Worm.Win32.AutoItGen_5841e5e6c9 – Adaware

not-a-virus:RemoteAdmin.Win32.Agent.gg (Kaspersky), Trojan.Win32.Swrort.3.FD, Worm.Win32.AutoIt.FD, WormAutoItGen.YR (Lavasoft MAS)Behaviour: Trojan, RemoteAdmin, Worm

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 5841e5e6c9e810a7ed641e901ebd759c

SHA1: c1a0f9eecf52b73d04cd62e20d7f6e19cca800e4

SHA256: f99f2e253c40a3241572c271368f4c75edb6cdb33626cb33217117c777d87f4a

SSDeep: 49152:MSVX8SIDMIEQAenGbROYWgpZ63dW23X9pG HMS8DzDPIHP5vFxOZ317tVrjf0W:MS6zfA9ktb3vnGOPMDUF8Z3FtVPsW

Size: 3144633 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6

Company: Program

Created at: 2010-04-16 10:47:33

Analyzed on: WindowsXP SP3 32-bit

Summary: Worm. A program that is primarily replicating on networks or removable drives.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Worm creates the following process(es):

RemoteDesktopServer.exe:1260

The Worm injects its code into the following process(es):

%original file name%.exe:1004

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1004 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\driver\driver\mv2.sys (588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autD.tmp (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autC.tmp (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autA.tmp (1249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1C.tmp (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\setpasswd.exe (1960 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\authSSP.dll (1625 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut4.tmp (87 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut5.tmp (745 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\workgrpdomnt4.dll (2017 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut3.tmp (2017 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\RemoteDesktopServiceInstaller.exe (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut13.tmp (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\driver\setupdrv.exe (1137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autF.tmp (1764 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\driver\driver\mv2.cat (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut19.tmp (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\testauth.exe (745 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\chunkvnc.ini (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut10.tmp (2897 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\MSLogonACL.exe (1633 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut16.tmp (1372 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut14.tmp (852 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut11.tmp (980 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (3097 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut7.tmp (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\logmessages.dll (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autE.tmp (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\driver\driver\mv2.dll (1176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\logo.jpg (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut18.tmp (1960 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autB.tmp (2057 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut8.tmp (1249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\setcad.exe (1764 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\authadmin.dll (1537 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\uvnc_settings.exe (5777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\ldapauth.dll (1857 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\rc4.key (87 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\RemoteDesktopServer.exe (16986 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\vnchooks.dll (549 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (9513 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\ldapauth9x.dll (1857 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut9.tmp (1249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut12.tmp (1176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1A.tmp (588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut15.tmp (1433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\MSRC4Plugin_for_sc.dsm (1137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\SecureVNCPlugin.dsm (4065 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\schook.dll (1137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\ldapauthnt4.dll (1857 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1B.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\driver\driver\mv2.inf (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\logging.dll (1473 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut6.tmp (1729 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\ultravnc.ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut17.tmp (1769 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\autD.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autC.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autA.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1C.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1B.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut13.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autF.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut10.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut11.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut16.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut14.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autE.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autB.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut19.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut9.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut12.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1A.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut15.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut18.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut17.tmp (0 bytes)

Registry activity

The process RemoteDesktopServer.exe:1260 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 2B 55 07 CB EB 75 27 50 66 B4 36 44 BD 75 0C"

The process %original file name%.exe:1004 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "18 A8 AA AC D6 95 BD A9 9C 4C 2D 23 55 1E D8 D1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RemoteDesktop_Temp_Files]
"RemoteDesktopServer.exe" = "VNC server for win32"

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Dropped PE files

MD5	File path
5608090bbdb504f627d5268590061cbd	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\RemoteDesktop_Temp_Files\MSLogonACL.exe
1b0d01fece707b9491f37642ffebd502	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\RemoteDesktop_Temp_Files\MSRC4Plugin_for_sc.dsm
71867d71c0d15ce63b8621dc41421f6f	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\RemoteDesktop_Temp_Files\RemoteDesktopServer.exe
1661a3c173bb027b1619e8cfe0f52e19	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\RemoteDesktop_Temp_Files\RemoteDesktopServiceInstaller.exe
61ec46d9fe9a680dae79a249027ef00f	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\RemoteDesktop_Temp_Files\SecureVNCPlugin.dsm
0f534e9f1c202eaece6ad25a3a6cc795	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\RemoteDesktop_Temp_Files\authSSP.dll
bfae28e475285e446963fc98b661594b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\RemoteDesktop_Temp_Files\authadmin.dll
0111779d75b252e1ab3e275ac7ed301d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\RemoteDesktop_Temp_Files\driver\driver\mv2.dll
2a8e5e1cb522b49b88b221396d6de072	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\RemoteDesktop_Temp_Files\driver\driver\mv2.sys
50f6a9509729a6d8d97e29ad259c6a1e	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\RemoteDesktop_Temp_Files\driver\setupdrv.exe
7109779904351aa3caf6f4b4b851d472	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\RemoteDesktop_Temp_Files\ldapauth.dll
358094c6f12ff6cfa06ddb50737ede70	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\RemoteDesktop_Temp_Files\ldapauth9x.dll
257240d5d4449fe417d1ab40aa46c846	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\RemoteDesktop_Temp_Files\ldapauthnt4.dll
dd48d8c480d20104e5f941671afc07dd	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\RemoteDesktop_Temp_Files\logging.dll
9ad9b965daba91aafba1bb41542a72ca	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\RemoteDesktop_Temp_Files\logmessages.dll
1b6fa3b51e6da3e3acca73f61528c707	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\RemoteDesktop_Temp_Files\schook.dll
41fba5b44cfac4dc23a48d0b01fbd085	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\RemoteDesktop_Temp_Files\setcad.exe
e5e0920b023e01a88116e2adba53c5ba	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\RemoteDesktop_Temp_Files\setpasswd.exe
4706365590b801076ede9e672caf19e3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\RemoteDesktop_Temp_Files\testauth.exe
529858daa2972946fbf6dd0976cdcfc1	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\RemoteDesktop_Temp_Files\uvnc_settings.exe
478f7912c1261bfb15a989219463d0a2	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\RemoteDesktop_Temp_Files\vnchooks.dll
527aa8ae3ce4e3299ffc2f62daf8749b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\RemoteDesktop_Temp_Files\workgrpdomnt4.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
RemoteDesktopServer.exe:1260
Delete the original Worm file.
Delete or disinfect the following files created/modified by the Worm:
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\driver\driver\mv2.sys (588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autD.tmp (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autC.tmp (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autA.tmp (1249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1C.tmp (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\setpasswd.exe (1960 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\authSSP.dll (1625 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut4.tmp (87 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut5.tmp (745 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\workgrpdomnt4.dll (2017 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut3.tmp (2017 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\RemoteDesktopServiceInstaller.exe (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut13.tmp (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\driver\setupdrv.exe (1137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autF.tmp (1764 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\driver\driver\mv2.cat (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut19.tmp (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\testauth.exe (745 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\chunkvnc.ini (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut10.tmp (2897 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\MSLogonACL.exe (1633 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut16.tmp (1372 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut14.tmp (852 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut11.tmp (980 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (3097 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut7.tmp (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\logmessages.dll (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autE.tmp (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\driver\driver\mv2.dll (1176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\logo.jpg (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut18.tmp (1960 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autB.tmp (2057 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut8.tmp (1249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\setcad.exe (1764 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\authadmin.dll (1537 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\uvnc_settings.exe (5777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\ldapauth.dll (1857 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\rc4.key (87 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\RemoteDesktopServer.exe (16986 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\vnchooks.dll (549 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (9513 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\ldapauth9x.dll (1857 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut9.tmp (1249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut12.tmp (1176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1A.tmp (588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut15.tmp (1433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\MSRC4Plugin_for_sc.dsm (1137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\SecureVNCPlugin.dsm (4065 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\schook.dll (1137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\ldapauthnt4.dll (1857 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1B.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\driver\driver\mv2.inf (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\logging.dll (1473 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut6.tmp (1729 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RemoteDesktop_Temp_Files\ultravnc.ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut17.tmp (1769 bytes)
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 3, 3, 6, 1
File Description:
Comments:
Language: English (United States)

Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 3, 3, 6, 1File Description: Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	466944	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	471040	270336	269824	5.49582	474039a9a07679be42a284d15d506a61
.rsrc	741376	16384	13824	3.64192	7a18b16ee4db3ec799fc544b102efacb

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Worm connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1004:

`.rsrc

s%j.Zf

tGHt.Ht&

tCPh

SSSSh

\$%u#Sj

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.

