TROJ_KOVTER.AUSIO
Trojan:Win32/Kovter (Microsoft); GenericR-JET!B38F9D4F29C7 (McAfee); Trojan.Kotver (Symantec); Trojan.Win32.Poweliks.mra (Kaspersky); Trojan.Win32.Generic!BT (Sunbelt); Trojan horse Atros4.CFND (AVG)
Windows
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It deletes itself after execution.
TECHNICAL DETAILS
Arrival Details
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This Trojan creates the following folders:
- %Application Data%\loge
- %User Profile%\CryptnetUrlCache\MetaData
- %User Profile%\Microsoft\CryptnetUrlCache
- %User Profile%\CryptnetUrlCache\Content
- %System Root%\_112203_
- %System Root%\2df6916556b3249c5982fbd2e2de
- %System Root%\2df6916556b3249c5982fbd2e2de\update
(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)
Other System Modifications
This Trojan adds the following registry keys:
HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main\FeatureControl
HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main\FeatureControl\
FEATURE_BROWSER_EMULATION
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main\FeatureControl\
FEATURE_BROWSER_EMULATION
HKEY_CURRENT_USER\Software\qanz
HKEY_LOCAL_MACHINE\SOFTWARE\qanz
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\WindowsUpdate\
OSUpgrade
HKEY_LOCAL_MACHINE\SOFTWARE\C7E8907B6AC14E45
HKEY_LOCAL_MACHINE\SOFTWARE\5DFAD47D3556F8EEDC
It adds the following registry entries:
HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main\FeatureControl\
FEATURE_BROWSER_EMULATION
regsvr32.exe = "22b8"
HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main\FeatureControl\
FEATURE_BROWSER_EMULATION
iexplore.exe = "22b8"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main\FeatureControl\
FEATURE_BROWSER_EMULATION
regsvr32.exe = "22b8"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main\FeatureControl\
FEATURE_BROWSER_EMULATION
iexplore.exe = "22b8"
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\WindowsUpdate
DisableOSUpgrade = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\WindowsUpdate\
OSUpgrade
ReservationsAllowed = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\qanz
ltpxeirzlt = "Iz0WjJY7B2CJww=="
HKEY_CURRENT_USER\Software\qanz
ltpxeirzlt = "ImkXicAwBZ4dGg=="
HKEY_LOCAL_MACHINE\SOFTWARE\qanz
bjtkim = "JTkRiMAwAiCP2VZSeuHBSFQDvk+tl7I="
HKEY_CURRENT_USER\Software\qanz
bjtkim = "dzlCj5NsVN5/5RiaJ24jD5GGeWUKJAo="
HKEY_LOCAL_MACHINE\SOFTWARE\qanz
eljz = "cThM3pRrVOIxtY/LKOAJcLI="
HKEY_CURRENT_USER\Software\qanz
eljz = "eGpAi55sU0J2NStgV3bilj4="
HKEY_LOCAL_MACHINE\SOFTWARE\qanz
zojewbdazo = "{random characters}"
HKEY_CURRENT_USER\Software\qanz
zojewbdazo = "{random characters}"
HKEY_LOCAL_MACHINE\SOFTWARE\qanz
kqdg = "{random characters}"
HKEY_CURRENT_USER\Software\qanz
kqdg = "{random characters}"
HKEY_LOCAL_MACHINE\SOFTWARE\C7E8907B6AC14E45
F367930B6F17E3B2E5 = "F367930B6F17E3B2E5"
HKEY_LOCAL_MACHINE\SOFTWARE\5DFAD47D3556F8EEDC
B067898B15B669F8 = "B067898B15B669F8"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Setup
LogLevel = "2"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Setup
LogLevel = "0"
It modifies the following registry entries:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
1206 = "0"
(Note: The default value data of the said registry entry is 3.)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
2300 = "0"
(Note: The default value data of the said registry entry is 1.)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
1809 = "3"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\1
1206 = "0"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\1
2300 = "0"
(Note: The default value data of the said registry entry is 1.)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\1
1809 = "3"
(Note: The default value data of the said registry entry is 3.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4EFCED9C6BDD0C985CA3C7D253063C5BE6FC620C
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4EF2E6670AC9B5091FE06BE0E5483EAAD6BA32D9
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4C95A9902ABE0777CED18D6ACCC3372D2748381E
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4BA7B9DDD68788E12FF852E1A024204BF286A8F6
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4B421F7515F6AE8A6ECEF97F6982A400A4D9224E
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
47AFB915CDA26D82467B97FA42914468726138DD
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4463C531D7CCC1006794612BB656D3BF8257846F
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
43F9B110D5BAFD48225231B0D0082B372FEF9A54
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
43DDB1FFF3B49B73831407F6BC8B975023D07C50
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
40E78C1D523D1CD9954FAC1A1AB3BD3CBAA15BFC
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4072BA31FEC351438480F62E6CB95508461EAB2F
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
3F85F2BB4A62B0B58BE1614ABB0D4631B4BEF8BA
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
