TROJ_BADUR.NJE


 ALIASES:

RDN/Generic.bfr!hk (McAfee); Trojan.Gen (Symantec); Trojan.Win32.Badur.ihvu (Kaspersky); Trojan.Win32.Generic!BT (Sunbelt); Found Win32/DH.FF8200A4{gRI0LoET} (AVG)

 PLATFORM:

Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW


This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

File Size:

311,520 bytes

File Type:

EXE

Memory Resident:

No

Initial Samples Received Date:

26 Jun 2014

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan creates the following folders:

  • %User Temp%/3f03101c
  • %User Temp%/3f03101c/dnokmo@vzrwcbdj.co.uk
  • %User Temp%/3f03101c/dnokmo@vzrwcbdj.co.uk/content
  • %User Temp%/3f03101c/bkecibghpbpfpglcmdgnkconcakelopp
  • %System Root%\Documents and Settings\Administrator
  • %Application Data%\Google
  • %Application Data%\Google\Chrome
  • %Application Data%\Google\Chrome\User Data
  • %Application Data%\Google\Chrome\User Data\Default
  • %Application Data%\Google\Chrome\User Data\Default\Extensions
  • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp
  • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2
  • %System Root%\Documents and Settings\ASPNET
  • %System Root%\Documents and Settings\Guest
  • %System Root%\Documents and Settings\HelpAssistant
  • %System Root%\Documents and Settings\SUPPORT_388945a0
  • %Application Data%\Comodo
  • %Application Data%\Comodo\Dragon
  • %Application Data%\Comodo\Dragon\User Data
  • %Application Data%\Comodo\Dragon\User Data\Default
  • %Application Data%\Comodo\Dragon\User Data\Default\Extensions
  • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp
  • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2
  • %Application Data%\Google\Chrome SxS
  • %Application Data%\Google\Chrome SxS\User Data
  • %Application Data%\Google\Chrome SxS\User Data\Default
  • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions
  • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp
  • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2
  • %Application Data%\Torch
  • %Application Data%\Torch\User Data
  • %Application Data%\Torch\User Data\Default
  • %Application Data%\Torch\User Data\Default\Extensions
  • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp
  • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2
  • %Application Data%\Chromatic Browser
  • %Application Data%\Chromatic Browser\User Data
  • %Application Data%\Chromatic Browser\User Data\Default
  • %Application Data%\Chromatic Browser\User Data\Default\Extensions
  • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp
  • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2
  • %System%\GroupPolicy
  • %System%\GroupPolicy\Machine
  • %System%\GroupPolicy\User
  • %Program Files%\CostMin
  • %Program Files%\Supporter

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %System% is the Windows system folder, which is usually C:\Windows\System32.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).)

Other System Modifications

This Trojan adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Google\
Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}

HKEY_LOCAL_MACHINE\SOFTWARE\Google\
Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Google\Update

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Group Policy Objects\
{8A7618FC-FCCB-4C27-AE08-6B5D1DF237C7}User

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Group Policy Objects\
{8A7618FC-FCCB-4C27-AE08-6B5D1DF237C7}Machine

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Group Policy Objects\
{8A7618FC-FCCB-4C27-AE08-6B5D1DF237C7}Machine\Software\Policies\
Google\Chrome

HKEY_CURRENT_USER\Software\RegisteredApplicationsEx

HKEY_CURRENT_USER\SOFTWARE\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4

HKEY_CURRENT_USER\SOFTWARE\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d

HKEY_CURRENT_USER\SOFTWARE\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\00000000

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\00000000

HKEY_LOCAL_MACHINE\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{5F189DF5-2D05-472B-9091-84D9848AE48B}{40030ae4}

HKEY_LOCAL_MACHINE\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Google\
Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
ap = "2.0-dev-multi-chrome"

HKEY_LOCAL_MACHINE\SOFTWARE\Google\
Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}
ap = "-dev-multi-chrome"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Google\Update
UpdateDefault = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Group Policy Objects\
{8A7618FC-FCCB-4C27-AE08-6B5D1DF237C7}Machine\Software\Policies\
Google\Chrome
MetricsReportingEnabled = "0"