uxtheme.dll

kernel32.dll

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N, \U, or \u

support for \P, \p, and \X has not been compiled

(*VERB) with an argument is not supported

ICMP.DLL

advapi32.dll

RegDeleteKeyExW

zcÃ

GetProcessHeap

CreatePipe

GetWindowsDirectoryW

GetCPInfo

GetConsoleOutputCP

RegDeleteKeyW

RegCreateKeyExW

RegEnumKeyExW

RegCloseKey

RegOpenKeyExW

SetViewportOrgEx

ShellExecuteExW

SHFileOperationW

ShellExecuteW

RegisterHotKey

GetKeyboardLayoutNameW

ExitWindowsEx

EnumThreadWindows

GetAsyncKeyState

SetKeyboardState

GetKeyboardState

GetKeyState

VkKeyScanW

EnumWindows

EnumChildWindows

MapVirtualKeyW

CloseWindowStation

SetProcessWindowStation

OpenWindowStationW

UnregisterHotKey

keybd_event

InternetCrackUrlW

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

FtpOpenFileW

FtpGetFileSize

InternetOpenUrlW

.text

`.rdata

@.data

.rsrc

].bodu

%[SubÃ‚l

KERNEL32.DLL

ADVAPI32.dll

COMCTL32.dll

COMDLG32.dll

GDI32.dll

MPR.dll

ole32.dll

OLEAUT32.dll

PSAPI.DLL

SHELL32.dll

USER32.dll

USERENV.dll

VERSION.dll

WININET.dll

WINMM.dll

WSOCK32.dll

mscoree.dll

>>>AUTOIT NO CMDEXECUTE

CMDLINERAW

CMDLINE

/AutoIt3ExecuteLine

/AutoIt3ExecuteScript

%s (%d) : ==> %s.:

Line %d:

Line %d (File "%s"):

%s (%d) : ==> %s:

AutoIt script files (*.au3, *.a3x)

*.au3;*.a3x

All files (*.*)

#NoAutoIt3Execute

APPSKEY

04090000

%u.%u.%u.%u

0.0.0.0

Mddddd

%s (%d) : ==> %s:

UDPSTARTUP

UDPSHUTDOWN

UDPSEND

UDPRECV

UDPOPEN

UDPCLOSESOCKET

UDPBIND

TRAYGETMSG

TCPSTARTUP

TCPSHUTDOWN

TCPSEND

TCPRECV

TCPNAMETOIP

TCPLISTEN

TCPCONNECT

TCPCLOSESOCKET

TCPACCEPT

SHELLEXECUTEWAIT

SHELLEXECUTE

REGENUMKEY

MSGBOX

ISKEYWORD

HTTPSETUSERAGENT

HTTPSETPROXY

HOTKEYSET

GUIREGISTERMSG

GUIGETMSG

GUICTRLSENDMSG

GUICTRLRECVMSG

FTPSETPROXY

\??\%s

GUI_RUNDEFMSG

SendKeyDelay

SendKeyDownDelay

TCPTimeout

AUTOITCALLVARIABLE%d

255.255.255.255

Keyword

AutoIt.Error

Null Object assignment in FOR..IN loop

Incorrect Object type in FOR..IN loop

HOTKEYPRESSED

AUTOITEXE

WINDOWSDIR

3, 3, 6, 1

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_USERS

%d/d/d

c:\%original file name%.exe

:C:\%original file name%.exe

AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.

Missing operator in expression."Unbalanced brackets in expression.

Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.

Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.

Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.

3This keyword cannot be used after a "Then" keyword.

>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.

HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.

String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.

%original file name%.exe_1004_rwx_00401000_000B3000:

s%j.Zf

tGHt.Ht&

tCPh

SSSSh

\$%u#Sj

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.

uxtheme.dll

kernel32.dll

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N, \U, or \u

support for \P, \p, and \X has not been compiled

(*VERB) with an argument is not supported

ICMP.DLL

advapi32.dll

RegDeleteKeyExW

zcÃ

GetProcessHeap

CreatePipe

GetWindowsDirectoryW

GetCPInfo

GetConsoleOutputCP

RegDeleteKeyW

RegCreateKeyExW

RegEnumKeyExW

RegCloseKey

RegOpenKeyExW

SetViewportOrgEx

ShellExecuteExW

SHFileOperationW

ShellExecuteW

RegisterHotKey

GetKeyboardLayoutNameW

ExitWindowsEx

EnumThreadWindows

GetAsyncKeyState

SetKeyboardState

GetKeyboardState

GetKeyState

VkKeyScanW

EnumWindows

EnumChildWindows

MapVirtualKeyW

CloseWindowStation

SetProcessWindowStation

OpenWindowStationW

UnregisterHotKey

keybd_event

InternetCrackUrlW

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

FtpOpenFileW

FtpGetFileSize

InternetOpenUrlW

.text

`.rdata

@.data

.rsrc

mscoree.dll

KERNEL32.DLL

>>>AUTOIT NO CMDEXECUTE

CMDLINERAW

CMDLINE

/AutoIt3ExecuteLine

/AutoIt3ExecuteScript

%s (%d) : ==> %s.:

Line %d:

Line %d (File "%s"):

%s (%d) : ==> %s:

AutoIt script files (*.au3, *.a3x)

*.au3;*.a3x

All files (*.*)

#NoAutoIt3Execute

APPSKEY

04090000

%u.%u.%u.%u

0.0.0.0

Mddddd

%s (%d) : ==> %s:

UDPSTARTUP

UDPSHUTDOWN

UDPSEND

UDPRECV

UDPOPEN

UDPCLOSESOCKET

UDPBIND

TRAYGETMSG

TCPSTARTUP

TCPSHUTDOWN

TCPSEND

TCPRECV

TCPNAMETOIP

TCPLISTEN

TCPCONNECT

TCPCLOSESOCKET

TCPACCEPT

SHELLEXECUTEWAIT

SHELLEXECUTE

REGENUMKEY

MSGBOX

ISKEYWORD

HTTPSETUSERAGENT

HTTPSETPROXY

HOTKEYSET

GUIREGISTERMSG

GUIGETMSG

GUICTRLSENDMSG

GUICTRLRECVMSG

FTPSETPROXY

\??\%s

GUI_RUNDEFMSG

SendKeyDelay

SendKeyDownDelay

TCPTimeout

AUTOITCALLVARIABLE%d

255.255.255.255

Keyword

AutoIt.Error

Null Object assignment in FOR..IN loop

Incorrect Object type in FOR..IN loop

HOTKEYPRESSED

AUTOITEXE

WINDOWSDIR

3, 3, 6, 1

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_USERS

%d/d/d

c:\%original file name%.exe

:C:\%original file name%.exe

Missing operator in expression."Unbalanced brackets in expression.

3This keyword cannot be used after a "Then" keyword.

String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.

RemoteDesktopServer.exe_1260:

.text

`.rdata

@.data

.rsrc

@.reloc

>.uTGF

t"SSh

RSSSSSSh

SSSh8

FTPj

f;Q.uK

SQSSh

.htlM

u.hhyM

SPSSh

=VKEYt

xSSSh

FTPjKS

FtPj;S

C.PjRV

@-@-@-@-

@-@-@-@-@-@-@-@-

1.2.5

Visual C CRT: Not enough memory to complete call to strerror.

portuguese-brazilian

Broken pipe

Inappropriate I/O control operation

Operation not permitted

GetProcessWindowStation

operator

benchmark.cpp : Blit time %i Getpixeltime %i Use getpixel= %i

\background.bmp

black_layered.cpp : OpenInputdesktop Error

black_layered.cpp : OpenInputdesktop OK

black_layered.cpp : !GetUserObjectInformation

black_layered.cpp : SelectHDESK to %s (%x) from %x

black_layered.cpp : SelectHDESK:!SetThreadDesktop

black_layered.cpp : end BlackWindow

kernel32.dll

ntdll.dll

interKey larger than maxNum

0.0.0

12-12-2002

Plugin.dsm

*.dsm

Archive: %s %ld bytes %u file%s

Archive: %s %ld %u

central directory contains %u %s. The central directory is %lu

This zipfile constitutes disk %u of a multi-part archive. The central

directory starts on disk %u; %u of its entries %s contained within

this zipfile, out of a total of %u %s. The entire central

The zipfile comment is %u bytes long and contains the following text:

%lu file%s, %lu bytes uncompressed, %lu bytes compressed: %s%d.%d%%

unknown (%d)

file system or operating system of origin: %s

version of encoding software: %u.%u

minimum file system compatibility required: %s

minimum software version required to extract: %u.%u

compression method: %s

size of sliding dictionary (implosion): %cK

number of Shannon-Fano trees (implosion): %c

compression sub-type (deflation): %s

file last modified on (UT extra field modtime): %s %s

file security status: %sencrypted

extended local header: %s

file last modified on (DOS date/time): %s

apparent file type: %s

MS-DOS file attributes (X hex): none

length of filename: %u characters

length of extra field: %u bytes

Theos file attributes (X hex): %s

length of file comment: %u characters

disk number on which file begins: disk %u

VMS file attributes (o octal): %s

Amiga file attributes (o octal): %s

Unix file attributes (o octal): %s

MS-DOS file attributes (X hex): read-only

- A subfield with ID 0xx (%s) and %u data bytes

MS-DOS file attributes (X hex): %s%s%s%s%s%s%s%s

Keyed

Indexed

error: EF data block (type 0xx) size %u exceeds remaining extra field

space %u; block length has been truncated.

field is %s and has %u bytes of VMS %s information%s

The local extra field has UTC/GMT %s time%s

The Mac long filename is %s

File is marked as %s

The local extra field has %lu bytes of %scompressed Macintosh

The associated file has type code `%c%c%c%c' and creator code `%c%c%c%c'

File is marked as %s, File Dates are in %d Bit

The QDOS extra field subtype is `%c%c%c%c'

The local extra field has %lu bytes of %scompressed AtheOS file attributes

The AOS/VS extra field revision is %d.%d

The local extra field has %lu bytes of %scompressed BeOS file attributes

Key Sequenced

The file was originally a Tandem %s file, with file code %u

The 128-bit MD5 signature is %s

There %s a local extra field with ID 0xx (%s) and

%u data bytes (%s).

