "567b8c13-686563"

Accept-Ranges: bytes
].............(..`(...;.ac..ML.].....W.....nED..*.$. .\#...F...Z....?.
...)......;;M..Q.b$..g.cj2.....T.........j.&..J}hZ.`Z...........P0...:
.W..4.......p..-....sK.I...........E..5..M[..i!.4.............0..t.Y.J
.,......%....6....*..*F2s=..y......<....X.s....:$...e..r.%...'tfN.y
.ai....eo.*..H. N{K.>A.k;.QpJ....>'..Q.&....3..ej.\!Ou....Q%_...
....No..7....)J..^.........oy.....<>.C4....7..\.gC.....l...../..
.2.%..3r7}B=..#...*Qa....Jy...4.e^..7.^.Ry...f.0f.|j.e....x...)..5>
...A|`..L....^.../'..........c......jB../.w..._w..?........|2..D~....F
....o..8....J'F...u..e3...r.....]...........U3...}..IT........y..5Y..i
G.f%.............d.....H..J9....?.9;.Ldm......$o..B.c...GH.b.....N*-.u
....'.&_.....C..V....:#..A..G.............I...O.w...z.....1...C..cV...
}W....2..d..,.np.....?.....gZJ3.o..]>...N.m..>..4.C........... .
......s..D.......:s..\h.Y.7l;FSsi....Y.....&.L{.Z...|.J..g.Q..m....Tm&
.5.._...i [&~.yw..M...E.oD....$........~..I..:j:].....h.y7.dI.."..7u.&
.....E...f..PA../.6.b..O<.<[email protected]<..j........k...]
.....GO......g.7.....t....6.....5.n4.I"3x.....w.G........n*...j......u
`[email protected].#qK..d...5....x.W3I...Dn2Wx...N..i......y#........ ...t...E..
..>..........nD......^$X....<.'a............W...6.D.s...Qf`.%...
0@%;... 6......._tu.O#...w.V.....8&/.....w.7..c....H.&.h.(.~..X."=....
`.`.gy..<t......!...*.7Cs5........&...n."lj.'.Z...........R..Xn....
...n..F;y.X.{..@^{S!..F]-HF....h.....18...j..L..U$........s.c..z.,.T=T
.W.....W...a:.....dK.....Hs..qj.HZ<.uT........N............R...
<<< skipped >>>

GET /img/no-cover.jpg HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: zona.ru

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Server: nginx

Date: Tue, 22 Mar 2016 11:09:23 GMT

Content-Type: text/html

Content-Length: 5630

Connection: keep-alive

ETag: "56ea60d7-15fe"
<!DOCTYPE html>.<html lang=ru>.  <head>.    <meta
 charset=UTF-8>.    <title>Zona - .............. ............
...... .............. ............ ........ .. .......................
. ..........</title>..    .      <meta property=og:type conte
nt=website>.      <meta property=og:title content=".............
....... ............">.      <meta property=og:image content=htt
p://zona.ru/img/logo-large.png>.      <meta property=og:descript
ion name=description content="........ - .............. ..............
.... .............. ............ Zona .. ........................ ....
...... .................. .............. ............ ...... .... ....
............ ............ .. .............. ............">.      . 
   ...    .    <meta name=format-detection content="telephone=no"&g
t;..<!--     .      <meta name="apple-mobile-web-app-capable" co
ntent="yes">.      <meta name="viewport" content="width=device-w
idth, initial-scale=1, maximum-scale=1, user-scalable=no">.     --&
gt;..    .      <link rel=stylesheet href=/css/main.f965a79d.css>
;.      <link rel=stylesheet href=/css/avast.css>.    ..    .   
 .    .    <!--[if lt IE 9]><link rel="stylesheet" href="/css
/ie8.css"><![endif]-->.    <!--[if lt IE 9]><script 
src="//html5shim.googlecode.com/svn/trunk/html5.js"></script>
<![endif]-->.    .    <link rel="shortcut icon" href=/favicon
.ico>.    <link rel=apple-touch-icon href=/img/apple-touch-i
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

