MD5: e4206a39ac291abff0450c7d3a196d47
SHA1: b51c74e60ed1c87138c4069c168b1282a842c854
SHA256: cc1cc16159dc57a2b58edd68849639fa015d7c098e2e9095af576f658410ac48
SSDeep: 3072:kS8YCfoDaXJUQyKnblrzdMUoX5CLUNwsR6fjqIKyJ66N4oTytmVbk:kPY6dFMsLud0/9A6N4LtmC
Size: 137954 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:58
Analyzed on: WindowsXP SP3 32-bit

Summary:

Virus. A program that recursively replicates a possibly evolved copy of itself.

Payload

Process activity

The Virus creates the following process(es):

nvupd32.exe:1996
%original file name%.exe:1780

The Virus injects its code into the following process(es):
No processes have been created.

File activity

The process %original file name%.exe:1780 makes changes in the file system.
The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\0008BD8C_rar\%original file name%.exe (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\nsProcess.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\winjuhs.exe (849 bytes)
%WinDir%\system.ini (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TerminateAndDelete.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fkgbh.exe (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\NVIDIA Corporation\Update\nvupd32.exe (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw2.tmp (2104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\System.dll (11 bytes)

The Virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\nsProcess.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\winjuhs.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw1.tmp (0 bytes)
%WinDir%\8bbb7 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TerminateAndDelete.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fkgbh.exe (0 bytes)
C:\%original file name%.exe (0 bytes)

Registry activity

The process nvupd32.exe:1996 makes changes in the system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AC 34 68 F0 E8 CF 93 96 98 CA 55 56 57 30 57 3E"

[HKLM\SOFTWARE\NVIDIA Corporation\Global\nvUpdSrv]
"value" = "20121218"
"GUID" = "fb1e6bc2-6b4b-4b3d-8e60-8d73ff4a060a"

The process %original file name%.exe:1780 makes changes in the system registry.
The Virus creates and/or sets the following values in system registry:

[HKCU\Software\Stvncyfrlda]
"m2_8" = "997420773"
"m2_9" = "2732719960"
"m2_2" = "3470576471"
"m2_3" = "910908362"
"m2_0" = "5517"
"m2_1" = "1735293664"
"m2_6" = "1821804803"
"m2_7" = "3557105270"
"m2_4" = "2646190137"
"m2_5" = "86522028"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKCU\Software\Stvncyfrlda]
"m1_78" = "496890157"
"m1_73" = "4016171852"
"m1_72" = "669845477"
"m1_71" = "2088517138"
"m1_70" = "2833234694"
"m1_77" = "158145522"
"m1_76" = "466998487"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Stvncyfrlda]
"m1_74" = "2146080585"
"m2_98" = "2554772804"
"m1_144" = "1016182680"
"m1_146" = "4262087002"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKCU\Software\Stvncyfrlda]
"m1_145" = "4240694470"
"m1_142" = "1688260649"
"m1_143" = "1231434809"
"m1_140" = "1111617513"
"m2_107" = "992512885"
"m2_99" = "4290055621"
"m3_35" = "622481870"
"m3_34" = "3182011987"
"m3_37" = "4092948712"
"m3_36" = "2323956093"
"m3_31" = "2270958618"
"m3_30" = "535979247"
"m3_33" = "1413429028"
"m3_32" = "3972958089"
"m3_39" = "3234960306"
"m3_38" = "1533534215"
"m4_0" = "0"
"m4_1" = "1735290733"
"m4_2" = "3470581466"
"m4_3" = "910904903"
"m4_4" = "2646195636"
"m4_5" = "86519073"
"m4_6" = "1821809806"
"m4_7" = "3557100539"
"m4_8" = "997423976"
"m4_9" = "2732714709"
"m2_69" = "3770948725"
"m2_68" = "2035647188"
"m2_61" = "2773521814"
"m2_60" = "1038225466"
"m2_63" = "1949136233"
"m2_62" = "213838740"
"m2_65" = "1124752575"
"m2_64" = "3684420318"
"m2_67" = "300363776"
"m2_66" = "2860033184"
"m1_79" = "2790714074"
"m4_129" = "514205165"
"m4_128" = "3073881728"
"m4_125" = "2162976825"
"m4_124" = "427686092"
"m4_127" = "1338590995"
"m4_126" = "3898267558"
"m4_121" = "3811748485"
"m4_120" = "2076457752"
"m4_123" = "2987362655"
"m4_122" = "1252071922"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Stvncyfrlda]
"m2_134" = "600723418"
"m2_135" = "2336020653"
"m4_29" = "3078791001"
"m4_28" = "1343500268"
"m2_130" = "2249490722"
"m2_131" = "3984789978"
"m2_132" = "1425106115"
"m2_133" = "3160406377"
"m4_23" = "1256981195"
"m4_22" = "3816657758"
"m4_21" = "2081367025"
"m4_20" = "346076292"
"m4_27" = "3903176831"
"m4_26" = "2167886098"
"m4_25" = "432595365"
"m4_24" = "2992271928"
"m1_24" = "2112193355"
"m1_25" = "2181166612"
"m1_26" = "2783849177"
"m1_27" = "1144466001"
"m1_20" = "480859198"
"m1_21" = "3559623819"
"m1_22" = "3042679330"
"m1_23" = "1478140349"
"m1_28" = "1162819486"
"m1_29" = "3669763340"
"m3_122" = "1268937691"
"m3_123" = "3003966326"
"m3_120" = "2059882801"
"m3_121" = "3794911404"
"m3_126" = "3914972559"
"m3_127" = "1321872698"
"m3_124" = "410948325"
"m3_125" = "2179924496"
"m3_128" = "3056917673"
"m3_129" = "530927556"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKCU\Software\Stvncyfrlda]
"m1_99" = "165019942"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "49 55 66 45 62 62 E9 C3 4F 4F 7C EB B3 02 E6 54"

