Systweak Spyware Library
Systweak Spyware Library text
More than 1309737 spyware signatures and growing
Microsoft Gold Certified Partner
Search in:
Adware.Agent.s Analysis Report
Threat Submitted On: 5/10/2007 3:57:44 PM
Threat Analysed On: 5/10/2007 8:57:44 PM
Threat Updated On: 11/8/2009 9:27:51 PM
Type : Adware
Symptoms of Agent.s
  • Displays porn/abusive content or intrusive third-party advertisements.
  • Shows deceptive or false warning.
  • Generates advertisement even when the program is not running
  • Synchronously installs other bundled program.
  • The program can places unwanted adverts on computer screen.
Information
Alias : AdWare.Win32.Agent.s
Md5 Hash : [1cbdabc23778aaea7f48a07ad10a7082]
File Size : (134728 bytes)

Here are the Technical findings of our analysis team after analyzing this malware in detail :-

Creates the following infected Files on user's System
Note:
Delete the following Files to remove Infection
File: bdudlex.ini
Path : %programfiles%\yara

Md5Hash :d01b5fa8f7b7b20f4c5abbeea8fa25ee ( 29 bytes)
File: egxg.dll
Path : %programfiles%\yara

Md5Hash :882657d0df5e7ca2b202c863dc315abe ( 43520 bytes)
File: ikbk.dll
Path : %programfiles%\yara

Md5Hash :0affc73e2caa716e79df0e8dfb86caa4 ( 385024 bytes)
File: lnen.dll
Path : %programfiles%\yara

Md5Hash :347963a28364b420589af55e430e3ddd ( 122880 bytes)
File: npgp.dll
Path : %programfiles%\yara

Md5Hash :797b2b472d38b637ac30a773ed3afccc ( 50688 bytes)
File: oqhq.lex
Path : %programfiles%\yara

Md5Hash :60f91f71c50f80c0f4038dd51605a776 ( 19 bytes)
File: qsjs.dll
Path : %programfiles%\yara

Md5Hash :a14643568c8b8b4112a32ce2dc93534a ( 143360 bytes)
File: tvmv.ini
Path : %programfiles%\yara

Md5Hash :b0d37a2e449de97ad870bd2910fe7545 ( 116 bytes)
File: xzqz.ini
Path : %programfiles%\yara

Md5Hash :e073a7c70592a103beb64da731d3c5ec ( 99 bytes)
File: bebhlex.ini
Path : %programfiles%\ybye

Md5Hash :d01b5fa8f7b7b20f4c5abbeea8fa25ee ( 29 bytes)
File: ehek.dll
Path : %programfiles%\ybye

Md5Hash :882657d0df5e7ca2b202c863dc315abe ( 43520 bytes)
File: ilio.dll
Path : %programfiles%\ybye

Md5Hash :0affc73e2caa716e79df0e8dfb86caa4 ( 385024 bytes)
File: lolr.dll
Path : %programfiles%\ybye

Md5Hash :347963a28364b420589af55e430e3ddd ( 122880 bytes)
File: nqnt.dll
Path : %programfiles%\ybye

Md5Hash :797b2b472d38b637ac30a773ed3afccc ( 50688 bytes)
File: orou.lex
Path : %programfiles%\ybye

Md5Hash :60f91f71c50f80c0f4038dd51605a776 ( 19 bytes)
File: qtqw.dll
Path : %programfiles%\ybye

Md5Hash :a14643568c8b8b4112a32ce2dc93534a ( 143360 bytes)
File: twtz.ini
Path : %programfiles%\ybye

Md5Hash :b0d37a2e449de97ad870bd2910fe7545 ( 116 bytes)
File: xaxd.ini
Path : %programfiles%\ybye

Md5Hash :e4ee450e290c6758b90a90d3404653d2 ( 99 bytes)
File: bjfqlex.ini
Path : %programfiles%\ygcn

Md5Hash :d01b5fa8f7b7b20f4c5abbeea8fa25ee ( 29 bytes)
File: emit.dll
Path : %programfiles%\ygcn

Md5Hash :882657d0df5e7ca2b202c863dc315abe ( 43520 bytes)
File: iqmx.dll
Path : %programfiles%\ygcn

Md5Hash :0affc73e2caa716e79df0e8dfb86caa4 ( 385024 bytes)
File: ltpa.dll
Path : %programfiles%\ygcn

Md5Hash :347963a28364b420589af55e430e3ddd ( 122880 bytes)
File: nvrc.dll
Path : %programfiles%\ygcn

Md5Hash :797b2b472d38b637ac30a773ed3afccc ( 50688 bytes)
File: owsd.lex
Path : %programfiles%\ygcn

Md5Hash :60f91f71c50f80c0f4038dd51605a776 ( 19 bytes)
File: qyuf.dll
Path : %programfiles%\ygcn

Md5Hash :a14643568c8b8b4112a32ce2dc93534a ( 143360 bytes)
File: tbxi.ini
Path : %programfiles%\ygcn

Md5Hash :b0d37a2e449de97ad870bd2910fe7545 ( 116 bytes)
File: xfbm.ini
Path : %programfiles%\ygcn

Md5Hash :e4ee450e290c6758b90a90d3404653d2 ( 99 bytes)
File: bnculex.ini
Path : %programfiles%\ykzr

Md5Hash :d01b5fa8f7b7b20f4c5abbeea8fa25ee ( 29 bytes)
File: eqfx.dll
Path : %programfiles%\ykzr

Md5Hash :882657d0df5e7ca2b202c863dc315abe ( 43520 bytes)
File: iujb.dll
Path : %programfiles%\ykzr

Md5Hash :0affc73e2caa716e79df0e8dfb86caa4 ( 385024 bytes)
File: lxme.dll
Path : %programfiles%\ykzr