394FF6850B06BE52E51856CC10E180E882B385CC
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
36863563FD5128C7BEA6F005CFE9B43668086CCE
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
2F173F7DE99667AFA57AF80AA2D1B12FAC830338
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
284F55C41A1A7A3F8328D4C262FB376ED6096F24
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
273EE12457FDC4F90C55E82B56167F62F532E547
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
24BA6D6C8A5B5837A48DB5FAE919EA675C94D217
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
24A40A1F573643A67F0A4B0749F6A22BF28ABB6B
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
23E594945195F2414803B4D564D2A3A3F5D88B8C
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
216B2A29E62A00CE820146D8244141B92511B279
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
209900B63D955728140CD13622D8C687A4EB0085
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
1F55E8839BAC30728BE7108EDE7B0BB0D3298224
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
1331F48A5DA8E01DAACA1BB0C17044ACFEF755BB
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
0B77BEBBCB7AA24705DECC0FBD6A02FC7ABD9B52
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
049811056AFE9FD0F5BE01685AACE6A5D1C4454C
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
0483ED3399AC3608058722EDBC5E4600E3BEF9D7
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
00EA522C8A9C06AA3ECCE0B4FA6CDC21D92E8099
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
0048F8D37B153F6EA2798C323EF4F318A5624A9E
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
It deletes the following registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE
Dropping Routine
This Trojan drops the following files:
- %Application Data%\loge\loge.exe
- %User Profile%\MetaData\2BF68F4714092295550497DD56F57004
- %User Profile%\Content\2BF68F4714092295550497DD56F57004
- %User Profile%\MetaData\94308059B57B3142E455B38A6EB92015
- %User Profile%\Content\94308059B57B3142E455B38A6EB92015
- %User Temp%\Cab17.tmp
- %User Temp%\Tar19.tmp
- %User Profile%\MetaData\AE1425687AA803AA0F6E35ADA1152297
- %User Profile%\Content\AE1425687AA803AA0F6E35ADA1152297
- %User Temp%\WindowsXP-KB968930-x86-ENG.exe
- %System Root%\2df6916556b3249c5982fbd2e2de\eventforwarding.adm
- %System Root%\2df6916556b3249c5982fbd2e2de\windowsremotemanagement.adm
- %System Root%\2df6916556b3249c5982fbd2e2de\windowsremoteshell.adm
- %System Root%\2df6916556b3249c5982fbd2e2de\windowspowershellhelp.chm
- %System Root%\2df6916556b3249c5982fbd2e2de\winrm.cmd
- %System Root%\2df6916556b3249c5982fbd2e2de\compiledcomposition.microsoft.powershell.gpowershell.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.backgroundintelligenttransfer.management.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.backgroundintelligenttransfer.management.interop.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.backgroundintelligenttransfer.management.resources.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.commands.diagnostics.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.commands.diagnostics.resources.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.commands.management.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.commands.management.resources.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.commands.utility.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.commands.utility.resources.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.consolehost.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.consolehost.resources.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.editor.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.editor.resources.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.gpowershell.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.gpowershell.resources.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.graphicalhost.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.graphicalhost.resources.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.security.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.security.resources.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.wsman.management.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.wsman.management.resources.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.wsman.runtime.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\powershell_ise.resources.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\pspluginwkr.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\pwrshmsg.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\pwrshplugin.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\pwrshsip.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\spmsg.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\system.management.automation.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\system.management.automation.resources.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\wevtfwd.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\winrmprov.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\winrscmd.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\winrsmgr.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\winrssrv.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\wsmauto.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\wsmplpxy.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\wsmres.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\wsmsvc.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\wsmwmipl.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\powershell.exe