[HKCU\Software\Stvncyfrlda]
"m1_91" = "2051716867"
"m1_90" = "1029108706"
"m1_93" = "4115819492"
"m1_92" = "4066794608"
"m1_95" = "3262248306"
"m1_94" = "1906517587"
"m1_97" = "35254771"
"m1_96" = "1305171134"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Stvncyfrlda]
"m1_108" = "3600036583"
"m1_109" = "1361232034"
"m1_102" = "1006028312"
"m1_103" = "646318433"
"m1_100" = "3722719213"
"m1_101" = "1657642839"
"m1_106" = "1682219155"
"m1_107" = "2574215857"
"m1_104" = "3861228572"
"m1_105" = "71901328"
"m3_3" = "927474798"
"m3_2" = "3487544563"
"m3_1" = "1718420804"
"m3_0" = "17001001"
"m3_7" = "3573965266"
"m3_6" = "1838544551"
"m3_5" = "69945096"
"m3_4" = "2629490589"
"m3_9" = "2749530364"
"m3_8" = "980422977"
"m3_93" = "2451378352"
"m3_92" = "716398853"
"m3_91" = "3309498774"
"m3_90" = "1573930619"
"m3_97" = "836457060"
"m3_96" = "3362431689"
"m3_95" = "1626878810"
"m3_94" = "4220485679"

[HKCU\Software\Stvncyfrlda\168128873]
"1735290733" = "87"

[HKCU\Software\Stvncyfrlda]
"m3_99" = "4273372430"
"m2_94" = "4203540783"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKCU\Software\Stvncyfrlda]
"m3_98" = "2571488659"
"m1_75" = "3884680605"
"m2_146" = "4244348646"
"m1_5" = "990974441"
"m1_4" = "2043211597"
"m1_7" = "2820037032"
"m1_6" = "942015960"
"m1_1" = "692605188"
"m1_0" = "1431655765"
"m3_68" = "2018964189"
"m3_69" = "3787940424"
"m3_66" = "2877018163"
"m3_67" = "283394990"
"m3_64" = "3667439977"
"m3_65" = "1107894404"
"m3_62" = "230528591"
"m3_63" = "1965949434"
"m3_60" = "1021409189"
"m3_61" = "2756962000"
"m1_141" = "2125166459"
"m2_29" = "3078784361"
"m2_28" = "1343503986"
"m2_25" = "432600617"
"m2_24" = "2992270466"
"m2_27" = "3903184141"
"m2_26" = "2167896592"
"m2_21" = "2081373437"
"m2_20" = "346071270"
"m2_23" = "1256986257"
"m2_22" = "3816666772"

[HKCU\Software\Stvncyfrlda\168128873]
"-1648771660" = "30"