@.reloc

PSSSSSSh

&hx%D

xSSSh

FTPjKS

FtPj;S

C.PjRV

Visual C   CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

portuguese-brazilian

GetProcessWindowStation

operator

inflate 1.1.3 Copyright 1995-1998 Mark Adler

123456789

u/megamakc/core/JavaVer.class

ru/megamakc/core/JavaArch.class

D:\workspace_mars\Installer\Installer\Release\ZonaRunner.pdb

GdiplusShutdown

gdiplus.dll

InternetCrackUrlW

HttpSendRequestW

HttpAddRequestHeadersW

HttpQueryInfoW

HttpOpenRequestW

WININET.dll

GetWindowsDirectoryW

KERNEL32.dll

EnumWindows

USER32.dll

GDI32.dll

RegCreateKeyExW

RegOpenKeyW

RegOpenKeyExW

RegEnumKeyExW

RegCloseKey

ADVAPI32.dll

ShellExecuteExW

ShellExecuteW

SHFileOperationW

SHELL32.dll

SHLWAPI.dll

VERSION.dll

GetCPInfo

zcÁ

.?AVUrlLinkLabel@@

.?AVExecuteProcessCommand@@

.?AVKeyState@@

.?AVWindowsRegistry@@

8|u%SS3

04|#04|.04|?04|

.tgPV

FTPjK

FtPj;

C.PjRVj

9|u.VV3

!7|&"7|~"7|

msvcr71.pdb

kernel32.dll

6y4|__MSVCRT_HEAP_SELECT

MSVCR71.dll

_CRT_RTC_INIT

__crtCompareStringA

__crtCompareStringW

__crtGetLocaleInfoW

__crtGetStringTypeW

__crtLCMapStringA

__crtLCMapStringW

__p__acmdln

__p__wcmdln

_acmdln

_amsg_exit

_execl

_execle

_execlp

_execlpe

_execv

_execve

_execvp

_execvpe

_pipe

_wcmdln

_wexecl

_wexecle

_wexeclp

_wexeclpe

_wexecv

_wexecve

_wexecvp

_wexecvpe

setnewh.cpp

mscoree.dll

- This application cannot run using the active version of the Microsoft .NET Runtime

Please contact the application's support team for more information.

4|GetProcessWindowStation

user32.dll

internal state. The program cannot safely continue execution and must

continue execution and must now be terminated.

n5|.com

cmd.exe

command.com

%S#[k

?#%X.y

GetConsoleOutputCP

PeekNamedPipe

CreatePipe

Assertion failed: %s, file %s, line %d

"%7|"%7|

;$;*;/;7;

7$858=8{8

8!8%8*898

5]5Q5\5i5

11m1

;'; ;7;;;