%u %s %u u:u:u

uuu.uuu

%2u-%s-u u:u

???? ??? ?? ??:??:??

cc skipping: %-22s need %s compat. v%u.%u (can do v%u.%u)

skipping: %-22s unsupported compression method %u

skipping: %-22s `%s' method not supported

%s: bad filename length (%s)

%s: warning, no memory for comparison with local header

%s: bad extra field length (%s)

%s: mismatching "local" filename (%s),

%s: ucsize %lu csize %lu for STORED entry

file #%lu: bad zipfile offset (%s): %ld

%8sing: %-22s %s%s

%s %s: %ld bytes required to uncompress to %lu bytes;

%s supposed to require %lu bytes%s%s%s

%s: bad file comment length

warning: %s appears to use backslashes as path separators

warning: stripped absolute path spec from %s

skipping: %-22s %svolume label

warning: set times/attribs failed for %s

At least one %serror was detected in %s.

Caution: zero files tested in %s.

%s: stored in VMS format. Extract anyway? (y/n)

skipping: %-22s unable to get password

skipping: %-22s incorrect password

%lu file%s skipped because of incorrect password.

(may instead be incorrect password)

No errors detected in compressed data of %s.

No errors detected in %s for the %lu file%s tested.

%lu file%s skipped because of unsupported compression or encoding.

error: %s%s %s

error: %s%s

warning: %s is probably truncated

%s: unknown compression method

compressed EA data missing (%d bytes)%s

compressed WinNT security data missing (%d bytes)%s

EF block length (%u bytes) exceeds remaining EF data (%u bytes)

unsupported NTSD EAs version %d

unknown compression method for EAs (%u)

error [%s]: bad extra-field CRC lx (should be lx)

error: unsupported extra-field compression type (%u)--skipping

error: cannot open zipfile [ %s ]

error: cannot create %s

error: cannot delete old %s

warning: extra field too long (%d). Ignoring...

%s: write error (disk full?).

%d archive%s successfully processed.

%d archive%s had warnings but no fatal errors.

%d archive%s had fatal errors.

%d file%s had no zipfile directory.

%d "zipfiles" were directories.

%s: cannot find any matches for wildcard specification "%s".

%s: cannot find zipfile directory in %s,

%sand cannot find %s, period.

%s: cannot find either %s or %s.

note: %s may be a plain executable, not an archive

warning [%s]: zipfile is empty

[%s]:

Zipfile is disk %u of a multi-disk archive, and this is not the disk on

which the central zipfile directory begins (disk %u).

warning [%s]: end-of-central-directory record claims this

is disk %u but that the central directory starts on disk %u; this is a

warning [%s]: zipfile claims to be last disk of a multi-part archive;

together in order. Expect "errors" and warnings...true multi-part support

error [%s]: attempt to seek before beginning of zipfile

warning [%s]: %ld extra byte%s at beginning or within zipfile

caution: filename not matched: %s

error [%s]: missing %ld bytes in zipfile

Compiled with %s%s for %s%s%s%s.

error [%s]: NULL central directory offset

error [%s]: start of central directory not found;

error [%s]: reported length of central directory is

%ld bytes too long (Atari STZip zipfile? J.H.Holm ZIPSPLIT 1.1

caution: excluded filename not matched: %s

-httpproxy

winvnc [-sc_prompt] [-sc_exit] [-id:????] [-stopreconnect][-autoreconnect[ ID:????]] [-connect host[:display]] [-connect host[::port]] [-repeater host[:port]] [-run]

HTTP/1.0 200 OK

classid = 'clsid:8AD9C840-044E-11D1-B3E9-00805F499D93'

codebase = 'hXXp://java.sun.com/update/1.4.2/jinstall-1_4-windows-i586.cab#Version=1,4,0,0'

WIDTH = %d HEIGHT = %d >

CODE = VncViewer.class \

ARCHIVE = VncViewer.jar \

WIDTH = %d \

HEIGHT = %d \

PORT =%d \

pluginspage ='hXXp://java.sun.com/products/plugin/index.html#download'>

HTTP/1.0 404 Not Found

SecureVNC;0;0xx;%s

KERNEL32.DLL

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009

SOFTWARE\Microsoft\Windows NT\CurrentVersion

Software\Microsoft\Windows NT\CurrentVersion

Windows

Windows CE

Windows 95

Windows 95 SP1

Windows 95 OSR2

Windows 98

Windows 98 SP1

Windows 98 Second Edition

Windows Millenium Edition

Windows ??

Windows NT

Windows 2000

Windows XP (Personal)

Windows XP (Professional)

Windows Server 2003

Windows Server 2003 (Domain Controller)

, (Web Edition)

Build:%d

Service Pack:%d.%d

Service Pack:%d

Service Pack:0.%d

HTTPConnect

AutoPortSelect

PortNumber

HTTPPortNumber

net stop "%s"

hXXp://VVV.uvnc.com

hXXp://forum.uvnc.com

net start "%s"

shell32.dll

HideDesktop.cpp : Killwallpaper %i

HideDesktop.cpp : Killwallpaper %i %i

HideDesktop.cpp : Restorewallpaper %i

HideDesktop.cpp : Restorewallpaper %i %i

HideDesktop.cpp : Failed to get SPI value for 0xx (0xx)

HideDesktop.cpp : Retrieved SPI value for 0xx: 0xx

HideDesktop.cpp : Failed to set SPI value for 0xx to 0xx (0xx)

HideDesktop.cpp : Set SPI value for 0xx to 0xx

HideDesktop.cpp : Failed to restore SPI value for 0xx (0xx)

HideDesktop.cpp : Restored SPI value for 0xx to 0xx

HideDesktop.cpp : Failed to get SPI value for SPI_GETFONTSMOOTHING (0xx)

HideDesktop.cpp : Retrieved SPI value for SPI_GETFONTSMOOTHING: 0xx

HideDesktop.cpp : Failed to get SPI value for SPI_GETFONTSMOOTHINGTYPE (0xx)

HideDesktop.cpp : Retrieved SPI value for SPI_GETFONTSMOOTHINGTYPE: 0xx

HideDesktop.cpp : Failed to get SPI value for SPI_GETCLEARTYPE (0xx)

HideDesktop.cpp : Retrieved SPI value for SPI_GETCLEARTYPE: 0xx

HideDesktop.cpp : Failed to set SPI value for SPI_SETCLEARTYPE (0xx)

HideDesktop.cpp : Set SPI value for SPI_SETCLEARTYPE: 0xx

HideDesktop.cpp : Failed to set SPI value for SPI_SETFONTSMOOTHING (0xx)

HideDesktop.cpp : Set SPI value for SPI_SETFONTSMOOTHING: 0xx

HideDesktop.cpp : Failed to restore SPI value for SPI_SETFONTSMOOTHING (0xx)

HideDesktop.cpp : Restored SPI value for SPI_SETFONTSMOOTHING: 0xx

HideDesktop.cpp : Failed to restore SPI value for SPI_SETCLEARTYPE (0xx)

HideDesktop.cpp : Restored SPI value for SPI_SETCLEARTYPE: 0xx

HideDesktop.cpp : Failed to restore SPI value for SPI_SETFONTSMOOTHINGTYPE (0xx)

HideDesktop.cpp : Restored SPI value for SPI_SETFONTSMOOTHINGTYPE: 0xx

0123456789.

userpass

Address not supported

Command not supported

HTTP_DIRECT

SSH_ASKPASS

CONNECT_PASSWORD

HTTP_PROXY_PASSWORD

HTTP_PROXY_USER

HTTP_PROXY

SOCKS5_PASSWORD

SOCKS5_PASSWD

hXXp://

\xX

Enter SOCKS5 password for %s@%s:

Enter proxy authentication password for %s@%s:

%s:%s

Proxy-Authorization: Basic %s

CONNECT %s:%d HTTP/1.0

winhttp.dll

WinHttpGetIEProxyConfigForCurrentUser

http=

https=

UltraVNC.ini

passwd

passwd2

{34F673E0-878F-11D5-B98A-57B0D07B8C7C}

{34F673E0-878F-11D5-B98A-00B0D07B8C7C}

Wtsapi32.dll

winlogon.exe

winsta.dll

user32.dll

sas.dll

cad.exe

LockWorkstation failed with error 0x%0X

advapi32.dll

SYSTEM\CurrentControlSet\Services\%s

Tcpip

SYSTEM\CurrentControlSet\Control\SafeBoot\%s\%s

/boot.ini

operating systems

bcdedit.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies

ding_dong.wav

RICHED32.DLL

TextChat.cpp : OpenInputdesktop Error

TextChat.cpp : OpenInputdesktop OK

TextChat.cpp : !GetUserObjectInformation

TextChat.cpp : SelectHDESK to %s (%x) from %x

TextChat.cpp : SelectHDESK:!SetThreadDesktop

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : rfbInitColourMapSingleTable called

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : failed to allocate translation table

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : Using video Palette

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : Using mirror video Palette

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : got %u palette entries

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : rfbInitColourMapSingleTable done

\uvnckeyboardhelper.exe

keyEvent

c:\video0.dat

c:\video1.dat

videodriver.cpp : Error video.dat

No '%s' found.