[HKCU\Software\Stvncyfrlda]
"m4_114" = "254647946"
"m4_115" = "1989938679"
"m4_116" = "3725229412"
"m4_117" = "1165552849"
"m4_110" = "1903419606"
"m4_111" = "3638710339"
"m4_112" = "1079033776"
"m4_113" = "2814324509"
"m4_118" = "2900843582"
"m4_119" = "341167019"
"m4_74" = "3857462658"
"m4_75" = "1297786095"
"m4_76" = "3033076828"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Stvncyfrlda]
"m4_70" = "1211267022"
"m4_71" = "2946557755"
"m4_72" = "386881192"
"m4_73" = "2122171925"
"m4_78" = "2208690998"
"m4_79" = "3943981731"
"m1_3" = "553799287"
"m1_2" = "2322242303"
"m2_90" = "1557347139"
"m2_91" = "3292629698"
"m2_92" = "732959114"
"m1_68" = "1969928109"
"m1_69" = "7623848"
"m2_93" = "2468241613"
"m1_60" = "3058324726"

"m1_62" = "185503965"
"m1_63" = "3055034906"
"m1_64" = "1713976635"
"m1_65" = "4148594982"
"m1_66" = "3018234535"
"m1_67" = "1682329809"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Stvncyfrlda]
"m2_96" = "3379157030"
"m3_130" = "2266496883"
"m2_97" = "819470841"
"m3_22" = "3799972215"
"m3_23" = "1273981154"
"m3_20" = "363060909"
"m3_21" = "2097957336"
"m3_26" = "2150906683"
"m3_27" = "3920013910"
"m3_24" = "3008960529"
"m3_25" = "415992716"
"m3_28" = "1360479685"
"m3_29" = "3061970288"

[HKCU\Software\Stvncyfrlda\168128873]
"910904903" = "0"

[HKCU\Software\Stvncyfrlda]
"m2_76" = "3033071995"
"m2_77" = "473406283"
"m2_74" = "3857460694"
"m2_75" = "1297789211"
"m2_72" = "386875799"
"m2_73" = "2122176396"
"m2_70" = "1211262086"
"m2_71" = "2946563951"
"m2_78" = "2208687796"
"m2_79" = "3943985447"
"m3_57" = "110470508"
"m3_56" = "2703963633"
"m3_55" = "968530498"
"m3_54" = "3494439639"
"m3_53" = "1759411128"
"m3_52" = "57526285"
"m3_51" = "2583910558"
"m3_50" = "848472419"
"m3_59" = "3614491702"
"m3_58" = "1845908635"
"m2_127" = "1338594359"
"m2_126" = "3898265228"
"m4_143" = "3333438947"
"m4_142" = "1598148214"
"m4_141" = "4157824777"
"m4_140" = "2422534044"
"m4_146" = "4244343850"
"m4_145" = "2509053117"
"m4_144" = "773762384"
"m4_38" = "1516538414"
"m4_39" = "3251829147"
"m2_125" = "2162978893"
"m2_124" = "427682167"
"m2_123" = "2987367843"
"m2_122" = "1252066758"
"m2_121" = "3811750321"
"m2_120" = "2076451886"
"m4_30" = "519114438"
"m4_31" = "2254405171"
"m4_32" = "3989695904"
"m4_33" = "1430019341"
"m4_34" = "3165310074"
"m4_35" = "605633511"
"m4_36" = "2340924244"
"m4_37" = "4076214977"

[HKCU\Software\Stvncyfrlda\168128873]
"-824385830" = "0"