- %System Root%\2df6916556b3249c5982fbd2e2de\powershell_ise.exe
- %System Root%\2df6916556b3249c5982fbd2e2de\pscustomsetuputil.exe
- %System Root%\2df6916556b3249c5982fbd2e2de\pssetupnativeutils.exe
- %System Root%\2df6916556b3249c5982fbd2e2de\spuninst.exe
- %System Root%\2df6916556b3249c5982fbd2e2de\spupdsvc.exe
- %System Root%\2df6916556b3249c5982fbd2e2de\winrs.exe
- %System Root%\2df6916556b3249c5982fbd2e2de\winrshost.exe
- %System Root%\2df6916556b3249c5982fbd2e2de\wsmanhttpconfig.exe
- %System Root%\2df6916556b3249c5982fbd2e2de\wsmprovhost.exe
- %System Root%\2df6916556b3249c5982fbd2e2de\wtrinstaller.ico
- %System Root%\2df6916556b3249c5982fbd2e2de\winrm.ini
- %System Root%\2df6916556b3249c5982fbd2e2de\winrmprov.mof
- %System Root%\2df6916556b3249c5982fbd2e2de\wsmauto.mof
- %System Root%\2df6916556b3249c5982fbd2e2de\powershell.exe.mui
- %System Root%\2df6916556b3249c5982fbd2e2de\profile.ps1
- %System Root%\2df6916556b3249c5982fbd2e2de\bitstransfer.format.ps1xml
- %System Root%\2df6916556b3249c5982fbd2e2de\certificate.format.ps1xml
- %System Root%\2df6916556b3249c5982fbd2e2de\diagnostics.format.ps1xml
- %System Root%\2df6916556b3249c5982fbd2e2de\dotnettypes.format.ps1xml
- %System Root%\2df6916556b3249c5982fbd2e2de\filesystem.format.ps1xml
- %System Root%\2df6916556b3249c5982fbd2e2de\getevent.types.ps1xml
- %System Root%\2df6916556b3249c5982fbd2e2de\help.format.ps1xml
- %System Root%\2df6916556b3249c5982fbd2e2de\powershellcore.format.ps1xml
- %System Root%\2df6916556b3249c5982fbd2e2de\powershelltrace.format.ps1xml
- %System Root%\2df6916556b3249c5982fbd2e2de\registry.format.ps1xml
- %System Root%\2df6916556b3249c5982fbd2e2de\types.ps1xml
- %System Root%\2df6916556b3249c5982fbd2e2de\wsman.format.ps1xml
- %System Root%\2df6916556b3249c5982fbd2e2de\bitstransfer.psd1
- %System Root%\2df6916556b3249c5982fbd2e2de\importallmodules.psd1
- %System Root%\2df6916556b3249c5982fbd2e2de\about_aliases.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_arithmetic_operators.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_arrays.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_assignment_operators.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_automatic_variables.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_bits_cmdlets.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_break.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_command_precedence.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_command_syntax.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_comment_based_help.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_commonparameters.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_comparison_operators.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_continue.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_core_commands.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_data_sections.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_debuggers.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_do.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_environment_variables.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_escape_characters.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_eventlogs.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_execution_policies.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_for.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_foreach.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_format.ps1xml.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_functions.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_functions_advanced.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_functions_advanced_methods.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_functions_advanced_parameters.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_functions_cmdletbindingattribute.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_hash_tables.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_history.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_if.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_job_details.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_jobs.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_join.