PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

  TECHNICAL DETAILS

File Size: 209,920 bytes
File Type: EXE
Memory Resident: Yes
Initial Samples Received Date: 29 Mar 2014

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan creates the following folders:

  • %User Profile%\CryptnetUrlCache\MetaData
  • %User Profile%\Microsoft\CryptnetUrlCache
  • %User Profile%\CryptnetUrlCache\Content

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
bbbfea = "%System Root%\bbbfeac\bbbfeac.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
bbbfeac = "%User Profile%\Application Data\bbbfeac.exe"

Other System Modifications

This Trojan modifies the following file(s):

  • %User Profile%\Application Data\Microsoft
  • %Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.DTD
  • %User Profile%\Templates\excel.xls
  • %User Profile%\Templates\excel4.xls
  • %User Profile%\Templates\powerpnt.ppt
  • %User Profile%\Templates\quattro.wb2
  • %User Profile%\Templates\winword.doc
  • %User Profile%\Templates\winword2.doc
  • %User Profile%\Templates\wordpfct.wpd

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It deletes the following files:

  • %System Root%\bbbfeac

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It adds the following registry keys:

HKEY_CURRENT_USER\software\BBBFEACF8539FC947B9028B6EE760345

HKEY_CURRENT_USER\software\BBBFEACF8539FC947B9028B6EE760345\
DISKS

HKEY_CURRENT_USER\software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED

HKEY_CURRENT_USER\software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0

It adds the following registry entries:

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345
text = "{random values}"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345
html = "{random values}"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345
weblink = "{random values}"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345
pub = "{random values}"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345
start = "1"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
DF87C3DE = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
4664571E = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
866419F6 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
1207A18F = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
A9D246E4 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
6E10B272 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
B6B67ED9 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
180F43DB = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
716A4C5A = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
7675AEDA = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
C0E2793C = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
C4B6F6F6 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
2F213C6C = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
2BF0D7B6 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
8E9E31AA = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
DEEE5852 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
C2696AAC = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
303CBF3D = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
C03E4E3B = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
205181D1 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
821B00E6 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
CBB30CFC = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
E95DEA19 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
BC82B119 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
88AAB850 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
CE5340B9 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
E1964A59 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
AC86A324 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
ECE59176 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
38E0E841 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
6E4AF06 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
67B018CB = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
1FB0E720 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
21690AB6 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
B6E7C0D9 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
9344454A = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
E6B01D60 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
3014CA4C = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
9478294F = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
F948B772 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
F742ACE = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
5BED2262 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
E7953DBF = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
D62E300F = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
AA2817CD = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
7119E9E3 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Internet Explorer\brndlog.txt = "68adfd"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
FDD4E4A4 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
48E704D7 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
A77F3530 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
E0629E55 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
E4EFE2E7 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
A36C0861 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
828EA9F0 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
3A050C0C = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
AC9807D5 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
80C57583 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
36F19BFB = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
CEFDA0BD = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
E2EDBB9 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.DTD = "68adfd"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
5A9064DD = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
6F9F90B5 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
37A2BE97 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
7CA9FC1 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
F0999EDB = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
B4656924 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
D274A7D3 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
1B2FE48 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
38BD2FA7 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
E76A2115 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
48FBD5D8 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
4A4787A0 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
CD98C648 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
9DCF1BF1 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
7D6C68D = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
627A96C3 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
30DDA2CF = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
41137D2D = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Templates\excel.xls = "68adfd"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Templates\excel4.xls = "68adfd"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Templates\powerpnt.ppt = "68adfd"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Templates\quattro.wb2 = "68adfd"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Templates\winword.doc = "68adfd"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Templates\winword2.doc = "68adfd"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Templates\wordpfct.wpd = "68adfd"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
45BCBDC6 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
4C853E72 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
D1674F40 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
8AC53A20 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
86DDB95E = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
E2E68DA4 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
595DFA08 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
D9E48997 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
DD69F525 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
38C650BC = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
DF9DBBAF = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
C783AA01 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
7D0E88B = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
C354FB50 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
4EBF9B61 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
18E71623 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
A7D40527 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
D3F0E56B = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
37AA0E77 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
A3E892FE = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
92232D0 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
E0B9FBF7 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
DBC22CFD = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
817BB52E = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
7E992925 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
5551E2C = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
287BAF84 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
CD17AA70 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
C99AD6C2 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
5E983FFE = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
18B2578B = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
3A1C3E4D = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
5868ADDB = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
80ABAF5A = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
F8319958 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
C1435C4 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
3D883229 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
2B8C46ED = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
E8BBB80 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
805342C8 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
79881720 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
15AF95C2 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
65B4BB0D = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
99C264C7 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
7BB39A2C = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
7832A2B0 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
9C17C390 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
4DEC104 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
60710059 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
BF2B6B01 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
D73C4A6C = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
121BE978 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
223C63A3 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
31EB1464 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
10183795 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
11866F0C = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
CAC2049B = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
CE4F7829 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
8E6F0ED0 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
171B0BDC = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
C0BDDF95 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
114A3E1 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Cookies\wilbert@atdmt[2].txt = "68adfd"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Cookies\wilbert@bing[2].txt = "68adfd"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Cookies\wilbert@c.atdmt[2].txt = "68adfd"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Cookies\wilbert@c.msn[2].txt = "68adfd"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Cookies\wilbert@doubleclick[1].txt = "68adfd"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Cookies\wilbert@microsoft[1].txt = "68adfd"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Cookies\wilbert@msnportal.112.2o7[1].txt = "68adfd"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Cookies\wilbert@msn[2].txt = "68adfd"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Cookies\wilbert@scorecardresearch[2].txt = "68adfd"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Cookies\wilbert@www.bing[2].txt = "68adfd"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Cookies\wilbert@www.msn[1].txt = "68adfd"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
AB5D0C5B = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
1D69E223 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
F4CA74D = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
AEC50DAA = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
4171B676 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
3B924B39 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
BC19B2F = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
55595B4D = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
72D89494 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%Application Data%\Microsoft\Wallpaper1.bmp = "68adfd"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
9275FE9B = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
2A3C3A8F = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
C086DA88 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
CA236A48 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
A8200A50 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
AE60F13D = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
D806D279 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
F030F216 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
DA9ECC20 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
981331D8 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
2B7031E7 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
1325567F = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
87528C02 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
64D89F62 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
6664CD1A = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
580D6464 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
85AB9DD = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
CA3F3304 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
FFDC253B = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
EB5305F0 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
3DDA59C8 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
C2A0C047 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
258410D1 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
64051A82 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
17FB8455 = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
8BB1D29A = "0"