[HKCU\Software\Stvncyfrlda]
"m1_11" = "31487998"
"m1_10" = "3127516927"
"m1_13" = "3959391552"
"m1_12" = "1954038609"
"m1_15" = "481741629"
"m1_14" = "628379951"
"m1_17" = "3003209313"
"m1_16" = "2981283468"
"m1_19" = "1354185793"
"m1_18" = "857169174"
"m3_135" = "2319427666"
"m3_134" = "583874855"
"m3_137" = "1528482684"
"m3_136" = "4087897025"
"m4_89" = "4117019877"
"m4_88" = "2381729144"
"m3_133" = "3176958344"
"m3_132" = "1441930781"
"m4_85" = "1470824241"
"m4_84" = "4030500804"
"m4_87" = "646438411"
"m4_86" = "3206114974"
"m4_81" = "3119595901"
"m4_80" = "1384305168"
"m4_83" = "2295210071"
"m4_82" = "559919338"
"m2_129" = "514207751"
"m2_128" = "3073876868"
"m1_86" = "2649054191"
"m1_87" = "1925033915"
"m1_84" = "3128572172"
"m1_85" = "3969956330"
"m1_82" = "1814322384"
"m1_83" = "1448494473"
"m1_80" = "1214350173"
"m1_81" = "2229866676"
"m1_88" = "956473009"
"m1_89" = "4124865492"
"m3_140" = "2439480757"
"m3_141" = "4140840224"
"m3_142" = "1581425759"
"m3_143" = "3350419402"
"m1_119" = "765342999"
"m1_118" = "248882171"
"m3_146" = "4260947459"
"m1_115" = "938637217"
"m1_114" = "4216106464"
"m1_117" = "3464095184"
"m1_116" = "975394621"
"m1_111" = "3632489257"
"m1_110" = "1588378220"
"m1_113" = "786271069"
"m1_112" = "1751031529"
"m3_80" = "1401010233"
"m3_81" = "3102878548"
"m3_82" = "542956227"
"m3_83" = "2311932542"
"m3_84" = "4047496685"
"m3_85" = "1453954328"
"m3_86" = "3189376183"
"m3_87" = "663008290"
"m3_88" = "2364876625"
"m3_89" = "4100445900"
"m3_19" = "2888904510"
"m3_18" = "1153482627"
"m3_13" = "1100530336"
"m3_12" = "3626914613"
"m3_11" = "1891476358"
"m3_10" = "190001259"
"m3_17" = "3746958356"
"m3_16" = "2011536633"
"m3_15" = "243002698"
"m3_14" = "2835971551"

[HKCU\Software\Stvncyfrlda\168128873]
"-737866757" = "58885256CEB138BF289B3FE61C5E671D2E4D94225C4FBCE4F0DE94D4B7C6392939AA4886E4653CEE7B60948B66308353C8BBD5AE9DDF9D8811FEE480E8441E72BE888FD57C7DF806E086A0E5DB748F0253CF7C7D80F1B655BBDC36A6B023154295785206CD56E65771B4CF0086E88C785CF8C0E79612D1A27360920106C8FD553BA45DC6F2A1000AB402F36DBF857C1185A98D2E85109D9FD5DA5D9DAC6CF78DD42468E6AAA565B58EBD7520B7BC8A2F1C00B75D6B842D36E293F4AF3B51E71EE226DED82E8165CB677EE0EA5BDDA27433B041F67665D554619E5A8CC804F9380D19D04300BC619829CDC374400D9780AF7BBAE5BA38A609F7EDFA8C4C4A9E5B"

[HKCU\Software\Stvncyfrlda]
"m2_49" = "3424863984"
"m2_48" = "1689567674"
"m2_47" = "4249249463"
"m2_46" = "2513965233"
"m2_45" = "778669791"
"m2_44" = "3338351236"
"m2_43" = "1603053585"
"m2_42" = "4162736658"
"m2_41" = "2427438881"
"m2_40" = "692154396"
"m2_38" = "1516540042"
"m2_39" = "3251823525"
"m2_32" = "3989700179"
"m2_33" = "1430014817"
"m2_30" = "519121676"
"m2_31" = "2254399646"
"m2_36" = "2340928256"
"m2_37" = "4076210421"
"m2_34" = "3165312108"
"m2_35" = "605629671"

"m4_107" = "992514703"
"m4_106" = "3552191266"
"m4_105" = "1816900533"
"m4_104" = "81609800"
"m4_103" = "2641286363"
"m4_102" = "905995630"
"m4_101" = "3465672193"
"m4_100" = "1730381460"
"m3_131" = "3967839982"
"m4_109" = "168128873"
"m4_108" = "2727805436"
"m4_41" = "2427443317"
"m4_40" = "692152584"
"m4_43" = "1603057487"
"m4_42" = "4162734050"
"m4_45" = "778671657"
"m4_44" = "3338348220"
"m4_47" = "4249253123"
"m4_46" = "2513962390"
"m4_49" = "3424867293"
"m4_48" = "1689576560"
"m3_100" = "1713433789"
"m3_139" = "703982086"
"m3_138" = "3230366443"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Stvncyfrlda]
"m1_55" = "869080572"
"m1_54" = "936325280"
"m1_57" = "2127420660"
"m1_56" = "2209700707"
"m1_51" = "2330347000"
"m1_50" = "2958820596"
"m1_53" = "1723007679"
"m1_52" = "2581220447"
"m1_59" = "1154213488"
"m1_58" = "4066474636"
"m3_108" = "2744413141"
"m3_109" = "184949568"
"m3_104" = "98446945"
"m3_105" = "1833490844"
"m3_106" = "3535358219"
"m3_107" = "975960230"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"