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_language_keywords.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_line_editing.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_locations.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_logical_operators.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_methods.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_modules.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_objects.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_operators.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_parameters.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_parsing.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_path_syntax.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_pipelines.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_preference_variables.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_profiles.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_prompts.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_properties.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_providers.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_pssession_details.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_pssessions.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_pssnapins.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_quoting_rules.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_redirection.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_ref.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_regular_expressions.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_remote.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_remote_faq.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_remote_jobs.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_remote_output.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_remote_requirements.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_remote_troubleshooting.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_requires.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_reserved_words.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_return.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_scopes.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_script_blocks.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_script_internationalization.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_scripts.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_session_configurations.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_signing.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_special_characters.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_split.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_switch.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_throw.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_transactions.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_trap.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_try_catch_finally.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_type_operators.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_types.ps1xml.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_variables.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_while.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_wildcards.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_windows_powershell_2.0.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_windows_powershell_ise.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_wmi_cmdlets.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_ws-management_cmdlets.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\default.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\winrm.vbs
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.backgroundintelligenttransfer.management.dll-help.xml
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.commands.diagnostics.dll-help.xml
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.commands.management.dll-help.xml
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.commands.utility.dll-help.xml
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.consolehost.dll-help.xml
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.security.dll-help.xml
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.wsman.management.dll-help.xml
- %System Root%\2df6916556b3249c5982fbd2e2de\system.management.automation.dll-help.xml
- %System Root%\2df6916556b3249c5982fbd2e2de\wsmpty.xsl
- %System Root%\2df6916556b3249c5982fbd2e2de\wsmtxt.xsl
- %System Root%\2df6916556b3249c5982fbd2e2de\update\kb968930xp.cat
- %System Root%\2df6916556b3249c5982fbd2e2de\update\spcustom.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\update\updspapi.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\update\update.exe
- %System Root%\2df6916556b3249c5982fbd2e2de\update\update.inf