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345
finish = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
B1BC968BD4F49D622AA89A81F2150152A41D829C
Blob = "{random values}"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SystemRestore
DisableSR = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
2F173F7DE99667AFA57AF80AA2D1B12FAC830338
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4EFCED9C6BDD0C985CA3C7D253063C5BE6FC620C
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4EF2E6670AC9B5091FE06BE0E5483EAAD6BA32D9
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4C95A9902ABE0777CED18D6ACCC3372D2748381E
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4BA7B9DDD68788E12FF852E1A024204BF286A8F6
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4B421F7515F6AE8A6ECEF97F6982A400A4D9224E
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
47AFB915CDA26D82467B97FA42914468726138DD
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4463C531D7CCC1006794612BB656D3BF8257846F
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
43F9B110D5BAFD48225231B0D0082B372FEF9A54
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
43DDB1FFF3B49B73831407F6BC8B975023D07C50
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
40E78C1D523D1CD9954FAC1A1AB3BD3CBAA15BFC
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4072BA31FEC351438480F62E6CB95508461EAB2F
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
3F85F2BB4A62B0B58BE1614ABB0D4631B4BEF8BA
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
394FF6850B06BE52E51856CC10E180E882B385CC
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
36863563FD5128C7BEA6F005CFE9B43668086CCE
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\CA\Certificates\
E5215D3460C2C20BBE2D9FE5FB665DAA2C0E225C
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
284F55C41A1A7A3F8328D4C262FB376ED6096F24
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
273EE12457FDC4F90C55E82B56167F62F532E547
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
24BA6D6C8A5B5837A48DB5FAE919EA675C94D217
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
24A40A1F573643A67F0A4B0749F6A22BF28ABB6B
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
23E594945195F2414803B4D564D2A3A3F5D88B8C
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
216B2A29E62A00CE820146D8244141B92511B279
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
209900B63D955728140CD13622D8C687A4EB0085
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
1F55E8839BAC30728BE7108EDE7B0BB0D3298224
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
1331F48A5DA8E01DAACA1BB0C17044ACFEF755BB
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
0B77BEBBCB7AA24705DECC0FBD6A02FC7ABD9B52
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
049811056AFE9FD0F5BE01685AACE6A5D1C4454C
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
0483ED3399AC3608058722EDBC5E4600E3BEF9D7
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
00EA522C8A9C06AA3ECCE0B4FA6CDC21D92E8099
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
0048F8D37B153F6EA2798C323EF4F318A5624A9E
Blob = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