HKEY_CURRENT_USER\Software\RegisteredApplicationsEx
6edbe30d93ca018c3edfd72d9fb388b9 = "1"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
date = "1403159992"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4
date = "1403159992"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
data.0 = "3VMhbySOrDUO6WYSUMjezqCPaV3GY7RVXlp/lwKPTKsVJaVN0"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4
data.0 = "3VMhbySOrDUO6WYSUMjezqCPaV3GY7RVXlp/lwKPTKsVJaVN0"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
data.1 = "IQ0RLif/YUBU+bcdefTdLStKRzCGQSNGN0zbwKe8Z+TxJJLS/e"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4
data.1 = "IQ0RLif/YUBU+bcdefTdLStKRzCGQSNGN0zbwKe8Z+TxJJLS/e"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
usr.0 = "JHVg1xXZTVNPRJLFHw"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4
usr.0 = "JHVg1xXZTVNPRJLFHw"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
usr.1 = "j++ACGcdefABCDWYSU"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4
usr.1 = "j++ACGcdefABCDWYSU"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4
version = "15761"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
uuid = "25fb90de-76df21b9-68ad0fd0"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4
uuid = "25fb90de-76df21b9-68ad0fd0"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
a2e3b941 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
a2e3b941 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
bbf88800 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
bbf88800 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4
state = "0"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
a1dcff5b = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
a1dcff5b = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
340d3099 = "/P////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
340d3099 = "/P////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
0e93c3f3 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
0e93c3f3 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
0c230bcb = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
0c230bcb = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
27ddcf6f = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
27ddcf6f = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
414bc593 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
414bc593 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
f0bf0bde = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
f0bf0bde = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
c99a5f5c = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
c99a5f5c = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
72758a5d = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
72758a5d = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
e46c271e = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
e46c271e = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
7f69fa1f = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
7f69fa1f = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
3c09c42b = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
3c09c42b = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
7367429f = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
7367429f = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
0dc3ee96 = "/P////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
0dc3ee96 = "/P////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
d1abcdb6 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
d1abcdb6 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
38583bc3 = "N//e/Ct/Vx/l/C/////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
38583bc3 = "N//e/Ct/Vx/l/C/////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
c24899a6 = "MP/f/CF/Mx/l/C/////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
c24899a6 = "MP/f/CF/Mx/l/C/////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
f1f24e29 = "Vl/l/C/////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
f1f24e29 = "Vl/l/C/////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
c5705860 = "Vx////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
c5705860 = "Vx////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
a0743acc = "N/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
a0743acc = "N/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
c6c5dd44 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
c6c5dd44 = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
1520c6f1 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
1520c6f1 = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
2d71d5ab = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
2d71d5ab = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
8b9e4cbc = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
8b9e4cbc = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
fe94ce1e = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
fe94ce1e = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
587b5709 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
587b5709 = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
lrts = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4
lrts = "0"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
mode = "f"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4
mode = "f"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4
svn = "Supporter"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4
svi = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4
svt = "53a285b9"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\00000000
370856c7 = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\00000000
370856c7 = "{random characters}"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\00000000
3efeb33e = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\00000000
3efeb33e = "{random characters}"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
060df2cd = "G/Ay/YP/FPAt/X6/clAj/Xl/alAy/XP/blAs/XD/ax/j/Xt/axAv/X6////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4\eae10f9d
060df2cd = "G/Ay/YP/FPAt/X6/clAj/Xl/alAy/XP/blAs/XD/ax/j/Xt/axAv/X6////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
iiid = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4
iiid = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Windows
LoadAppInit_DLLs = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252}
40030ae4 = "%Program Files%\Supporter\Supporter.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4
dlpath = "%Program Files%\suppor~1\suppor~1.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4
svpath = "%Program Files%\suppor~1\SupporterSvc.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\
_40030ae4
Install_Dir = "%Program Files%\Supporter"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{5F189DF5-2D05-472B-9091-84D9848AE48B}{40030ae4}
UninstallString = "%System%\RUNDLL32.EXE %Program Files%\SUPPOR~1\SUPPOR~1.DLL,_uninstall /un"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{5F189DF5-2D05-472B-9091-84D9848AE48B}{40030ae4}
QuietUninstallString = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{5F189DF5-2D05-472B-9091-84D9848AE48B}{40030ae4}
NoModify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{5F189DF5-2D05-472B-9091-84D9848AE48B}{40030ae4}
NoRepair = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{5F189DF5-2D05-472B-9091-84D9848AE48B}{40030ae4}
Publisher = "Costmin"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{5F189DF5-2D05-472B-9091-84D9848AE48B}{40030ae4}
InstallDate = "20140618"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{5F189DF5-2D05-472B-9091-84D9848AE48B}{40030ae4}
DisplayName = "Supporter 1.80"