- %System Root%\2df6916556b3249c5982fbd2e2de\update\eula.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\update\update.ver
- %System Root%\2df6916556b3249c5982fbd2e2de\$shtdwn$.req
Other Details
This Trojan connects to the following possibly malicious URL:
- http://{BLOCKED}7.72.90
- http://{BLOCKED}7.72.90/{random path}
- {BLOCKED}3.233.173
- {BLOCKED}.145.44
- {BLOCKED}.216.218
- {BLOCKED}.202.72
- {BLOCKED}.195.251
- {BLOCKED}.101.156
- {BLOCKED}.136.72
- {BLOCKED}7.62.95
- {BLOCKED}.85.104
- {BLOCKED}0.109.245
- {BLOCKED}.253.109
- {BLOCKED}.242.184
- {BLOCKED}.197.200
- {BLOCKED}237.252
- {BLOCKED}248.88
- {BLOCKED}4.10.208
- {BLOCKED}2.215.43
- {BLOCKED}.201.22
- {BLOCKED}5.213
- {BLOCKED}83.243
- {BLOCKED}.25.70
- {BLOCKED}0.157.129
- {BLOCKED}6.35.87
- {BLOCKED}2.132
- {BLOCKED}70.64
- {BLOCKED}.87.137
- {BLOCKED}13.194
- {BLOCKED}240.63
- {BLOCKED}.123.122
- {BLOCKED}7.169.1
- {BLOCKED}8.47.9
- {BLOCKED}4.64.173
- {BLOCKED}190.8
- {BLOCKED}2.87.159
- {BLOCKED}74.87
- {BLOCKED}.200.90
- {BLOCKED}.37.112
- {BLOCKED}.47.168
- {BLOCKED}.39.172
- {BLOCKED}118.81
- {BLOCKED}.202.10
- {BLOCKED}.42.8
- {BLOCKED}.247.160
- {BLOCKED}.169.124
- {BLOCKED}0.231.118
- {BLOCKED}5.166.14
- {BLOCKED}.82.250
- {BLOCKED}.113.204
- {BLOCKED}105.159
- {BLOCKED}.166.172
- {BLOCKED}4.11
- {BLOCKED}.96.161
- {BLOCKED}6.64
- {BLOCKED}2.182.135
- {BLOCKED}7.173.56
- {BLOCKED}.72.105
- {BLOCKED}3.189.212
- {BLOCKED}223.44
- {BLOCKED}.37.247
- {BLOCKED}.28.71
- {BLOCKED}8.158.172
- {BLOCKED}203.205
- {BLOCKED}2.84.95
- {BLOCKED}8.86.138
- {BLOCKED}5.188.169
- {BLOCKED}7.204.64
- {BLOCKED}2.223.146
- {BLOCKED}1.82.82
- {BLOCKED}214.177
- {BLOCKED}2.244.127
- {BLOCKED}.205.146
- {BLOCKED}0.17.158
- {BLOCKED}.250.122
- {BLOCKED}.182.111
- {BLOCKED}.140.236
- {BLOCKED}.233.76
- {BLOCKED}.215.189
- {BLOCKED}.65.25
- {BLOCKED}7.208.196
- {BLOCKED}.196.6
- {BLOCKED}.83.94
- {BLOCKED}7.55.221
- {BLOCKED}5.1.69
- {BLOCKED}1.236.80
- {BLOCKED}.232.143
- {BLOCKED}.96.232
- {BLOCKED}45.98
- {BLOCKED}.226.153
- {BLOCKED}.63.241
- {BLOCKED}.242.53
- {BLOCKED}4.12.242
- {BLOCKED}2.123.27
- {BLOCKED}2.135.106
- {BLOCKED}8.243.62
- {BLOCKED}.182.23
- {BLOCKED}.103.143
- {BLOCKED}.183.255
- {BLOCKED}0.211.232
- {BLOCKED}19.247
- {BLOCKED}2.145.216
- {BLOCKED}4.55.160
- {BLOCKED}.121.94
- {BLOCKED}.43.25
- {BLOCKED}61.58
- {BLOCKED}12.55
- {BLOCKED}.36.198
- {BLOCKED}.150.116
- {BLOCKED}2.230.247
- {BLOCKED}121.106
- {BLOCKED}3.5.160
- {BLOCKED}.63.145
- {BLOCKED}.163.114
- {BLOCKED}.30.77
- {BLOCKED}.143.160
- {BLOCKED}.230.227
- {BLOCKED}.4.50
- {BLOCKED}.50.225
- {BLOCKED}7.88.182
- {BLOCKED}.197.250
- {BLOCKED}.183.74
- {BLOCKED}5.181.52
- {BLOCKED}16.187
- {BLOCKED}9.100.242
- {BLOCKED}.61.254
- {BLOCKED}9.13.160
- {BLOCKED}255.55
- {BLOCKED}.56.78
- {BLOCKED}7.66.247
- {BLOCKED}.117.93
- {BLOCKED}.151.161
- {BLOCKED}.178.79
- {BLOCKED}45.163
- {BLOCKED}.218.137
- {BLOCKED}.115.209
- {BLOCKED}1.184.129
- {BLOCKED}.104.149
- {BLOCKED}.106.54
- {BLOCKED}9.188.21
- {BLOCKED}2.118.100
- {BLOCKED}8.138.104
- {BLOCKED}161.26
- {BLOCKED}8.245.8
- {BLOCKED}3.110.229
- {BLOCKED}4.219.33
- {BLOCKED}3.85.255
- {BLOCKED}.229.187
- {BLOCKED}8.143.44
- {BLOCKED}98.83
- {BLOCKED}.54.35
- {BLOCKED}3.62.251
- {BLOCKED}9.121.185
- {BLOCKED}67.222
- {BLOCKED}.95.25
- {BLOCKED}142.127
- {BLOCKED}235.241
- {BLOCKED}2.196.218
- {BLOCKED}.221.69
- {BLOCKED}.190.84
- {BLOCKED}0.222.154
- {BLOCKED}4.17.18
- {BLOCKED}.131.194
- {BLOCKED}6.160.250
- {BLOCKED}.21.64
- {BLOCKED}9.110.156
- {BLOCKED}.59.254
- {BLOCKED}.206.252
- {BLOCKED}8.45.225
- {BLOCKED}212.27
- {BLOCKED}.234.88
- {BLOCKED}3.214.242
- {BLOCKED}1.110.135
- {BLOCKED}.160.148
- {BLOCKED}247.233
- {BLOCKED}.118.246
- {BLOCKED}.96.215
- {BLOCKED}.108.43
- {BLOCKED}.244.233
- {BLOCKED}.77.156
- {BLOCKED}7.128.115
- {BLOCKED}.61.157
- {BLOCKED}.121.151
- {BLOCKED}6.196
- {BLOCKED}.30.124
- {BLOCKED}109.228
- {BLOCKED}4.245.99
- {BLOCKED}4.87.197
- {BLOCKED}7.178.77
- {BLOCKED}7.83.21
- {BLOCKED}40.231
- {BLOCKED}5.87.10
- {BLOCKED}0.142.15
- {BLOCKED}20.235
- {BLOCKED}.226.204
- {BLOCKED}9.53.222
- {BLOCKED}2.40.159
- {BLOCKED}82.82
- {BLOCKED}.85.139
- {BLOCKED}.173.191
- {BLOCKED}.174.113
- {BLOCKED}5.244.204
- {BLOCKED}.112.33
- {BLOCKED}0.220.230
- {BLOCKED}6.96.119
- {BLOCKED}.184.200
- {BLOCKED}.255.222
- {BLOCKED}6.70.110
- {BLOCKED}.68.15
- {BLOCKED}.64.153
- {BLOCKED}9.138.68
- {BLOCKED}.84.238
- {BLOCKED}3.15.3
- {BLOCKED}.158.156
- {BLOCKED}.93.86
- {BLOCKED}.161.129
- {BLOCKED}3.186.78
- {BLOCKED}7.42.83
- {BLOCKED}9.86
- {BLOCKED}9.243.46
- {BLOCKED}.146.174
- {BLOCKED}190.59
- {BLOCKED}8.231.86
- {BLOCKED}242.138
- {BLOCKED}.119.72
- {BLOCKED}7.193.37
- {BLOCKED}5.146.80
- {BLOCKED}.154.20
- {BLOCKED}.253.21
- {BLOCKED}.44.7
- {BLOCKED}.129.208
- {BLOCKED}6.247.78
- {BLOCKED}0.232.63
- {BLOCKED}7.197.245
- {BLOCKED}170.12
It deletes itself after execution.
This report is generated via an automated analysis system.
SOLUTION
Step 1
Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.