It deletes the following registry keys:

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS

HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0

Dropping Routine

This Trojan drops the following files:

  • %System Root%\bbbfeac\bbbfeac.exe
  • %User Profile%\Application Data\bbbfeac.exe
  • %User Startup%\bbbfeac.exe
  • %User Profile%\Microsoft\Crypto
  • %User Profile%\Crypto\RSA
  • %User Profile%\RSA\S-1-5-21-1645522239-1292428093-682003330-1003
  • %User Profile%\Internet Explorer\brndlog.txt.cry
  • %User Profile%\Internet Explorer\brndlog.txt
  • %User Profile%\Internet Explorer\HOW_DECRYPT.TXT
  • %User Profile%\Internet Explorer\HOW_DECRYPT.HTML
  • %User Profile%\Internet Explorer\HOW_DECRYPT.URL
  • %User Profile%\Microsoft\HOW_DECRYPT.TXT
  • %User Profile%\Microsoft\HOW_DECRYPT.HTML
  • %User Profile%\Microsoft\HOW_DECRYPT.URL
  • %User Profile%\Application Data\HOW_DECRYPT.TXT
  • %User Profile%\Application Data\HOW_DECRYPT.HTML
  • %User Profile%\Application Data\HOW_DECRYPT.URL
  • %Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.DTD.cry
  • %Application Data%\Microsoft\Windows Media\9.0\HOW_DECRYPT.TXT
  • %Application Data%\Microsoft\Windows Media\9.0\HOW_DECRYPT.HTML
  • %Application Data%\Microsoft\Windows Media\9.0\HOW_DECRYPT.URL
  • %Application Data%\Microsoft\Windows Media\HOW_DECRYPT.TXT
  • %Application Data%\Microsoft\Windows Media\HOW_DECRYPT.HTML
  • %Application Data%\Microsoft\Windows Media\HOW_DECRYPT.URL
  • %Application Data%\Microsoft\HOW_DECRYPT.TXT
  • %Application Data%\Microsoft\HOW_DECRYPT.HTML
  • %Application Data%\Microsoft\HOW_DECRYPT.URL
  • %Application Data%\HOW_DECRYPT.TXT
  • %Application Data%\HOW_DECRYPT.HTML
  • %Application Data%\HOW_DECRYPT.URL
  • %User Profile%\Local Settings\HOW_DECRYPT.TXT
  • %User Profile%\Local Settings\HOW_DECRYPT.HTML
  • %User Profile%\Local Settings\HOW_DECRYPT.URL
  • %User Profile%\Templates\excel.xls.cry
  • %User Profile%\Templates\excel4.xls.cry
  • %User Profile%\Templates\powerpnt.ppt.cry
  • %User Profile%\Templates\quattro.wb2.cry
  • %User Profile%\Templates\winword.doc.cry
  • %User Profile%\Templates\winword2.doc.cry
  • %User Profile%\Templates\wordpfct.wpd.cry
  • %User Profile%\Templates\HOW_DECRYPT.TXT
  • %User Profile%\Templates\HOW_DECRYPT.HTML
  • %User Profile%\Templates\HOW_DECRYPT.URL
  • %User Profile%\HOW_DECRYPT.TXT
  • %User Profile%\HOW_DECRYPT.HTML
  • %User Profile%\HOW_DECRYPT.URL
  • %User Profile%\Cookies\wilbert@atdmt[2].txt.cry
  • %User Profile%\Cookies\wilbert@atdmt[2].txt
  • %User Profile%\Cookies\wilbert@bing[2].txt.cry
  • %User Profile%\Cookies\wilbert@bing[2].txt
  • %User Profile%\Cookies\wilbert@c.atdmt[2].txt.cry
  • %User Profile%\Cookies\wilbert@c.atdmt[2].txt
  • %User Profile%\Cookies\wilbert@c.msn[2].txt.cry
  • %User Profile%\Cookies\wilbert@c.msn[2].txt
  • %User Profile%\Cookies\wilbert@doubleclick[1].txt.cry
  • %User Profile%\Cookies\wilbert@doubleclick[1].txt
  • %User Profile%\Cookies\wilbert@microsoft[1].txt.cry
  • %User Profile%\Cookies\wilbert@microsoft[1].txt
  • %User Profile%\Cookies\wilbert@msnportal.112.2o7[1].txt.cry
  • %User Profile%\Cookies\wilbert@msnportal.112.2o7[1].txt
  • %User Profile%\Cookies\wilbert@msn[2].txt.cry
  • %User Profile%\Cookies\wilbert@msn[2].txt
  • %User Profile%\Cookies\wilbert@scorecardresearch[2].txt.cry
  • %User Profile%\Cookies\wilbert@scorecardresearch[2].txt
  • %User Profile%\Cookies\wilbert@www.bing[2].txt.cry
  • %User Profile%\Cookies\wilbert@www.bing[2].txt
  • %User Profile%\Cookies\wilbert@www.msn[1].txt.cry
  • %User Profile%\Cookies\wilbert@www.msn[1].txt
  • %User Profile%\Cookies\HOW_DECRYPT.TXT
  • %User Profile%\Cookies\HOW_DECRYPT.HTML
  • %User Profile%\Cookies\HOW_DECRYPT.URL
  • %Application Data%\Microsoft\Wallpaper1.bmp.cry
  • %Application Data%\Microsoft\Wallpaper1.bmp
  • %System Root%\Documents and Settings\HOW_DECRYPT.TXT
  • %System Root%\Documents and Settings\HOW_DECRYPT.HTML
  • %System Root%\Documents and Settings\HOW_DECRYPT.URL
  • %Desktop%\HOW_DECRYPT.TXT
  • %Desktop%\HOW_DECRYPT.HTML
  • %Desktop%\HOW_DECRYPT.URL
  • %User Startup%\HOW_DECRYPT.TXT
  • %User Startup%\HOW_DECRYPT.HTML
  • %User Startup%\HOW_DECRYPT.URL
  • %User Profile%\MetaData\2BF68F4714092295550497DD56F57004
  • %User Profile%\Content\2BF68F4714092295550497DD56F57004
  • %User Profile%\MetaData\94308059B57B3142E455B38A6EB92015
  • %User Profile%\Content\94308059B57B3142E455B38A6EB92015
  • %User Temp%\Cab9C.tmp
  • %User Temp%\Tar9E.tmp

