Worm.Win32.AutoItGen_b5646055a4 – Adaware

Susp_Dropper (Kaspersky), Trojan.Win32.Swrort.3.FD, Worm.Win32.AutoIt.FD, mzpefinder_pcap_file.YR, WormAutoItGen.YR (Lavasoft MAS)Behaviour: Trojan, Worm

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: b5646055a4dc3ad91a8c6325c5ad9940

SHA1: 57ebc1227891f79571f57ca55a18d20e28de03a6

SHA256: 93efd0c03ffe4d181dabad82240fe7451b184237ab7496f17b86a556f215b2fe

SSDeep: 6144:J1db49 rEg024fpLZazEjvE/rbay19tSt4bO2BaDmeBJe59 n7IPECy4QP:JjkArEN249AyE/rbaMct4bO2/VU7IM26

Size: 335304 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6

Company: no certificate found

Created at: 2010-04-16 10:47:33

Analyzed on: WindowsXP SP3 32-bit

Summary: Worm. A program that is primarily replicating on networks or removable drives.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Worm creates the following process(es):

TavsegitsegServer.exe:1304
%original file name%.exe:580

The Worm injects its code into the following process(es):

tavsegitseg.exe:1056
tavsegitseg.exe:912

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:580 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tavsegitseg.exe (266214 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tavsegitseg[1].exe (1012256 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tavsegitseg[2].exe (0 bytes)

The process tavsegitseg.exe:1056 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\autD.tmp (1960 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autC.tmp (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\TavsegitsegServer.exe (16986 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\ultravnc.ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut7.tmp (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut4.tmp (980 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut5.tmp (87 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut3.tmp (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\driver\driver\mv2.sys (588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (3249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\TavsegitsegServiceInstaller.exe (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\driver\driver\mv2.cat (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autF.tmp (588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\vnchooks.dll (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (9417 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autA.tmp (980 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut10.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\chunkvnc.ini (81 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut11.tmp (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\setcad.exe (1764 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autE.tmp (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\driver\setupdrv.exe (1137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\MSRC4Plugin_for_sc.dsm (1137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\schook.dll (1137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autB.tmp (854 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut8.tmp (1764 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\rc4.key (87 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut9.tmp (2897 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\driver\driver\mv2.inf (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\SecureVNCPlugin.dsm (4065 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\driver\driver\mv2.dll (1176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\background.bmp (1764 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut6.tmp (81 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\logo.jpg (22 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aut9.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autD.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autE.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autC.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autA.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autF.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut10.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autB.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut11.tmp (0 bytes)

Registry activity

The process TavsegitsegServer.exe:1304 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AD 74 2B ED 6A 8F 2A 5D B0 D7 3F 92 53 9C 58 F4"

The process %original file name%.exe:580 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"tavsegitseg.exe" = "tavsegitseg"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD CA 74 90 F1 D0 80 9C F8 1C 3F 2B 14 7F D5 E8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process tavsegitseg.exe:1056 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A8 24 F3 76 5D 20 51 04 7D 20 8E 55 8C DE D8 16"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Tavsegitseg_Temp_Files]
"TavsegitsegServer.exe" = "VNC server for win32"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files]
"TavsegitsegServer.exe" = "%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\TavsegitsegServer.exe:*:Enabled:StefÃƒÆ’Ã‚Â¡nia tÃƒÆ’Ã‚Â¡vsegÃƒÆ’Ã‚ÂtsÃƒÆ’Ã‚Â©g"

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process tavsegitseg.exe:912 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "73 3F 53 0E AB AE 15 20 25 97 3C 51 BE 7B 31 A3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

Dropped PE files

MD5	File path
1b0d01fece707b9491f37642ffebd502	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Tavsegitseg_Temp_Files\MSRC4Plugin_for_sc.dsm
61ec46d9fe9a680dae79a249027ef00f	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Tavsegitseg_Temp_Files\SecureVNCPlugin.dsm
bb0522f4d486de5effc5d24692c74d23	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Tavsegitseg_Temp_Files\TavsegitsegServer.exe
55632c49e986a2ad305fc99cd4591864	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Tavsegitseg_Temp_Files\TavsegitsegServiceInstaller.exe
0111779d75b252e1ab3e275ac7ed301d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Tavsegitseg_Temp_Files\driver\driver\mv2.dll
2a8e5e1cb522b49b88b221396d6de072	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Tavsegitseg_Temp_Files\driver\driver\mv2.sys
50f6a9509729a6d8d97e29ad259c6a1e	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Tavsegitseg_Temp_Files\driver\setupdrv.exe
1b6fa3b51e6da3e3acca73f61528c707	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Tavsegitseg_Temp_Files\schook.dll
6b15466b94c37aeb7c396c56df458671	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Tavsegitseg_Temp_Files\setcad.exe
0c6c1ebe9caeccb29829179d7e886d95	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Tavsegitseg_Temp_Files\vnchooks.dll
9f00a8857323cb6ea8614963884326a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\tavsegitseg.exe
9f00a8857323cb6ea8614963884326a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tavsegitseg[1].exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
TavsegitsegServer.exe:1304
%original file name%.exe:580
Delete the original Worm file.
Delete or disinfect the following files created/modified by the Worm:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tavsegitseg.exe (266214 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tavsegitseg[1].exe (1012256 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autD.tmp (1960 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autC.tmp (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\TavsegitsegServer.exe (16986 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\ultravnc.ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut7.tmp (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut4.tmp (980 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut5.tmp (87 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut3.tmp (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\driver\driver\mv2.sys (588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (3249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\TavsegitsegServiceInstaller.exe (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\driver\driver\mv2.cat (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autF.tmp (588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\vnchooks.dll (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (9417 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autA.tmp (980 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut10.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\chunkvnc.ini (81 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut11.tmp (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\setcad.exe (1764 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autE.tmp (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\driver\setupdrv.exe (1137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\MSRC4Plugin_for_sc.dsm (1137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\schook.dll (1137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autB.tmp (854 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut8.tmp (1764 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\rc4.key (87 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut9.tmp (2897 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\driver\driver\mv2.inf (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\SecureVNCPlugin.dsm (4065 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\driver\driver\mv2.dll (1176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\background.bmp (1764 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut6.tmp (81 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tavsegitseg_Temp_Files\logo.jpg (22 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 3, 3, 6, 1
File Description:
Comments:
Language: English (United States)

Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 3, 3, 6, 1File Description: Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	507904	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	512000	270336	269824	5.49581	d9dfdd59481375ff1e637f90584a0a4c
.rsrc	782336	57344	56320	5.28732	14555f024dd4b1e387670bc081a62b41

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 108
87c9bbe903da73728b66fa984779da11
4658616b4c911de6dfaceaf8e23612c4
9cca7e6ae5eb99999a27076ace433072
319eba6591a027afc63a7cd55b77146c
f78a84d6ca940621badf4647f4f4bc48
ccffcfa641ffa20e6b0cbaa28057ff7f
9ec15408b23917bf1d0c31e5605d7906
2216ea77778dc81d6c96b8532fc1f78f
4acf0ea9061fd1ba4dfca0d4d32e78c9
67f4ed691b8e0a54d7926616e2228b06
8fac20e4aea03400dd3569bef8df1342
8ae9f44ef41a254f3f89b63fbd59e086
18a33152a8c6a59bde741933b97e6a1b
96cc225b7e956eddbbb08c39d0adeba8
c07779e058cb5915d0f6e6dab1170e49
15d14d5e36fc25841457db1722ee0852
989941b0ec80294702cf515805d44f2c
f125793154fd111cdbf17cc7c6d393f8
d5f1f8cba14146b4ce1c70b8e7a4bf99
e203fd8ab36cc3cc63d22c2fe7ae4dc5
042f0f38286d9be3391e2806d71c51a1
0edfc6c0b18b0c27a7b46a2edce52448
1eaa3c9a082817e3af8af76d2ffa1be1
e8a70c7000979fd2683f0b74eecb183e
02d5f2decb26be5c08744f218a59abdf

Network Activity

URLs

URL	IP
hxxp://vitarex.hu/Download/tavsegitseg.exe
hxxp://www.vitarex.hu/Download/tavsegitseg.exe	62.112.193.138

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /Download/tavsegitseg.exe HTTP/1.1

User-Agent: AutoIt

Host: VVV.vitarex.hu

Cache-Control: no-cache

HTTP/1.1 200 OK

Connection: Keep-Alive

Content-Length: 2239224

Date: Mon, 21 Dec 2015 04:08:41 GMT

Content-Type: application/octet-stream

ETag: "4fb1106382ccf1:0"

Server: Microsoft-IIS/7.0

Accept-Ranges: bytes

Cache-Control: max-age=60

Last-Modified: Wed, 08 Jan 2014 15:00:36 GMT

X-Powered-By: ASP.NET

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`. .P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi...........................PE..L......K..........#...... ........................@..................................`".......@.......@...............................................".H...........................................................................................UPX0....................................UPX1..... ..........................@....rsrc................"..............@..............................................................................................................................................................................................................................................................................................................................................................3.03.UPX!..........B..........D..&.......3.......8..rI.tCh..P.T$.R.#........ ...!.........$Qj..D..k.$..V.....J....$H............F$S3.;...J....,.^o.s.$.^0.48.^..6..[e.~..:..j.....p......t.....N..H....F.....lLt.....L....$S.\>W.|.PQ..../.._[...>U.....QV;..n.o.uP...:s(...r#;=..J..r.7...TU..E.RPWS..&^...~..]...^.u#6h..X........,.?I`..o......w9....G....w..$...{^..@.......x...j6....".....wa.........._f.o.BQd......ph.,.v..g.hhHH...=....i...bY...-...k.............WDu....B..,Z.tZ....Wd..pw.waX....P..A....a..$..dF.l.=..:<..:....$...hz.t.X.u..