HKEY_LOCAL_MACHINE\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252}
n = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
n = "1"

HKEY_CURRENT_USER\Software\AppDataLow\
{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
dbaf3ce3 = "/P////%%"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Windows
AppInit_DLLs = "%Program Files%\suppor~1\suppor~1.dll"

It deletes the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Group Policy Objects

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Group Policy Objects\
{8A7618FC-FCCB-4C27-AE08-6B5D1DF237C7}Machine\Software

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Group Policy Objects\
{8A7618FC-FCCB-4C27-AE08-6B5D1DF237C7}Machine\Software\Policies

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Group Policy Objects\
{8A7618FC-FCCB-4C27-AE08-6B5D1DF237C7}Machine\Software\Policies\
Google

Dropping Routine

This Trojan drops the following files:

  • %User Temp%\pl33171017.fyt
  • %User Temp%\294823_.exe
  • %User Temp%\18be6784_.exe
  • %User Temp%/3f03101c/MENodU.dat
  • %User Temp%/3f03101c/MENodU.exe
  • %User Temp%/3f03101c/3osXy.dll
  • %User Temp%/3f03101c/8pvVL.x64.dll
  • %User Temp%/3f03101c/8pvVL.tlb
  • %User Temp%/3f03101c/8pvVL.dll
  • %User Temp%/3f03101c/dnokmo@vzrwcbdj.co.uk/content/bg.js
  • %User Temp%/3f03101c/dnokmo@vzrwcbdj.co.uk/install.rdf
  • %User Temp%/3f03101c/dnokmo@vzrwcbdj.co.uk/chrome.manifest
  • %User Temp%/3f03101c/dnokmo@vzrwcbdj.co.uk/bootstrap.js
  • %User Temp%/3f03101c/bkecibghpbpfpglcmdgnkconcakelopp/lsdb.js
  • %User Temp%/3f03101c/bkecibghpbpfpglcmdgnkconcakelopp/content.js
  • %User Temp%/3f03101c/bkecibghpbpfpglcmdgnkconcakelopp/manifest.json
  • %User Temp%/3f03101c/bkecibghpbpfpglcmdgnkconcakelopp/background.html
  • %User Temp%/3f03101c/bkecibghpbpfpglcmdgnkconcakelopp/iNPF_4k.js
  • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\background.html
  • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\content.js
  • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\iNPF_4k.js
  • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\lsdb.js
  • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\manifest.json
  • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\background.html
  • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\content.js
  • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\iNPF_4k.js
  • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\lsdb.js
  • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\manifest.json
  • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\background.html
  • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\content.js
  • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\iNPF_4k.js
  • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\lsdb.js
  • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\manifest.json
  • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\background.html
  • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\content.js
  • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\iNPF_4k.js
  • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\lsdb.js
  • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\manifest.json
  • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\background.html
  • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\content.js
  • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\iNPF_4k.js
  • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\lsdb.js
  • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\manifest.json
  • %System%\GroupPolicy\Machine\Registry.pol
  • %Program Files%\CostMin\8pvVL.dll
  • %Program Files%\CostMin\8pvVL.tlb
  • %Program Files%\CostMin\8pvVL.dat
  • %User Temp%\tf00294823.dll
  • %Program Files%\Supporter\Supporter.dll
  • %Program Files%\suppor~1\SupporterSvc.dll

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %System% is the Windows system folder, which is usually C:\Windows\System32.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).)

Other Details

This Trojan connects to the following possibly malicious URL:

  • http://download.{BLOCKED}n.info/?{random characters}
  • http://download.{BLOCKED}n.info/get/?{random characters}
  • {BLOCKED}2.197.109
  • {BLOCKED}1.116.97
  • {BLOCKED}.76.32
  • {BLOCKED}0.192.21

This report is generated via an automated analysis system.