Other Details

This Trojan connects to the following possibly malicious URL:

  • http://{BLOCKED}esraka.com/p1750yvl1t4jl2s
  • http://{BLOCKED}esraka.com/kpp0p1nt7jkkrg
  • http://{BLOCKED}esraka.com/yfdqecs8ag
  • http://{BLOCKED}esraka.com/ft89sq79ua

It deletes itself after execution.

This report is generated via an automated analysis system.

  SOLUTION

Minimum Scan Engine: 9.300

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Restart in Safe Mode

[ Learn More ]

Step 3

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_CURRENT_USER\software
    • BBBFEACF8539FC947B9028B6EE760345
  • In HKEY_CURRENT_USER\software\BBBFEACF8539FC947B9028B6EE760345
    • DISKS
  • In HKEY_CURRENT_USER\software\BBBFEACF8539FC947B9028B6EE760345
    • PROTECTED
  • In HKEY_CURRENT_USER\software\BBBFEACF8539FC947B9028B6EE760345\DISKS
    • 68AD0FD0

Step 4

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • bbbfea = "%System Root%\bbbfeac\bbbfeac.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • bbbfeac = "%User Profile%\Application Data\bbbfeac.exe"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345
    • text = "{random values}"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345
    • html = "{random values}"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345
    • weblink = "{random values}"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345
    • pub = "{random values}"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345
    • start = "1"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • DF87C3DE = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 4664571E = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 866419F6 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 1207A18F = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • A9D246E4 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 6E10B272 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • B6B67ED9 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 180F43DB = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 716A4C5A = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 7675AEDA = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • C0E2793C = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • C4B6F6F6 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 2F213C6C = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 2BF0D7B6 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 8E9E31AA = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • DEEE5852 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • C2696AAC = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 303CBF3D = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • C03E4E3B = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 205181D1 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 821B00E6 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • CBB30CFC = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • E95DEA19 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • BC82B119 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 88AAB850 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • CE5340B9 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • E1964A59 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • AC86A324 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • ECE59176 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 38E0E841 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 6E4AF06 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 67B018CB = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 1FB0E720 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 21690AB6 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • B6E7C0D9 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 9344454A = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • E6B01D60 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 3014CA4C = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 9478294F = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • F948B772 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • F742ACE = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 5BED2262 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • E7953DBF = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • D62E300F = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • AA2817CD = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 7119E9E3 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
    • %User Profile%\Internet Explorer\brndlog.txt = "68adfd"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • FDD4E4A4 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 48E704D7 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • A77F3530 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • E0629E55 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • E4EFE2E7 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • A36C0861 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 828EA9F0 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 3A050C0C = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • AC9807D5 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 80C57583 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 36F19BFB = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • CEFDA0BD = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • E2EDBB9 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
    • %Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.DTD = "68adfd"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 5A9064DD = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 6F9F90B5 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 37A2BE97 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 7CA9FC1 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • F0999EDB = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • B4656924 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • D274A7D3 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 1B2FE48 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 38BD2FA7 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • E76A2115 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 48FBD5D8 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 4A4787A0 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • CD98C648 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 9DCF1BF1 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 7D6C68D = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 627A96C3 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 30DDA2CF = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 41137D2D = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
    • %User Profile%\Templates\excel.xls = "68adfd"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
    • %User Profile%\Templates\excel4.xls = "68adfd"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
    • %User Profile%\Templates\powerpnt.ppt = "68adfd"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
    • %User Profile%\Templates\quattro.wb2 = "68adfd"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
    • %User Profile%\Templates\winword.doc = "68adfd"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
    • %User Profile%\Templates\winword2.doc = "68adfd"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
