MD5: acf0e457727b20a052aa59fda4af028a
SHA1: ffe8e6f3b4505c88f01655aaf770c88d16b748b5
SHA256: 206f3174c3c4c9f5925ad15e6ee14322a1f13024bf7f5fcd41e61536a254689e
SSDeep: 24576:6FQeYL KKEPS1bvKE2JjaHnUCP577jfYVOTxcFB4KiAeHP:6FQWKKEP2biE2JjaHnH73gVYxAzAHP
Size: 1169785 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2012-04-10 03:11:21
Analyzed on: Windows7 SP1 32-bit

Summary:

Worm. A program that is primarily replicating on networks or removable drives.

Payload

No specific payload has been found.

Process activity

The Worm creates the following process(es):

rundll32.exe:3740
%original file name%.exe:2572

The Worm injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process rundll32.exe:3740 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1P4JZWT3\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Y4TCPF8O\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BXV56KLN\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\desktop.ini (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Y2QR99RW\desktop.ini (67 bytes)

The process %original file name%.exe:2572 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\ver_lock[1].txt (358 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\acf0e457727b20a052aa59fda4af028a.lnk (7995 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\autCED5.tmp (196 bytes)
%Program Files%\360\360Safe\deepscan\speedmem2.hg (7337 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\autCE77.tmp (3465 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\ver_lock[1].txt (358 bytes)
%Program Files%\Home\srvany.exe (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ver.txt (376 bytes)

The Worm deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\autCED5.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\ver_lock[1].txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\autCE77.tmp (0 bytes)

Registry activity

The process %original file name%.exe:2572 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\acf0e457727b20a052aa59fda4af028a_RASAPI32]
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

[HKLM\System\CurrentControlSet\services\HomeLock]
"ObjectName" = "LocalSystem"

[HKLM\SOFTWARE\2345PCSafe]]
"Value4" = "kityeah 2155"

[HKLM\SOFTWARE\Microsoft\Tracing\acf0e457727b20a052aa59fda4af028a_RASMANCS]
"EnableConsoleTracing" = "0"
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKLM\SOFTWARE\2345Movie]]
"Value4" = "kityeah 2155"

[HKLM\SOFTWARE\Microsoft\Tracing\acf0e457727b20a052aa59fda4af028a_RASMANCS]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\2345SoftMgr]
"Value7" = "https://www.2345.com/?kityeah 2155"

[HKLM\System\CurrentControlSet\services\HomeLock\Parameters]
"Application" = "C:\%original file name%.exe"

[HKLM\System\CurrentControlSet\services\HomeLock]
"DisplayName" = "HomeLock"

[HKLM\SOFTWARE\Microsoft\Tracing\acf0e457727b20a052aa59fda4af028a_RASMANCS]
"MaxFileSize" = "1048576"

[HKLM\System\CurrentControlSet\services\HomeLock]
"Description" = "主页保护程序"
"ErrorControl" = "1"

[HKCR\.ex]
"(Default)" = "exefile"

[HKLM\SOFTWARE\Microsoft\Tracing\acf0e457727b20a052aa59fda4af028a_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\2345Pic]
"Value4" = "kityeah 2155"

[HKLM\System\CurrentControlSet\services\HomeLock]
"Type" = "272"

"Start" = "2"

[HKLM\SOFTWARE\Microsoft\Tracing\acf0e457727b20a052aa59fda4af028a_RASAPI32]
"EnableConsoleTracing" = "0"

[HKCR\.ex]
"Content Type" = "application/x-msdownload"

[HKLM\System\CurrentControlSet\services\HomeLock]
"WOW64" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\acf0e457727b20a052aa59fda4af028a_RASMANCS]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\2345Explorer]
"Value4" = "kityeah 2155"

[HKLM\SOFTWARE\HaoZip]
"Value4" = "kityeah 2155"

[HKLM\SOFTWARE\Microsoft\Tracing\acf0e457727b20a052aa59fda4af028a_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\System\CurrentControlSet\services\HomeLock\Parameters]
"AppParameters" = ""

[HKLM\SOFTWARE\Microsoft\Tracing\acf0e457727b20a052aa59fda4af028a_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\acf0e457727b20a052aa59fda4af028a_RASAPI32]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\2345Pinyin]]
"Value4" = "kityeah 2155"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations]
"ModRiskFileTypes" = ".exe;.ex;.vbs"

[HKLM\System\CurrentControlSet\services\HomeLock\Parameters]
"AppDirectory" = "C:\"