  SOLUTION

Minimum Scan Engine:

9.700

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState
    • {8A69D345-D564-463C-AFF1-A69D9E530F96}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState
    • {4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google
    • Update
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects
    • {8A7618FC-FCCB-4C27-AE08-6B5D1DF237C7}User
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects
    • {8A7618FC-FCCB-4C27-AE08-6B5D1DF237C7}Machine
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{8A7618FC-FCCB-4C27-AE08-6B5D1DF237C7}Machine\Software\Policies\Google
    • Chrome
  • In HKEY_CURRENT_USER\Software
    • RegisteredApplicationsEx
  • In HKEY_CURRENT_USER\SOFTWARE\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
    • _40030ae4
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}
    • _40030ae4
  • In HKEY_CURRENT_USER\SOFTWARE\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • eae10f9d
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • eae10f9d
  • In HKEY_CURRENT_USER\SOFTWARE\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • 00000000
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • 00000000
  • In HKEY_LOCAL_MACHINE\SOFTWARE
    • {77D46E27-0E41-4478-87A6-AABE6FBCF252}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
    • {5F189DF5-2D05-472B-9091-84D9848AE48B}{40030ae4}
  • In HKEY_LOCAL_MACHINE\SOFTWARE
    • {3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

Step 3

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
    • ap = "2.0-dev-multi-chrome"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}
    • ap = "-dev-multi-chrome"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Update
    • UpdateDefault = "0"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{8A7618FC-FCCB-4C27-AE08-6B5D1DF237C7}Machine\Software\Policies\Google\Chrome
    • MetricsReportingEnabled = "0"
  • In HKEY_CURRENT_USER\Software\RegisteredApplicationsEx
    • 6edbe30d93ca018c3edfd72d9fb388b9 = "1"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • date = "1403159992"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • date = "1403159992"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • data.0 = "3VMhbySOrDUO6WYSUMjezqCPaV3GY7RVXlp/lwKPTKsVJaVN0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • data.0 = "3VMhbySOrDUO6WYSUMjezqCPaV3GY7RVXlp/lwKPTKsVJaVN0"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • data.1 = "IQ0RLif/YUBU+bcdefTdLStKRzCGQSNGN0zbwKe8Z+TxJJLS/e"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • data.1 = "IQ0RLif/YUBU+bcdefTdLStKRzCGQSNGN0zbwKe8Z+TxJJLS/e"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • usr.0 = "JHVg1xXZTVNPRJLFHw"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • usr.0 = "JHVg1xXZTVNPRJLFHw"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • usr.1 = "j++ACGcdefABCDWYSU"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • usr.1 = "j++ACGcdefABCDWYSU"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • version = "15761"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • uuid = "25fb90de-76df21b9-68ad0fd0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • uuid = "25fb90de-76df21b9-68ad0fd0"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • a2e3b941 = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • a2e3b941 = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • bbf88800 = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • bbf88800 = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • state = "0"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • a1dcff5b = "V/////%%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • a1dcff5b = "V/////%%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 340d3099 = "/P////%%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 340d3099 = "/P////%%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 0e93c3f3 = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 0e93c3f3 = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 0c230bcb = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 0c230bcb = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 27ddcf6f = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 27ddcf6f = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 414bc593 = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 414bc593 = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • f0bf0bde = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • f0bf0bde = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • c99a5f5c = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • c99a5f5c = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 72758a5d = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 72758a5d = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • e46c271e = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • e46c271e = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 7f69fa1f = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 7f69fa1f = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 3c09c42b = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 3c09c42b = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 7367429f = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 7367429f = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 0dc3ee96 = "/P////%%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 0dc3ee96 = "/P////%%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • d1abcdb6 = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • d1abcdb6 = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 38583bc3 = "N//e/Ct/Vx/l/C/////%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 38583bc3 = "N//e/Ct/Vx/l/C/////%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • c24899a6 = "MP/f/CF/Mx/l/C/////%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • c24899a6 = "MP/f/CF/Mx/l/C/////%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • f1f24e29 = "Vl/l/C/////%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • f1f24e29 = "Vl/l/C/////%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • c5705860 = "Vx////%%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • c5705860 = "Vx////%%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • a0743acc = "N/////%%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • a0743acc = "N/////%%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • c6c5dd44 = "V/////%%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • c6c5dd44 = "V/////%%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 1520c6f1 = "V/////%%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 1520c6f1 = "V/////%%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 2d71d5ab = "V/////%%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 2d71d5ab = "V/////%%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 8b9e4cbc = "V/////%%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 8b9e4cbc = "V/////%%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • fe94ce1e = "V/////%%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • fe94ce1e = "V/////%%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 587b5709 = "V/////%%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 587b5709 = "V/////%%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • lrts = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • lrts = "0"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • mode = "f"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • mode = "f"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • svn = "Supporter"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • svi = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • svt = "53a285b9"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\00000000
    • 370856c7 = "{random characters}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\00000000
    • 370856c7 = "{random characters}"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\00000000
    • 3efeb33e = "{random characters}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\00000000
    • 3efeb33e = "{random characters}"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 060df2cd = "G/Ay/YP/FPAt/X6/clAj/Xl/alAy/XP/blAs/XD/ax/j/Xt/axAv/X6////%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • 060df2cd = "G/Ay/YP/FPAt/X6/clAj/Xl/alAy/XP/blAs/XD/ax/j/Xt/axAv/X6////%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • iiid = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • iiid = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
    • LoadAppInit_DLLs = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252}
    • 40030ae4 = "%Program Files%\Supporter\Supporter.dll"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • dlpath = "%Program Files%\suppor~1\suppor~1.dll"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • svpath = "%Program Files%\suppor~1\SupporterSvc.dll"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4
    • Install_Dir = "%Program Files%\Supporter"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5F189DF5-2D05-472B-9091-84D9848AE48B}{40030ae4}
    • UninstallString = "%System%\RUNDLL32.EXE %Program Files%\SUPPOR~1\SUPPOR~1.DLL,_uninstall /un"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5F189DF5-2D05-472B-9091-84D9848AE48B}{40030ae4}
    • QuietUninstallString = "{random characters}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5F189DF5-2D05-472B-9091-84D9848AE48B}{40030ae4}
    • NoModify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5F189DF5-2D05-472B-9091-84D9848AE48B}{40030ae4}
    • NoRepair = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5F189DF5-2D05-472B-9091-84D9848AE48B}{40030ae4}
    • Publisher = "Costmin"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5F189DF5-2D05-472B-9091-84D9848AE48B}{40030ae4}
    • InstallDate = "20140618"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5F189DF5-2D05-472B-9091-84D9848AE48B}{40030ae4}
    • DisplayName = "Supporter 1.80"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252}
    • n = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
    • n = "1"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}\_40030ae4\eae10f9d
    • dbaf3ce3 = "/P////%%"

