MD5: 5b60d99ba2331c9048dc0b215efe6caa
SHA1: de04ce2cca17dade22fae22a666c672a9e58f46b
SHA256: dd94cce1188ae9a85bb04ed40e285a58e8fb0942fd7a5578b34991552ef29be6
SSDeep: 6144:jeO4eJPBtO0qzxna dl6YHey2ZYc6Hknq73ZX8wjveEtt2NB6 shLfXc0Ff2I03d:ZJPKzxa d8Yz2TqNyEWfXshbN2fd
Size: 508464 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: UCUYN
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit

Summary:

Virus. A program that recursively replicates a possibly evolved copy of itself.

Payload

Process activity

The Virus creates the following process(es):

%original file name%.exe:268

The Virus injects its code into the following process(es):

Explorer.EXE:1140

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:268 makes changes in the file system.
The Virus creates and/or writes to the following file(s):

%WinDir%\system.ini (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\netlog.txt (35 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\HwInfo.dll (1062 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\StdUtils.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\inetc.dll (1888 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\WmiInspector.dll (2734 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007EFCC_Rar\%original file name%.exe (3073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\HttpRequest.dll (4512 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\modern-header.bmp (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\UAC.dll (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\xtInfoPlugin.dll (3833 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\partnersquery.txt (539 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ButtonEvent.dll (4 bytes)

The Virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ButtonEvent.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\bundle.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\HwInfo.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\StdUtils.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\WmiInspector.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\HttpRequest.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\modern-header.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\UAC.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\xtInfoPlugin.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\partnersquery.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsk1.tmp (0 bytes)

Registry activity

The process %original file name%.exe:268 makes changes in the system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\Aas]
"a1_0" = "3585464105"

[HKCU\Software\Store\WindApp]
"lastPartnerUpdate" = "12.12.2015 21:32:37"

[HKCU\Software\Aas\695404737]
"35845605" = "346"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Aas\695404737]
"50183847" = "5B68D29F5F257E60B647DC1827F5438DD92AAD1B81B3A1C6102C99131826B86429DC47A17661558ABD0B88DDDBFC8C493E11520205E0DD6E2B190FFE1E602DF47196BE3B95B876A40411FD1F49281AEC0373FF8649D483A9275B5B5EFC9412D9E9102DCB8E7DB7C56D7F098531F57995DF6F48E78C56E274F6496D19EFFCB523"
"43014726" = "0900687474703A2F2F676C616D66726F6D656173742E636F6D2F696D6167652F6C6F676F2E67696600687474703A2F2F656469726E656C692E6E65742F74722F6C6F676F2E67696600687474703A2F2F656D7261686B7563756B6B617064616E2E636F6D2F696D672F627574746F6E2E67696600687474703A2F2F676172646170616C6163652E69742F6C6F676F2E67696600687474703A2F2F686964726F7365727662697374726974612E726F2F696D616765732F6C6F676F2E67696600687474703A2F2F6261627973746F70686F7573652E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F6D616264657369676E2E756E6C756761722E636F6D2F627574746F6E2E67696600687474703A2F2F646174616C696E6B736F6C2E636F6D2F6C6F676F2E67696600687474703A2F2F736E736F66742E686F73742D65642E6D652F696D616765732F6C6F676F732E676966"

[HKCU\Software\Aas]
"a3_0" = "17001001"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas\695404737]
"21507363" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKCU\Software\Aas\695404737]
"14338242" = "0"
"7169121" = "215"

"28676484" = "35"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B5 C2 AC 48 7B 5D 1A 56 A9 26 20 48 C1 D1 30 E3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Aas]
"a2_0" = "9039"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_0" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Virus modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Virus modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

Firewall notifications are disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"%original file name%.exe" = "c:\%original file name%.exe:*:Enabled:ipsec"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

The Virus modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

Task Manager is disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr" = "1"