Md5Hash :347963a28364b420589af55e430e3ddd ( 122880 bytes)
File: nzog.dll
Path : %programfiles%\ykzr

Md5Hash :797b2b472d38b637ac30a773ed3afccc ( 50688 bytes)
File: oaph.lex
Path : %programfiles%\ykzr

Md5Hash :60f91f71c50f80c0f4038dd51605a776 ( 19 bytes)
File: qcrj.dll
Path : %programfiles%\ykzr

Md5Hash :a14643568c8b8b4112a32ce2dc93534a ( 143360 bytes)
File: tfum.ini
Path : %programfiles%\ykzr

Md5Hash :b0d37a2e449de97ad870bd2910fe7545 ( 116 bytes)
File: xjyq.ini
Path : %programfiles%\ykzr

Md5Hash :e4ee450e290c6758b90a90d3404653d2 ( 99 bytes)
File: bprulex.ini
Path : %programfiles%\ymor

Md5Hash :d01b5fa8f7b7b20f4c5abbeea8fa25ee ( 29 bytes)
File: esux.dll
Path : %programfiles%\ymor

Md5Hash :882657d0df5e7ca2b202c863dc315abe ( 43520 bytes)
File: iwyb.dll
Path : %programfiles%\ymor

Md5Hash :0affc73e2caa716e79df0e8dfb86caa4 ( 385024 bytes)
File: lzbe.dll
Path : %programfiles%\ymor

Md5Hash :347963a28364b420589af55e430e3ddd ( 122880 bytes)
File: nbdg.dll
Path : %programfiles%\ymor

Md5Hash :797b2b472d38b637ac30a773ed3afccc ( 50688 bytes)
File: oceh.lex
Path : %programfiles%\ymor

Md5Hash :60f91f71c50f80c0f4038dd51605a776 ( 19 bytes)
File: qegj.dll
Path : %programfiles%\ymor

Md5Hash :a14643568c8b8b4112a32ce2dc93534a ( 143360 bytes)
File: thjm.ini
Path : %programfiles%\ymor

Md5Hash :b0d37a2e449de97ad870bd2910fe7545 ( 116 bytes)
File: xlnq.ini
Path : %programfiles%\ymor

Md5Hash :375de7d36c394a753d994a9964ae157b ( 99 bytes)
File: bpzllex.ini
Path : %programfiles%\ymwi

Md5Hash :d01b5fa8f7b7b20f4c5abbeea8fa25ee ( 29 bytes)
File: esco.dll
Path : %programfiles%\ymwi

Md5Hash :882657d0df5e7ca2b202c863dc315abe ( 43520 bytes)
File: iwgs.dll
Path : %programfiles%\ymwi

Md5Hash :0affc73e2caa716e79df0e8dfb86caa4 ( 385024 bytes)
File: lzjv.dll
Path : %programfiles%\ymwi

Md5Hash :347963a28364b420589af55e430e3ddd ( 122880 bytes)
File: nblx.dll
Path : %programfiles%\ymwi

Md5Hash :797b2b472d38b637ac30a773ed3afccc ( 50688 bytes)
File: ocmy.lex
Path : %programfiles%\ymwi

Md5Hash :60f91f71c50f80c0f4038dd51605a776 ( 19 bytes)
File: qeoa.dll
Path : %programfiles%\ymwi

Md5Hash :a14643568c8b8b4112a32ce2dc93534a ( 143360 bytes)
File: thrd.ini
Path : %programfiles%\ymwi

Md5Hash :b0d37a2e449de97ad870bd2910fe7545 ( 116 bytes)
File: xlvh.ini
Path : %programfiles%\ymwi

Md5Hash :e4ee450e290c6758b90a90d3404653d2 ( 99 bytes)
File: bqkplex.ini
Path : %programfiles%\ynhm

Md5Hash :d01b5fa8f7b7b20f4c5abbeea8fa25ee ( 29 bytes)
File: etns.dll
Path : %programfiles%\ynhm

Md5Hash :882657d0df5e7ca2b202c863dc315abe ( 43520 bytes)
File: ixrw.dll
Path : %programfiles%\ynhm

Md5Hash :0affc73e2caa716e79df0e8dfb86caa4 ( 385024 bytes)
File: lauz.dll
Path : %programfiles%\ynhm

Md5Hash :347963a28364b420589af55e430e3ddd ( 122880 bytes)
File: ncwb.dll
Path : %programfiles%\ynhm

Md5Hash :797b2b472d38b637ac30a773ed3afccc ( 50688 bytes)
File: odxc.lex
Path : %programfiles%\ynhm

Md5Hash :60f91f71c50f80c0f4038dd51605a776 ( 19 bytes)
File: qfze.dll
Path : %programfiles%\ynhm

Md5Hash :a14643568c8b8b4112a32ce2dc93534a ( 143360 bytes)
File: tich.ini
Path : %programfiles%\ynhm

Md5Hash :b0d37a2e449de97ad870bd2910fe7545 ( 116 bytes)
File: xmgl.ini
Path : %programfiles%\ynhm

Md5Hash :e4ee450e290c6758b90a90d3404653d2 ( 99 bytes)
File: brablex.ini
Path : %programfiles%\yoxy

Md5Hash :d01b5fa8f7b7b20f4c5abbeea8fa25ee ( 29 bytes)
File: eude.dll
Path : %programfiles%\yoxy

Md5Hash :882657d0df5e7ca2b202c863dc315abe ( 43520 bytes)
File: iyhi.dll
Path : %programfiles%\yoxy

Md5Hash :0affc73e2caa716e79df0e8dfb86caa4 ( 385024 bytes)
File: lbkl.dll
Path : %programfiles%\yoxy