9 9$94989

`.data

MSVCR100.dll

??0invalid_operation@Concurrency@@QAE@PBD@Z

??0invalid_operation@Concurrency@@QAE@XZ

??0invalid_oversubscribe_operation@Concurrency@@QAE@PBD@Z

??0invalid_oversubscribe_operation@Concurrency@@QAE@XZ

??0invalid_scheduler_policy_key@Concurrency@@QAE@PBD@Z

??0invalid_scheduler_policy_key@Concurrency@@QAE@XZ

??0operation_timed_out@Concurrency@@QAE@PBD@Z

??0operation_timed_out@Concurrency@@QAE@XZ

??0unsupported_os@Concurrency@@QAE@PBD@Z

??0unsupported_os@Concurrency@@QAE@XZ

?GetExecutionContextId@Concurrency@@YAIXZ

?GetPolicyValue@SchedulerPolicy@Concurrency@@QBEIW4PolicyElementKey@2@@Z

?SetPolicyValue@SchedulerPolicy@Concurrency@@QAEIW4PolicyElementKey@2@I@Z

?_ConcRT_Assert@details@Concurrency@@YAXPBD0H@Z

?_ConcRT_CoreAssert@details@Concurrency@@YAXPBD0H@Z

?_ConcRT_DumpMessage@details@Concurrency@@YAXPB_WZZ

?_ConcRT_Trace@details@Concurrency@@YAXHPB_WZZ

?_Trace_ppl_function@Concurrency@@YAXABU_GUID@@EW4ConcRT_EventType@1@@Z

?_ValidateExecute@@YAHP6GHXZ@Z

_CRT_RTC_INITW

__report_gsfailure

_calloc_crt

_crt_debugger_hook

_malloc_crt

_realloc_crt

_recalloc_crt

_set_malloc_crt_max_wait

wcrtomb

wcrtomb_s

xMaxPolicyElementKey

pExecutionResource

s.SVW

*Yp3.CP 

GetProcessHeap

msvcr100.i386.pdb

.?AUIExecutionContext@Concurrency@@

.?AVinvalid_oversubscribe_operation@Concurrency@@

.?AVoperation_timed_out@Concurrency@@

.?AVinvalid_operation@Concurrency@@

.?AVinvalid_scheduler_policy_key@Concurrency@@

.?AVunsupported_os@Concurrency@@

.?AUIExecutionResource@Concurrency@@

.?AVExecutionResource@details@Concurrency@@

.PAVscheduler_resource_allocation_error@Concurrency@@

.PAVexception@std@@

0$0(0,0004080<0@0

1(1/14181<1]1

1&2,2024282

4C4U4V5Z6

2!272?2{2

3&3,3:3@3

=$=(?2?=?

7 8%9-9J9Z9};

2#2)23292?2

7 7$7)7/7

1!2=2}2

8 949\9|9

= =$=(=,=

3hXXp://crl.microsoft.com/pki/crl/products/CSPCA.crl0H

,hXXp://VVV.microsoft.com/pki/certs/CSPCA.crt0

3hXXp://crl.microsoft.com/pki/crl/products/tspca.crl0H

,hXXp://VVV.microsoft.com/pki/certs/tspca.crt0

hXXp://microsoft.com0

LAUNCH_ON_WINDOWS_STARTUP=

.torrent

Mail.Ru

@Mail.Ru

[email protected]

FireFox

MAILRU_INSTALL_CHROME_EXTENSIONS=

Chrome

1.0.1.6

[email protected],

SECOND_INSTANCE_TEXT1=Found running Zona, waiting %d second(s).

NOT_ENOUGH_SPACE_TO_INSTALL=Not enough disk space, you need to %s MB of free space

ZONA_COMPONENT_NOT_FOUND=Important components of the program are not found. Please reinstall Zona.

DOWNLOADING=Downloading %s

UNPACKING=Unpacking %s

INSTALLING=Installing %s

INSTALL_SOFT_FOR_HELP=Establishing the proposed software you help %s remain free

LAUNCH_ON_WINDOWS_STARTUP=Start Zona when Windows starts

OPEN_TORRENT_VIA_ZONA=Open .torrent files in Zona

PARTNER_TITLE=Together with %s You can install additional software

MAILRU_HOME_PAGE=Set Mail.Ru homepage

MAILRU_SEARCH=Set [email protected] search by default

MAILRU_INSTALL_GUARD=Install [email protected]

@Mail.Ru for FireFox

MAILRU_INSTALL_CHROME_EXTENSIONS=Install Chrome extensions

VERSION_LESS_THAN_1016=This link works in Zona version 1.0.1.6 and above. Please wait for updates and follow the link again.

UNINSTALLER_CLOSING_ZONA=Shutdown running zona...PAD

X.Igy

j-K.PX

k.aIi

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><v3:trustInfo xmlns:v3="urn:schemas-microsoft-com:asm.v3" xmlns="urn:schemas-microsoft-com:asm.v3"><v3:security><v3:requestedPrivileges><v3:requestedExecutionLevel level="asInvoker" uiAccess="false"></v3:requestedExecutionLevel></v3:requestedPrivileges></v3:security></v3:trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS>

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS>

2$2,232=2`2

4 4$4(4,4044484<4

8!9'969}9

3"383@3|3

6&6.646:6

2 2$2(2,2024282

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

KERNEL32.DLL

WUSER32.DLL

%s\%s

Error: %d

dll d %s

ZonaUpdater.exe

Updater ver [%d.%d.%d.%d]