The Virus deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

Company Name: Nosibay
Product Name: WindApp
Product Version:
Legal Copyright: (c) Store
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 3.0.673.0.62793
File Description:
Comments:
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://rrbstatic.yabison.com/s2/Install/Update.Addons.test/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=/e.gif
hxxp://rrbstatic.yabison.com/s2/Install/Update.Addons.start/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=/e.gif
hxxp://fr-inst.windapp.net/bundles/activelist.php	83.145.109.178
hxxp://rrbstatic.yabison.com/s2/Install/Update.Nsis.bundlesrequest/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=offer=0/e.gif
hxxp://rrbstatic.yabison.com/s2/Install/Update.PartnerPage.abort/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=&offer=0/e.gif
hxxp://rrbstatic.yabison.com/s2/Install/Update.Addons.complete/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=/e.gif
hxxp://fr-st.windapp.net/s2/Install/Update.Addons.test/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=/e.gif	91.121.69.110
hxxp://fr-st.windapp.net/s2/Install/Update.Addons.start/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=/e.gif	91.121.69.110
hxxp://fr-st.windapp.net/s2/Install/Update.Nsis.bundlesrequest/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=offer=0/e.gif	91.121.69.110
hxxp://fr-st.windapp.net/s2/Install/Update.PartnerPage.abort/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=&offer=0/e.gif	91.121.69.110
hxxp://fr-st.windapp.net/s2/Install/Update.Addons.complete/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=/e.gif	91.121.69.110

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers

Traffic

POST /bundles/activelist.php HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Filename: partnersquery.txt

User-Agent: NSIS_Inetc (Mozilla)

Host: fr-inst.windapp.net

Content-Length: 279

Connection: Keep-Alive

Cache-Control: no-cache

c=&p=yes&ins=&lastupt=&phase=update&tag=&vuid=&offer=0&offerscount=1&browser=IEXPLORE.EXE&firewall=&os=Microsoft Windows XP Professional version : 5.1.2600 service pack : 3.0&AntiVirus=&DotNet=2.0.0&screen=1276x846&cpuspeed=3391&memory=512&bgcolor=D4D0C8&apc=APC157&enable=&api=2
HTTP/1.1 200 OK

Date: Sat, 12 Dec 2015 19:32:29 GMT

Server: Apache

X-Powered-By: PHP/5.1.6

Pragma: no-cache

Expires: 0

Content-Transfer-Encoding: binary

Content-Length: 0

Connection: close

Content-Type: text/plain; charset=iso-8859-1

GET /s2/Install/Update.Addons.test/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=/e.gif HTTP/1.1

User-Agent: urlRequest

Host: fr-st.windapp.net

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 12 Dec 2015 19:32:27 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: keep-alive

Keep-Alive: timeout=5

Expires: Sat, 12 Dec 2015 19:32:26 GMT

Cache-Control: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: ng
inx..Date: Sat, 12 Dec 2015 19:32:27 GMT..Content-Type: image/gif..Con
tent-Length: 43..Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT..Connect
ion: keep-alive..Keep-Alive: timeout=5..Expires: Sat, 12 Dec 2015 19:3
2:26 GMT..Cache-Control: no-cache..GIF89a.............!.......,.......
....L..;....


GET /s2/Install/Update.Addons.start/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=/e.gif HTTP/1.1

User-Agent: urlRequest

Host: fr-st.windapp.net

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 12 Dec 2015 19:32:29 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: keep-alive

Keep-Alive: timeout=5

Expires: Sat, 12 Dec 2015 19:32:28 GMT

Cache-Control: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: ng
inx..Date: Sat, 12 Dec 2015 19:32:29 GMT..Content-Type: image/gif..Con
tent-Length: 43..Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT..Connect
ion: keep-alive..Keep-Alive: timeout=5..Expires: Sat, 12 Dec 2015 19:3
2:28 GMT..Cache-Control: no-cache..GIF89a.............!.......,.......
....L..;....


GET /s2/Install/Update.Nsis.bundlesrequest/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=offer=0/e.gif HTTP/1.1

User-Agent: urlRequest

Host: fr-st.windapp.net

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 12 Dec 2015 19:32:30 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: keep-alive

Keep-Alive: timeout=5

Expires: Sat, 12 Dec 2015 19:32:29 GMT

Cache-Control: no-cache
GIF89a.............!.......,...........L..;....


GET /s2/Install/Update.PartnerPage.abort/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=&offer=0/e.gif HTTP/1.1

User-Agent: urlRequest

Host: fr-st.windapp.net

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 12 Dec 2015 19:32:30 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: keep-alive

Keep-Alive: timeout=5

Expires: Sat, 12 Dec 2015 19:32:29 GMT

Cache-Control: no-cache
GIF89a.............!.......,...........L..;....