Md5Hash :347963a28364b420589af55e430e3ddd ( 122880 bytes)
File: ndmn.dll
Path : %programfiles%\yoxy

Md5Hash :797b2b472d38b637ac30a773ed3afccc ( 50688 bytes)
File: oeno.lex
Path : %programfiles%\yoxy

Md5Hash :60f91f71c50f80c0f4038dd51605a776 ( 19 bytes)
File: qgpq.dll
Path : %programfiles%\yoxy

Md5Hash :a14643568c8b8b4112a32ce2dc93534a ( 143360 bytes)
File: tjst.ini
Path : %programfiles%\yoxy

Md5Hash :b0d37a2e449de97ad870bd2910fe7545 ( 116 bytes)
File: xnwx.ini
Path : %programfiles%\yoxy

Skip Navigation Links.
Collapse Md5Hash :Md5Hash :
04009e2f42a3bda9eb226dd4e718a9d5 ( 99 bytes)
e4ee450e290c6758b90a90d3404653d2 ( 99 bytes)
File: bstslex.ini
Path : %programfiles%\ypqp

Md5Hash :d01b5fa8f7b7b20f4c5abbeea8fa25ee ( 29 bytes)
File: evwv.dll
Path : %programfiles%\ypqp

Md5Hash :882657d0df5e7ca2b202c863dc315abe ( 43520 bytes)
File: izaz.dll
Path : %programfiles%\ypqp

Md5Hash :0affc73e2caa716e79df0e8dfb86caa4 ( 385024 bytes)
File: lcdc.dll
Path : %programfiles%\ypqp

Md5Hash :347963a28364b420589af55e430e3ddd ( 122880 bytes)
File: nefe.dll
Path : %programfiles%\ypqp

Md5Hash :797b2b472d38b637ac30a773ed3afccc ( 50688 bytes)
File: ofgf.lex
Path : %programfiles%\ypqp

Md5Hash :60f91f71c50f80c0f4038dd51605a776 ( 19 bytes)
File: qhih.dll
Path : %programfiles%\ypqp

Md5Hash :a14643568c8b8b4112a32ce2dc93534a ( 143360 bytes)
File: tklk.ini
Path : %programfiles%\ypqp

Md5Hash :b0d37a2e449de97ad870bd2910fe7545 ( 116 bytes)
File: xopo.ini
Path : %programfiles%\ypqp

Md5Hash :e4ee450e290c6758b90a90d3404653d2 ( 99 bytes)
File: bsaelex.ini
Path : %programfiles%\ypxb

Md5Hash :d01b5fa8f7b7b20f4c5abbeea8fa25ee ( 29 bytes)
File: evdh.dll
Path : %programfiles%\ypxb

Md5Hash :882657d0df5e7ca2b202c863dc315abe ( 43520 bytes)
File: izhl.dll
Path : %programfiles%\ypxb

Md5Hash :0affc73e2caa716e79df0e8dfb86caa4 ( 385024 bytes)
File: lcko.dll
Path : %programfiles%\ypxb

Md5Hash :347963a28364b420589af55e430e3ddd ( 122880 bytes)
File: nemq.dll
Path : %programfiles%\ypxb

Md5Hash :797b2b472d38b637ac30a773ed3afccc ( 50688 bytes)
File: ofnr.lex
Path : %programfiles%\ypxb

Md5Hash :60f91f71c50f80c0f4038dd51605a776 ( 19 bytes)
File: qhpt.dll
Path : %programfiles%\ypxb

Md5Hash :a14643568c8b8b4112a32ce2dc93534a ( 143360 bytes)
File: tksw.ini
Path : %programfiles%\ypxb

Md5Hash :b0d37a2e449de97ad870bd2910fe7545 ( 116 bytes)
File: xowa.ini
Path : %programfiles%\ypxb

Md5Hash :e4ee450e290c6758b90a90d3404653d2 ( 99 bytes)
File: btrplex.ini
Path : %programfiles%\yqom

Md5Hash :d01b5fa8f7b7b20f4c5abbeea8fa25ee ( 29 bytes)
File: ewus.dll
Path : %programfiles%\yqom

Md5Hash :882657d0df5e7ca2b202c863dc315abe ( 43520 bytes)
File: gywu.ini
Path : %programfiles%\yqom

Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File: iayw.dll
Path : %programfiles%\yqom

Md5Hash :0affc73e2caa716e79df0e8dfb86caa4 ( 385024 bytes)
File: ldbz.dll
Path : %programfiles%\yqom

Md5Hash :347963a28364b420589af55e430e3ddd ( 122880 bytes)
File: nfdb.dll
Path : %programfiles%\yqom

Md5Hash :797b2b472d38b637ac30a773ed3afccc ( 50688 bytes)
File: ogec.lex
Path : %programfiles%\yqom

Md5Hash :60f91f71c50f80c0f4038dd51605a776 ( 19 bytes)
File: qige.dll
Path : %programfiles%\yqom

Md5Hash :a14643568c8b8b4112a32ce2dc93534a ( 143360 bytes)
File: tljh.ini
Path : %programfiles%\yqom

Md5Hash :b0d37a2e449de97ad870bd2910fe7545 ( 116 bytes)
File: xpnl.ini
Path : %programfiles%\yqom

Md5Hash :8058be461c2687e65a36d43b9537d8ef ( 99 bytes)
File: buorlex.ini
Path : %programfiles%\yrlo

Md5Hash :d01b5fa8f7b7b20f4c5abbeea8fa25ee ( 29 bytes)
File: exru.dll
Path : %programfiles%\yrlo

Md5Hash :882657d0df5e7ca2b202c863dc315abe ( 43520 bytes)
File: ibvy.dll
Path : %programfiles%\yrlo