Step 4

Restore these modified registry values

[ Learn More ]

Important:Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this only if you know how to or you can seek your system administrator's help. You may also check out this Microsoft article first before modifying your computer's registry.

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
    • AppInit_DLLs = "%Program Files%\suppor~1\suppor~1.dll"

Step 5

Search and delete these components

[ Learn More ]
There may be some components that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.
  • %User Temp%\pl33171017.fyt
  • %User Temp%\294823_.exe
  • %User Temp%\18be6784_.exe
  • %User Temp%/3f03101c/MENodU.dat
  • %User Temp%/3f03101c/MENodU.exe
  • %User Temp%/3f03101c/3osXy.dll
  • %User Temp%/3f03101c/8pvVL.x64.dll
  • %User Temp%/3f03101c/8pvVL.tlb
  • %User Temp%/3f03101c/8pvVL.dll
  • %User Temp%/3f03101c/dnokmo@vzrwcbdj.co.uk/content/bg.js
  • %User Temp%/3f03101c/dnokmo@vzrwcbdj.co.uk/install.rdf
  • %User Temp%/3f03101c/dnokmo@vzrwcbdj.co.uk/chrome.manifest
  • %User Temp%/3f03101c/dnokmo@vzrwcbdj.co.uk/bootstrap.js
  • %User Temp%/3f03101c/bkecibghpbpfpglcmdgnkconcakelopp/lsdb.js
  • %User Temp%/3f03101c/bkecibghpbpfpglcmdgnkconcakelopp/content.js
  • %User Temp%/3f03101c/bkecibghpbpfpglcmdgnkconcakelopp/manifest.json
  • %User Temp%/3f03101c/bkecibghpbpfpglcmdgnkconcakelopp/background.html
  • %User Temp%/3f03101c/bkecibghpbpfpglcmdgnkconcakelopp/iNPF_4k.js
  • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\background.html
  • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\content.js
  • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\iNPF_4k.js
  • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\lsdb.js
  • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\manifest.json
  • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\background.html
  • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\content.js
  • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\iNPF_4k.js
  • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\lsdb.js
  • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\manifest.json
  • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\background.html
  • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\content.js
  • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\iNPF_4k.js
  • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\lsdb.js
  • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\manifest.json
  • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\background.html
  • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\content.js
  • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\iNPF_4k.js
  • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\lsdb.js
  • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\manifest.json
  • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\background.html
  • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\content.js
  • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\iNPF_4k.js
  • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\lsdb.js
  • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2\manifest.json
  • %System%\GroupPolicy\Machine\Registry.pol
  • %Program Files%\CostMin\8pvVL.dll
  • %Program Files%\CostMin\8pvVL.tlb
  • %Program Files%\CostMin\8pvVL.dat
  • %User Temp%\tf00294823.dll
  • %Program Files%\Supporter\Supporter.dll
  • %Program Files%\suppor~1\SupporterSvc.dll