GET /s2/Install/Update.Addons.complete/2/a4e5b4e6a99943058c936bd9f3337cdd/APC157//NONE//version=1.0.3.62793&tag=&installDate=/e.gif HTTP/1.1

User-Agent: urlRequest

Host: fr-st.windapp.net

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 12 Dec 2015 19:32:30 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: keep-alive

Keep-Alive: timeout=5

Expires: Sat, 12 Dec 2015 19:32:29 GMT

Cache-Control: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: ng
inx..Date: Sat, 12 Dec 2015 19:32:30 GMT..Content-Type: image/gif..Con
tent-Length: 43..Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT..Connect
ion: keep-alive..Keep-Alive: timeout=5..Expires: Sat, 12 Dec 2015 19:3
2:29 GMT..Cache-Control: no-cache..GIF89a.............!.......,.......
....L..;..

The Virus connects to the servers at the folowing location(s):

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

.rsrc

.text

Explorer.EXE_1140_rwx_01E00000_00001000:

|explorer.exeM_1140_

Explorer.EXE_1140_rwx_03A00000_0108E000:

c:\windows

hXXp://glamfromeast.com/image/logo.gif

hXXp://edirneli.net/tr/logo.gif

hXXp://emrahkucukkapdan.com/img/button.gif

hXXp://gardapalace.it/logo.gif

hXXp://hidroservbistrita.ro/images/logo.gif

hXXp://babystophouse.com/images/logo.gif

hXXp://mabdesign.unlugar.com/button.gif

hXXp://datalinksol.com/logo.gif

hXXp://snsoft.host-ed.me/images/logos.gif

%System%\drivers\kdhhe.sys

5200312201

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

.rsrc

.text

hXXp://89.119.67.154/testo5/

hXXp://kukutrustnet777.info/home.gif

hXXp://kukutrustnet888.info/home.gif

hXXp://kukutrustnet987.info/home.gif

KERNEL32.dll

USER32.dll

h.rdata

H.data

.reloc

ntoskrnl.exe

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731)

Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion

hXXp://VVV.klkjwre9fqwieluoi.info/

hXXp://kukutrustnet777888.info/

Software\Microsoft\Windows\CurrentVersion\policies\system

Software\Microsoft\Windows\ShellNoRoam\MUICache

%s:*:Enabled:ipsec

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced

GdiPlus.dll

hXXp://

ipfltdrv.sys

VVV.microsoft.com

?%x=%d

&%x=%d

SYSTEM.INI

USER32.DLL

.%c%s

\\.\amsint32

NTDLL.DLL

autorun.inf

ADVAPI32.DLL

win%s.exe

%s.exe

WININET.DLL

InternetOpenUrlA

avast! Web Scanner

Avira AntiVir Premium WebGuard

cmdGuard

cmdAgent

Eset HTTP Server

ProtoPort Firewall service

SpIDer FS Monitor for Windows NT

Symantec Password Validation

WebrootDesktopFirewallDataService

WebrootFirewall

%d%d.tmp

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

%s\%s

%s\Software\Microsoft\Windows\CurrentVersion\Ext\Stats

Software\Microsoft\Windows\CurrentVersion\Ext\Stats

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

Explorer.exe

A2CMD.

ASHWEBSV.

AVGCC.AVGCHSVX.

DRWEB

DWEBLLIO

DWEBIO

FSGUIEXE.

MCVSSHLD.

NPFMSG.

SYMSPORT.

WEBSCANX.

.adata

M_%d_

%c%d_%d

?456789:;<=

!"#$%&'()* ,-./0123

GetProcessHeap

GetWindowsDirectoryA

RegEnumKeyExA

RegDeleteKeyA

RegOpenKeyExA

RegCreateKeyA

RegCloseKey

SHFileOperationA

&3&3&3&389

.rdata

.data

rnl.exe?

= =$=(=,=0=4=8=<=@

rv:1.9.2.3)

.NEtCLR

.klkjw:9fqwiBu

f3a.sysB

D6c.pBTab

drfig%s:*:

0}.T&?%x=

~UrlA'W

\'Web%

HTTP)s'PJ

o.ENHCD

KPCKwWEBWUPD

>*?456789:;<=

!"#$%&'()* ,-./01230 0

ADVAPI32.dll

MSVCRT.dll

SHELL32.dll

WS2_32.dll

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:268
   

2. Delete the original Virus file.
   
3. Delete or disinfect the following files created/modified by the Virus:
   

   %WinDir%\system.ini (70 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\netlog.txt (35 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\HwInfo.dll (1062 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\StdUtils.dll (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\inetc.dll (1888 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\WmiInspector.dll (2734 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\0007EFCC_Rar\%original file name%.exe (3073 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\HttpRequest.dll (4512 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\modern-header.bmp (1568 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\UAC.dll (13 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\xtInfoPlugin.dll (3833 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\partnersquery.txt (539 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\ButtonEvent.dll (4 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.