Md5Hash :0affc73e2caa716e79df0e8dfb86caa4 ( 385024 bytes)
File: leyb.dll
Path : %programfiles%\yrlo

Md5Hash :347963a28364b420589af55e430e3ddd ( 122880 bytes)
File: ngad.dll
Path : %programfiles%\yrlo

Md5Hash :797b2b472d38b637ac30a773ed3afccc ( 50688 bytes)
File: ohbe.lex
Path : %programfiles%\yrlo

Md5Hash :60f91f71c50f80c0f4038dd51605a776 ( 19 bytes)
File: qjdg.dll
Path : %programfiles%\yrlo

Md5Hash :a14643568c8b8b4112a32ce2dc93534a ( 143360 bytes)
File: tmgj.ini
Path : %programfiles%\yrlo

Md5Hash :b0d37a2e449de97ad870bd2910fe7545 ( 116 bytes)
File: xqkn.ini
Path : %programfiles%\yrlo

Md5Hash :8058be461c2687e65a36d43b9537d8ef ( 99 bytes)
File: buanlex.ini
Path : %programfiles%\yrxk

Md5Hash :d01b5fa8f7b7b20f4c5abbeea8fa25ee ( 29 bytes)
File: exdq.dll
Path : %programfiles%\yrxk

Md5Hash :882657d0df5e7ca2b202c863dc315abe ( 43520 bytes)
File: ibhu.dll
Path : %programfiles%\yrxk

Md5Hash :0affc73e2caa716e79df0e8dfb86caa4 ( 385024 bytes)
File: lekx.dll
Path : %programfiles%\yrxk

Md5Hash :347963a28364b420589af55e430e3ddd ( 122880 bytes)
File: ngmz.dll
Path : %programfiles%\yrxk

Md5Hash :797b2b472d38b637ac30a773ed3afccc ( 50688 bytes)
File: ohna.lex
Path : %programfiles%\yrxk

Md5Hash :60f91f71c50f80c0f4038dd51605a776 ( 19 bytes)
File: qjpc.dll
Path : %programfiles%\yrxk

Md5Hash :a14643568c8b8b4112a32ce2dc93534a ( 143360 bytes)
File: tmsf.ini
Path : %programfiles%\yrxk

Md5Hash :b0d37a2e449de97ad870bd2910fe7545 ( 116 bytes)
File: xqwj.ini
Path : %programfiles%\yrxk

Md5Hash :e4ee450e290c6758b90a90d3404653d2 ( 99 bytes)
File: buaplex.ini
Path : %programfiles%\yrxm

Md5Hash :d01b5fa8f7b7b20f4c5abbeea8fa25ee ( 29 bytes)
File: exds.dll
Path : %programfiles%\yrxm

Md5Hash :882657d0df5e7ca2b202c863dc315abe ( 43520 bytes)
File: ibhw.dll
Path : %programfiles%\yrxm

Md5Hash :0affc73e2caa716e79df0e8dfb86caa4 ( 385024 bytes)
File: lekz.dll
Path : %programfiles%\yrxm

Md5Hash :347963a28364b420589af55e430e3ddd ( 122880 bytes)
File: ngmb.dll
Path : %programfiles%\yrxm

Md5Hash :797b2b472d38b637ac30a773ed3afccc ( 50688 bytes)
File: ohnc.lex
Path : %programfiles%\yrxm

Md5Hash :60f91f71c50f80c0f4038dd51605a776 ( 19 bytes)
File: qjpe.dll
Path : %programfiles%\yrxm

Md5Hash :a14643568c8b8b4112a32ce2dc93534a ( 143360 bytes)
File: tmsh.ini
Path : %programfiles%\yrxm

Md5Hash :b0d37a2e449de97ad870bd2910fe7545 ( 116 bytes)
File: xqwl.ini
Path : %programfiles%\yrxm

Skip Navigation Links.
Collapse Md5Hash :Md5Hash :
1596bcd6c44d7a9f1ae931a4d7d2609c ( 99 bytes)
6852be4d9c548de1a6647e78aaf0bfec ( 99 bytes)
File: bvsdlex.ini
Path : %programfiles%\yspa

Md5Hash :d01b5fa8f7b7b20f4c5abbeea8fa25ee ( 29 bytes)
File: eyvg.dll
Path : %programfiles%\yspa

Md5Hash :882657d0df5e7ca2b202c863dc315abe ( 43520 bytes)
File: iczk.dll
Path : %programfiles%\yspa

Md5Hash :0affc73e2caa716e79df0e8dfb86caa4 ( 385024 bytes)
File: lfcn.dll
Path : %programfiles%\yspa

Md5Hash :347963a28364b420589af55e430e3ddd ( 122880 bytes)
File: nhep.dll
Path : %programfiles%\yspa

Md5Hash :797b2b472d38b637ac30a773ed3afccc ( 50688 bytes)
File: oifq.lex
Path : %programfiles%\yspa

Md5Hash :60f91f71c50f80c0f4038dd51605a776 ( 19 bytes)
File: qkhs.dll
Path : %programfiles%\yspa

Md5Hash :a14643568c8b8b4112a32ce2dc93534a ( 143360 bytes)
File: tnkv.ini
Path : %programfiles%\yspa

Md5Hash :b0d37a2e449de97ad870bd2910fe7545 ( 116 bytes)
File: xroz.ini
Path : %programfiles%\yspa

Md5Hash :e4ee450e290c6758b90a90d3404653d2 ( 99 bytes)
File: bwknlex.ini
Path : %programfiles%\ythk

Md5Hash :d01b5fa8f7b7b20f4c5abbeea8fa25ee ( 29 bytes)
File: eznq.dll
Path : %programfiles%\ythk

