Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\geBssrOi] 'Logon' = 'o'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\geBssrOi] 'DllName' = 'geBssrOi.dll'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] '{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}' = ''
- C:\ainhkx.exe
- C:\vsuirwl.exe
- C:\nfewsb.exe
- C:\etwd.exe
- C:\bwwh.exe
- C:\qsialm.exe
- <SYSTEM32>\ghu02\ghu022328.exe
- %HOMEPATH%\UxfjSeuG.exe
- %HOMEPATH%\aHSwyng.exe
- C:\ojypnwxl.exe
- C:\vsuirwl.exe (downloaded from the Internet)
- C:\bwwh.exe (downloaded from the Internet)
- C:\etwd.exe (downloaded from the Internet)
- C:\qsialm.exe (downloaded from the Internet)
- C:\ojypnwxl.exe (downloaded from the Internet)
- C:\nfewsb.exe (downloaded from the Internet)
- C:\ainhkx.exe (downloaded from the Internet)
- <SYSTEM32>\dumprep.exe 3068 -dm 7 7 %TEMP%\WER453e.dir00\svchost.exe.hdmp 16325836412027180
- <SYSTEM32>\rundll32.exe "<SYSTEM32>\xxywVmjH.dll",s
- <SYSTEM32>\rundll32.exe <SYSTEM32>\sysdm.cpl,NoExecuteProcessException <SYSTEM32>\svchost.exe
- <SYSTEM32>\cmd.exe /c %TEMP%\fccdcYoo.bat "%HOMEPATH%\LRTQJQ~1.EXE"
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\dumprep.exe 3068 -dm 7 7 %TEMP%\WER453e.dir00\svchost.exe.mdmp 16325836412027160
- <SYSTEM32>\winlogon.exe
- gw.exe
- MCAGENT.EXE
- mpftray.exe
- GUARD.EXE
- fsav32.exe
- gc.exe
- ge.exe
- NAVAPW32.EXE
- zapro.exe
- zlclient.exe
- ZONEALARM.EXE
- smc.exe
- nod.exe
- nod32.exe
- outpost.exe
- AVP.EXE
- AVP32.EXE
- AVPCC.EXE
- AVGCTRL.EXE
- ash.exe
- avgcc.exe
- AVGCC32.EXE
- AVPM.EXE
- ClamWin.exe
- drweb.exe
- fsav.exe
- ccapp.exe
- AVSYNMGR.EXE
- bdagent.exe
- bdss.exe
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '{A8A88C49-5EB2-4990-A1A2-0876022C854F}' = ''
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1A10' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '{AEBA21FA-782A-4A90-978D-B72164C80120}' = ''
- %TEMP%\WER453e.dir00\svchost.exe.hdmp
- C:\ainhkx.exe
- C:\nfewsb.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ppzzra[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\surboccgqn[1].php
- <SYSTEM32>\xxywVmjH.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\apstpldr.dll[1].html
- C:\qsialm.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\khreff[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\agpdue[1].php
- C:\vsuirwl.exe
- %TEMP%\WER453e.dir00\manifest.txt
- %TEMP%\WER453e.dir00\appcompat.txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\pifccddur[1]
- C:\etwd.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\scijpzqww[1].php
- C:\bwwh.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\nkuyivi[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\IpGeo[1].aspx
- <SYSTEM32>\MSINET.DEP
- %HOMEPATH%\UxfjSeuG.exe
- <SYSTEM32>\MSINET.OCX
- <SYSTEM32>\MSINET.oca
- %HOMEPATH%\aHSwyng.exe
- %HOMEPATH%\mtQFJSDNZ.exe
- %HOMEPATH%\lrTqjQHfhW.exe
- <SYSTEM32>\geBssrOi.dll
- %HOMEPATH%\Cookies\%USERNAME%@wmvmedialease[1].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bluivja[1].php
- C:\-1998166001
- %TEMP%\WER453e.dir00\svchost.exe.mdmp
- C:\ojypnwxl.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\xuhlivwj[1].php
- <SYSTEM32>\ghu02\ghu022328.exe
- <SYSTEM32>\pac.txt
- %TEMP%\fccdcYoo.bat
- %HOMEPATH%\rYJnpexdNk.exe
- %HOMEPATH%\mtQFJSDNZ.exe
- %HOMEPATH%\lrTqjQHfhW.exe
- '64.##5.153.65':80
- 'ch##dhe.com':80
- 'localhost':1038
- 'aa###djkgn.com':80
- 'localhost':1037
- aa###djkgn.com/progs/xckhdrr/scijpzqww.php
- aa###djkgn.com/progs/xckhdrr/ppzzra.php
- aa###djkgn.com/progs/xckhdrr/nkuyivi.php
- aa###djkgn.com/progs/xckhdrr/agpdue.php?ad#################################################
- aa###djkgn.com/progs/xckhdrr/pifccddur
- aa###djkgn.com/progs/xckhdrr/surboccgqn.php
- aa###djkgn.com/progs/xckhdrr/bluivja.php
- aa###djkgn.com/progs/xckhdrr/xuhlivwj.php?ad########
- 64.##5.153.65/reporting/IpGeo.aspx
- aa###djkgn.com/progs/xckhdrr/khreff.php
- ch##dhe.com/pas/apstpldr.dll.html?af#####################################################
- DNS ASK ch##dhe.com
- DNS ASK aa###djkgn.com
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''