[HKLM\System\CurrentControlSet\services\HomeLock]
"ImagePath" = "%Program Files%\Home\srvany.exe"

To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"acf0e457727b20a052aa59fda4af028a" = "C:\%original file name%.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The Worm disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"acf0e457727b20a052aa59fda4af028a"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright: UUV8
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 0.0.0.95
File Description: ??????
Comments: ??????,??????
Language: English (United States)

PE Sections

Dropped from:

2e19d53e50a19f9356aa6585a014432e

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 1
2e19d53e50a19f9356aa6585a014432e

URLs

URL	IP
hxxp://update.link66.cn/ver_lock.txt	117.18.9.152

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile

Traffic

GET /ver_lock.txt HTTP/1.1

User-Agent: AutoIt

Host: update.link66.cn

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Thu, 08 Feb 2018 00:38:18 GMT

Server: Apache/2

Last-Modified: Mon, 13 Nov 2017 13:50:47 GMT

ETag: "400027-166-55ddd8eb5fbc0"

Accept-Ranges: bytes

Content-Length: 358

Vary: Accept-Encoding,User-Agent

Content-Type: text/plain

X-Pad: avoid browser bug
[Update].Version=00095.Setup=hXXp://update.link66.cn/32-00095.exe.Loca
lFile=.FileSize=1169785.FileTime=20171113214919.[Update32].Version=000
95.Setup=hXXp://update.link66.cn/32-00095.exe.LocalFile=.FileSize=1169
785.FileTime=20171113214919.[Update64].Version=00095.Setup=hXXp://upda
te.link66.cn/64-00095.exe.LocalFile=.FileSize=1266553.FileTime=2017111
3214921.....


GET /ver_lock.txt HTTP/1.1

User-Agent: AutoIt

Host: update.link66.cn

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Thu, 08 Feb 2018 00:38:18 GMT

Server: Apache/2

Last-Modified: Mon, 13 Nov 2017 13:50:47 GMT

ETag: "400027-166-55ddd8eb5fbc0"

Accept-Ranges: bytes

Content-Length: 358

Vary: Accept-Encoding,User-Agent

Content-Type: text/plain

X-Pad: avoid browser bug
[Update].Version=00095.Setup=hXXp://update.link66.cn/32-00095.exe.Loca
lFile=.FileSize=1169785.FileTime=20171113214919.[Update32].Version=000
95.Setup=hXXp://update.link66.cn/32-00095.exe.LocalFile=.FileSize=1169
785.FileTime=20171113214919.[Update64].Version=00095.Setup=hXXp://upda
te.link66.cn/64-00095.exe.LocalFile=.FileSize=1266553.FileTime=2017111
3214921.HTTP/1.1 200 OK..Date: Thu, 08 Feb 2018 00:38:18 GMT..Server: 
Apache/2..Last-Modified: Mon, 13 Nov 2017 13:50:47 GMT..ETag: "400027-
166-55ddd8eb5fbc0"..Accept-Ranges: bytes..Content-Length: 358..Vary: A
ccept-Encoding,User-Agent..Content-Type: text/plain..X-Pad: avoid brow
ser bug..[Update].Version=00095.Setup=hXXp://update.link66.cn/32-00095
.exe.LocalFile=.FileSize=1169785.FileTime=20171113214919.[Update32].Ve
rsion=00095.Setup=hXXp://update.link66.cn/32-00095.exe.LocalFile=.File
Size=1169785.FileTime=20171113214919.[Update64].Version=00095.Setup=ht
tp://update.link66.cn/64-00095.exe.LocalFile=.FileSize=1266553.FileTim
e=20171113214921...

The Worm connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

s%j.Zf

8crtsu

:crts

PSSSSSSh

crts

?#%X.y

GetProcessWindowStation

operator

uxtheme.dll

kernel32.dll

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N{name}, \U, or \u

support for \P, \p, and \X has not been compiled

this version of PCRE is not compiled with PCRE_UCP support

ICMP.DLL

advapi32.dll

RegDeleteKeyExW

Error text not found (please report)