DevNum:%d

Name:%s

String:%s

ID:%s

Key:%s

Attach.ToDesktop

Fail: Using 32bit winvnc.exe with a 64bit driver?

mv2.dll

1.00.22

Driver verion is not 1.00.22

driver info: required version 1.00.22

vistahook.cpp : REct %i %i %i %i

vistahook.cpp : OpenInputdesktop Error

vistahook.cpp : OpenInputdesktop OK

vistahook.cpp : !GetUserObjectInformation

vistahook.cpp : SelectHDESK to %s (%x) from %x

vistahook.cpp : SelectHDESK:!SetThreadDesktop

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

\mylogo.bmp

AutoAccept:%u

AutoReject:%u

AutoAccept: %u

AutoReject: %u

vncbuffer.cpp : request local buffer[%d]

vncbuffer.cpp : fast blits detected - using DIBsection buffer

vncbuffer.cpp : unable to allocate main buffer[%d]

vncbuffer.cpp : unable to allocate back buffer[%d]

vncbuffer.cpp : unable to allocate cache buffer[%d]

vncbuffer.cpp : unable to allocate scaled buffer[%d]

vncbuffer.cpp : local buffer=%d

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : GetPalette called but no encoder set

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : request client buffer[%u]

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : unable to allocate client buffer[%u]

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : raw encoder requested

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : RRE encoder requested

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : CoRRE encoder requested

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : Hextile encoder requested

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : Ultra encoder requested

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : ZRLE encoder requested

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : ZYWRLE encoder requested

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : Zlib encoder requested

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : ZlibHex encoder requested

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : Tight encoder requested

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : unknown encoder requested

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : client pixel format is not supported

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : SetClientFormat called

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncpasswd.h : PASSWD : ToText called

vncclient.cpp : init update thread

vncclient.cpp : update thread gone

vncclient.cpp : kill update thread

vncclient.cpp : enable update thread

vncclient.cpp : disable update thread

vncclient.cpp : enable/disable synced

vncclient.cpp : starting update thread

vncclient.cpp : stopping update thread

0.0.0.0

RFB d.d

vncclient.cpp : m_ms_logon set to %s

vncclient.cpp : no password specified for server - client rejected

This server does not have a valid password enabled. Until a password is set, incoming connections cannot be accepted.

vncclient.cpp : loopback connection attempted - client rejected

vncclient.cpp : loopback connection attempted - client accepted

vncclient.cpp : authentication failed

\logging.dll

vncclient.cpp : connections already exist - client rejected

vncclient.cpp : non-shared connection - disconnecting old clients

vncclient.cpp : Leaving InitAuthenticate

After DH: g=%I64u, m=%I64u, i=%I64u, key=%I64u

CheckUserGroupPasswordUni result=%i

password authentication

vncclient.cpp : Failed to send challenge to client

vncclient.cpp : Failed to receive challenge response from client

View-only password authentication

vncclient.cpp : failed to set socket timeout(%d)

vncclient.cpp : DSMPlugin Pointer to socket OK

vncclient.cpp : Invalid DSMPlugin Pointer

vncclient.cpp : A connection using DSM already exist - client rejected to avoid crash

vncclient.cpp : client connected : %s (%hd)

Could not connect using %s!

Could not connect to %s!

vncclient.cpp : PostAddNewClient I

vncclient.cpp : negotiated version

vncclient.cpp : authenticated connection

vncclient.cpp : sent pixel format to client

vncclient.cpp : vncClientThread

vncclient.cpp : remote pixel format invalid

vncclient.cpp : Cache protocol extension enabled

vncclient.cpp : XOR protocol extension enabled

vncclient.cpp : compression level requested: %d

vncclient.cpp : image quality level requested: %d

vncclient.cpp : LastRect protocol extension enabled

vncclient.cpp : X-style cursor shape updates enabled

vncclient.cpp : Full-color cursor shape updates enabled

vncclient.cpp : PointerPos protocol extension enabled

vncclient.cpp : ServerState protocol extension enabled

vncclient.cpp : KeepAlive protocol extension enabled

vncclient.cpp : FTProtocolVersion protocol extension enabled

vncclient.cpp : Extended clipboard protocol extension enabled

vncclient.cpp : Streaming DSM support enabled

vncclient.cpp : ZRLE found

vncclient.cpp : Tight found

vncclient.cpp : defaulting to raw encoder

vncclient.cpp : failed to select raw encoder!

vncclient.cpp : rfbSetServerInput: inputs %s

vncclient.cpp : failed to close desktop

vncclient.cpp : client disconnected : %s (%hd)

vncclient.cpp : PostAddNewClient II

vncclient.cpp : vncClient() executing...

vncclient.cpp : TEST 4

vncclient.cpp : ~vncClient() executing...

vncclient.cpp : deleting socket

vncclient.cpp : client Kill() called

vncclient.cpp : FATAL! client update region is empty!

vncclient.cpp : updating local pixel format

vncclient.cpp : updating local pixel format and buffer size

vncclient.cpp : protocol enabled too many times!

vncclient.cpp : failed to send RFB message to client

vncclient.cpp : ******** Sending %d Cache Rects

vncclient.cpp : *** Sending CacheZip Rects=%d Size=%d (%d)

vncclient.cpp : Compress returned error in File Send :%d

%s%s%s%s

vncclient.cpp : %%%%%%%%%%%%% vncClient::DoFTUserImpersonation - Call

vncclient.cpp : %%%%%%%%%%%%% vncClient::DoFTUserImpersonation - 1

vncclient.cpp : %%%%%%%%%%%%% vncClient::DoFTUserImpersonation - WSLocked

vncclient.cpp : %%%%%%%%%%%%% vncClient::DoFTUserImpersonation - currentUser = %s

vncclient.cpp : %%%%%%%%%%%%% vncClient::DoFTUserImpersonation - OpenProcessToken Error

vncclient.cpp : %%%%%%%%%%%%% vncClient::DoFTUserImpersonation - ImpersonateLoggedOnUser Failed

vncclient.cpp : %%%%%%%%%%%%% vncClient::UNDoFTUserImpersonation - 1

vncclient.cpp : %%%%%%%%%%%%% vncClient::UNDoFTUserImpersonation - Impersonationtoken exists

Connect to Technical Support

WinVNC.Update.DrawRect

WinVNC.Update.CopyRect

WinVNC.Update.Mouse

vncdesktop.cpp : ### PixelsGrid %d created !

vncdesktop.cpp : ~vncDesktop

vncdesktop.cpp : Desktop thread running, force close

vncdesktop.cpp : ~vncDesktop Shutdown()

vncdesktop.cpp : delete ((RGBPixelList)

vncdesktop.cpp : ~vncDesktop m_lGridsList.clear

vncdesktop.cpp : ~vncDesktop:: second request to close InitWindowthread

vncdesktop.cpp : InitDesktop Failed

vncdesktop.cpp : InitVideo driver Called

vncdesktop.cpp : Driver option enabled

vncdesktop.cpp : no default desktop

vncdesktop.cpp : Driver option disabled

vncdesktop.cpp : Break log

vncdesktop.cpp : InitBitmap Failed

vncdesktop.cpp : ThunkBitmapInfo Failed

vncdesktop.cpp : Removing real Dib buffer and replace by driver communication buffer

vncdesktop.cpp : EnableOptimisedBlits Failed

vncdesktop.cpp : SetPixFormat Failed

vncdesktop.cpp : SetPixShift Failed

vncdesktop.cpp : SetPalette Failed

vncdesktop.cpp : failed to DeleteDC hrootdc

vncdesktop.cpp : failed to DeleteDC hmemdc

vncdesktop.cpp : failed to DeleteObject

vncdesktop.cpp : failed to close desktop

vncdesktop.cpp : InitDesktop...