[HKCU\Software\Stvncyfrlda]
"m3_101" = "3482491944"
"m3_102" = "922947399"
"m3_103" = "2624438002"
"m2_83" = "2295218147"
"m4_77" = "473400265"
"m1_124" = "2434404267"
"m1_125" = "1308835936"
"m1_126" = "1950560213"
"m1_127" = "2787039010"
"m1_120" = "3348298643"
"m1_121" = "3754038516"
"m1_122" = "665180793"
"m1_123" = "3625339348"
"m1_128" = "934007257"
"m1_129" = "1187006103"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKCU\Software\Stvncyfrlda]
"m3_44" = "3354938517"
"m3_45" = "795540480"
"m3_46" = "2497408959"
"m3_47" = "4232388394"
"m3_40" = "675414817"
"m3_41" = "2444014172"
"m3_42" = "4179439051"
"m3_43" = "1586486630"
"m3_48" = "1706528345"
"m3_49" = "3441441268"
"m3_144" = "790480761"
"m3_145" = "2492364436"
"m2_118" = "2900836589"
"m2_119" = "341171289"
"m2_112" = "1079030500"
"m2_113" = "2814328779"
"m2_110" = "1903427405"
"m2_111" = "3638708175"
"m2_116" = "3725225075"
"m2_117" = "1165554821"
"m2_114" = "254643117"
"m2_115" = "1989941830"
"m4_98" = "2554767290"
"m4_99" = "4290058023"
"m4_92" = "732957484"
"m4_93" = "2468248217"
"m4_90" = "1557343314"
"m4_91" = "3292634047"
"m4_96" = "3379153120"
"m4_97" = "819476557"
"m4_94" = "4203538950"
"m4_95" = "1643862387"
"m2_137" = "1511634973"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKCU\Software\Stvncyfrlda]
"m2_138" = "3246916711"
"m2_139" = "687249728"
"m1_9" = "151879564"
"m1_8" = "3256253133"
"m2_108" = "2727810816"
"m2_58" = "1862610710"
"m2_59" = "3597909434"
"m2_54" = "3511393050"
"m2_55" = "951706087"
"m2_56" = "2686992738"
"m2_57" = "127325810"
"m2_50" = "865194941"
"m2_51" = "2600479459"
"m2_52" = "40811178"
"m2_53" = "1776091217"
"m2_106" = "3552184040"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\c:\%original file name%.exe,"