WSOCK32.dll

VERSION.dll

WINMM.dll

COMCTL32.dll

MPR.dll

InternetCrackUrlW

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

FtpOpenFileW

FtpGetFileSize

InternetOpenUrlW

WININET.dll

PSAPI.DLL

USERENV.dll

GetProcessHeap

CreatePipe

GetWindowsDirectoryW

KERNEL32.dll

OpenWindowStationW

SetProcessWindowStation

CloseWindowStation

MapVirtualKeyW

EnumChildWindows

EnumWindows

VkKeyScanW

GetKeyState

GetKeyboardState

SetKeyboardState

GetAsyncKeyState

keybd_event

EnumThreadWindows

ExitWindowsEx

UnregisterHotKey

RegisterHotKey

GetKeyboardLayoutNameW

USER32.dll

SetViewportOrgEx

GDI32.dll

COMDLG32.dll

RegOpenKeyExW

RegCloseKey

RegCreateKeyExW

RegEnumKeyExW

RegDeleteKeyW

ADVAPI32.dll

ShellExecuteW

SHFileOperationW

ShellExecuteExW

SHELL32.dll

ole32.dll

OLEAUT32.dll

GetCPInfo

zcÁ

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

mscoree.dll

nKERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

>>>AUTOIT NO CMDEXECUTE<<<

CMDLINERAW

CMDLINE

/AutoIt3ExecuteLine

/AutoIt3ExecuteScript

%s (%d) : ==> %s.:

Line %d:

Line %d (File "%s"):

%s (%d) : ==> %s:

AutoIt script files (*.au3, *.a3x)

*.au3;*.a3x

All files (*.*)

#NoAutoIt3Execute

APPSKEY

04090000

%u.%u.%u.%u

0.0.0.0

Mddddd

"%s" (%d) : ==> %s:

UDPSTARTUP

UDPSHUTDOWN

UDPSEND

UDPRECV

UDPOPEN

UDPCLOSESOCKET

UDPBIND

TRAYGETMSG

TCPSTARTUP

TCPSHUTDOWN

TCPSEND

TCPRECV

TCPNAMETOIP

TCPLISTEN

TCPCONNECT

TCPCLOSESOCKET

TCPACCEPT

SHELLEXECUTEWAIT

SHELLEXECUTE

REGENUMKEY

MSGBOX

ISKEYWORD

HTTPSETUSERAGENT

HTTPSETPROXY

HOTKEYSET

GUIREGISTERMSG

GUIGETMSG

GUICTRLSENDMSG

GUICTRLRECVMSG

FTPSETPROXY

\??\%s

GUI_RUNDEFMSG

SendKeyDelay

SendKeyDownDelay

TCPTimeout

AUTOITCALLVARIABLE%d

255.255.255.255

Keyword

AutoIt.Error

Null Object assignment in FOR..IN loop

Incorrect Object type in FOR..IN loop

HOTKEYPRESSED

AUTOITEXE

WINDOWSDIR

3, 3, 9, 4

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_USERS

%d/d/d

c:\%original file name%.exe

C:\%original file name%.exe

]5]>]?]<]/]

0.0.0.95

SearchProtocolHost.exe_3200:

.text

`.data

.rsrc

@.reloc

ADVAPI32.dll

ntdll.DLL

KERNEL32.dll

msvcrt.dll

USER32.dll

ole32.dll

OLEAUT32.dll

TQUERY.DLL

MSSHooks.dll

IMM32.dll

SHLWAPI.dll

SrchCollatorCatalogInfo

SrchDSSLogin

SrchDSSPortManager

SrchPHHttp

SrchIndexerQuery

SrchIndexerProperties

SrchIndexerPlugin

SrchIndexerClient

SrchIndexerSchema

Msidle.dll

Failed to get REGKEY_FLTRDMN_MS_TO_IDLE, using default

pfps->psProperty.ulKind is LPWSTR but psProperty.lpwstr is NULL or empty

d:\win7sp1_gdr\enduser\mssearch2\common\utils\crchash.cxx

d:\win7sp1_gdr\enduser\mssearch2\search\search\gather\fltrdmn\fltrdaemon.cxx

d:\win7sp1_gdr\enduser\mssearch2\search\common\include\secutil.hxx

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracerhelpers.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\mutex.cpp

d:\win7sp1_gdr\enduser\mssearch2\common\include\srchxcpt.hxx

RegDeleteKeyW

RegDeleteKeyExW

8%uiP

Invalid parameter passed to C runtime function.