WindowsScreenSaverClass

vncdesktop.cpp : KillScreenSaver...

vncdesktop.cpp : Killing ScreenSaver

vncdesktop.cpp : No driver used

vncdesktop.cpp : Failed m_rootdc

vncdesktop.cpp : bitmap dimensions are %d x %d

vncdesktop.cpp : failed to create compatibleDC(%d)

vncDesktop : root device doesn't support BitBlt

vncDesktop : memory device doesn't support GetDIBits

vncdesktop.cpp : failed to create memory bitmap(%d)

vncdesktop.cpp : created memory bitmap

vncdesktop.cpp : unable to get display format

vncdesktop.cpp : unable to get display colour info

vncdesktop.cpp : got bitmap format

vncdesktop.cpp : DBG:used/bits/planes/comp/size = %d/%d/%d/%d/%d

vncdesktop.cpp : DBG:display context has %d planes!

vncdesktop.cpp : DBG:memory context has %d planes!

unsupported truecolour pixel format for setpixshifts

vncdesktop.cpp : unable to allocate logical palette

vncdesktop.cpp : unable to get system palette entries

vncdesktop.cpp : unable to create HPALETTE

vncdesktop.cpp : unable to select() HPALETTE

vncdesktop.cpp : warning - failed to RealizePalette

vncdesktop.cpp : initialised palette OK

vncdesktop.cpp : framebuffer has %u palette entries

vncdesktop.cpp : unable to create temporary DC

vncdesktop.cpp : unable to select DIB section into temporary DC

vncdesktop.cpp : unable to set DIB section palette

vncdesktop.cpp : unable to restore temporary DC bitmap

vncdesktop.cpp : no palette data for truecolour display

vncdesktop.cpp : attempting to enable DIBsection blits

vncdesktop.cpp : failed to build DIB section - reverting to slow blits

vncdesktop.cpp : enabled slow blits OK

vncdesktop.cpp : enabled fast DIBsection blits OK

vncdesktop.cpp : initialising desktop handler

vncdesktop.cpp : failed to start hook thread

vncdesktop.cpp : Set extended clipboard data

vncdesktop.cpp : Failed to set extended clipboard data

vncdesktop.cpp : SetBlankMonitor: monitor %s, using alpha %s

vncdesktop.cpp : Driver option is enabled

vncdesktop.cpp : Closing pending driver driver version

vncdesktop.cpp : Start Mirror driver

vncdesktop.cpp : Start Mirror driver Failed

vncdesktop.cpp : Using non driver mode

vncdesktop.cpp : Driver Used

vncdesktop.cpp : Unable to map memory

vncdesktop.cpp : Shared memory mapped

vncdesktop.cpp : SethookMechanism called

vncdesktop.cpp : Sethook_restart_wanted hook=%d driver=%d

vncdesktop.cpp : Hookdll status changed

vncdesktop.cpp : Driver Status changed

\16bithlp.exe

vncdesktop.cpp : set ddihooks Failed

vncdesktop.cpp : set ddihooks OK

vncdesktopsink.cpp : ShutdownInitWindowthread

vncdesktopsink.cpp : ~vncDesktop::Tell initwindowthread to close

vncdesktopsink.cpp : ~vncDesktop::ERROR: messageloop blocked

vncdesktopsink.cpp : ~vncDesktop:: iniwindowthread proper closed

vncdesktopsink.cpp : initwindowthread already closed

vncdesktopsink.cpp : StartInitWindowthread

vncdesktopsink.cpp : StartInitWindowthread default desk

vncdesktopsink.cpp : ERROR: initwindowthread failed to start

vncdesktopsink.cpp : StartInitWindowthread started

vncdesktopsink.cpp : StartInitWindowthread reactivate

vncdesktopsink.cpp : StartInitWindowthread no default desk

vncdesktopsink.cpp : wmcreate

vncdesktopsink.cpp : set W8 hooks OK

vncdesktopsink.cpp : set SC hooks OK

vncdesktopsink.cpp : failed to set system hooks

vncdesktopsink.cpp : set hooks OK

vncdesktopsink.cpp : unset W8 hooks OK

vncdesktopsink.cpp : unset SC hooks OK

vncdesktopsink.cpp : Unsethooks Failed

vncdesktopsink.cpp : Unsethooks OK

vncdesktopsink.cpp : WM_DESTROY

vncdesktopsink.cpp : Monitor22 %i

vncdesktopsink.cpp : Monitor3 %i %i

vncdesktopsink.cpp : Monitor222 %i

vncdesktopsink.cpp : Power3 %i %i

vncdesktopsink.cpp : WM_DISPLAYCHANGE

vncdesktopsink.cpp : Resolution switch detected, driver active

vncdesktopsink.cpp : Resolution switch by driver activation removed

vncdesktopsink.cpp : Resolution switch detected, driver NOT active

vncdesktopsink.cpp : InitWindow called

vncdesktopsink.cpp : InitWindow:OpenInputdesktop Error

vncdesktopsink.cpp : InitWindow:OpenInputdesktop OK

vncdesktopsink.cpp : InitWindow:!GetUserObjectInformation

vncdesktopsink.cpp : InitWindow:SelectHDESK to %s (%x) from %x

vncdesktopsink.cpp : InitWindow:SelectHDESK:!SetThreadDesktop

vncdesktopsink.cpp : failed to register window class

vncdesktopsink.cpp : failed to create hook window

vncdesktopsink.cpp : OOOOOOOOOOOO load hookdll's

\vnchooks.dll

\schook.dll

\w8hook.dll

SetKeyboardFilterHook

vncdesktopsink.cpp : OOOOOOOOOOOO start dispatch

vncdesktopsink.cpp : OOOOOOOOOOOO %i %i

vncdesktopsink.cpp : OOOOOOOOOOOO called wm_quit

vncdesktopsink.cpp : OOOOOOOOOOOO called wm_user 4

vncdesktopsink.cpp : RFB_SCREEN_UPDATE

vncdesktopsink.cpp : REct3 %i %i %i %i

vncdesktopsink.cpp : RFB_MOUSE_UPDATE

vncdesktopsink.cpp : OOOOOOOOOOOO called wm_user 3

vncdesktopsink.cpp : OOOOOOOOOOOO end dispatch

vncDesktopSW.cpp : SWinit

vncDesktopSW.cpp : GetQuarterSize

UAC protected windows.

vncdesktopthread.cpp : threadHandle stop

vncdesktopthread.cpp : Wait for viewer init

vncdesktopthread.cpp : Screensize changed

vncdesktopthread.cpp : m_SWtoDesktop

vncdesktopthread.cpp : m_hookswitch

vncdesktopthread.cpp : desktop switch %i %i

vncdesktopthread.cpp : InputDesktopSelected

vncdesktopthread.cpp : m_desktop->Shutdown

vncdesktopthread.cpp : Shutdown KillAuthClients

vncdesktopthread.cpp : m_desktop->Startup

vncdesktopthread.cpp : Startup KillAuthClients

vncdesktopthread.cpp : m_videodriver == NULL

vncdesktopthread.cpp : threadHandle

vncdesktopthread.cpp : threadHandle2

vncdesktopthread.cpp : SCR: new screen format %dx%dx%d

vncdesktopthread.cpp : Size changed

vncdesktopthread.cpp : Request Monitor %d

vncdesktopthread.cpp : First two Monitor: width = %d height = %d

vncdesktopthread.cpp : Last two monitor: width = %d height = %d

vncdesktopthread.cpp : All Monitor: width = %d height = %d

vncdesktopthread.cpp : Monitor %d: width = %d height = %d

vncdesktopthread.cpp : ***********###############************ %i %i %i %i %i %i

vncdesktopthread.cpp : Format changed

vncdesktopthread.cpp : Hook changed 1

vncdesktopthread.cpp : Hook changed 2

vncdesktopthread.cpp : Hook changed

vncdesktopthread.cpp : quitting desktop server thread

vncdesktopthread.cpp : quitting desktop server thread:SetBlockInputState

vncdesktopthread.cpp : quitting desktop server thread:ClearShiftKeys

vncdesktopthread.cpp : quitting desktop server thread:g_DesktopThread_running=false

vncdesktopthread.cpp : quitting desktop server thread:m_desktop->Shutdown

getBgColour: bpp %d?

%s: unusual colour = %d

vncencoder.cpp : remote palette data requested

vncencoder.cpp : generating BGR233 palette data

vncencoder.cpp : generating 8-bit palette data

vncencoder.cpp : failed to obtain colour map data!

vncencoder.cpp : settranslatefunction called

vncencoder.cpp : only 8, 16 or 32 bits supported remotely - %d requested

vncencoder.cpp : only 8, 16 or 32 bits supported locally - %d in use

vncencoder.cpp : only 8-bit palette format supported remotely

vncencoder.cpp : only 8-bit palette format supported locally

vncencoder.cpp : no encoding required - both 8-bit palettized

vncencoder.cpp : local truecolour, remote palettized. using BGR233 palette

vncencoder.cpp : unknown local pixel format in use!

vncencoder.cpp : using 8-bit colourmap to truecolour translation

vncencoder.cpp : no translation required

vncencoder.cpp : single LUT used

vncencoder.cpp : triple LUT used

vncencoderCursor.cpp : cursor handle is NULL.

vncencoderCursor.cpp : GetIconInfo() failed.

vncencoderCursor.cpp : cursor bitmap handle is NULL.

vncencoderCursor.cpp : GetObject() for bitmap failed.

vncencoderCursor.cpp : incorrect data in cursor bitmap.

vncencoderCursor.cpp : GetBitmapBits() failed.

vncencoderCursor.cpp : vncDesktop::GetRichCursorData() failed.

vncEncodeTight.cpp : calling deflateInit2 with zlib level:%d

vncEncodeTight.cpp : deflateInit2 returned error:%d:%s

vncEncodeTight.cpp : calling deflateParams with zlib level:%d

vncEncodeTight.cpp : deflateParams returned error:%d:%s

vncEncodeTight.cpp : deflate() call failed.