Md5Hash :882657d0df5e7ca2b202c863dc315abe ( 43520 bytes)
File: idru.dll
Path : %programfiles%\ythk

Md5Hash :0affc73e2caa716e79df0e8dfb86caa4 ( 385024 bytes)
File: lgux.dll
Path : %programfiles%\ythk

Md5Hash :347963a28364b420589af55e430e3ddd ( 122880 bytes)
File: niwz.dll
Path : %programfiles%\ythk

Md5Hash :797b2b472d38b637ac30a773ed3afccc ( 50688 bytes)
File: ojxa.lex
Path : %programfiles%\ythk

Md5Hash :60f91f71c50f80c0f4038dd51605a776 ( 19 bytes)
File: qlzc.dll
Path : %programfiles%\ythk

Md5Hash :a14643568c8b8b4112a32ce2dc93534a ( 143360 bytes)
File: tocf.ini
Path : %programfiles%\ythk

Md5Hash :b0d37a2e449de97ad870bd2910fe7545 ( 116 bytes)
File: xsgj.ini
Path : %programfiles%\ythk

Md5Hash :e4ee450e290c6758b90a90d3404653d2 ( 99 bytes)
File: bxpalex.ini
Path : %programfiles%\yumx

Md5Hash :d01b5fa8f7b7b20f4c5abbeea8fa25ee ( 29 bytes)
File: easd.dll
Path : %programfiles%\yumx

Md5Hash :882657d0df5e7ca2b202c863dc315abe ( 43520 bytes)
File: iewh.dll
Path : %programfiles%\yumx

Md5Hash :0affc73e2caa716e79df0e8dfb86caa4 ( 385024 bytes)
File: lhzk.dll
Path : %programfiles%\yumx

Md5Hash :347963a28364b420589af55e430e3ddd ( 122880 bytes)
File: njbm.dll
Path : %programfiles%\yumx

Md5Hash :797b2b472d38b637ac30a773ed3afccc ( 50688 bytes)
File: okcn.lex
Path : %programfiles%\yumx

Md5Hash :60f91f71c50f80c0f4038dd51605a776 ( 19 bytes)
File: qmep.dll
Path : %programfiles%\yumx

Md5Hash :a14643568c8b8b4112a32ce2dc93534a ( 143360 bytes)
File: tphs.ini
Path : %programfiles%\yumx

Md5Hash :b0d37a2e449de97ad870bd2910fe7545 ( 116 bytes)
File: xtlw.ini
Path : %programfiles%\yumx

Md5Hash :e4ee450e290c6758b90a90d3404653d2 ( 99 bytes)
File: baetlex.ini
Path : %programfiles%\yxbq

Md5Hash :d01b5fa8f7b7b20f4c5abbeea8fa25ee ( 29 bytes)
File: edhw.dll
Path : %programfiles%\yxbq

Md5Hash :882657d0df5e7ca2b202c863dc315abe ( 43520 bytes)
File: ihla.dll
Path : %programfiles%\yxbq

Md5Hash :0affc73e2caa716e79df0e8dfb86caa4 ( 385024 bytes)
File: lkod.dll
Path : %programfiles%\yxbq

Md5Hash :347963a28364b420589af55e430e3ddd ( 122880 bytes)
File: nmqf.dll
Path : %programfiles%\yxbq

Md5Hash :797b2b472d38b637ac30a773ed3afccc ( 50688 bytes)
File: onrg.lex
Path : %programfiles%\yxbq

Md5Hash :60f91f71c50f80c0f4038dd51605a776 ( 19 bytes)
File: qpti.dll
Path : %programfiles%\yxbq

Md5Hash :a14643568c8b8b4112a32ce2dc93534a ( 143360 bytes)
File: tswl.ini
Path : %programfiles%\yxbq

Md5Hash :b0d37a2e449de97ad870bd2910fe7545 ( 116 bytes)
File: xwap.ini
Path : %programfiles%\yxbq

Md5Hash :e4ee450e290c6758b90a90d3404653d2 ( 99 bytes)
File: baiglex.ini
Path : %programfiles%\yxfd

Md5Hash :d01b5fa8f7b7b20f4c5abbeea8fa25ee ( 29 bytes)
File: edlj.dll
Path : %programfiles%\yxfd

Md5Hash :882657d0df5e7ca2b202c863dc315abe ( 43520 bytes)
File: ihpn.dll
Path : %programfiles%\yxfd

Md5Hash :0affc73e2caa716e79df0e8dfb86caa4 ( 385024 bytes)
File: lksq.dll
Path : %programfiles%\yxfd

Md5Hash :347963a28364b420589af55e430e3ddd ( 122880 bytes)
File: nmus.dll
Path : %programfiles%\yxfd

Md5Hash :797b2b472d38b637ac30a773ed3afccc ( 50688 bytes)
File: onvt.lex
Path : %programfiles%\yxfd

Md5Hash :60f91f71c50f80c0f4038dd51605a776 ( 19 bytes)
File: qpxv.dll
Path : %programfiles%\yxfd

Md5Hash :a14643568c8b8b4112a32ce2dc93534a ( 143360 bytes)
File: tsay.ini
Path : %programfiles%\yxfd

Md5Hash :b0d37a2e449de97ad870bd2910fe7545 ( 116 bytes)
File: xwec.ini
Path : %programfiles%\yxfd

Skip Navigation Links.
Collapse Md5Hash :Md5Hash :
2b08eab1a642f0bddd88ec68b6b1bc02 ( 99 bytes)
e4ee450e290c6758b90a90d3404653d2 ( 99 bytes)
File: edds.dll
Path : %programfiles%\yxxm

Md5Hash :882657d0df5e7ca2b202c863dc315abe ( 43520 bytes)
File: ihhw.dll
Path : %programfiles%\yxxm