%s\Zona\updates\inst_*

%s\License_ru.rtf

%s\License_uk.rtf

%s\License_en.rtf

shell32.dll

%s\zona.ru

%s\zona.ru\zona.sol

\Macromedia\Flash Player\#SharedObjects\%s

\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\%s

%s\Zona\launch.log

\jre_packed.exe

/moveXUL /appDataPath "%s" /appPath "%s" /jvmPath "%s"

ttp://dl.zonainst.com/jre_packed.exe

ttp://dl.zonainst.com/jre_latest.exe

msvcr71.dll

msvcr100.dll

%s %s -classpath Zona.jar;swt.jar -Dlog4j.configuratorClass=org.gudy.azureus2.core3.util.LogConfigurator ru.zona.Main %s

%sjavaw.exe

Exception in Janel.main()

%s\utils.jar

Exception in Janel.getProperties()

Exception in Janel.launchJavaMainMethod()

ttp://zona.ru

ttp://zona.ru/?ref=%s

\Zona.jar

\zreg.dll

\swt.jar

@ExecuteProcessCommand

xecute process, WAIT cmd:

xit code is %d

13:45:09

oftware\%s

[%d_%d_%d %d:%d:%d:%d] %s : [%s] : %s

%s%s%s

httpget start asynch loading

wininet.dll

id:%s url:%s ErrorCode:%d

%s ErrorText:%s

httpget

InternetCrackUrl

%sx

HttpOpenRequest

Range: bytes=%d-

HttpSendRequest

HttpQueryInfo

%s_%s

Error copy file, err: %d

Error delete file, err: %d

avaVer.class found

%s\bin\javaw.exe" -classpath "%s" ru.megamakc.core.JavaVer

avaVer.class NOT FOUND

%s\bin\javaw.exe" -classpath "%s" org.gudy.azureus2.core3.util.Constants

s\Zona.jar

s\plugins\zxulrunner\plugin.properties

s\plugins\zxulrunner10\plugin.properties

s\plugins\zxulrunner*|%s\plugins

s.

Exception in JVMInfo.getComparableVersionUsingRegularVersion()

Exception in JVMInfo.adjustComparableVersionForJavaBundle()

Exception in JVMInfo.adjustComparableVersionForBinJvmDir()

Exception in JVMInfo.clone()

Exception in JVMInfo.getJrePath()

Exception in JVMInfo.existsJvmDLL()

Error while testing if JVM.DLL exists.

\jvm.dll

Exception in JVMInfo.getJvmDLLPath()

Error while getting the jvm.dll path.

javaw.exe

\bin\splashscreen.dll

Loading splashscreen.dll from

Failed to load splashscreen.dll

command line arg[%u]=%s

Exception in JVMLauncher.launch()

-Djava.class.path=

-Djava.library.path=

Exception in JVMLauncher.setupJavaVMInitArgs()

Exception in Properties.loadProperties()

-Xmx%dm

-XX:ErrorFile="%s\Zona\errors\hs_err_pid%%p.log"

-Dlog4j.configuratorClass=org.gudy.azureus2.core3.util.LogConfigurator

-Djava.class.path=Zona.jar;swt.jar

ru.zona.Main

m_fullPathAndNameOfExe=

Exception in Properties.isVersionLessThanEqualMax()

Exception in Properties.isVersionGreaterThanEqualMin()

-Dprocess.id=%u

-Djava.class.path

-Djava.library.path

Error adding directories to java.library.path.