vncEncodeUltra.cpp : Memory error

vncEncodeUltra.cpp : Ultra encoder stats: rawdata=%d protocol=%d compressed=%d transmitted=%d

vncEncodeUltra.cpp : Ultra encoder efficiency: %.3f%%

vncEncodeUltra.cpp : ********QUEUEQUEUE********** %d %d %d

vncEncodeZlib.cpp : Memory error

vncEncodeZlib.cpp : Zlib Xor encoder stats: rawdata=%d protocol=%d compressed=%d transmitted=%d

vncEncodeZlib.cpp : Zlib Xor encoder efficiency: %.3f%%

vncEncodeZlib.cpp : deflateInit2 returned error:%d:%s

vncEncodeZlib.cpp : deflate returned error:%d:%s

vncEncodeZlib.cpp : compression error

vncEncodeZlib.cpp : ********QUEUEQUEUE********** %d %d %d

vncEncodeZlibHex.cpp : Memory error

vncEncodeZlibHex.cpp : calling deflateInit2 with zlib level:%d

vncEncodeZlibHex.cpp : deflateInit2 returned error:%d:%s

vncEncodeZlibHex.cpp : deflate returned error:%d:%s

/FTPFRame$StrComp.class

/DH.class

/FTPFrame.class

/SessionRecorder.class

/RecordingFrame.class

/ButtonPanel.class

/VncViewer.class

/VncCanvas.class

/RfbProto.class

/OptionsFrame.class

/DesCipher.class

/ClipboardFrame.class

/AuthPanel.class

/VncViewer.jar

vnchttpconnect.cpp : started HTTP server thread

vnchttpconnect.cpp : HTTP client connected

vnchttpconnect.cpp : quitting HTTP server thread

GET %s

vnchttpconnect.cpp : file %s requested

vnchttpconnect.cpp : parameters read

vnchttpconnect.cpp : filename didn't begin with '/'

vnchttpconnect.cpp : sending main page

vnchttpconnect.cpp : sent page

vnchttpconnect.cpp : requested file recognised

vnchttpconnect.cpp : sending file...

vnchttpconnect.cpp : file successfully sent

fake %d down

fake %d up

Found dead key 0x%x '%c'

keysym 0x%x

************** DEAD KEY

Compose dead 0x%x 0x%x

Composed 0x%x

Found key

Simulating ALT %d%d%d

ignoring unrecognised Latin-1 keysym 0x%x

latin-1 key: keysym %d(0x%x) vkCode 0x%x down %d capslockOn %d

ignoring unknown keysym %d

taskmgr.exe

vnckeymap.cpp : setshiftstate %d - (%s->%s)

vnckeymap.cpp : new state %d (%s)

fh is %d

WinVNC.log

Error opening log file %s

error code 0xX

codec.cfg

WinVNC.AddClient.Message.Init

WinVNC.AddClient.Message

WinVNC.AddAutoClient.Message

WinVNC.AddStopClient.Message

WinVNC.AddStopAllClient.Message

WinVNC.AddRepeaterID.Message

WinVNC.TrayIconBalloon2.Message

UltraVNC.Viewer.FileTransferSendPacketMessage

dwmapi.dll

vncmenu.cpp : DisableAero %i

vncmenu.cpp : Reset %i

vncmenu.cpp : vncmenu(server)

wtsapi32.dll

icon1.ico

icon2.ico

vncmenu.cpp : vncmenu killed

vncmenu.cpp : ########### Shell_TrayWnd found %i

vncmenu.cpp : IP interface change detected %s %s

vncmenu.cpp : IsIconSet

vncmenu.cpp : Failed IsIconSet

vncmenu.cpp : vncMenu::Shutdown: Close menu - Disconnect all - Shutdown server

vncmenu.cpp : WM_TASKBARCREATED

vncmenu.cpp : ############## Kill vncMenu thread

vncmenu.cpp : Add client reconnect from timer

vncmenu.cpp : user name has changed

vncmenu.cpp : show default properties requested

vncmenu.cpp : show user properties requested

vncmenu.cpp : KillAuthClients() ID_KILLCLIENTS

vncmenu.cpp : KillAuthClients() ID_CLOSE

vncmenu.cpp : no submenu available

vncmenu.cpp : vncMenu WM_CLOSE call - All cleanup done

vncmenu.cpp : quitting from WM_DESTROY

vncmenu.cpp : SHUTDOWN OS detected

vncmenu.cpp : Session ID %i

vncmenu.cpp : WM_QUERYENDSESSION session!=0

vncmenu.cpp : WM_ENDSESSION

vncmenu.cpp : ############### Usernames change: old="%s", new="%s"

vncmenu.cpp : Warning: exception handling balloon message

Activeds.dll

netapi32.dll

radmin32.dll

\authSSP.dll

vncntlm.cpp : GetProcAddress

CheckUserPasswordSDUni result=%i

You selected ms-logon, but authSSP.dll

was not found.Check you installation

\authadmin.dll

authadmin.dll not found

\workgrpdomnt4.dll

workgrpdomnt4.dll not found

\ldapauth.dll

ldapauth.dll not found

\ldapauthnt4.dll

ldapauthnt4.dll not found

\ldapauth9x.dll

ldapauth9x.dll not found

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncpasswd.h : PASSWD : FromText called

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncpasswd.h : PASSWD : FromClear called

vncproperties.cpp : show per-user Properties

vncproperties.cpp : show default system Properties

vncproperties.cpp : dialog result = %d

vncproperties.cpp : warning - empty password

vncproperties.cpp : no password - QUITTING

vncproperties.cpp : INITDIALOG properties

vncproperties.cpp : enddialog (OK)

vncproperties.cpp : enddialog (CANCEL)

NoPassword,

Password

Password2

vncproperties.cpp : ***** DBG - Entering Load

vncproperties.cpp : ***** DBG - User mode

vncproperties.cpp : ***** DBG - Service mode

vncproperties.cpp : ***** DBG - NO current user

vncproperties.cpp : ***** DBG - Force USER SYSTEM 1

vncproperties.cpp : ***** DBG - UserName = %s

vncproperties.cpp : ***** DBG - Machine level prefs

vncproperties.cpp : loading local-only settings

vncproperties.cpp : ***** DBG - Load User Preferences

vncproperties.cpp : clearing user settings

vncproperties.cpp : ***** DBG - Local Preferences - Default

vncproperties.cpp : loading DEFAULT local settings

vncproperties.cpp : ***** DBG - User Settings on

vncproperties.cpp : ***** DBG - LoadUser Preferences

vncproperties.cpp : loading "%s" local settings

vncproperties.cpp : ***** DBG - Override system settings with users settings

vncproperties.cpp : loading "%s" global settings

vncproperties.cpp : ***** DBG - User Settings off

vncproperties.cpp : bypassing user-specific settings (both local and global)

vncproperties.cpp : $$$$$$$$$$ ApplyUserPrefs - Plugin Enabled - Call SetDSMPlugin()

vncproperties.cpp : $$$$$$$$$$ ApplyUserPrefs - Plugin NOT enabled

vncproperties.cpp : saving current settings to registry

vncproperties.cpp : ***** DBG - Force USER SYSTEM 2

vncpropertiesPoll.cpp : show per-user Properties

vncpropertiesPoll.cpp : dialog result = %d

vncpropertiesPoll.cpp : Error while reading Window Name %d

vncpropertiesPoll.cpp : enddialog (OK)

vncpropertiesPoll.cpp : enddialog (CANCEL)

vncpropertiesPoll.cpp : Reset Reg

vncpropertiesPoll.cpp : clearing user settings

vncpropertiesPoll.cpp : loading DEFAULT local settings

vncpropertiesPoll.cpp : loading "%s" local settings

vncpropertiesPoll.cpp : loading "%s" global settings

vncserver.cpp : shutting down server object1

vncserver.cpp : Waiting for desktop to shutdown

vncserver.cpp : ~server m_pDSMPlugin = NULL

vncserver.cpp : shutting down server object2

vncserver.cpp : ShutdownServer m_pDSMPlugin = NULL

vncserver.cpp : AddClient() started

vncserver.cpp : failed to initialise client object

vncserver.cpp : AddClient() done

vncserver.cpp : Desktop init failed, unlock in application mode ?