Step 2
Delete this registry key
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
- FeatureControl
- In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl
- FEATURE_BROWSER_EMULATION
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl
- FEATURE_BROWSER_EMULATION
- In HKEY_CURRENT_USER\Software
- qanz
- In HKEY_LOCAL_MACHINE\SOFTWARE
- qanz
- In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
- OSUpgrade
- In HKEY_LOCAL_MACHINE\SOFTWARE
- C7E8907B6AC14E45
- In HKEY_LOCAL_MACHINE\SOFTWARE
- 5DFAD47D3556F8EEDC
Step 3
Delete this registry value
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
- regsvr32.exe = "22b8"
- In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
- iexplore.exe = "22b8"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
- regsvr32.exe = "22b8"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
- iexplore.exe = "22b8"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
- DisableOSUpgrade = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\OSUpgrade
- ReservationsAllowed = "0"
- In HKEY_LOCAL_MACHINE\SOFTWARE\qanz
- ltpxeirzlt = "Iz0WjJY7B2CJww=="
- In HKEY_CURRENT_USER\Software\qanz
- ltpxeirzlt = "ImkXicAwBZ4dGg=="
- In HKEY_LOCAL_MACHINE\SOFTWARE\qanz
- bjtkim = "JTkRiMAwAiCP2VZSeuHBSFQDvk+tl7I="
- In HKEY_CURRENT_USER\Software\qanz
- bjtkim = "dzlCj5NsVN5/5RiaJ24jD5GGeWUKJAo="
- In HKEY_LOCAL_MACHINE\SOFTWARE\qanz
- eljz = "cThM3pRrVOIxtY/LKOAJcLI="
- In HKEY_CURRENT_USER\Software\qanz
- eljz = "eGpAi55sU0J2NStgV3bilj4="
- In HKEY_LOCAL_MACHINE\SOFTWARE\qanz
- zojewbdazo = "{random characters}"
- In HKEY_CURRENT_USER\Software\qanz
- zojewbdazo = "{random characters}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\qanz
- kqdg = "{random characters}"
- In HKEY_CURRENT_USER\Software\qanz
- kqdg = "{random characters}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\C7E8907B6AC14E45
- F367930B6F17E3B2E5 = "F367930B6F17E3B2E5"
- In HKEY_LOCAL_MACHINE\SOFTWARE\5DFAD47D3556F8EEDC
- B067898B15B669F8 = "B067898B15B669F8"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup
- LogLevel = "2"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup
- LogLevel = "0"
Step 4
Restore these modified registry values
Important:Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this only if you know how to or you can seek your system administrator's help. You may also check out this Microsoft article first before modifying your computer's registry.
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
- From: 1206 = "0"
To: 1206 = ""3""
- From: 1206 = "0"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
- From: 2300 = "0"
To: 2300 = ""1""
- From: 2300 = "0"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
- 1809 = "3"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- 1206 = "0"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- From: 2300 = "0"
To: 2300 = ""1""
- From: 2300 = "0"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- From: 1809 = "3"
To: 1809 = ""3""
- From: 1809 = "3"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFCED9C6BDD0C985CA3C7D253063C5BE6FC620C
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EF2E6670AC9B5091FE06BE0E5483EAAD6BA32D9
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4C95A9902ABE0777CED18D6ACCC3372D2748381E
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4BA7B9DDD68788E12FF852E1A024204BF286A8F6
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4B421F7515F6AE8A6ECEF97F6982A400A4D9224E
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47AFB915CDA26D82467B97FA42914468726138DD
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4463C531D7CCC1006794612BB656D3BF8257846F
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\43F9B110D5BAFD48225231B0D0082B372FEF9A54
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\43DDB1FFF3B49B73831407F6BC8B975023D07C50
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\40E78C1D523D1CD9954FAC1A1AB3BD3CBAA15BFC
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4072BA31FEC351438480F62E6CB95508461EAB2F
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3F85F2BB4A62B0B58BE1614ABB0D4631B4BEF8BA
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\394FF6850B06BE52E51856CC10E180E882B385CC
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\36863563FD5128C7BEA6F005CFE9B43668086CCE
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2F173F7DE99667AFA57AF80AA2D1B12FAC830338
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\284F55C41A1A7A3F8328D4C262FB376ED6096F24
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\273EE12457FDC4F90C55E82B56167F62F532E547
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\24BA6D6C8A5B5837A48DB5FAE919EA675C94D217
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\24A40A1F573643A67F0A4B0749F6A22BF28ABB6B
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\23E594945195F2414803B4D564D2A3A3F5D88B8C
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\216B2A29E62A00CE820146D8244141B92511B279
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\209900B63D955728140CD13622D8C687A4EB0085
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F55E8839BAC30728BE7108EDE7B0BB0D3298224
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1331F48A5DA8E01DAACA1BB0C17044ACFEF755BB
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0B77BEBBCB7AA24705DECC0FBD6A02FC7ABD9B52
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\049811056AFE9FD0F5BE01685AACE6A5D1C4454C
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0483ED3399AC3608058722EDBC5E4600E3BEF9D7
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\00EA522C8A9C06AA3ECCE0B4FA6CDC21D92E8099
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0048F8D37B153F6EA2798C323EF4F318A5624A9E
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
Step 5
Search and delete these components
- %Application Data%\loge\loge.exe
- %User Profile%\MetaData\2BF68F4714092295550497DD56F57004
- %User Profile%\Content\2BF68F4714092295550497DD56F57004
- %User Profile%\MetaData\94308059B57B3142E455B38A6EB92015
- %User Profile%\Content\94308059B57B3142E455B38A6EB92015
- %User Temp%\Cab17.tmp
- %User Temp%\Tar19.tmp
- %User Profile%\MetaData\AE1425687AA803AA0F6E35ADA1152297
- %User Profile%\Content\AE1425687AA803AA0F6E35ADA1152297
- %User Temp%\WindowsXP-KB968930-x86-ENG.exe
- %System Root%\2df6916556b3249c5982fbd2e2de\eventforwarding.adm
- %System Root%\2df6916556b3249c5982fbd2e2de\windowsremotemanagement.adm
- %System Root%\2df6916556b3249c5982fbd2e2de\windowsremoteshell.adm
- %System Root%\2df6916556b3249c5982fbd2e2de\windowspowershellhelp.chm
- %System Root%\2df6916556b3249c5982fbd2e2de\winrm.cmd