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracersecutil.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.cpp

-d-d-d-d-d-d-d-%d

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.h

</MSG></TRC>

<MSG>

<ERR> 0xx=

<LOC> %s(%d) </LOC>

tid="0x%x"

pid="0x%x"

tagname="%s"

tagid="0x%x"

el="0x%x"

time="d/d/d d:d:d.d"

logname="%s"

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\sysimprs.cxx

SHELL32.dll

PROPSYS.dll

ntdll.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegQueryInfoKeyW

RegEnumKeyExW

ReportEventW

_amsg_exit

MsgWaitForMultipleObjects

SearchProtocolHost.pdb

2 2(20282|2

4%5S5

Software\Microsoft\Windows Search

https

kernel32.dll

msTracer.dll

msfte.dll

lX-X-X-XX-XXXXXX

SOFTWARE\Microsoft\Windows Search

tquery.dll

%s\%s

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

Windows Search Service

<Exception><HR>0xx</HR><eip>%p</eip><module>%S</module><line>%d</line></Exception>

advapi32.dll

WAPI-MS-Win-Core-LocalRegistry-L1-1-0.dll

winhttp.dll

Software\Microsoft\Windows Search\Tracing

Software\Microsoft\Windows Search\Tracing\EventThrottleLastReported

Software\Microsoft\Windows Search\Tracing\EventThrottleState

<MSG>

<LOC> %S(%d) </LOC>

tagname="%S"

logname="%S"

Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}

.\%s.mui

.\%s\%s.mui

%s\%s.mui

%s\%s\%s.mui

Microsoft Windows Search Protocol Host

7.00.7601.17610 (win7sp1_gdr.110503-1502)

SearchProtocolHost.exe

Windows

7.00.7601.17610

SearchFilterHost.exe_3008:

.text

`.data

.rsrc

@.reloc

ADVAPI32.dll

ntdll.DLL

KERNEL32.dll

msvcrt.dll

USER32.dll

ole32.dll

OLEAUT32.dll

TQUERY.DLL

IMM32.dll

MSSHooks.dll

mscoree.dll

SHLWAPI.dll

d:\win7sp1_gdr\enduser\mssearch2\search\search\gather\fltrhost\bufstm.cxx

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\mutex.cpp

RegDeleteKeyW

RegDeleteKeyExW

8%uiP

d:\win7sp1_gdr\enduser\mssearch2\common\include\srchxcpt.hxx

Invalid parameter passed to C runtime function.

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracersecutil.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.cpp

-d-d-d-d-d-d-d-%d

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\sysimprs.cxx

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegQueryInfoKeyW

RegEnumKeyExW

ReportEventW

_amsg_exit

SearchFilterHost.pdb

version="5.1.0.0"

name="Microsoft.Windows.Search.MSSFH"

<requestedExecutionLevel

3 3(30383|3

kernel32.dll

Software\Microsoft\Windows Search

SOFTWARE\Microsoft\Windows Search

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

Windows Search Service

tquery.dll

advapi32.dll

API-MS-Win-Core-LocalRegistry-L1-1-0.dll

<Exception><HR>0xx</HR><eip>%p</eip><module>%S</module><line>%d</line></Exception>

Software\Microsoft\Windows Search\Tracing

Software\Microsoft\Windows Search\Tracing\EventThrottleLastReported

Software\Microsoft\Windows Search\Tracing\EventThrottleState

<MSG>

<ERR> 0xx=

<LOC> %S(%d) </LOC>

tid="0x%x"

pid="0x%x"

tagname="%S"

tagid="0x%x"

el="0x%x"

time="d/d/d d:d:d.d"

logname="%S"

</MSG></TRC>

Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}

.\%s.mui

.\%s\%s.mui

%s\%s.mui

%s\%s\%s.mui

%s\%s

winhttp.dll

Microsoft Windows Search Filter Host

7.00.7601.17610 (win7sp1_gdr.110503-1502)

SearchFilterHost.exe

Windows

7.00.7601.17610

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   rundll32.exe:3740
   %original file name%.exe:2572

2. Delete the original Worm file.
   
3. Delete or disinfect the following files created/modified by the Worm:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1P4JZWT3\desktop.ini (67 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\desktop.ini (67 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Y4TCPF8O\desktop.ini (67 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BXV56KLN\desktop.ini (67 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat (16 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\desktop.ini (67 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Y2QR99RW\desktop.ini (67 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\ver_lock[1].txt (358 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\acf0e457727b20a052aa59fda4af028a.lnk (7995 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\autCED5.tmp (196 bytes)
   %Program Files%\360\360Safe\deepscan\speedmem2.hg (7337 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\autCE77.tmp (3465 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\ver_lock[1].txt (358 bytes)
   %Program Files%\Home\srvany.exe (8 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ver.txt (376 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "acf0e457727b20a052aa59fda4af028a" = "C:\%original file name%.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.