Remote user successfully connected (%s) and is currently sharing your desktop.

vncserver.cpp : Authenticated() done

vncserver.cpp : killing unauth client

vncserver.cpp : killing auth client

vncserver.cpp : KillClient() done

vncserver.cpp : Killing client named: %s

vncserver.cpp : KillClient() from name done

vncserver.cpp : Client %s is not Ultra. Doesn't know TextChat

vncserver.cpp : TextChat with client named: %s

vncserver.cpp : KillAuthClients() done

%s - %s

vncserver.cpp : KillUnauthClients() done

vncserver.cpp : removing unauthorised client

vncserver.cpp : removing authorised client

vncserver.cpp : deleting desktop server

vncserver.cpp : client disconnect - failed to logoff user!

vncserver.cpp : desktop deleted

vncserver.cpp : RemoveClient() done

vncserver.cpp : SockConnect %d

vncserver.cpp : trying port number %d

vncserver.cpp : SockConnect Done %d

vncserver.cpp : KillAuthClients() fix up a lock-up

\xdmcp\xdmcp.exe

vncserver.cpp : Failed rootdc

vncserver.cpp : authhosts cleared

vncserver.cpp : authhosts set to "%s"

vncserver.cpp : client %s rejected due to blacklist entry

vncserver.cpp : verify failed - null hostname

vncserver.cpp : verify host - malformed AuthHosts string

vncserver.cpp : verify host - pattern processing failed!

vncserver.cpp : client %s verifiedHost %u prior to adjustment

vncserver.cpp : client %s verifiedHost %u after adjustment

vncserver.cpp : Unable to set new desktop size

vncserver.cpp : $$$$$$$$$$ SetDSMPlugin - Entry

vncserver.cpp : $$$$$$$$$$ SetDSMPlugin - Enabled

vncserver.cpp : $$$$$$$$$$ SetDSMPlugin - Is Loaded

vncserver.cpp : $$$$$$$$$$ SetDSMPlugin - FORCE RELOADING OF THE PLUGIN

vncserver.cpp : $$$$$$$$$$ SetDSMPlugin - New one - Unload the current

vncserver.cpp : $$$$$$$$$$ SetDSMPlugin - Plugin NOT loaded - Try to load it

vncserver.cpp : $$$$$$$$$$ DSMPlugin cannot be loaded

vncserver.cpp : $$$$$$$$$$ SetDSMPlugin - Plugin successfully loaded

vncserver.cpp : $$$$$$$$$$ SetDSMPlugin - Init plugin call

VNCPasswordNeeded

NoPassword

vncserver.cpp : $$$$$$$$$$ SetDSMPlugin - SetPluginParams call

vncserver.cpp : DSMPlugin Params OK

vncserver.cpp : Unable to set DSMPlugin Params

vncserver.cpp : Unable to init DSMPlugin

vncserver.cpp : AutoConnectRetry(): started

vncserver.cpp : Attempting AutoReconnect....

explorer.exe

vncservice.cpp : @@@@@@@@@@@@@ GetCurrentUser - ERROR : No window station

vncservice.cpp : @@@@@@@@@@@@@ GetCurrentUser - Error: Usersize 0

vncservice.cpp : @@@@@@@@@@@@@ GetCurrentUser - Error: NOT impersonating user

vncservice.cpp : @@@@@@@@@@@@@ GetCurrentUser - Error: No user logged on

vncservice.cpp : getusername error %d

vncservice.cpp : @@@@@@@@@@@@@ GetCurrentUser - UserNAme found: %s

vncservice.cpp : @@@@@@@@@@@@@ GetCurrentUser - Error: Unknown OS

vncservice.cpp : !GetUserObjectInformation

vncservice.cpp : SelectHDESK to %s (%x) from %x

vncservice.cpp : SelectHDESK:!SetThreadDesktop

vncservice.cpp : SelectDesktop

vncservice.cpp : OpenInputdesktop2 named

vncservice.cpp : OpenInputdesktop2 NULL

vncservice.cpp : OpenInputdesktop2

vncservice.cpp : OpenInputdesktop2 OK

vncservice.cpp : SelectDesktop failed to close desktop

vncservice.cpp : OpenInputDesktop %i I

vncservice.cpp : OpenInputDesktop II

vncservice.cpp : failed to close input desktop

vncservice.cpp : !GetUserObjectInformation(threaddesktop

vncservice.cpp : !GetUserObjectInformation(inputdesktop

vncservice.cpp : threadname, inputname differ

vncservice.cpp : failed to select logon desktop

vncservice.cpp : generating ctrl-alt-del

vncservice.cpp : preparing to generate ctrl-alt-del

vncservice.cpp : spawn ctrl-alt-del thread...

vncservice.cpp : unable to lock workstation - not NT

vncservice.cpp : locking workstation

vncservice.cpp : unable to load User32 DLL (%u)

vncservice.cpp : unable to locate LockWorkStation - requires Windows 2000 or above (%u)

vncservice.cpp : call to LockWorkstation failed

vncservice.cpp : PostAddNewClient failed

vncsockconnect.cpp : started socket connection thread

vncsockconnect.cpp : accepted connection from %s

vncsockconnect.cpp : quitting socket connection thread

vsocket.cpp : VSocket() m_pDSMPlugin = NULL

Iphlpapi.dll

GetPerTcpConnectionEStats

SetPerTcpConnectionEStats

vsocket.cpp : closing socket

vsocket.cpp : shutdown socket

vsocket.cpp : WriteExact: DSMPlugin-RestoreBuffer Alloc Error

vsocket.cpp : zero bytes read1

vsocket.cpp : socket error 1: %d

vsocket.cpp : zero bytes read2

vsocket.cpp : zero bytes read3

vsocket.cpp : HTTP socket error: %d

vnclang_server.dll

winvnc.cpp : test... %s %d

winvnc.cpp : PostAddNewClient III

winvnc.cpp : PostAddNewClient IIII

winvnc.cpp : PostAddNewRepeaterClient I

winvnc.cpp : OpenInputdesktop Error

winvnc.cpp : OpenInputdesktop OK

winvnc.cpp : !GetUserObjectInformation

winvnc.cpp : SelectHDESK to %s (%x) from %x

winvnc.cpp : SelectHDESK:!SetThreadDesktop

winvnc.cpp : getusername error %d

winvnc.cpp : Username %s

winvnc.cpp : failed to create tray menu

winvnc.cpp : PostAddNewClient IIIII

winvnc.cpp : PostAddNewRepeaterClient II

winvnc.cpp : ****************** WaitForSingleObject - Shutdown server

winvnc.cpp : ****************** Init SDTimer

winvnc.cpp : ****************** Kill SDTimer

winvnc.cpp : ***** DBG - WinVNCAPPMain

winvnc.cpp : %s -- exiting

winvnc.cpp : server created ok

winvnc.cpp : ***************** SDEvent created

winvnc.cpp : ################## Closing Imp Thread

winvnc.cpp : ################## SHUTING DOWN SERVER ####################

Enter password for:

Password incorrect--reenter:

%sEmpty zipfile.

warning: cannot set time for %s

[ %s ]

warning (%d): could not set file attributes

CreateFile() error %d when trying set file time

SetFileTime failed: %d

warning: CreateFile() error %d (set file times for %s)

warning: SetFileTime() for %s error %d

warning: skipped "../" path component(s) in %s

warning (%d): could not set file attributes for %s

mapname: conversion of %s failed

labelling %s %-22s

checkdir error: path too long: %s

checkdir error: cannot create %s

unable to process %s.

checkdir error: %s exists but is not directory

-> %s

checkdir: cannot create extraction directory: %s

Skipping %s

XABKEY

%u.%u

.r.-... %u.%u

%s %s %8lu

=%%

%s %s

Unable to allocate memory in zip library at %s

wiz.exe

Verify password:

Enter password:

zip error: %s (%s)

attempting to restore %s to its previous state

zip warning: %s%s

.Z:.zip:.zoo:.arc:.lzh:.arj

was getting encryption password

zero length password not allowed

was verifying encryption password

password verification failed

mm not supported

no such option: %c

M----

--M

-M not supported, use -MM for Must Match

zip diagnostic: %s %s

freshening: %s

updating: %s

was zipping %s

was copying %s

deleting: %s

User terminated operation

adding: %s

Enter comment for %s:

total bytes=%lu, compressed=%lu -> %d%% savings

excluding %s

replace: can't open %s

made by version %d.%d on system type %d:

needs unzip %d.%d on system type %d:

local flags = 0xx, central = 0xx:

undefined bits used in flags = 0xx:

unknown compression method %u:

starts on disk %u:

unknown internal attributes = 0xx:

zip info: %s%s

zip info: %s has %ld bytes of %sextra data

zip: reading %s

compressed size %ld, actual size %ld for %s

zip warning: %s %s truncated.