    • %User Profile%\Templates\wordpfct.wpd = "68adfd"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 45BCBDC6 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 4C853E72 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • D1674F40 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 8AC53A20 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 86DDB95E = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • E2E68DA4 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 595DFA08 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • D9E48997 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • DD69F525 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 38C650BC = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • DF9DBBAF = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • C783AA01 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 7D0E88B = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • C354FB50 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 4EBF9B61 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 18E71623 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • A7D40527 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • D3F0E56B = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 37AA0E77 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • A3E892FE = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 92232D0 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • E0B9FBF7 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • DBC22CFD = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 817BB52E = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 7E992925 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 5551E2C = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 287BAF84 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • CD17AA70 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • C99AD6C2 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 5E983FFE = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 18B2578B = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 3A1C3E4D = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 5868ADDB = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 80ABAF5A = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • F8319958 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • C1435C4 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 3D883229 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 2B8C46ED = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • E8BBB80 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 805342C8 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 79881720 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 15AF95C2 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 65B4BB0D = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 99C264C7 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 7BB39A2C = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 7832A2B0 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 9C17C390 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 4DEC104 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 60710059 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • BF2B6B01 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • D73C4A6C = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 121BE978 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 223C63A3 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 31EB1464 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 10183795 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 11866F0C = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • CAC2049B = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • CE4F7829 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 8E6F0ED0 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 171B0BDC = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • C0BDDF95 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 114A3E1 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
    • %User Profile%\Cookies\wilbert@atdmt[2].txt = "68adfd"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
    • %User Profile%\Cookies\wilbert@bing[2].txt = "68adfd"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
    • %User Profile%\Cookies\wilbert@c.atdmt[2].txt = "68adfd"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
    • %User Profile%\Cookies\wilbert@c.msn[2].txt = "68adfd"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
    • %User Profile%\Cookies\wilbert@doubleclick[1].txt = "68adfd"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
    • %User Profile%\Cookies\wilbert@microsoft[1].txt = "68adfd"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
    • %User Profile%\Cookies\wilbert@msnportal.112.2o7[1].txt = "68adfd"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
    • %User Profile%\Cookies\wilbert@msn[2].txt = "68adfd"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
    • %User Profile%\Cookies\wilbert@scorecardresearch[2].txt = "68adfd"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
    • %User Profile%\Cookies\wilbert@www.bing[2].txt = "68adfd"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
    • %User Profile%\Cookies\wilbert@www.msn[1].txt = "68adfd"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • AB5D0C5B = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 1D69E223 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • F4CA74D = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • AEC50DAA = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 4171B676 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 3B924B39 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • BC19B2F = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 55595B4D = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 72D89494 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
    • %Application Data%\Microsoft\Wallpaper1.bmp = "68adfd"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 9275FE9B = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 2A3C3A8F = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • C086DA88 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • CA236A48 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • A8200A50 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • AE60F13D = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • D806D279 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • F030F216 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • DA9ECC20 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 981331D8 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 2B7031E7 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 1325567F = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 87528C02 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 64D89F62 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 6664CD1A = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 580D6464 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 85AB9DD = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • CA3F3304 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • FFDC253B = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • EB5305F0 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 3DDA59C8 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • C2A0C047 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 258410D1 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 64051A82 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 17FB8455 = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
    • 8BB1D29A = "0"
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345
    • finish = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C
    • Blob = "{random values}"