- %System Root%\2df6916556b3249c5982fbd2e2de\compiledcomposition.microsoft.powershell.gpowershell.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.backgroundintelligenttransfer.management.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.backgroundintelligenttransfer.management.interop.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.backgroundintelligenttransfer.management.resources.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.commands.diagnostics.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.commands.diagnostics.resources.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.commands.management.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.commands.management.resources.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.commands.utility.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.commands.utility.resources.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.consolehost.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.consolehost.resources.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.editor.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.editor.resources.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.gpowershell.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.gpowershell.resources.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.graphicalhost.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.graphicalhost.resources.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.security.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.security.resources.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.wsman.management.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.wsman.management.resources.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.wsman.runtime.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\powershell_ise.resources.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\pspluginwkr.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\pwrshmsg.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\pwrshplugin.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\pwrshsip.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\spmsg.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\system.management.automation.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\system.management.automation.resources.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\wevtfwd.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\winrmprov.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\winrscmd.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\winrsmgr.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\winrssrv.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\wsmauto.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\wsmplpxy.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\wsmres.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\wsmsvc.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\wsmwmipl.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\powershell.exe
- %System Root%\2df6916556b3249c5982fbd2e2de\powershell_ise.exe
- %System Root%\2df6916556b3249c5982fbd2e2de\pscustomsetuputil.exe
- %System Root%\2df6916556b3249c5982fbd2e2de\pssetupnativeutils.exe
- %System Root%\2df6916556b3249c5982fbd2e2de\spuninst.exe
- %System Root%\2df6916556b3249c5982fbd2e2de\spupdsvc.exe
- %System Root%\2df6916556b3249c5982fbd2e2de\winrs.exe
- %System Root%\2df6916556b3249c5982fbd2e2de\winrshost.exe
- %System Root%\2df6916556b3249c5982fbd2e2de\wsmanhttpconfig.exe
- %System Root%\2df6916556b3249c5982fbd2e2de\wsmprovhost.exe
- %System Root%\2df6916556b3249c5982fbd2e2de\wtrinstaller.ico
- %System Root%\2df6916556b3249c5982fbd2e2de\winrm.ini
- %System Root%\2df6916556b3249c5982fbd2e2de\winrmprov.mof
- %System Root%\2df6916556b3249c5982fbd2e2de\wsmauto.mof
- %System Root%\2df6916556b3249c5982fbd2e2de\powershell.exe.mui
- %System Root%\2df6916556b3249c5982fbd2e2de\profile.ps1
- %System Root%\2df6916556b3249c5982fbd2e2de\bitstransfer.format.ps1xml
- %System Root%\2df6916556b3249c5982fbd2e2de\certificate.format.ps1xml
- %System Root%\2df6916556b3249c5982fbd2e2de\diagnostics.format.ps1xml
- %System Root%\2df6916556b3249c5982fbd2e2de\dotnettypes.format.ps1xml
- %System Root%\2df6916556b3249c5982fbd2e2de\filesystem.format.ps1xml
- %System Root%\2df6916556b3249c5982fbd2e2de\getevent.types.ps1xml
- %System Root%\2df6916556b3249c5982fbd2e2de\help.format.ps1xml
- %System Root%\2df6916556b3249c5982fbd2e2de\powershellcore.format.ps1xml
- %System Root%\2df6916556b3249c5982fbd2e2de\powershelltrace.format.ps1xml
- %System Root%\2df6916556b3249c5982fbd2e2de\registry.format.ps1xml
- %System Root%\2df6916556b3249c5982fbd2e2de\types.ps1xml
- %System Root%\2df6916556b3249c5982fbd2e2de\wsman.format.ps1xml
- %System Root%\2df6916556b3249c5982fbd2e2de\bitstransfer.psd1
- %System Root%\2df6916556b3249c5982fbd2e2de\importallmodules.psd1
- %System Root%\2df6916556b3249c5982fbd2e2de\about_aliases.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_arithmetic_operators.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_arrays.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_assignment_operators.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_automatic_variables.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_bits_cmdlets.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_break.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_command_precedence.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_command_syntax.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_comment_based_help.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_commonparameters.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_comparison_operators.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_continue.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_core_commands.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_data_sections.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_debuggers.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_do.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_environment_variables.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_escape_characters.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_eventlogs.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_execution_policies.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_for.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_foreach.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_format.ps1xml.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_functions.