%s: adjusting offsets for a preamble of %lu bytes

offset %u--local = x, central = x

%s: %s a preamble of %lu bytes

zip diagnostic: deleting file %s

deleting directory %s (if empty)

zip diagnostic: %scluding %s

zip -0 not supported for I/O on pipes or devices

(deflated %d%%)

WS2_32.dll

WINMM.dll

VERSION.dll

USERENV.dll

WinExec

WaitNamedPipeW

SetProcessShutdownParameters

KERNEL32.dll

ExitWindowsEx

GetKeyState

keybd_event

GetKeyboardState

EnumWindows

EnumDesktopWindows

VkKeyScanA

MapVirtualKeyA

GetAsyncKeyState

USER32.dll

GDI32.dll

RegOpenKeyExA

RegCloseKey

RegDeleteKeyA

RegCreateKeyExA

RegCreateKeyA

ADVAPI32.dll

ShellExecuteA

ShellExecuteExA

SHFileOperationA

SHELL32.dll

ole32.dll

IMM32.dll

GetProcessHeap

GetCPInfo

PeekNamedPipe

:;,= "[]|

%ld%c

Bogus message code %d

Invalid component ID %d in SOS

IDCT output block size %d not supported

Wrong JPEG library version: library is %d, caller expects %d

Invalid memory pool code %d

Unsupported JPEG data precision %d

Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d

Invalid progressive parameters at scan script entry %d

Invalid scan script at entry %d

Improper call to JPEG library in state %d

JPEG parameter struct mismatch: library thinks size is %u, caller expects %u

Buffer passed to JPEG library is too small

Too many color components: %d, max %d

Unsupported color conversion request

Bogus DAC index %d

Bogus DAC value 0x%x

Bogus DHT index %d

Bogus DQT index %d

Empty JPEG image (DNL not supported)

Maximum supported image dimension is %u pixels

Cannot transcode due to multiple use of quantization table %d

Backing store not supported

Huffman table 0xx was not defined

Quantization table 0xx was not defined

Not a JPEG file: starts with 0xx 0xx

Insufficient memory (case %d)

Cannot quantize more than %d color components

Cannot quantize to fewer than %d colors

Cannot quantize to more than %d colors

Unsupported JPEG process: SOF type 0xx

Failed to create temporary file %s

Unsupported marker type 0xx

Unknown APP0 marker (not JFIF), length %u

Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d

Unknown APP14 marker (not Adobe), length %u

Define Arithmetic Table 0xx: 0xx

Define Huffman Table 0xx

Define Quantization Table %d precision %d

Define Restart Interval %u

Freed EMS handle %u

Obtained EMS handle %u

= = = = = = = =

JFIF APP0 marker: version %d.d, density %dx%d %d

Warning: thumbnail image size does not match data length %u

JFIF extension marker: type 0xx, length %u

with %d x %d thumbnail image

Miscellaneous marker 0xx, length %u

Unexpected marker 0xx

%4u %4u %4u %4u %4u %4u %4u %4u

Quantizing to %d = %d*%d*%d colors

Quantizing to %d colors

Selected %d colors for quantization

At marker 0xx, recovery action %d

RST%d

Smoothing not supported with nonstandard sampling ratios

Start Of Frame 0xx: width=%u, height=%u, components=%d

Component %d: %dhx%dv q=%d

Start Of Scan: %d components

Component %d: dc=%d ac=%d

Ss=%d, Se=%d, Ah=%d, Al=%d

Closed temporary file %s

Opened temporary file %s

JFIF extension marker: palette thumbnail image, length %u

JFIF extension marker: JPEG-compressed thumbnail image, length %u

JFIF extension marker: RGB thumbnail image, length %u

Unrecognized component IDs %d %d %d, assuming YCbCr

Freed XMS handle %u

Obtained XMS handle %u

Unknown Adobe color transform code %d

Corrupt JPEG data: %u extraneous bytes before marker 0xx

Inconsistent progression sequence for component %d coefficient %d

Warning: unknown JFIF revision number %d.d

Corrupt JPEG data: found marker 0xx instead of RST%d

;3 #>6.&

'2, / 0&7!4-)1#

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RemoteDesktop_Temp_Files\WinVNC.log

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RemoteDesktop_Temp_Files

.?AVvncHTTPConnectThread@@

.?AVvncHTTPConnect@@

.?AVvncTimedMsgBoxThread@@

zcÃ

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RemoteDesktop_Temp_Files\RemoteDesktopServer.exe

192.168.25.227

9.152.220.192

It presumably does not support TextChat

You selected ms-logon, but the auth.dll

WARNING : Running WinVNC without setting a password is a dangerous security risk!

Until you set a password, WinVNC will not accept incoming connections.

Unable to load the Rich Edit (RICHED32.DLL) control!

You selected ms-logon, but the authad.dll

WARNING : This machine has no default password set. WinVNC will present the Default Properties dialog now to allow one to be entered.

Chat with - UltraVNC

No password has been set & this machine has been preconfigured to prevent users from setting their own.

FTPFrame.java

FTPFrame$StrComp

file.separator

FTPFrame

setDefaultCloseOperation

(LFTPFrame;)V

setViewportView

password

moveFocusToPasswordField

AuthPanel.java

Password:

ClipboardFrame.java

OptionsFrame.java

versionMsg

KeyboardEvent

sz_rfbFileTransferMsg

rfbRErrorUnknownCmd

rfbRErrorCmd

port

brokenKeyPressed

readVersionMsg

writeVersionMsg

readRfbFileTransferMsg

writeRfbFileTransferMsg

"writeRfbFileTransferMsgForSendFile

readFTPMsgDriveList

readFTPMsgDirectoryList

readFTPMsgDirectoryListContent

!readFTPMsgDirectoryListEndContent

readFTPMsgDirectorydriveNotReady

writeKeyEvent

(Ljava/awt/event/KeyEvent;)V

writeModifierKeyEvents

RfbProto.java

PORT:

REPEATERPORT:

port

LFTPFrame;

java/awt/event/KeyEvent

getKeyChar

getKeyCode

isActionKey

keyPressed

keyReleased

keyTyped

processLocalKeyEvent

VncCanvas.java

java/awt/event/KeyListener

addKeyListener

(Ljava/awt/event/KeyListener;)V

repeaterPort

passwordParam

encPasswordParam

VncViewer.java

%RFB server supports protocol version

cThe current authentication method does not transfer your password securely.Do you want to continue?

, key=

PORT

PORT PARAM :

REPEATERPORT

REPEATERPORT PARAM :

ENCPASSWORD

PASSWORD

createInterKey

createEncryptionKey

()Ljava/net/URL;

java/net/URL

ftpButton

ButtonPanel.java

encryptKeys

decryptKeys

setKey

deskey

cookey

DesCipher.java

RecordingFrame.java

user.dir

vncsession.fbs

SessionRecorder.java

DH_KEY

createKeys

DH.java

interKey too large

META-INF/MANIFEST.MFu

META-INF/_51B5489.SFu

META-INF/_51B5489.RSA

~Ã‡"

AuthPanel.class}V[\

ButtonPanel.classuV]p

ClipboardFrame.class

DesCipher.class

D\%D$

DH.classmV

FTPFrame$StrComp.classeQ

FTPFrame.class

$[KeY

OptionsFrame.class

~.rER

RecordingFrame.class

<.vf>

RfbProto.class

.PiVB\

SessionRecorder.class

VncCanvas.class

Qu0%C

Voq'%f

VncViewer.class

D.Ll1

META-INF/MANIFEST.MFPK

META-INF/_51B5489.SFPK

META-INF/_51B5489.RSAPK

AuthPanel.classPK

ButtonPanel.classPK

ClipboardFrame.classPK

DesCipher.classPK

DH.classPK

FTPFrame$StrComp.classPK

FTPFrame.classPK

OptionsFrame.classPK

RecordingFrame.classPK

RfbProto.classPK

SessionRecorder.classPK

VncCanvas.classPK

VncViewer.classPK

.TGUej[

^.Zua

,du.bSq

l%csU

!z{{zz{{P. .Pz

2244444422

vw%u!'yu

''&(''&(''&(''&(''&(''&(''&(''&(''&(''&(''&(''&(''&(''&(''&"$$$

(-55577555-(

&'((&'((&'((&'((&'((&'((&'((&'((&'((&'((&'((&'((&'((&'((&''"#$%

! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! !

*** --,

00---,---...431

00/000111221##

1%%&%%&

33#((( (

7"7 747=7

6*74797>7

8"8*838

1-141K1X1a1h1v1}1

3&3-3;3}3

9 :$:(:,:0:

|01C1Y1e1

9&9 989=9_9

?!?'?-?4?

?'?,?2?`?~?

4%4-454=4

0 020:0~0

8â€ž8;8~8

4#4 41474|4

;#;(;7;^;

3 3$3(3,303

: :@:`:|:

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

\winsta.dll

\\.\Pipe\TerminalServer\SystemExecSrvr\%d

(&) 0,5-?.1

"'#,$1%

UltraVNC Win32 Server 1.1.8

Poll Console Windows Only

Display Number or Ports to use:

Ports

Http:

Enable JavaViewer (Http Connect)

Keyboard && Mouse

Alternate keyboard method

VNC Password:

View-Only Password:

Require MS Logon (User/Pass./Domain)

New MS Logon (supports multiple domains)

Log debug infos to the WinVNC.log file

1.1.8

WinVNC.exe

This machine has been preconfigured with WinVNC settings, which cannot be overridden by individual users. The preconfigured settings may be modified only by a System Administrator.DThe WinVNC settings for the current user are unavailable at present.PYou do not have sufficient priviliges to edit the default local WinVNC settings.

Until you set a password, WinVNC will not accept incoming connections.9The Plugin cannot be loaded.

WVNCNYou selected ms-logon, but the authad.dll

WARNINGLYou selected ms-logon, but the auth.dll

was not found.Check you installationevncDesktop : root device doesn't support BitBlt

WinVNC cannot be used with this graphic device driverkvncDesktop : memory device doesn't support GetDIBits

4Unable to load the Rich Edit (RICHED32.DLL) control!

AutoAccept:%u Ctrl-alt-del require service, no permission;The file cad.exe was not found in the same folder as winvncsPermission denied on cad.exe, UltraVNC must be installed in "program files" else special cad permission is refused.