<<< skipped >>>

Map

The Worm connects to the servers at the folowing location(s):

Strings from Dumps

tavsegitseg.exe_912:

`.rsrc

s%j.Zf

tGHt.Ht&

tCPh

SSSSh

\$%u#Sj

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.

uxtheme.dll

kernel32.dll

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N, \U, or \u

support for \P, \p, and \X has not been compiled

(*VERB) with an argument is not supported

ICMP.DLL

advapi32.dll

RegDeleteKeyExW

zcÃ

GetProcessHeap

CreatePipe

GetWindowsDirectoryW

GetCPInfo

GetConsoleOutputCP

RegDeleteKeyW

RegCreateKeyExW

RegEnumKeyExW

RegCloseKey

RegOpenKeyExW

SetViewportOrgEx

ShellExecuteExW

SHFileOperationW

ShellExecuteW

RegisterHotKey

GetKeyboardLayoutNameW

ExitWindowsEx

EnumThreadWindows

GetAsyncKeyState

SetKeyboardState

GetKeyboardState

GetKeyState

VkKeyScanW

EnumWindows

EnumChildWindows

MapVirtualKeyW

CloseWindowStation

SetProcessWindowStation

OpenWindowStationW

UnregisterHotKey

keybd_event

InternetCrackUrlW

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

FtpOpenFileW

FtpGetFileSize

InternetOpenUrlW

.text

`.rdata

@.data

.rsrc

s.ak[|

]aM#}.bod:o

Sub%CR

.vgFy#

''&(''&(''&(''&(''&(''&(''&(''&(''&(''&(''&(''&(''&(''&(''&"$$$

KERNEL32.DLL

ADVAPI32.dll

COMCTL32.dll

COMDLG32.dll

GDI32.dll

MPR.dll

ole32.dll

OLEAUT32.dll

PSAPI.DLL

SHELL32.dll

USER32.dll

USERENV.dll

VERSION.dll

WININET.dll

WINMM.dll

WSOCK32.dll

mscoree.dll

>>>AUTOIT NO CMDEXECUTE

CMDLINERAW

CMDLINE

/AutoIt3ExecuteLine

/AutoIt3ExecuteScript

%s (%d) : ==> %s.:

Line %d:

Line %d (File "%s"):

%s (%d) : ==> %s:

AutoIt script files (*.au3, *.a3x)

*.au3;*.a3x

All files (*.*)

#NoAutoIt3Execute

APPSKEY

04090000

%u.%u.%u.%u

0.0.0.0

Mddddd

%s (%d) : ==> %s:

UDPSTARTUP

UDPSHUTDOWN

UDPSEND

UDPRECV

UDPOPEN

UDPCLOSESOCKET

UDPBIND

TRAYGETMSG

TCPSTARTUP

TCPSHUTDOWN

TCPSEND

TCPRECV

TCPNAMETOIP

TCPLISTEN

TCPCONNECT

TCPCLOSESOCKET

TCPACCEPT

SHELLEXECUTEWAIT

SHELLEXECUTE

REGENUMKEY

MSGBOX

ISKEYWORD

HTTPSETUSERAGENT

HTTPSETPROXY

HOTKEYSET

GUIREGISTERMSG

GUIGETMSG

GUICTRLSENDMSG

GUICTRLRECVMSG

FTPSETPROXY

\??\%s

GUI_RUNDEFMSG

SendKeyDelay

SendKeyDownDelay

TCPTimeout

AUTOITCALLVARIABLE%d

255.255.255.255

Keyword

AutoIt.Error

Null Object assignment in FOR..IN loop

Incorrect Object type in FOR..IN loop

HOTKEYPRESSED

AUTOITEXE

WINDOWSDIR

3, 3, 6, 1

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_USERS

%d/d/d

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\tavsegitseg.exe

:%Documents and Settings%\%current user%\Local Settings\Temp\tavsegitseg.exe

AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.

Missing operator in expression."Unbalanced brackets in expression.

Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.

Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.

Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.

3This keyword cannot be used after a "Then" keyword.

>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.

HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.

String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.

tavsegitseg.exe_912_rwx_00401000_000BD000:

s%j.Zf

tGHt.Ht&

tCPh

SSSSh

\$%u#Sj

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.

uxtheme.dll

kernel32.dll

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N, \U, or \u

support for \P, \p, and \X has not been compiled

(*VERB) with an argument is not supported

ICMP.DLL

advapi32.dll

RegDeleteKeyExW

zcÃ

GetProcessHeap

CreatePipe

GetWindowsDirectoryW

GetCPInfo

GetConsoleOutputCP

RegDeleteKeyW

RegCreateKeyExW

RegEnumKeyExW

RegCloseKey

RegOpenKeyExW

SetViewportOrgEx

ShellExecuteExW

SHFileOperationW

ShellExecuteW

RegisterHotKey

GetKeyboardLayoutNameW

ExitWindowsEx

EnumThreadWindows

GetAsyncKeyState

SetKeyboardState

GetKeyboardState

GetKeyState

VkKeyScanW

EnumWindows

EnumChildWindows

MapVirtualKeyW

CloseWindowStation

SetProcessWindowStation

OpenWindowStationW

UnregisterHotKey

keybd_event

InternetCrackUrlW

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

FtpOpenFileW

FtpGetFileSize

InternetOpenUrlW

.text

`.rdata

@.data

.rsrc

s.ak[|

mscoree.dll

KERNEL32.DLL

>>>AUTOIT NO CMDEXECUTE

CMDLINERAW

CMDLINE

/AutoIt3ExecuteLine

/AutoIt3ExecuteScript

%s (%d) : ==> %s.:

Line %d:

Line %d (File "%s"):

%s (%d) : ==> %s:

AutoIt script files (*.au3, *.a3x)

*.au3;*.a3x

All files (*.*)

#NoAutoIt3Execute

APPSKEY

04090000

%u.%u.%u.%u

0.0.0.0

Mddddd

%s (%d) : ==> %s:

UDPSTARTUP

UDPSHUTDOWN

UDPSEND

UDPRECV

UDPOPEN

UDPCLOSESOCKET

UDPBIND

TRAYGETMSG

TCPSTARTUP

TCPSHUTDOWN

TCPSEND

TCPRECV

TCPNAMETOIP

TCPLISTEN

TCPCONNECT

TCPCLOSESOCKET

TCPACCEPT

SHELLEXECUTEWAIT

SHELLEXECUTE

REGENUMKEY

MSGBOX

ISKEYWORD

HTTPSETUSERAGENT

HTTPSETPROXY

HOTKEYSET

GUIREGISTERMSG

GUIGETMSG

GUICTRLSENDMSG

GUICTRLRECVMSG

FTPSETPROXY

\??\%s

GUI_RUNDEFMSG

SendKeyDelay

SendKeyDownDelay

TCPTimeout

AUTOITCALLVARIABLE%d

255.255.255.255

Keyword

AutoIt.Error

Null Object assignment in FOR..IN loop

Incorrect Object type in FOR..IN loop

HOTKEYPRESSED

AUTOITEXE

WINDOWSDIR

3, 3, 6, 1

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_USERS

%d/d/d

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\tavsegitseg.exe

:%Documents and Settings%\%current user%\Local Settings\Temp\tavsegitseg.exe

Missing operator in expression."Unbalanced brackets in expression.

3This keyword cannot be used after a "Then" keyword.

String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.

tavsegitseg.exe_1056:

`.rsrc

s%j.Zf

tGHt.Ht&

tCPh

SSSSh

\$%u#Sj

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.

uxtheme.dll

kernel32.dll

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N, \U, or \u

support for \P, \p, and \X has not been compiled

(*VERB) with an argument is not supported

ICMP.DLL

advapi32.dll

RegDeleteKeyExW

zcÃ

GetProcessHeap

CreatePipe

GetWindowsDirectoryW

GetCPInfo

GetConsoleOutputCP

RegDeleteKeyW

RegCreateKeyExW

RegEnumKeyExW

RegCloseKey

RegOpenKeyExW

SetViewportOrgEx

ShellExecuteExW

SHFileOperationW

ShellExecuteW

RegisterHotKey

GetKeyboardLayoutNameW

ExitWindowsEx

EnumThreadWindows

GetAsyncKeyState

SetKeyboardState

GetKeyboardState

GetKeyState

VkKeyScanW

EnumWindows

EnumChildWindows

MapVirtualKeyW

CloseWindowStation

SetProcessWindowStation

OpenWindowStationW

UnregisterHotKey

keybd_event

InternetCrackUrlW

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

FtpOpenFileW

FtpGetFileSize

InternetOpenUrlW

.text

`.rdata

@.data

.rsrc

s.ak[|

]aM#}.bod:o

Sub%CR

.vgFy#

''&(''&(''&(''&(''&(''&(''&(''&(''&(''&(''&(''&(''&(''&(''&"$$$

KERNEL32.DLL

ADVAPI32.dll

COMCTL32.dll

COMDLG32.dll

GDI32.dll

MPR.dll

ole32.dll

OLEAUT32.dll

PSAPI.DLL

SHELL32.dll

USER32.dll

USERENV.dll

VERSION.dll

WININET.dll

WINMM.dll

WSOCK32.dll

mscoree.dll

>>>AUTOIT NO CMDEXECUTE

CMDLINERAW

CMDLINE

/AutoIt3ExecuteLine

/AutoIt3ExecuteScript

%s (%d) : ==> %s.:

Line %d:

Line %d (File "%s"):

%s (%d) : ==> %s:

AutoIt script files (*.au3, *.a3x)

*.au3;*.a3x

All files (*.*)

#NoAutoIt3Execute

APPSKEY

04090000

%u.%u.%u.%u

0.0.0.0

Mddddd

%s (%d) : ==> %s:

UDPSTARTUP

UDPSHUTDOWN

UDPSEND

UDPRECV

UDPOPEN

UDPCLOSESOCKET

UDPBIND

TRAYGETMSG

TCPSTARTUP

TCPSHUTDOWN

TCPSEND

TCPRECV

TCPNAMETOIP

TCPLISTEN

TCPCONNECT

TCPCLOSESOCKET

TCPACCEPT

SHELLEXECUTEWAIT

SHELLEXECUTE

REGENUMKEY

MSGBOX

ISKEYWORD

HTTPSETUSERAGENT

HTTPSETPROXY

HOTKEYSET

GUIREGISTERMSG

GUIGETMSG

GUICTRLSENDMSG

GUICTRLRECVMSG

FTPSETPROXY

\??\%s

GUI_RUNDEFMSG

SendKeyDelay

SendKeyDownDelay

TCPTimeout

AUTOITCALLVARIABLE%d

255.255.255.255

Keyword

AutoIt.Error

Null Object assignment in FOR..IN loop

Incorrect Object type in FOR..IN loop

HOTKEYPRESSED

AUTOITEXE

WINDOWSDIR

3, 3, 6, 1

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_USERS

%d/d/d

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\tavsegitseg.exe

:%Documents and Settings%\%current user%\Local Settings\Temp\tavsegitseg.exe

Missing operator in expression."Unbalanced brackets in expression.

