Windows Security Tutorials - Herong's Tutorial Examples - v3.01, by Dr. Herong Yang
.exe and .dll Files of the Second Trojan
This section describes malicious executable .exe programs and .dll files created by the second Trojan.
The second PWS Trojan continued to install DLL files in the system folder. Many of them were detected and deleted by McAfee VirusScan. See OnAccessScanLog.txt log file records below:
<date> 9:36:12 PM Cleaned NT AUTHORITY\SYSTEM C:\WINDOWS\system32 \cxyqra.exe c:\windows\system32\de02f764.dll PWS-OnlineGames.s (Trojan) <date> 9:36:38 PM Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\WINDOWS\system32\cxyqra.exe C:WINDOWS\system32\DE02F764.dll <date> 9:36:38 PM Deleted NT AUTHORITY\SYSTEM C:\WINDOWS\system32 \cxyqra.exe C:\WINDOWS\SYSTEM32\DE02F764.DLL PWS-OnlineGames.s (Trojan) <date> 9:36:38 PM Deleted NT AUTHORITY\SYSTEM C:\WINDOWS\system32 \cxyqra.exe C:\WINDOWS\system32\DE02F764.dll PWS-OnlineGames.s (Trojan) <date> 9:36:45 PM Deleted (Clean failed because the detection isn't cleanable) NT AUTHORITY\SYSTEM C:\WINDOWS\system32\yvspqn.exe C:\WINDOWS\system32\rabpcx.exe New Malware.aq (Trojan) <date> 9:36:49 PM Cleaned NT AUTHORITY\SYSTEM C:\WINDOWS\system32 \bpcxyq.exe c:\windows\system32\08223b03.dll PWS-OnlineGames.s (Trojan) <date> 9:36:54 PM Cleaned NT AUTHORITY\SYSTEM C:\WINDOWS\system32 \zqabop.exe c:\windows\system32\3474a8c2.dll PWS-OnlineGames.s (Trojan) <date> 9:36:57 PM Deleted NT AUTHORITY\SYSTEM C:\WINDOWS\system32 \bpcxyq.exe C:\WINDOWS\SYSTEM32\08223B03.DLL PWS-OnlineGames.s (Trojan) <date> 9:36:57 PM Deleted NT AUTHORITY\SYSTEM C:\WINDOWS\system32 \bpcxyq.exe C:\WINDOWS\system32\08223B03.dll PWS-OnlineGames.s (Trojan) <date> 9:37:01 PM Cleaned NT AUTHORITY\SYSTEM C:\WINDOWS\system32 \pcxyqr.exe c:\windows\system32\122b901e.dll PWS-OnlineGames.s (Trojan) <date> 9:37:02 PM Deleted NT AUTHORITY\SYSTEM C:\WINDOWS\system32 \zqabop.exe C:\WINDOWS\SYSTEM32\3474A8C2.DLL PWS-OnlineGames.s (Trojan) <date> 9:37:02 PM Deleted NT AUTHORITY\SYSTEM C:\WINDOWS\system32 \zqabop.exe C:\WINDOWS\system32\3474A8C2.dll PWS-OnlineGames.s (Trojan) <date> 9:37:06 PM Cleaned NT AUTHORITY\SYSTEM C:\WINDOWS\system32 \zbyzqa.exe c:\windows\system32\9ca963ca.dll PWS-OnlineGames.s (Trojan) <date> 9:37:07 PM Deleted NT AUTHORITY\SYSTEM C:\WINDOWS\system32 \pcxyqr.exe C:\WINDOWS\SYSTEM32\122B901E.DLL PWS-OnlineGames.s (Trojan) <date> 9:37:07 PM Deleted NT AUTHORITY\SYSTEM C:\WINDOWS\system32 \pcxyqr.exe C:\WINDOWS\system32\122B901E.dll PWS-OnlineGames.s (Trojan) <date> 9:37:12 PM Deleted NT AUTHORITY\SYSTEM C:\WINDOWS\system32 \zbyzqa.exe C:\WINDOWS\SYSTEM32\9CA963CA.DLL PWS-OnlineGames.s (Trojan) <date> 9:37:12 PM Deleted NT AUTHORITY\SYSTEM C:\WINDOWS\system32 \zbyzqa.exe C:\WINDOWS\system32\9CA963CA.dll PWS-OnlineGames.s (Trojan) <date> 9:37:13 PM Deleted NT AUTHORITY\SYSTEM C:\WINDOWS\system32 \yvspqn.exe C:\WINDOWS\SYSTEM32\ABPCXY.EXE PWS-Mmorpg.gen (Trojan) <date> 9:37:13 PM Deleted NT AUTHORITY\SYSTEM C:\WINDOWS\system32 \yvspqn.exe C:\WINDOWS\system32\abpcxy.exe\abpcxy.exe\00005060.EXE PWS-Mmorpg.gen (Trojan)
Table of Contents
About This Windows Security Book
Windows 8: System Security Review
Windows 8: System Security Protection
Windows 8 Defender for Real-Time Protection
Windows 7: System Security Review
Windows 7: System Security Protection
Windows 7 Forefront Client Security
Norton Power Eraser - Anti-Virus Scan Tool
McAfee Virus and Malware Protection Tools
Spybot - Spyware Blocker, Detection and Removal
Keeping IE (Internet Explorer) Secure
Malware (Adware, Spyware, Trojan, Worm, and Virus)
HijackThis - Browser Hijacker Diagnosis Tool
IE Add-on Program Listing and Removal
"Conduit Search" - Malware Detection and Removal
"Tube Dimmer", "Scorpion Saver" or "Adpeak" Malware
Malware Manual Removal Experience
Vundo (VirtuMonde/VirtuMundo) - vtsts.dll Removal
Trojan and Malware "Puper" Description and Removal
VSToolbar (VSAdd-in.dll) - Description and Removal
►PWS (Password Stealer) Trojan Infection Removal
What Is PWS (Password Stealer) Trojan?
JS/Downloader.gen - JavaScript Downloader Malware
PWS-Mmorpg.gen - A Password Stealer Trojan
heb.exe - The Trojan Installer Program
.exe and .dll Files Installed by the Trojan
my.exe - A Second PWS Trojan Infection
►.exe and .dll Files of the Second Trojan
Explorer.EXE Trying to Install a Trojan
AccessProtectionLog.txt Log File Records
ATF-Cleaner.exe - Temporary File Remover
Trajon Files Left in the System Folder
Removing PWS Trojan Startup Entries
Command Processor AutoRun - Registry Value
UserInit - Winlogon Registry Key
js.users.51.la - hosts File Entries
Image File Execution Options - Registry Key