,m_javaSystemProperties[%u]=%s

,m_commandLineArguments[%u]=%s

Exception in LocalUtilites.trim()

Exception in LocalUtilites.fileExists()

AException in PropertiesFile.loadPropertiesFromFile()

Ajanel.main.class

janel.bin.jvm.dir

janel.java.bundle

janel.min.java.version

janel.max.java.version

janel.jvm.path

janel.java.home.path

janel.trap.console.ctrl

janel.classpath.jars.dir

janel.classpath.jars.dir.recursive

janel.debug.file

janel.library.path.dir

janel.library.path.dir.recursive

janel.working.dir

janel.main.argument

janel.sysprop.process.id

janel.splash

janel.memory.check.limits

janel.memory.max.available.percent

janel.memory.max.total.percent

janel.memory.max.upper.limit

janel.memory.max.lower.limit

janel.memory.init.available.percent

janel.memory.init.total.percent

janel.memory.init.upper.limit

janel.memory.init.lower.limit

janel.error.default.text

janel.error.show.detail

FOUND_EXE_FOLDER

sJavaArch.class found

"%s\bin\javaw.exe" -classpath "%s" ru.megamakc.core.JavaArch

JavaArch.class NOT FOUND

Exception in JVMChooser.getBestJVM()

%s\jre

%s\bin\client\jvm.dll

Exception in JVMChooser.getAllJVMs()

Exception in JVMChooser.breakoutBinJvmDirs()

JVMChooser.determineVersions version is bad:

Exception in JVMChooser.determineVersions()

Exception in JVMChooser.removeUnacceptableJVMs()

Exception in JVMChooser.getJvmFromCustomJvmPath():

Exception in JVMChooser.getJvmFromCustomJvmPath()

Exception in JVMChooser.getJvmFromCustomJavaHomePath():

Exception in JVMChooser.getJvmFromCustomJavaHomePath()

Exception in JVMChooser.getJvm()

fullKeyPath=

Exception in WindowsRegistry.addAllSdkJvms()

Exception in WindowsRegistry.addAllJreJvms()

Registry key

Briched20.dll

%Program Files%\Zona\Zona.exe

7.10.3052.4

MSVCR71.DLL

Visual Studio .NET

wUSER32.DLL

advapi32.dll

[%d:%d:%d:%d(%d)] %S: !!!!!!!Assert Failed(%S: %d)

[%d] %S: !!!!!!!Assert Failed(%S: %d)

[%d:%d:%d:%d(%d)]

ADVAPI32.DLL

10.00.30319.415

msvcr100_clr0400.dll

msvcr100.dl

1.0.6.5

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   RUpdate.exe:1792
   RUpdate.exe:1512
   Zona.exe:1240
   Zona.exe:788
   %original file name%.exe:1392
   %original file name%.exe:772

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Application Data\Rambler\Holdem\assistcookie.tmp (10 bytes)
   %Documents and Settings%\%current user%\Application Data\Rambler\Holdem\holdem_scheduler.log (2796 bytes)
   %Documents and Settings%\%current user%\Application Data\Rambler\Holdem\ping.tmp (86 bytes)
   %Documents and Settings%\%current user%\Application Data\Rambler\Holdem\searcherror.tmp (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\p[1].gif (43 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\p[1].gif (43 bytes)
   %Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\del_cookie_assist[1].xml (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Rambler\RamblerUpdater\rupdate.exe (7726 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\setsearch[1].xml (5 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@rambler[1].txt (167 bytes)
   %Documents and Settings%\%current user%\Application Data\Zona\launch.log (7639 bytes)
   %Documents and Settings%\%current user%\Application Data\Zona\init.xml (255 bytes)
   %Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\zona.ru\zona.sol (47 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\appdata.7z (1326784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zon1.tmp (47 bytes)
   %Documents and Settings%\%current user%\Start Menu\Zona.lnk (706 bytes)
   %Documents and Settings%\%current user%\Desktop\Zona.lnk (706 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Zona.7z (435264 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\rambler_r33.7z (27336 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zon2.tmp (47 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ZonaInstall.log (14173 bytes)
   %Program Files%\Zona\utils.jar (29 bytes)
   %Program Files%\Zona\License_uk.rtf (21 bytes)
   %Program Files%\Zona\License_en.rtf (5 bytes)
   %Program Files%\Zona\License_ru.rtf (23 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
   "Rambler Update RunOnce" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Rambler\RamblerUpdater\rupdate.exe /fromrunonce /standalone r33 /sethome /setsearch"
   
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Zona" = "%Program Files%\Zona\Zona.exe /MINIMIZED"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.