3This keyword cannot be used after a "Then" keyword.

String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.

tavsegitseg.exe_1056_rwx_00401000_000BD000:

s%j.Zf

tGHt.Ht&

tCPh

SSSSh

\$%u#Sj

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.

uxtheme.dll

kernel32.dll

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N, \U, or \u

support for \P, \p, and \X has not been compiled

(*VERB) with an argument is not supported

ICMP.DLL

advapi32.dll

RegDeleteKeyExW

zcÃ

GetProcessHeap

CreatePipe

GetWindowsDirectoryW

GetCPInfo

GetConsoleOutputCP

RegDeleteKeyW

RegCreateKeyExW

RegEnumKeyExW

RegCloseKey

RegOpenKeyExW

SetViewportOrgEx

ShellExecuteExW

SHFileOperationW

ShellExecuteW

RegisterHotKey

GetKeyboardLayoutNameW

ExitWindowsEx

EnumThreadWindows

GetAsyncKeyState

SetKeyboardState

GetKeyboardState

GetKeyState

VkKeyScanW

EnumWindows

EnumChildWindows

MapVirtualKeyW

CloseWindowStation

SetProcessWindowStation

OpenWindowStationW

UnregisterHotKey

keybd_event

InternetCrackUrlW

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

FtpOpenFileW

FtpGetFileSize

InternetOpenUrlW

.text

`.rdata

@.data

.rsrc

s.ak[|

mscoree.dll

KERNEL32.DLL

>>>AUTOIT NO CMDEXECUTE

CMDLINERAW

CMDLINE

/AutoIt3ExecuteLine

/AutoIt3ExecuteScript

%s (%d) : ==> %s.:

Line %d:

Line %d (File "%s"):

%s (%d) : ==> %s:

AutoIt script files (*.au3, *.a3x)

*.au3;*.a3x

All files (*.*)

#NoAutoIt3Execute

APPSKEY

04090000

%u.%u.%u.%u

0.0.0.0

Mddddd

%s (%d) : ==> %s:

UDPSTARTUP

UDPSHUTDOWN

UDPSEND

UDPRECV

UDPOPEN

UDPCLOSESOCKET

UDPBIND

TRAYGETMSG

TCPSTARTUP

TCPSHUTDOWN

TCPSEND

TCPRECV

TCPNAMETOIP

TCPLISTEN

TCPCONNECT

TCPCLOSESOCKET

TCPACCEPT

SHELLEXECUTEWAIT

SHELLEXECUTE

REGENUMKEY

MSGBOX

ISKEYWORD

HTTPSETUSERAGENT

HTTPSETPROXY

HOTKEYSET

GUIREGISTERMSG

GUIGETMSG

GUICTRLSENDMSG

GUICTRLRECVMSG

FTPSETPROXY

\??\%s

GUI_RUNDEFMSG

SendKeyDelay

SendKeyDownDelay

TCPTimeout

AUTOITCALLVARIABLE%d

255.255.255.255

Keyword

AutoIt.Error

Null Object assignment in FOR..IN loop

Incorrect Object type in FOR..IN loop

HOTKEYPRESSED

AUTOITEXE

WINDOWSDIR

3, 3, 6, 1

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_USERS

%d/d/d

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\tavsegitseg.exe

:%Documents and Settings%\%current user%\Local Settings\Temp\tavsegitseg.exe

Missing operator in expression."Unbalanced brackets in expression.

3This keyword cannot be used after a "Then" keyword.

String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.

TavsegitsegServer.exe_1304:

.text

`.rdata

@.data

.rsrc

@.reloc

>.uTGF

t"SSh

RSSSSSSh

FTPj

f;Q.uP

u.htgM

SQSSh

SPSSh

SSShdVM

=VKEYt

xSSSh

FTPjKS

FtPj;S

C.PjRV

@-@-@-@-

@-@-@-@-@-@-@-@-

1.2.5

Visual C CRT: Not enough memory to complete call to strerror.

portuguese-brazilian

Broken pipe

Inappropriate I/O control operation

Operation not permitted

GetProcessWindowStation

operator

benchmark.cpp : Blit time %i Getpixeltime %i Use getpixel= %i

\background.bmp

black_layered.cpp : OpenInputdesktop Error

black_layered.cpp : OpenInputdesktop OK

black_layered.cpp : !GetUserObjectInformation

black_layered.cpp : SelectHDESK to %s (%x) from %x

black_layered.cpp : SelectHDESK:!SetThreadDesktop

black_layered.cpp : end BlackWindow

kernel32.dll

ntdll.dll

interKey larger than maxNum

0.0.0

12-12-2002

Plugin.dsm

*.dsm

Archive: %s %ld bytes %u file%s

Archive: %s %ld %u

central directory contains %u %s. The central directory is %lu

This zipfile constitutes disk %u of a multi-part archive. The central

directory starts on disk %u; %u of its entries %s contained within

this zipfile, out of a total of %u %s. The entire central

The zipfile comment is %u bytes long and contains the following text:

%lu file%s, %lu bytes uncompressed, %lu bytes compressed: %s%d.%d%%

unknown (%d)

file system or operating system of origin: %s

version of encoding software: %u.%u

minimum file system compatibility required: %s

minimum software version required to extract: %u.%u

compression method: %s

size of sliding dictionary (implosion): %cK

number of Shannon-Fano trees (implosion): %c

compression sub-type (deflation): %s

file last modified on (UT extra field modtime): %s %s

file security status: %sencrypted

extended local header: %s

file last modified on (DOS date/time): %s

apparent file type: %s

MS-DOS file attributes (X hex): none

length of filename: %u characters

length of extra field: %u bytes

Theos file attributes (X hex): %s

length of file comment: %u characters

disk number on which file begins: disk %u

VMS file attributes (o octal): %s

Amiga file attributes (o octal): %s

Unix file attributes (o octal): %s

MS-DOS file attributes (X hex): read-only

- A subfield with ID 0xx (%s) and %u data bytes

MS-DOS file attributes (X hex): %s%s%s%s%s%s%s%s

Keyed

Indexed

error: EF data block (type 0xx) size %u exceeds remaining extra field

space %u; block length has been truncated.

field is %s and has %u bytes of VMS %s information%s

The local extra field has UTC/GMT %s time%s

The Mac long filename is %s

File is marked as %s

The local extra field has %lu bytes of %scompressed Macintosh

The associated file has type code `%c%c%c%c' and creator code `%c%c%c%c'

File is marked as %s, File Dates are in %d Bit

The QDOS extra field subtype is `%c%c%c%c'

The local extra field has %lu bytes of %scompressed AtheOS file attributes

The AOS/VS extra field revision is %d.%d

The local extra field has %lu bytes of %scompressed BeOS file attributes

Key Sequenced

The file was originally a Tandem %s file, with file code %u

The 128-bit MD5 signature is %s

There %s a local extra field with ID 0xx (%s) and

%u data bytes (%s).

%u %s %u u:u:u

uuu.uuu

%2u-%s-u u:u

???? ??? ?? ??:??:??

cc skipping: %-22s need %s compat. v%u.%u (can do v%u.%u)

skipping: %-22s unsupported compression method %u

skipping: %-22s `%s' method not supported

%s: bad filename length (%s)

%s: warning, no memory for comparison with local header

%s: bad extra field length (%s)

%s: mismatching "local" filename (%s),

%s: ucsize %lu csize %lu for STORED entry

file #%lu: bad zipfile offset (%s): %ld

%8sing: %-22s %s%s

%s %s: %ld bytes required to uncompress to %lu bytes;

%s supposed to require %lu bytes%s%s%s

%s: bad file comment length

warning: %s appears to use backslashes as path separators

warning: stripped absolute path spec from %s

skipping: %-22s %svolume label

warning: set times/attribs failed for %s

At least one %serror was detected in %s.

Caution: zero files tested in %s.

%s: stored in VMS format. Extract anyway? (y/n)

skipping: %-22s unable to get password

skipping: %-22s incorrect password

%lu file%s skipped because of incorrect password.

(may instead be incorrect password)

No errors detected in compressed data of %s.

No errors detected in %s for the %lu file%s tested.

%lu file%s skipped because of unsupported compression or encoding.

error: %s%s %s

error: %s%s

warning: %s is probably truncated

%s: unknown compression method

compressed EA data missing (%d bytes)%s

compressed WinNT security data missing (%d bytes)%s

EF block length (%u bytes) exceeds remaining EF data (%u bytes)

unsupported NTSD EAs version %d

unknown compression method for EAs (%u)

error [%s]: bad extra-field CRC lx (should be lx)

error: unsupported extra-field compression type (%u)--skipping

error: cannot open zipfile [ %s ]

error: cannot create %s

error: cannot delete old %s

warning: extra field too long (%d). Ignoring...

%s: write error (disk full?).

%d archive%s successfully processed.

%d archive%s had warnings but no fatal errors.

%d archive%s had fatal errors.

%d file%s had no zipfile directory.

%d "zipfiles" were directories.

%s: cannot find any matches for wildcard specification "%s".

%s: cannot find zipfile directory in %s,

%sand cannot find %s, period.

%s: cannot find either %s or %s.

note: %s may be a plain executable, not an archive

warning [%s]: zipfile is empty

[%s]:

Zipfile is disk %u of a multi-disk archive, and this is not the disk on

which the central zipfile directory begins (disk %u).

warning [%s]: end-of-central-directory record claims this

is disk %u but that the central directory starts on disk %u; this is a

warning [%s]: zipfile claims to be last disk of a multi-part archive;

together in order. Expect "errors" and warnings...true multi-part support

error [%s]: attempt to seek before beginning of zipfile

warning [%s]: %ld extra byte%s at beginning or within zipfile

caution: filename not matched: %s

error [%s]: missing %ld bytes in zipfile

Compiled with %s%s for %s%s%s%s.

error [%s]: NULL central directory offset

error [%s]: start of central directory not found;

error [%s]: reported length of central directory is

%ld bytes too long (Atari STZip zipfile? J.H.Holm ZIPSPLIT 1.1

caution: excluded filename not matched: %s

-httpproxy

winvnc [-sc_prompt] [-sc_exit] [-id:????] [-stopreconnect][-autoreconnect[ ID:????]] [-connect host[:display]] [-connect host[::port]] [-repeater host[:port]] [-run]

