Trojan.Win32.Sasfis_65807d2c8b

by malwarelabrobot on March 7th, 2014 in Malware Descriptions.

InstallCore.b (fs) (VIPRE), Trojan.Win32.Sasfis.FDWebToolbar.Win32.InstallCore.FD (Lavasoft MAS)
Behaviour: Trojan, WebToolbar


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary
Dynamic Analysis
Static Analysis
Relationships
Map
Strings from Dumps
Removals

MD5: 65807d2c8b5771b89f9a6b3756af98de
SHA1: 5c9554b4ce33692097c31f106f80a7cd9022d374
SHA256: 697c0c796e01ebf618b6892c050e24a65b20b5b4f74020e8f7d5d4b9bff8f9b4
SSDeep: 12288:d4BFtvhLsqMZxhsMjcUKtzdsEsdSDNRntC1/fn58qvueVWzGXuA:WEZxSzmnGNwH58qvxMzG3
Size: 663672 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPXv0896v102v105v122Delphistub, UPolyXv05_v6
Company: Firseria
Created at: 1992-06-20 01:22:17
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:444

The Trojan injects its code into the following process(es):

%original file name%.exe:1692

File activity

The process %original file name%.exe:1692 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\pause_btn.png (493 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is1705941228\7051167_Setup.CIS (337250 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\grey_btn.png (1320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\R5BRBDUV\c1c90573e366fb4e7682fd08150c769c[1].htm (3123 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XWHK1GPI\PC Speed Up (Russia)[1].jpg (1294 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\css\sdk-ui\images\button-bg.png (131 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\006BACE1.log (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XWHK1GPI\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XWHK1GPI\bg2_ru[1].jpg (40674 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\R5BRBDUV\IE_logo[1].png (5406 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X7VALIDZ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\css\sdk-ui\images\progress-bg-corner.png (1636 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is1705941228\sqlite3.dll (688072 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X7VALIDZ\logo[1].png (37938 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\loader.gif (10819 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\R5BRBDUV\theme2_template8[1].css (1181 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\css\sdk-ui\images\progress-bg2.png (978 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\grey_btn323.png (1843 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\offer_big.png (1246 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OEBBOQ59\bg4_ru[1].jpg (38758 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X7VALIDZ\Sanasenesa_EN[1].png (45712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XWHK1GPI\blank[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X7VALIDZ\logo[2].png (12972 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\color_btn.png (4222 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OEBBOQ59\19026[1].gif (951 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\R5BRBDUV\bg3_us[1].jpg (44717 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\006B9477.log (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\R5BRBDUV\logo_new[1].png (4569 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\R5BRBDUV\theme2_template8[2].css (6007 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\css\main.css (6325 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OEBBOQ59\jquery.min[1].js (41378 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OEBBOQ59\Mapayuy[1].png (19688 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\bg.png (36329 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\R5BRBDUV\bg4_us[1].jpg (38678 bytes)
%Documents and Settings%\%current user%\Рабочий стол\Continue Kybtec World Clock Installation.lnk (913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\bg.jpg (22125 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\css\sdk-ui\button.css (417 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\css\sdk-ui\checkbox.css (190 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\csshover3.htc (2893 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\R5BRBDUV\Sanasenesa_logo[1].png (7213 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\Sponsored-Offer.png (3904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\close_hover.jpg (1685 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OEBBOQ59\CH_logo[1].png (4577 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\006B9717.log (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\progress.png (104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\color_btn_hover.png (3743 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\css\sdk-ui\progress-bar.css (506 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\006BB666.log (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\grey_btn_hover.png (1333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X7VALIDZ\clkL.min[2].js (594 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is1705941228\1643772874.cfg (208 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X7VALIDZ\clkL.min[1].js (348 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OEBBOQ59\bg3_ru[1].jpg (37853 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\progress_bar.png (520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\isf_7051210.flat (688400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\R5BRBDUV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is1705941228\1282401253.cfg (208 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OEBBOQ59\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XWHK1GPI\bg1_us[1].jpg (21968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XWHK1GPI\bg1_ru[1].jpg (36122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\close_hover.png (207 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X7VALIDZ\c1c90573e366fb4e7682fd08150c769c[1] (1245 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OEBBOQ59\bg[1].png (41675 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\css\ie6_main.css (870 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\bootstrap_23075.html (156 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\locale\EN.locale (2148 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XWHK1GPI\jquery.min[1].js (118484 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\progress.jpg (2973 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\css\sdk-ui\browse.css (337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\006BACD1.log (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XWHK1GPI\FF_logo[1].png (5025 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\close.png (207 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X7VALIDZ\Seniser[1].png (54465 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ICReinstall_%original file name%.exe (1187960 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\close.jpg (1725 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\icon_generic.png (1906 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OEBBOQ59\addon[1].png (554 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X7VALIDZ\bg2_us[1].jpg (41588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\006B7660.log (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\resume_btn.png (681 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\css\sdk-ui\images\progress-bg.png (1105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\welcome_prod_box.png (221 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\006B9717.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\006BACE1.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\006BB666.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\isf_7051210.flat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OEBBOQ59\jquery.min[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\006B9477.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\R5BRBDUV\theme2_template8[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\006BACD1.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X7VALIDZ\clkL.min[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\006B7660.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\bootstrap_23075.html (0 bytes)