[HKCU\Software\Stvncyfrlda]
"m1_61" = "27768135"
"m4_138" = "3246919874"
"m4_139" = "687243311"
"m4_132" = "1425110068"
"m4_133" = "3160400801"
"m4_130" = "2249495898"
"m4_131" = "3984786631"
"m4_136" = "4071305704"
"m4_137" = "1511629141"
"m4_134" = "600724238"
"m4_135" = "2336014971"
"m2_136" = "4071301233"
"m2_141" = "4157818829"
"m2_140" = "2422537115"
"m2_143" = "3333434644"
"m2_142" = "1598150498"
"m2_145" = "2509061137"
"m2_144" = "773765463"
"m4_58" = "1862614706"
"m4_59" = "3597905439"
"m4_56" = "2687000536"
"m4_57" = "127323973"
"m4_54" = "3511386366"
"m4_55" = "951709803"
"m4_52" = "40804900"
"m4_53" = "1776095633"
"m4_50" = "865190730"
"m4_51" = "2600481463"
"m1_37" = "3754015242"
"m1_36" = "3274605069"
"m1_35" = "2161529661"
"m1_34" = "1003101363"
"m1_33" = "1943819026"
"m1_32" = "2731709687"
"m1_31" = "790639245"
"m1_30" = "1973672093"
"m1_39" = "571943250"
"m1_38" = "3655391382"
"m1_42" = "557879107"
"m1_43" = "2474203956"
"m1_40" = "739755721"
"m1_41" = "2015799742"
"m1_46" = "796432676"
"m1_47" = "3896583602"
"m1_44" = "1149988469"
"m1_45" = "3272971938"
"m1_48" = "1130703054"
"m1_49" = "3113898838"
"m3_119" = "357998978"
"m3_118" = "2917414423"
"m3_117" = "1148946168"
"m3_116" = "3741914957"
"m3_115" = "2006935518"
"m3_114" = "237958307"
"m3_113" = "2797356340"
"m3_112" = "1096013209"
"m3_111" = "3655416426"
"m3_110" = "1886423807"
"m2_95" = "1643859302"
"m1_137" = "1354978574"
"m1_136" = "4126179874"
"m1_135" = "3750719942"
"m1_134" = "2767697203"
"m1_133" = "3534992108"
"m1_132" = "2976761342"
"m1_131" = "2275606011"
"m1_130" = "3550298598"
"m1_139" = "1407045521"
"m1_138" = "1008508540"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKCU\Software\Stvncyfrlda]
"m2_10" = "173032746"
"m2_11" = "1908331499"
"m2_12" = "3643615808"
"m2_13" = "1083945517"
"m2_14" = "2819228168"
"m2_15" = "259556002"
"m2_16" = "1994846993"
"m2_17" = "3730138108"
"m2_18" = "1170458986"
"m2_19" = "2905758723"
"m3_71" = "2929954066"
"m3_70" = "1227955687"
"m3_73" = "2139008060"
"m3_72" = "369900673"
"m3_75" = "1280954054"
"m3_74" = "3840892843"
"m3_77" = "490007008"
"m3_76" = "3049946741"
"m3_79" = "3927378058"
"m3_78" = "2191956255"

"m2_89" = "4117013649"
"m2_88" = "2381731014"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

[HKCU\Software\Stvncyfrlda]
"m2_82" = "559916891"
"m2_81" = "3119600977"
"m2_80" = "1384301287"
"m2_87" = "646433310"
"m2_86" = "3206115838"
"m2_85" = "1470817537"
"m2_84" = "4030504192"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\Stvncyfrlda]
"m1_98" = "2437606373"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Stvncyfrlda]
"m2_109" = "168126038"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Stvncyfrlda]
"m4_12" = "3643619612"
"m4_13" = "1083943049"
"m4_10" = "173038146"
"m4_11" = "1908328879"
"m4_16" = "1994847952"
"m4_17" = "3730138685"
"m4_14" = "2819233782"
"m4_15" = "259557219"
"m2_105" = "1816896086"
"m2_104" = "81613218"
"m4_18" = "1170462122"
"m4_19" = "2905752855"
"m2_101" = "3465667997"
"m2_100" = "1730386994"
"m2_103" = "2641283973"
"m2_102" = "906000462"

[HKCU\Software\Stvncyfrlda\168128873]
"1821809806" = "0200687474703A2F2F7061647275702E636F6D2E64732F736F62616B61312E67696600687474703A2F2F34362E3130352E3130332E3231392F736F62616B61766F6C6F732E676966"

[HKCU\Software\Stvncyfrlda]
"m4_67" = "300362119"
"m4_66" = "2860038682"
"m4_65" = "1124747949"
"m4_64" = "3684424512"
"m4_63" = "1949133779"
"m4_62" = "213843046"
"m4_61" = "2773519609"
"m4_60" = "1038228876"
"m4_69" = "3770943585"
"m4_68" = "2035652852"

[HKCU\Software\Stvncyfrlda\168128873]
"86519073" = "73"

Firewall notifications are disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"%original file name%.exe" = "c:\%original file name%.exe:*:Enabled:ipsec"

The Virus deletes the following value(s) in system registry:
The Virus disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GoogleUpdateBeta"

"NvUpdSrv"

"GoogleUpdate"

"nvUpdService"

"Google Update"

Network activity (URLs)

URL	IP
kafeshka.org	178.79.190.156

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   nvupd32.exe:1996
   %original file name%.exe:1780

2. Delete the original Virus file.
   
3. Delete or disinfect the following files created/modified by the Virus:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\0008BD8C_rar\%original file name%.exe (673 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\nsProcess.dll (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\winjuhs.exe (849 bytes)
   %WinDir%\system.ini (70 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\TerminateAndDelete.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\fkgbh.exe (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\NVIDIA Corporation\Update\nvupd32.exe (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw2.tmp (2104 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp\System.dll (11 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.