Step 5

Restore these modified registry values

[ Learn More ]

Important:Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this only if you know how to or you can seek your system administrator's help. You may also check out this Microsoft article first before modifying your computer's registry.

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
    • DisableSR = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2F173F7DE99667AFA57AF80AA2D1B12FAC830338
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFCED9C6BDD0C985CA3C7D253063C5BE6FC620C
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EF2E6670AC9B5091FE06BE0E5483EAAD6BA32D9
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4C95A9902ABE0777CED18D6ACCC3372D2748381E
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4BA7B9DDD68788E12FF852E1A024204BF286A8F6
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4B421F7515F6AE8A6ECEF97F6982A400A4D9224E
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47AFB915CDA26D82467B97FA42914468726138DD
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4463C531D7CCC1006794612BB656D3BF8257846F
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\43F9B110D5BAFD48225231B0D0082B372FEF9A54
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\43DDB1FFF3B49B73831407F6BC8B975023D07C50
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\40E78C1D523D1CD9954FAC1A1AB3BD3CBAA15BFC
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4072BA31FEC351438480F62E6CB95508461EAB2F
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3F85F2BB4A62B0B58BE1614ABB0D4631B4BEF8BA
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\394FF6850B06BE52E51856CC10E180E882B385CC
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\36863563FD5128C7BEA6F005CFE9B43668086CCE
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\E5215D3460C2C20BBE2D9FE5FB665DAA2C0E225C
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\284F55C41A1A7A3F8328D4C262FB376ED6096F24
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\273EE12457FDC4F90C55E82B56167F62F532E547
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\24BA6D6C8A5B5837A48DB5FAE919EA675C94D217
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\24A40A1F573643A67F0A4B0749F6A22BF28ABB6B
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\23E594945195F2414803B4D564D2A3A3F5D88B8C
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\216B2A29E62A00CE820146D8244141B92511B279
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\209900B63D955728140CD13622D8C687A4EB0085
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F55E8839BAC30728BE7108EDE7B0BB0D3298224
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1331F48A5DA8E01DAACA1BB0C17044ACFEF755BB
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0B77BEBBCB7AA24705DECC0FBD6A02FC7ABD9B52
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\049811056AFE9FD0F5BE01685AACE6A5D1C4454C
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0483ED3399AC3608058722EDBC5E4600E3BEF9D7
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\00EA522C8A9C06AA3ECCE0B4FA6CDC21D92E8099
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0048F8D37B153F6EA2798C323EF4F318A5624A9E
    • From: Blob = "{random values}"
      To: Blob = ""{random values}""