Registry activity

The process %original file name%.exe:1692 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65324"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 2F 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Главное меню"

"Common Documents" = "%Documents and Settings%\All Users\Документы"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\Мои документы"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ebcf8d94-66db-11de-b228-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
"CommonMusic" = "%Documents and Settings%\All Users\Документы\Моя музыка"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d42-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Рабочий стол"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Рабочий стол"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\Мои документы\Мои рисунки"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65324"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Главное меню"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65324"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "708992537"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Документы\Мои видеозаписи"
"CommonPictures" = "%Documents and Settings%\All Users\Документы\Мои рисунки"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "71 CB 73 AA A8 A4 17 E7 92 D9 C1 C7 90 40 61 82"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65324"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d8c0d8da-77bd-11e0-bb02-000c293bc0fd}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d45-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:444 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "76 65 24 40 9C 17 5A 7D 17 0B 29 88 68 58 99 13"

Network activity (URLs)

URL IP
hxxp://d.adapd.com/widget/render/hash/c1c90573e366fb4e7682fd08150c769c 66.216.77.22
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.7.1/jquery.min.js
hxxp://d1zz5pu7f8sf8g.cloudfront.net/ico/19026.gif
hxxp://kybtec.de/wbx01/dnl/wc/wc_01__2_3_3_12__dlsites01_non_01.exe 68.71.132.252
hxxp://os-slv-1323817372.us-west-2.elb.amazonaws.com/FindMySoft_V2/?v=3.0&c=7622049
hxxp://a1834.g1.akamai.net/js/widgets/clkL.min.js
hxxp://a1834.g1.akamai.net/styles/widget/static/theme2_template8.css
hxxp://a1834.g1.akamai.net/images/addons/icons/18859/PC Speed Up (Russia).jpg
hxxp://a1834.g1.akamai.net/images/widget/2/addon.png
hxxp://counter-817696455.us-east-1.elb.amazonaws.com/blank.gif?t=141299141171&h=c1c90573e366fb4e7682fd08150c769c&cids=idb
hxxp://img.findmysoftcdn.com/img/Sanasenesa/Sanasenesa_EN.png 199.58.87.155
hxxp://img.findmysoftcdn.com/img/Seniser/Seniser.png
hxxp://img.findmysoftcdn.com/ofr/sqlite3.cis (Malicious)
hxxp://img.findmysoftcdn.com/img/_template/IE_logo.png
hxxp://img.findmysoftcdn.com/img/_template/CH_logo.png
hxxp://img.findmysoftcdn.com/img/_template/FF_logo.png
hxxp://img.findmysoftcdn.com/img/Sanasenesa/Sanasenesa_logo.png
hxxp://img.findmysoftcdn.com/img/Mapayuy/Mapayuy.png
hxxp://img.findmysoftcdn.com/img/Sesakesaye/bg.png
hxxp://img.findmysoftcdn.com/img/Rulilap/bg1_us.jpg
hxxp://img.findmysoftcdn.com/img/Rulilap/bg2_us.jpg
hxxp://img.findmysoftcdn.com/img/Rulilap/logo.png
hxxp://img.findmysoftcdn.com/img/Rulilap/bg3_us.jpg
hxxp://img.findmysoftcdn.com/img/Rulilap/bg4_us.jpg
hxxp://img.findmysoftcdn.com/img/Rulilap/bg1_ru.jpg
hxxp://img.findmysoftcdn.com/img/Rulilap/bg2_ru.jpg
hxxp://img.findmysoftcdn.com/img/Rulilap/bg3_ru.jpg
hxxp://img.findmysoftcdn.com/img/Rulilap/bg4_ru.jpg
hxxp://img.findmysoftcdn.com/img/Rerarapepe/logo.png
hxxp://img.findmysoftcdn.com/img/Rerarapepe/logo_new.png
counter.d.adapd.com 184.73.221.87
ajax.googleapis.com 74.125.143.95
cdnus.findmysoftcdn.com 199.58.87.151
os.findmysoftcdn.com 54.212.249.225
cdneu.findmysoftcdn.com 146.185.27.53
cdn.adapd.com 23.3.91.67
img.findmysoft.com 205.251.219.10