HTTP/1.0 200 OK

classid = 'clsid:8AD9C840-044E-11D1-B3E9-00805F499D93'

codebase = 'hXXp://java.sun.com/update/1.4.2/jinstall-1_4-windows-i586.cab#Version=1,4,0,0'

WIDTH = %d HEIGHT = %d >

CODE = VncViewer.class \

ARCHIVE = VncViewer.jar \

WIDTH = %d \

HEIGHT = %d \

PORT =%d \

pluginspage ='hXXp://java.sun.com/products/plugin/index.html#download'>

HTTP/1.0 404 Not Found

SecureVNC;0;0xx;%s

KERNEL32.DLL

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009

SOFTWARE\Microsoft\Windows NT\CurrentVersion

Software\Microsoft\Windows NT\CurrentVersion

Windows

Windows CE

Windows 95

Windows 95 SP1

Windows 95 OSR2

Windows 98

Windows 98 SP1

Windows 98 Second Edition

Windows Millenium Edition

Windows ??

Windows NT

Windows 2000

Windows XP (Personal)

Windows XP (Professional)

Windows Server 2003

Windows Server 2003 (Domain Controller)

, (Web Edition)

Build:%d

Service Pack:%d.%d

Service Pack:%d

Service Pack:0.%d

HTTPConnect

AutoPortSelect

PortNumber

HTTPPortNumber

net stop "%s"

hXXp://VVV.uvnc.com

hXXp://forum.uvnc.com

net start "%s"

shell32.dll

HideDesktop.cpp : Killwallpaper %i

HideDesktop.cpp : Killwallpaper %i %i

HideDesktop.cpp : Restorewallpaper %i

HideDesktop.cpp : Restorewallpaper %i %i

HideDesktop.cpp : Failed to get SPI value for 0xx (0xx)

HideDesktop.cpp : Retrieved SPI value for 0xx: 0xx

HideDesktop.cpp : Failed to set SPI value for 0xx to 0xx (0xx)

HideDesktop.cpp : Set SPI value for 0xx to 0xx

HideDesktop.cpp : Failed to restore SPI value for 0xx (0xx)

HideDesktop.cpp : Restored SPI value for 0xx to 0xx

HideDesktop.cpp : Failed to get SPI value for SPI_GETFONTSMOOTHING (0xx)

HideDesktop.cpp : Retrieved SPI value for SPI_GETFONTSMOOTHING: 0xx

HideDesktop.cpp : Failed to get SPI value for SPI_GETFONTSMOOTHINGTYPE (0xx)

HideDesktop.cpp : Retrieved SPI value for SPI_GETFONTSMOOTHINGTYPE: 0xx

HideDesktop.cpp : Failed to get SPI value for SPI_GETCLEARTYPE (0xx)

HideDesktop.cpp : Retrieved SPI value for SPI_GETCLEARTYPE: 0xx

HideDesktop.cpp : Failed to set SPI value for SPI_SETCLEARTYPE (0xx)

HideDesktop.cpp : Set SPI value for SPI_SETCLEARTYPE: 0xx

HideDesktop.cpp : Failed to set SPI value for SPI_SETFONTSMOOTHING (0xx)

HideDesktop.cpp : Set SPI value for SPI_SETFONTSMOOTHING: 0xx

HideDesktop.cpp : Failed to restore SPI value for SPI_SETFONTSMOOTHING (0xx)

HideDesktop.cpp : Restored SPI value for SPI_SETFONTSMOOTHING: 0xx

HideDesktop.cpp : Failed to restore SPI value for SPI_SETCLEARTYPE (0xx)

HideDesktop.cpp : Restored SPI value for SPI_SETCLEARTYPE: 0xx

HideDesktop.cpp : Failed to restore SPI value for SPI_SETFONTSMOOTHINGTYPE (0xx)

HideDesktop.cpp : Restored SPI value for SPI_SETFONTSMOOTHINGTYPE: 0xx

0123456789.

userpass

Address not supported

Command not supported

HTTP_DIRECT

SSH_ASKPASS

CONNECT_PASSWORD

HTTP_PROXY_PASSWORD

HTTP_PROXY_USER

HTTP_PROXY

SOCKS5_PASSWORD

SOCKS5_PASSWD

hXXp://

\xX

Enter SOCKS5 password for %s@%s:

Enter proxy authentication password for %s@%s:

%s:%s

Proxy-Authorization: Basic %s

CONNECT %s:%d HTTP/1.0

winhttp.dll

WinHttpGetIEProxyConfigForCurrentUser

http=

https=

UltraVNC.ini

passwd

passwd2

{34F673E0-878F-11D5-B98A-57B0D07B8C7C}

{34F673E0-878F-11D5-B98A-00B0D07B8C7C}

Wtsapi32.dll

winlogon.exe

winsta.dll

user32.dll

sas.dll

cad.exe

LockWorkstation failed with error 0x%0X

advapi32.dll

SYSTEM\CurrentControlSet\Services\%s

Tcpip

SYSTEM\CurrentControlSet\Control\SafeBoot\%s\%s

/boot.ini

operating systems

bcdedit.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies

ding_dong.wav

RICHED32.DLL

TextChat.cpp : OpenInputdesktop Error

TextChat.cpp : OpenInputdesktop OK

TextChat.cpp : !GetUserObjectInformation

TextChat.cpp : SelectHDESK to %s (%x) from %x

TextChat.cpp : SelectHDESK:!SetThreadDesktop

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : rfbInitColourMapSingleTable called