Step 6

Search and delete these components

[ Learn More ]
There may be some components that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.
  • %System Root%\bbbfeac\bbbfeac.exe
  • %User Profile%\Application Data\bbbfeac.exe
  • %User Startup%\bbbfeac.exe
  • %User Profile%\Microsoft\Crypto
  • %User Profile%\Crypto\RSA
  • %User Profile%\RSA\S-1-5-21-1645522239-1292428093-682003330-1003
  • %User Profile%\Internet Explorer\brndlog.txt.cry
  • %User Profile%\Internet Explorer\brndlog.txt
  • %User Profile%\Internet Explorer\HOW_DECRYPT.TXT
  • %User Profile%\Internet Explorer\HOW_DECRYPT.HTML
  • %User Profile%\Internet Explorer\HOW_DECRYPT.URL
  • %User Profile%\Microsoft\HOW_DECRYPT.TXT
  • %User Profile%\Microsoft\HOW_DECRYPT.HTML
  • %User Profile%\Microsoft\HOW_DECRYPT.URL
  • %User Profile%\Application Data\HOW_DECRYPT.TXT
  • %User Profile%\Application Data\HOW_DECRYPT.HTML
  • %User Profile%\Application Data\HOW_DECRYPT.URL
  • %Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.DTD.cry
  • %Application Data%\Microsoft\Windows Media\9.0\HOW_DECRYPT.TXT
  • %Application Data%\Microsoft\Windows Media\9.0\HOW_DECRYPT.HTML
  • %Application Data%\Microsoft\Windows Media\9.0\HOW_DECRYPT.URL
  • %Application Data%\Microsoft\Windows Media\HOW_DECRYPT.TXT
  • %Application Data%\Microsoft\Windows Media\HOW_DECRYPT.HTML
  • %Application Data%\Microsoft\Windows Media\HOW_DECRYPT.URL
  • %Application Data%\Microsoft\HOW_DECRYPT.TXT
  • %Application Data%\Microsoft\HOW_DECRYPT.HTML
  • %Application Data%\Microsoft\HOW_DECRYPT.URL
  • %Application Data%\HOW_DECRYPT.TXT
  • %Application Data%\HOW_DECRYPT.HTML
  • %Application Data%\HOW_DECRYPT.URL
  • %User Profile%\Local Settings\HOW_DECRYPT.TXT
  • %User Profile%\Local Settings\HOW_DECRYPT.HTML
  • %User Profile%\Local Settings\HOW_DECRYPT.URL
  • %User Profile%\Templates\excel.xls.cry
  • %User Profile%\Templates\excel4.xls.cry
  • %User Profile%\Templates\powerpnt.ppt.cry
  • %User Profile%\Templates\quattro.wb2.cry
  • %User Profile%\Templates\winword.doc.cry
  • %User Profile%\Templates\winword2.doc.cry
  • %User Profile%\Templates\wordpfct.wpd.cry
  • %User Profile%\Templates\HOW_DECRYPT.TXT
  • %User Profile%\Templates\HOW_DECRYPT.HTML
  • %User Profile%\Templates\HOW_DECRYPT.URL
  • %User Profile%\HOW_DECRYPT.TXT
  • %User Profile%\HOW_DECRYPT.HTML
  • %User Profile%\HOW_DECRYPT.URL
  • %User Profile%\Cookies\wilbert@atdmt[2].txt.cry
  • %User Profile%\Cookies\wilbert@atdmt[2].txt
  • %User Profile%\Cookies\wilbert@bing[2].txt.cry
  • %User Profile%\Cookies\wilbert@bing[2].txt
  • %User Profile%\Cookies\wilbert@c.atdmt[2].txt.cry
  • %User Profile%\Cookies\wilbert@c.atdmt[2].txt
  • %User Profile%\Cookies\wilbert@c.msn[2].txt.cry
  • %User Profile%\Cookies\wilbert@c.msn[2].txt
  • %User Profile%\Cookies\wilbert@doubleclick[1].txt.cry
  • %User Profile%\Cookies\wilbert@doubleclick[1].txt
  • %User Profile%\Cookies\wilbert@microsoft[1].txt.cry
  • %User Profile%\Cookies\wilbert@microsoft[1].txt
  • %User Profile%\Cookies\wilbert@msnportal.112.2o7[1].txt.cry
  • %User Profile%\Cookies\wilbert@msnportal.112.2o7[1].txt
  • %User Profile%\Cookies\wilbert@msn[2].txt.cry
  • %User Profile%\Cookies\wilbert@msn[2].txt
  • %User Profile%\Cookies\wilbert@scorecardresearch[2].txt.cry
  • %User Profile%\Cookies\wilbert@scorecardresearch[2].txt
  • %User Profile%\Cookies\wilbert@www.bing[2].txt.cry
  • %User Profile%\Cookies\wilbert@www.bing[2].txt
  • %User Profile%\Cookies\wilbert@www.msn[1].txt.cry
  • %User Profile%\Cookies\wilbert@www.msn[1].txt
  • %User Profile%\Cookies\HOW_DECRYPT.TXT
  • %User Profile%\Cookies\HOW_DECRYPT.HTML
  • %User Profile%\Cookies\HOW_DECRYPT.URL
  • %Application Data%\Microsoft\Wallpaper1.bmp.cry
  • %Application Data%\Microsoft\Wallpaper1.bmp
  • %System Root%\Documents and Settings\HOW_DECRYPT.TXT
  • %System Root%\Documents and Settings\HOW_DECRYPT.HTML
  • %System Root%\Documents and Settings\HOW_DECRYPT.URL
  • %Desktop%\HOW_DECRYPT.TXT
  • %Desktop%\HOW_DECRYPT.HTML
  • %Desktop%\HOW_DECRYPT.URL
  • %User Startup%\HOW_DECRYPT.TXT
  • %User Startup%\HOW_DECRYPT.HTML
  • %User Startup%\HOW_DECRYPT.URL
  • %User Profile%\MetaData\2BF68F4714092295550497DD56F57004
  • %User Profile%\Content\2BF68F4714092295550497DD56F57004
  • %User Profile%\MetaData\94308059B57B3142E455B38A6EB92015
  • %User Profile%\Content\94308059B57B3142E455B38A6EB92015
  • %User Temp%\Cab9C.tmp
  • %User Temp%\Tar9E.tmp