IDS verdicts

Dropped PE files

MD5 File path
fd3bd02c9334a382df8c4e9fbe6fe368 c:\Documents and Settings\test\Local Settings\Temp\is1705941228\sqlite3.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Screenshot

VersionInfo

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
UPX0 4096 679936 0 0 d41d8cd98f00b204e9800998ecf8427e
UPX1 684032 618496 617984 5.49553 1586fdff38c07c4689c7bb3e95f8cec8
.rsrc 1302528 40960 38912 3.99962 907e5adffdd16efd66e1ac7aed1145f7

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 6
7682b590359b2dee99bac769d4bf7e76
3cfdd794e081eff636267735304f52b2
d223e0bc8b71537d349afb2a8884ba47
77fab6109401d85692bb448671e03013
59acff666064f5184561fa37cf77a7a9
dcf707404a2cc7cd8223dcec252123e3

`.rsrc
kernel32.dll
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
EVariantBadIndexError
htKeyword
EInvalidOperation
u%CNu
%s[%d]
%s_%d
.Owner
EInvalidGraphicOperation
USER32.DLL
comctl32.dll
UrlMon
Uhw%C
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
TKeyEvent
TKeyPressEvent
HelpKeyword
crSQLWait
%s (%s)
IMM32.DLL
AutoHotkeys
ssHotTrack
TWindowState
poProportional
TWMKey
KeyPreview
WindowState
OnKeyDown
OnKeyPress
OnKeyUp
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
User32.dll
2301654879
A`bng`@ikc-4,uUxlxs-4,Ht.HA
Vh-0,Cd`jiVhlxwd-0,tLcibD.ZP
TThreadExecuter
TScanAllWindowsCallBackData
Portuguese
i\*.*2XE
i.dwcnhE
nmhpjhc03.fcclJL
i.ulzn1E
Uh%.F
powrprof.dll
1.2.3
THttpTimeOutThread
THttpCallBackShell
Gx-21,\igh]ixyj-42,M.DJ
A`qjz``-0,ZkdkNgij.pc
Kcqjpc`-0,Aaj-1,gEdafa`.pM
https://
http://
https
SQL error or missing database
An internal logic error in SQLite
Operation terminated by sqlite3_interrupt()
Uses OS features not supported on host
2nd parameter to sqlite3_bind out of range
sqlite3_step() has another row ready
sqlite3_step() has finished executing
Unknown SQLite Error Code
sqlite3.dll
ESQLiteException
TSQLiteDatabase
TSQLiteTable
Error executing SQL
Could not prepare SQL statement
Error executing SQL statement
select [sql] from sqlite_master where [type] = 'table' and lower(name) = '
Could not prepare SQL statement
SQLite is Busy
SOFTWARE\Mozilla\Mozilla Firefox
cookies.sqlite
session\urls_to_restore_on_startup
SELECT value FROM meta WHERE key='Default Search Provider ID'
SELECT short_name FROM keywords WHERE id='
UPDATE keywords SET sync_guid='
UPDATE keywords SET instant_url='' WHERE id=
keywords_backup
DROP TABLE keywords_backup
CREATE TABLE keywords_backup AS SELECT * FROM keywords ORDER BY id ASC
autogenerate_keyword ||
SELECT id || short_name || keyword || favicon_url || url || safe_for_autoreplace || originating_url || date_created || usage_count || input_encodings || show_in_default_list || suggest_url || prepopulate_id ||
created_by_policy || instant_url || last_modified || sync_guid
FROM keywords ORDER BY id ASC
RemoveChromeSearchProvider - cannot remove
DELETE from keywords WHERE short_name='
RemoveChromeSearchProvider - exception:
SELECT id FROM keywords WHERE short_name='
Opera
Home URL
Amazon.com
eBay.com
Merriam-Webster
Suggest URL
Opera Preferences version 2.0
; Do not edit this file while Opera is running
Key=c
Suggest URL=
HNetCfg.FwMgr
HNetCfg.FwAuthorizedApplication
]DKizHi-4,exc-1,Hc`hk-3.GI
6?0N2=.Lq
;768>1-80
005345000000
000000000000
000000000010
000000000030
cabinet.dll
Kernel32.dll
advapi32.dll
RegOpenKeyExA
TUninstallExecuter
TUninstallExecuter can be created only once.
Report internal param:
CJ[hx.Xu
BND_HTTP_CODE
&ExeChkSum=
Report main param:
Report param (pkg:
), exeName:
GENERIC_WINDOWS
NO_JAR_SUPPORT
ole32.dll
olepro32.dll
IWebBrowser
IWebBrowserApp
IWebBrowser2
TEWBWindowSetResizable
TEWBWindowSetLeft
TEWBWindowSetTop
TEWBWindowSetWidth
TEWBWindowSetHeight
bstrUrlContext
bstrUrl
OnWindowSetResizableh
OnWindowSetLeft
OnWindowSetTop
OnWindowSetWidth
OnWindowSetHeightP
grfKeyState
TComTargetExecEvent
CmdGroup
nCmdID
nCmdexecopt
hhctrl.ocx
URLMON.DLL
SHDOCLC.DLL
rcmDefault
rcmDebug