Step 6

Search and delete these folders

[ Learn More ]
Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden folders in the search result.
  • %User Temp%/3f03101c
  • %User Temp%/3f03101c/dnokmo@vzrwcbdj.co.uk
  • %User Temp%/3f03101c/dnokmo@vzrwcbdj.co.uk/content
  • %User Temp%/3f03101c/bkecibghpbpfpglcmdgnkconcakelopp
  • %System Root%\Documents and Settings\Administrator
  • %Application Data%\Google
  • %Application Data%\Google\Chrome
  • %Application Data%\Google\Chrome\User Data
  • %Application Data%\Google\Chrome\User Data\Default
  • %Application Data%\Google\Chrome\User Data\Default\Extensions
  • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp
  • %Application Data%\Google\Chrome\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2
  • %System Root%\Documents and Settings\ASPNET
  • %System Root%\Documents and Settings\Guest
  • %System Root%\Documents and Settings\HelpAssistant
  • %System Root%\Documents and Settings\SUPPORT_388945a0
  • %Application Data%\Comodo
  • %Application Data%\Comodo\Dragon
  • %Application Data%\Comodo\Dragon\User Data
  • %Application Data%\Comodo\Dragon\User Data\Default
  • %Application Data%\Comodo\Dragon\User Data\Default\Extensions
  • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp
  • %Application Data%\Comodo\Dragon\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2
  • %Application Data%\Google\Chrome SxS
  • %Application Data%\Google\Chrome SxS\User Data
  • %Application Data%\Google\Chrome SxS\User Data\Default
  • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions
  • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp
  • %Application Data%\Google\Chrome SxS\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2
  • %Application Data%\Torch
  • %Application Data%\Torch\User Data
  • %Application Data%\Torch\User Data\Default
  • %Application Data%\Torch\User Data\Default\Extensions
  • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp
  • %Application Data%\Torch\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2
  • %Application Data%\Chromatic Browser
  • %Application Data%\Chromatic Browser\User Data
  • %Application Data%\Chromatic Browser\User Data\Default
  • %Application Data%\Chromatic Browser\User Data\Default\Extensions
  • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp
  • %Application Data%\Chromatic Browser\User Data\Default\Extensions\bkecibghpbpfpglcmdgnkconcakelopp\2.2
  • %System%\GroupPolicy
  • %System%\GroupPolicy\Machine
  • %System%\GroupPolicy\User
  • %Program Files%\CostMin
  • %Program Files%\Supporter

Step 7

Scan your computer with your Trend Micro product to delete files detected as TROJ_BADUR.NJE. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Step 8

Restore these deleted registry keys/values from backup

*Note: Only Microsoft-related keys/values will be restored. If the malware/grayware also deleted registry keys/values related to programs that are not from Microsoft, please reinstall those programs on your computer.

  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
    • Group Policy Objects
  • In HKEY_CURRENT_USER\Microsoft\Windows\CurrentVersion\Group Policy Objects\{8A7618FC-FCCB-4C27-AE08-6B5D1DF237C7}Machine
    • Software
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{8A7618FC-FCCB-4C27-AE08-6B5D1DF237C7}Machine\Software
    • Policies
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{8A7618FC-FCCB-4C27-AE08-6B5D1DF237C7}Machine\Software\Policies
    • Google


Did this description help? Tell us how we did.