Step 7

Search and delete these folders

[ Learn More ]
Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden folders in the search result.
  • %User Profile%\CryptnetUrlCache\MetaData
  • %User Profile%\Microsoft\CryptnetUrlCache
  • %User Profile%\CryptnetUrlCache\Content

Step 8

Restart in normal mode and scan your computer with your Trend Micro product for files detected as TROJ_RANSOM.YMIH. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Step 9

Restore deleted/modified files and/or registry entries from backup

*Note: Only Microsoft-related files/keys/values will be restored. If this malware/grayware also deleted registry keys/values related to programs that are not from Microsoft, please reinstall those programs on your computer.

    • %User Profile%\Application Data\Microsoft
    • %Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.DTD
    • %User Profile%\Templates\excel.xls
    • %User Profile%\Templates\excel4.xls
    • %User Profile%\Templates\powerpnt.ppt
    • %User Profile%\Templates\quattro.wb2
    • %User Profile%\Templates\winword.doc
    • %User Profile%\Templates\winword2.doc
    • %User Profile%\Templates\wordpfct.wpd

Step 10

Restore this file from backup only Microsoft-related files will be restored. If this malware/grayware also deleted files related to programs that are not from Microsoft, please reinstall those programs on you computer again.

  • %System Root%\bbbfeac

Step 11

Restore these deleted registry keys/values from backup

*Note: Only Microsoft-related keys/values will be restored. If the malware/grayware also deleted registry keys/values related to programs that are not from Microsoft, please reinstall those programs on your computer.

  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345
    • DISKS
  • In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS
    • 68AD0FD0


Did this description help? Tell us how we did.