DontExecuteScripts
DontExecuteJava
DontExecuteActiveX
DisableUrlIfEncodingUTF8
EnableUrlIfEncodingUTF8
CheckFontSupportsCodePage
DisableSubmitUrlInUTF8
EnableSubmitUrlInUTF8
lpMsg
PMsg
pguidCmdGroup
TTranslateUrlEvent
pchURLIn
ppchURLOut
CmdID
pszUrl
pszUrlContext
szPassWord
ErrorUrl
OptionKeyPath
OverrideOptionKeyPath
OnTranslateUrl
OnCommandExec
'%s' is not supported.
TMsgEvent
TKeyEventEx
Port
Password
poPortrait
OnKeyDownL}J
0.750000
3333333
\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform
User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)(
This object does not support this method (
Unsupported type for Parameter with Index %d
Method call unsuccessful. %s (%s).
eiOnKeyDown
eiOnKeyPress
eiOnKeyUp
Handler with EventID = %s already exists.
Error on IConnectionPoint.Advise
Source don't have connection point for [%s]
JS function sync-execution failed with message:
] execution failed with message:
.html
MAPI32.DLL
LeftPopup
TPipeServer
TPipeObject
TPipeServerListener
TPipeClientU
2.1.0.0
This exe was created with an old version of HtmlAppMaker.
irsoMsgDialog
irsoGetCurExePath
irsoJoinPath
irsoGetCmdLineParam
irsoGetCmdLineCount
irsoGetCmdLineIndexOf
irsoGetCmdLineParamValue
irsoGetCmdLineAll
irsoRegCreateKey
irsoRegCreateKeyTree
irsoRegDeleteKey
irsoIsRegKeyExists
irsoRegListKeyValues
irsoRegListKeyKeys
irsoRegSearchKeyKeys
irsoRegCopyKey
irsoHttpGetData
irsoHttpGetDataInThread
irsoLibraryExecuteProc
irsoLibraryExecuteProcW
irsoLibraryExecuteProcWithResult
!irsoLibraryExecuteProcWithResultW
irsoExecute
irsoIsMutexExists
irsoGetCurExeCheckSum
irsoSetSQLiteDll
irsoGetSQLiteDll
TExecArgsX
H-4,njBdi-2,o-4,r.vY
Uh.YL
iexplore.exe
firefox.exe
chrome.exe
safari.exe
opera.exe
THtmlUIExeApp
irsoExecutePackage
irsoReportPackageError
irsoReportPackageSkip
irsoReportPackageQuit
irsoReportPackageSuccess
irsoGetPackageFilenameFromHttp
irsoGetPackageExecExitCode
irsoGetPackageExecResult
irsoSetPackageRelProgressShare
irsoIsFireFoxInstalled
irsoIsChromeInstalled
irsoIsOperaInstalled
irsoGetFireFoxHomePage
irsoGetChromeHomePage
irsoGetOperaHomePage
irsoSetFireFoxHomePage
irsoSetChromeHomePage
irsoSetOperaHomePage
irsoGetFireFoxDefaultSP
irsoGetChromeDefaultSP
irsoGetOperaDefaultSP
irsoAddFireFoxDefaultSPFromXML
irsoAddFireFoxDefaultSP
irsoSetFireFoxAddressBar
irsoAddOperaDefaultSP
irsoAddChromeDefaultSP
irsoGetFireFoxEXE
irsoGetIEEXE
irsoGetChromeEXE
irsoGetOperaEXE
irsoGetFireFoxVer
irsoGetChromeVer
irsoGetOperaVer
irsoLocateSQLite
irsoGetFireFoxCookie
irsoGetChromeCookie
irsoIsFireFoxExtensionInstalled
irsoInstallFireFoxAddon
irsoInstallChromeAddon
irsoUninstallAddExeCmd
irsoUninstallAddOpenBrowserCmd
irsoUninstallAddRegistryKey
irsoUninstallExecute
irsoReportStart
irsoSetExclusiveExec
An attempt to download bundle data was denied: adServer domain name must remain the same! Url:
\fuj-1,w+U,P\O+U,qah`k,.nlvcbqff,-U>
/UnExeFile:
UnExeFile
z`o1caig2,.hf5b+Q,0cfh)914`,,34`6;ia2f=ae-3,L1
user32.dll
GetKeyboardType
RegCloseKey
oleaut32.dll
UnhookWindowsHookEx
SetWindowsHookExA
MapVirtualKeyA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
GetAsyncKeyState
EnumWindows
EnumThreadWindows
EnumChildWindows
ActivateKeyboardLayout
gdi32.dll
SetViewportOrgEx
version.dll
WaitNamedPipeA
PeekNamedPipe
GetWindowsDirectoryW
GetCPInfo
DisconnectNamedPipe
CreatePipe
CreateNamedPipeA
ConnectNamedPipe
RegQueryInfoKeyA
RegOpenKeyExW
RegFlushKey
RegEnumKeyW
RegEnumKeyExA
RegDeleteKeyW
RegDeleteKeyA
RegCreateKeyExW
RegCreateKeyExA
shell32.dll
ShellExecuteExW
ShellExecuteA
wininet.dll
comdlg32.dll
1.2.1
inflate 1.2.1 Copyright 1995-2003 Mark Adler
?456789:;<=
!"#$%&'()*+,-./0123
333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
33333333
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
O}.pJ
%xu_qN
xV.Bqt
d).mJ
P.uf1w
C%C["
-Ec}L
zUrL
.BGZR
WaitNamedPipeW
VkKeyScanExW
RegisterHotKey
UnregisterHotKey
SetWindowsHookExW
.idata
.rdata
P.reloc
P.rsrc
;'"OhnKey
Fl.SBW