Md5Hash :0affc73e2caa716e79df0e8dfb86caa4 ( 385024 bytes)
File: lkkz.dll
Path : %programfiles%\yxxm

Md5Hash :347963a28364b420589af55e430e3ddd ( 122880 bytes)
File: nmmb.dll
Path : %programfiles%\yxxm

Md5Hash :797b2b472d38b637ac30a773ed3afccc ( 50688 bytes)
File: qppe.dll
Path : %programfiles%\yxxm

Md5Hash :a14643568c8b8b4112a32ce2dc93534a ( 143360 bytes)
File: tssh.ini
Path : %programfiles%\yxxm

Md5Hash :b0d37a2e449de97ad870bd2910fe7545 ( 116 bytes)
File: xwwl.ini
Path : %programfiles%\yxxm

Md5Hash :e4ee450e290c6758b90a90d3404653d2 ( 99 bytes)
File: bbaylex.ini
Path : %programfiles%\yyxv

Md5Hash :d01b5fa8f7b7b20f4c5abbeea8fa25ee ( 29 bytes)
File: eedb.dll
Path : %programfiles%\yyxv

Md5Hash :882657d0df5e7ca2b202c863dc315abe ( 43520 bytes)
File: iihf.dll
Path : %programfiles%\yyxv

Md5Hash :0affc73e2caa716e79df0e8dfb86caa4 ( 385024 bytes)
File: llki.dll
Path : %programfiles%\yyxv

Md5Hash :347963a28364b420589af55e430e3ddd ( 122880 bytes)
File: nnmk.dll
Path : %programfiles%\yyxv

Md5Hash :797b2b472d38b637ac30a773ed3afccc ( 50688 bytes)
File: oonl.lex
Path : %programfiles%\yyxv

Md5Hash :60f91f71c50f80c0f4038dd51605a776 ( 19 bytes)
File: qqpn.dll
Path : %programfiles%\yyxv

Md5Hash :a14643568c8b8b4112a32ce2dc93534a ( 143360 bytes)
File: ttsq.ini
Path : %programfiles%\yyxv

Md5Hash :b0d37a2e449de97ad870bd2910fe7545 ( 116 bytes)
File: xxwu.ini
Path : %programfiles%\yyxv

Md5Hash :e4ee450e290c6758b90a90d3404653d2 ( 99 bytes)
File: zangotb.dll
Path : %programfiles%\zango programs\zango toolbar

Md5Hash :9250d30872a439185d09de164aadc476 ( 87624 bytes)
File: zangotbuninstaller.exe
Path : %programfiles%\zango programs\zango toolbar

Md5Hash :cc710217d0c5ec4440a12acb45cd45a3 ( 29768 bytes)
File: ~de1b.tmp
Path : %systemdrive%

Md5Hash :ffbafdb3130ca00fb2738ca26ecb98ad ( 831488 bytes)
File: ceve.ini
Path : %systemdrive%\progra~1\yara

Md5Hash :d86f3167d070bf03460c9941457a531a ( 91 bytes)
File: cfci.ini
Path : %systemdrive%\progra~1\ybye

Skip Navigation Links.
Collapse Md5Hash :Md5Hash :
b6c988f531d4065843a00cf0ea5497eb ( 91 bytes)
dfdc4a0c8b0beedce5e8361880eafd25 ( 89 bytes)
File: ckgr.ini
Path : %systemdrive%\progra~1\ygcn

Md5Hash :5f54a524aa0915f588a68e907887153f ( 90 bytes)
File: codv.ini
Path : %systemdrive%\progra~1\ykzr

Md5Hash :c9532cbcb8bf6f4be7eea98f7f51338f ( 91 bytes)
File: cqsv.ini
Path : %systemdrive%\progra~1\ymor

Md5Hash :e645f9521fc11a1ba49b7f3175db0612 ( 91 bytes)
File: cqam.ini
Path : %systemdrive%\progra~1\ymwi

Md5Hash :f984abbdbffa77482b754ec546021b94 ( 91 bytes)
File: crlq.ini
Path : %systemdrive%\progra~1\ynhm

Md5Hash :96e6b95d68af5f67aed0d06cb74015d0 ( 91 bytes)
File: csbc.ini
Path : %systemdrive%\progra~1\yoxy

Skip Navigation Links.
Collapse Md5Hash :Md5Hash :
73d66216365f71f27f73262cbb4365cc ( 91 bytes)
b6c988f531d4065843a00cf0ea5497eb ( 91 bytes)
File: ctut.ini
Path : %systemdrive%\progra~1\ypqp

Md5Hash :b6c988f531d4065843a00cf0ea5497eb ( 91 bytes)
File: ctbf.ini
Path : %systemdrive%\progra~1\ypxb

Md5Hash :a7c0bda79f862a7f65649af4c1a53477 ( 91 bytes)
File: cusq.ini
Path : %systemdrive%\progra~1\yqom

Md5Hash :2ab13cb9451037c35850e970a128fc8c ( 90 bytes)
File: cvps.ini
Path : %systemdrive%\progra~1\yrlo

Md5Hash :9799292f42ded233e88bc17d2e583f43 ( 91 bytes)
File: cvbo.ini
Path : %systemdrive%\progra~1\yrxk

Md5Hash :285f4d2febc32dd5b911b108b42c4caa ( 91 bytes)
File: cvbq.ini
Path : %systemdrive%\progra~1\yrxm

Skip Navigation Links.
Collapse Md5Hash :Md5Hash :
4d1b77e82d539cbd813cd229a00e2f86 ( 91 bytes)
b6c988f531d4065843a00cf0ea5497eb ( 91 bytes)
File: cwte.ini
Path : %systemdrive%\progra~1\yspa