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_functions_advanced.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_functions_advanced_methods.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_functions_advanced_parameters.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_functions_cmdletbindingattribute.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_hash_tables.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_history.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_if.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_job_details.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_jobs.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_join.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_language_keywords.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_line_editing.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_locations.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_logical_operators.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_methods.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_modules.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_objects.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_operators.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_parameters.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_parsing.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_path_syntax.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_pipelines.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_preference_variables.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_profiles.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_prompts.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_properties.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_providers.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_pssession_details.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_pssessions.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_pssnapins.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_quoting_rules.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_redirection.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_ref.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_regular_expressions.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_remote.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_remote_faq.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_remote_jobs.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_remote_output.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_remote_requirements.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_remote_troubleshooting.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_requires.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_reserved_words.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_return.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_scopes.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_script_blocks.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_script_internationalization.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_scripts.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_session_configurations.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_signing.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_special_characters.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_split.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_switch.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_throw.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_transactions.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_trap.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_try_catch_finally.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_type_operators.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_types.ps1xml.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_variables.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_while.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_wildcards.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_windows_powershell_2.0.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_windows_powershell_ise.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_wmi_cmdlets.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\about_ws-management_cmdlets.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\default.help.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\winrm.vbs
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.backgroundintelligenttransfer.management.dll-help.xml
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.commands.diagnostics.dll-help.xml
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.commands.management.dll-help.xml
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.commands.utility.dll-help.xml
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.consolehost.dll-help.xml
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.powershell.security.dll-help.xml
- %System Root%\2df6916556b3249c5982fbd2e2de\microsoft.wsman.management.dll-help.xml
- %System Root%\2df6916556b3249c5982fbd2e2de\system.management.automation.dll-help.xml
- %System Root%\2df6916556b3249c5982fbd2e2de\wsmpty.xsl
- %System Root%\2df6916556b3249c5982fbd2e2de\wsmtxt.xsl
- %System Root%\2df6916556b3249c5982fbd2e2de\update\kb968930xp.cat
- %System Root%\2df6916556b3249c5982fbd2e2de\update\spcustom.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\update\updspapi.dll
- %System Root%\2df6916556b3249c5982fbd2e2de\update\update.exe
- %System Root%\2df6916556b3249c5982fbd2e2de\update\update.inf
- %System Root%\2df6916556b3249c5982fbd2e2de\update\eula.txt
- %System Root%\2df6916556b3249c5982fbd2e2de\update\update.ver
- %System Root%\2df6916556b3249c5982fbd2e2de\$shtdwn$.req
Step 6
Search and delete these folders
- %Application Data%\loge
- %User Profile%\CryptnetUrlCache\MetaData
- %User Profile%\Microsoft\CryptnetUrlCache
- %User Profile%\CryptnetUrlCache\Content
- %System Root%\_112203_
- %System Root%\2df6916556b3249c5982fbd2e2de
- %System Root%\2df6916556b3249c5982fbd2e2de\update
Step 7
Scan your computer with your Trend Micro product to delete files detected as TROJ_KOVTER.AUSIO. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Step 8
Restore these deleted registry keys/values from backup
*Note: Only Microsoft-related keys/values will be restored. If the malware/grayware also deleted registry keys/values related to programs that are not from Microsoft, please reinstall those programs on your computer.
- In HKEY_LOCAL_MACHINE
- SOFTWARE
Did this description help? Tell us how we did.