KERNEL32.DLL
COMCTL32.DLL
GDI32.DLL
1,.fnnnf`-24,n`yn,+?Ngxn`f-4,lQZyd-4,/N`ynVEhikta-0,V+J.x
Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice
http\shell\open\command
PathToExe
mozsqlite3.dll
GetChromeDefaultSearchProviderFromDb - failed to get spid, returning default!
Google\Chrome
sqlGetQueryResultEx failed!
Opera\
\operaprefs.ini
\profile\operaprefs.ini
\profile\opera6.ini
\opera6.ini
Software\Opera Software
locale\en\en.lng
\profile\search.ini
\search.ini
search.ini
\defaults\search.ini
TopResultURLFallback
FaviconURL
FaviconURLFallback
*.txt
Uninstall\Uninstall.exe
Uninstall\uninst.dat
uninst.dat
regsvr32.exe
_EXEXE_
errorUrl
Failed to launch htmlUI from the following url:
main.html
Remote mask loading is currently not supported. mask:
Please login as administrator and try again.
Installer Account Name altered after at least one report already sent.
.Uninstall\
No help found for %s#No context-sensitive help installed$No topic-based help system installed
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
OLE error %.8x%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s
Alt+ Clipboard does not support Icons/Menu '%s' is already being used by another form
!Control '%s' has no parent window
Metafile is not valid!Cannot change the size of an icon Invalid operation on TOleGraphic
Unsupported clipboard format
Invalid data type for '%s' List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d)+Out of memory while expanding memory stream
Error reading %s%s%s: %s
Failed to get data for '%s'
Failed to set data for '%s'
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file %s
Cannot open file %s
Invalid stream format$''%s'' is not a valid component name
Ancestor for '%s' not found
External exception %x
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation!Invalid variant operation ($%.8x)
Variant is not an array5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
Integer overflow Invalid floating point operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value('%s' is not a valid floating point value"'%s' is not a valid currency value!'%g' is not a valid date and time
'%s' is not a valid GUID value
I/O error %d