Md5Hash :f428817ea5236324e342b879b9ab05e0 ( 91 bytes)
File: cxlo.ini
Path : %systemdrive%\progra~1\ythk

Md5Hash :331ae1313c7e8dc7538f49959b332f56 ( 90 bytes)
File: cyqb.ini
Path : %systemdrive%\progra~1\yumx

Md5Hash :ddcd412b9beb8c4fd54e7e2850f5dc46 ( 91 bytes)
File: cbfu.ini
Path : %systemdrive%\progra~1\yxbq

Md5Hash :6001c937cd85cf3041d3e18ad0b2d52f ( 91 bytes)
File: cbjh.ini
Path : %systemdrive%\progra~1\yxfd

Skip Navigation Links.
Collapse Md5Hash :Md5Hash :
84ebe5bbfa07414398a29072f70e60a9 ( 91 bytes)
c5ec8e37fbd81c24eb2262cbe4b9008f ( 91 bytes)
File: ccbz.ini
Path : %systemdrive%\progra~1\yyxv

Md5Hash :2be96262291c10aec573da9374ce2830 ( 90 bytes)
File: ais_2225_0.exe
Path : %systemdrive%\temp

Md5Hash :( bytes)
File: insshell.exe
Path : %systemdrive%\temp

Md5Hash :ffbafdb3130ca00fb2738ca26ecb98ad ( bytes)
File: ais_2199_0.exe
Path : %temp%

Md5Hash :( bytes)
File: ais_2201_0.exe
Path : %temp%

Md5Hash :( bytes)
File: ais_2203_0.exe
Path : %temp%

Skip Navigation Links.
Collapse Md5Hash :Md5Hash :
( bytes)
ffbafdb3130ca00fb2738ca26ecb98ad ( 831488 bytes)
File: ais_2204_0.exe
Path : %temp%

Md5Hash :( bytes)
File: ais_2216_0.exe
Path : %temp%

Md5Hash :( bytes)
File: ais_2224_0.exe
Path : %temp%

Md5Hash :( bytes)
File: ais_2225_0.exe
Path : %temp%

Md5Hash :( bytes)
File: ais_2247_0.exe
Path : %temp%

Md5Hash :( bytes)
File: insshell.exe
Path : %temp%

Md5Hash :ffbafdb3130ca00fb2738ca26ecb98ad ( bytes)
File: nsb3.tmp
Path : %temp%

Md5Hash :72b3980d933c93cbdd292345e57f42f0 ( bytes)
File: nsc3.tmp
Path : %temp%

Skip Navigation Links.
Collapse Md5Hash :Md5Hash :
72b3980d933c93cbdd292345e57f42f0 ( bytes)
9d1f04f8e237528073218a87520b0d6f ( bytes)
d1342a358d9612faa2a069623e4f528b ( bytes)
File: nsd3.tmp
Path : %temp%

Md5Hash :72b3980d933c93cbdd292345e57f42f0 ( bytes)
File: nse3.tmp
Path : %temp%

Skip Navigation Links.
Collapse Md5Hash :Md5Hash :
54bd9c2a23d941e158c6d14823c294f3 ( bytes)
72b3980d933c93cbdd292345e57f42f0 ( bytes)
File: nsg3.tmp
Path : %temp%

Md5Hash :72b3980d933c93cbdd292345e57f42f0 ( bytes)
File: nsh3.tmp
Path : %temp%

Md5Hash :72b3980d933c93cbdd292345e57f42f0 ( bytes)
File: nsk3.tmp
Path : %temp%

Md5Hash :72b3980d933c93cbdd292345e57f42f0 ( bytes)
File: nsl3.tmp
Path : %temp%

Md5Hash :72b3980d933c93cbdd292345e57f42f0 ( bytes)
File: nsm3.tmp
Path : %temp%

Skip Navigation Links.
Collapse Md5Hash :Md5Hash :
60f33b3b2117a7d2ed4cff232f1d0f76 ( bytes)
72b3980d933c93cbdd292345e57f42f0 ( bytes)
File: nsq3.tmp
Path : %temp%

Md5Hash :72b3980d933c93cbdd292345e57f42f0 ( bytes)
File: nss3.tmp
Path : %temp%

Skip Navigation Links.
Collapse Md5Hash :Md5Hash :
0bc920598033a7e04e85237eb976a096 ( bytes)
72b3980d933c93cbdd292345e57f42f0 ( bytes)
b73c633aa5821a079144ddcb7fedf578 ( bytes)
File: nst3.tmp
Path : %temp%

Md5Hash :72b3980d933c93cbdd292345e57f42f0 ( bytes)
File: nsx3.tmp
Path : %temp%

Md5Hash :72b3980d933c93cbdd292345e57f42f0 ( bytes)
File: [randomname].exe
Path : %workingdir%

Skip Navigation Links.
Collapse Md5Hash :Md5Hash :
03795f92227f727841b3b6d0f5b7589c ( 303036 bytes)
127d643601115e3be2677aed44fc8882 ( 303037 bytes)
1cbdabc23778aaea7f48a07ad10a7082 ( 134728 bytes)
33fedd84d38c55ec1f8a28ab7dbbfaee ( 303047 bytes)
453710c642796633876e8be34db18de3 ( 302910 bytes)
5805b9116280111db62ce6c3c202e724 ( 303034 bytes)
5a6995cbfd8ba670a56661ad0a24456d ( 300493 bytes)
5f01c34f300a0a99d454349446b8e885 ( 278982 bytes)
670e0865314a6d66a716a6851359fe2e ( 303032 bytes)
68e54b3992390533b069ed0c7094e4cd ( 303034 bytes)
7f141638d10f2c5b944b268ce37edccc ( 303032 bytes)
86b70495498cf31fd2257d1aca8a7b34 ( 303034 bytes)
89634b031e92fc0e073872ceedaf07f0 ( 303036 bytes)
8b116b125665fdc118cc7bb5d2b989db ( 303037 bytes)
8b1c5a2e40f6c72c2d305372b7249bb3 ( 303037 bytes)
955525c4331c934ce4bf691425cd4e65 ( 303034 bytes)
ae14d104b290303ea70b9d2cdc71b611 ( 303037 bytes)
bfde1b047c41f9e857dd693ce2865c9f ( 303032 bytes)
c5d78bdc84d298ae2f8e4d9165c43f99 ( 303036 bytes)
c8935ee2197ff73fc4f1a528c23d00dc ( 303042 bytes)
ce2eb4659a2a44007c974c68ee8016d4 ( 303036 bytes)
cf17b4aa21875d1a1ebcd29d34fb9611 ( 303034 bytes)
d65f176a359ac583cf084522f6300dc5 ( 303102 bytes)
daf5838290942b8d478679a65fbc289b ( 303032 bytes)
dc6f6f6549f5ddf45ccefa2a4177d6a6 ( 303036 bytes)
e70dc2762060e5da876f90318af4e72b ( 303032 bytes)
e82d0de80a6733a8e753bdfd4f7a4645 ( 303009 bytes)
Also creates the following files on user's System which are also created by Genuine Software :-
Note:
These file(s) can be kept as they are also created by genuine Software.
File : gizi.ini
Path : %programfiles%\yara

Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File : gjgm.ini
Path : %programfiles%\ybye

Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File : gokv.ini
Path : %programfiles%\ygcn

Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File : gshz.ini
Path : %programfiles%\ykzr

Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File : guwz.ini
Path : %programfiles%\ymor

Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File : gueq.ini
Path : %programfiles%\ymwi

Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File : gvpu.ini
Path : %programfiles%\ynhm

Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File : gwfg.ini
Path : %programfiles%\yoxy

Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File : gxyx.ini
Path : %programfiles%\ypqp

Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File : gxfj.ini
Path : %programfiles%\ypxb

Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File : gztw.ini
Path : %programfiles%\yrlo

Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File : gzfs.ini
Path : %programfiles%\yrxk

Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File : gzfu.ini
Path : %programfiles%\yrxm

Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File : gaxi.ini
Path : %programfiles%\yspa

Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File : gbps.ini
Path : %programfiles%\ythk

Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File : gcuf.ini
Path : %programfiles%\yumx

Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File : gfjy.ini
Path : %programfiles%\yxbq

Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File : gfnl.ini
Path : %programfiles%\yxfd

Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File : gffu.ini
Path : %programfiles%\yxxm

Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File : ggfd.ini
Path : %programfiles%\yyxv

Md5Hash :d41d8cd98f00b204e9800998ecf8427e ( 0 bytes)
File : nsl3.tmp
Path : %systemdrive%\temp

Md5Hash :b73c633aa5821a079144ddcb7fedf578 ( bytes)
File : nsi3.tmp
Path : %temp%

Md5Hash :9c78a0e299a9f0fcc7fa189ef16418a3 ( bytes)
Creates the following infected Registry Keys on user's System
Note:
Delete these Registries to remove Infection
The following Registry Values are added to the provided Registry Keys :-
Note:
Delete the added Values from the Key to remove Infection
|__ Value Added :
AppID = "{f1f040d5-e8f8-4680-b101-9334e9773841}"
|__ Value Added :
AppID = "{f1f040d5-e8f8-4680-b101-9334e9773841}"
|__ Value Added :
ThreadingModel = "apartment"
|__ Value Added :
{EA0D26BD-9029-431A-86E0-83152D67828A} = "zango toolbar"
|__ Value Added :
UninstallString = "%programfiles%\zango programs\zango toolbar\zangotbuninstaller.exe"
|__ Value Added :
ToolbarMoved = "[reg_dword, value: 00000001]"
Creates the following child process(s) on execution:

%windir%\system32\regsvr32.exe %windir%\system32\regsvr32.exe /s %programfiles%\zango programs\zango toolbar\zangotb.dll

%programfiles%\internet explorer\iexplore.exe about:blank

Creates the Following MUTEX(s) on user's System:-
oleacc-msaa-loaded
shell.cmrupidllist
ctf.lbes.mutexdefaults-1-5-21-1960408961-115176313-1801674531-500
ctf.compart.mutexdefaults-1-5-21-1960408961-115176313-1801674531-500
ctf.asm.mutexdefaults-1-5-21-1960408961-115176313-1801674531-500
ctf.layouts.mutexdefaults-1-5-21-1960408961-115176313-1801674531-500
ctf.tmd.mutexdefaults-1-5-21-1960408961-115176313-1801674531-500

NOTE:

1. %programfiles% Refers to the program files folder. By default it is 'C:\Program Files'
2. %systemdrive% Refers to the windows System drive folder. By default it is 'C:\'
3. %temp% Refers to the windows temp folder. By default it is 'C:\Documents and Settings\[user]\Local Settings\Temp'
4. %workingdir% Refers to the current directory in which user is working.

Important: We strongly recommend that you backup the Registry before making any changes to it. Incorrect changes to the Registry can result in permanent data loss or corrupted Files. Modify the malicious\suspicious Subkeys only.

Click Here for more spywarelib.com recommended PC Security and Optimization Tools

To modify registry entries in Windows Operating System:
Follow Steps:
1. Click Start > Run
2. Type “regedit” : to open registry editor
3. Navigate to required registry Key from the Left Tree control and modify accordingly.


Microsoft Gold Certified Partner

© Systweak Inc., 1999-2009 All rights reserved.