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:444

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\pause_btn.png (493 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\is1705941228\7051167_Setup.CIS (337250 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\grey_btn.png (1320 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\R5BRBDUV\c1c90573e366fb4e7682fd08150c769c[1].htm (3123 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XWHK1GPI\PC Speed Up (Russia)[1].jpg (1294 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\css\sdk-ui\images\button-bg.png (131 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\006BACE1.log (8 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XWHK1GPI\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XWHK1GPI\bg2_ru[1].jpg (40674 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\R5BRBDUV\IE_logo[1].png (5406 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X7VALIDZ\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\css\sdk-ui\images\progress-bg-corner.png (1636 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\is1705941228\sqlite3.dll (688072 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X7VALIDZ\logo[1].png (37938 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\loader.gif (10819 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\R5BRBDUV\theme2_template8[1].css (1181 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\css\sdk-ui\images\progress-bg2.png (978 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\grey_btn323.png (1843 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\offer_big.png (1246 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OEBBOQ59\bg4_ru[1].jpg (38758 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X7VALIDZ\Sanasenesa_EN[1].png (45712 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XWHK1GPI\blank[1].gif (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X7VALIDZ\logo[2].png (12972 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\color_btn.png (4222 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OEBBOQ59\19026[1].gif (951 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\R5BRBDUV\bg3_us[1].jpg (44717 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\006B9477.log (8 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\R5BRBDUV\logo_new[1].png (4569 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\R5BRBDUV\theme2_template8[2].css (6007 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\css\main.css (6325 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OEBBOQ59\jquery.min[1].js (41378 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OEBBOQ59\Mapayuy[1].png (19688 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\bg.png (36329 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\R5BRBDUV\bg4_us[1].jpg (38678 bytes)
    %Documents and Settings%\%current user%\Рабочий стол\Continue Kybtec World Clock Installation.lnk (913 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\bg.jpg (22125 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\css\sdk-ui\button.css (417 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\css\sdk-ui\checkbox.css (190 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\csshover3.htc (2893 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\R5BRBDUV\Sanasenesa_logo[1].png (7213 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\Sponsored-Offer.png (3904 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\close_hover.jpg (1685 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OEBBOQ59\CH_logo[1].png (4577 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\006B9717.log (8 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\progress.png (104 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\color_btn_hover.png (3743 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\css\sdk-ui\progress-bar.css (506 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\006BB666.log (8 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\grey_btn_hover.png (1333 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X7VALIDZ\clkL.min[2].js (594 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\is1705941228\1643772874.cfg (208 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X7VALIDZ\clkL.min[1].js (348 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OEBBOQ59\bg3_ru[1].jpg (37853 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\progress_bar.png (520 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\isf_7051210.flat (688400 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\R5BRBDUV\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\is1705941228\1282401253.cfg (208 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OEBBOQ59\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XWHK1GPI\bg1_us[1].jpg (21968 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XWHK1GPI\bg1_ru[1].jpg (36122 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\close_hover.png (207 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X7VALIDZ\c1c90573e366fb4e7682fd08150c769c[1] (1245 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OEBBOQ59\bg[1].png (41675 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\css\ie6_main.css (870 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\bootstrap_23075.html (156 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\locale\EN.locale (2148 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XWHK1GPI\jquery.min[1].js (118484 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\progress.jpg (2973 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\css\sdk-ui\browse.css (337 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\006BACD1.log (8 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\XWHK1GPI\FF_logo[1].png (5025 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\close.png (207 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X7VALIDZ\Seniser[1].png (54465 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ICReinstall_%original file name%.exe (1187960 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\close.jpg (1725 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\icon_generic.png (1906 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OEBBOQ59\addon[1].png (554 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X7VALIDZ\bg2_us[1].jpg (41588 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\006B7660.log (8 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\resume_btn.png (681 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\css\sdk-ui\images\progress-bg.png (1105 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ish7042671\images\welcome_prod_box.png (221 bytes)

  4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  5. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.