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : failed to allocate translation table

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : Using video Palette

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : Using mirror video Palette

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : got %u palette entries

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\tableinitcmtemplate.cpp : rfbInitColourMapSingleTable done

\uvnckeyboardhelper.exe

keyEvent

c:\video0.dat

c:\video1.dat

videodriver.cpp : Error video.dat

No '%s' found.

DevNum:%d

Name:%s

String:%s

ID:%s

Key:%s

Attach.ToDesktop

Fail: Using 32bit winvnc.exe with a 64bit driver?

mv2.dll

1.00.22

Driver verion is not 1.00.22

driver info: required version 1.00.22

vistahook.cpp : REct %i %i %i %i

vistahook.cpp : OpenInputdesktop Error

vistahook.cpp : OpenInputdesktop OK

vistahook.cpp : !GetUserObjectInformation

vistahook.cpp : SelectHDESK to %s (%x) from %x

vistahook.cpp : SelectHDESK:!SetThreadDesktop

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

\mylogo.bmp

AutoAccept:%u

AutoReject:%u

AutoAccept: %u

AutoReject: %u

vncbuffer.cpp : request local buffer[%d]

vncbuffer.cpp : fast blits detected - using DIBsection buffer

vncbuffer.cpp : unable to allocate main buffer[%d]

vncbuffer.cpp : unable to allocate back buffer[%d]

vncbuffer.cpp : unable to allocate cache buffer[%d]

vncbuffer.cpp : unable to allocate scaled buffer[%d]

vncbuffer.cpp : local buffer=%d

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : GetPalette called but no encoder set

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : request client buffer[%u]

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : unable to allocate client buffer[%u]

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : raw encoder requested

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : RRE encoder requested

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : CoRRE encoder requested

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : Hextile encoder requested

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : Ultra encoder requested

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : jpeg encoder is only supported on 32bit color display

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : ZRLE encoder requested

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : ZYWRLE encoder requested

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : Zlib encoder requested

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : ZlibHex encoder requested

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : Tight encoder requested

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : unknown encoder requested

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : client pixel format is not supported

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncencodemgr.h : SetClientFormat called

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncpasswd.h : PASSWD : ToText called

vncclient.cpp : init update thread

vncclient.cpp : update thread gone

vncclient.cpp : kill update thread

vncclient.cpp : enable update thread

vncclient.cpp : disable update thread

vncclient.cpp : enable/disable synced

vncclient.cpp : starting update thread

vncclient.cpp : stopping update thread

0.0.0.0

RFB d.d

vncclient.cpp : m_ms_logon set to %s

vncclient.cpp : no password specified for server - client rejected

This server does not have a valid password enabled. Until a password is set, incoming connections cannot be accepted.

vncclient.cpp : loopback connection attempted - client rejected

vncclient.cpp : loopback connection attempted - client accepted

vncclient.cpp : authentication failed

\logging.dll

vncclient.cpp : connections already exist - client rejected

vncclient.cpp : non-shared connection - disconnecting old clients

vncclient.cpp : Leaving InitAuthenticate

After DH: g=%I64u, m=%I64u, i=%I64u, key=%I64u

CheckUserGroupPasswordUni result=%i

password authentication

vncclient.cpp : Failed to send challenge to client

vncclient.cpp : Failed to receive challenge response from client

View-only password authentication

vncclient.cpp : failed to set socket timeout(%d)

vncclient.cpp : DSMPlugin Pointer to socket OK

vncclient.cpp : Invalid DSMPlugin Pointer

vncclient.cpp : A connection using DSM already exist - client rejected to avoid crash

vncclient.cpp : client connected : %s (%hd)

Could not connect using %s!

Could not connect to %s!

vncclient.cpp : PostAddNewClient I

vncclient.cpp : negotiated version

vncclient.cpp : authenticated connection

vncclient.cpp : sent pixel format to client

vncclient.cpp : vncClientThread

vncclient.cpp : remote pixel format invalid

vncclient.cpp : Cache protocol extension enabled

vncclient.cpp : XOR protocol extension enabled

vncclient.cpp : compression level requested: %d

vncclient.cpp : image quality level requested: %d

vncclient.cpp : LastRect protocol extension enabled

vncclient.cpp : X-style cursor shape updates enabled

vncclient.cpp : Full-color cursor shape updates enabled

vncclient.cpp : PointerPos protocol extension enabled

vncclient.cpp : ServerState protocol extension enabled

vncclient.cpp : KeepAlive protocol extension enabled

vncclient.cpp : FTProtocolVersion protocol extension enabled

vncclient.cpp : Extended clipboard protocol extension enabled

vncclient.cpp : Streaming DSM support enabled

vncclient.cpp : ZRLE found

vncclient.cpp : Tight found

vncclient.cpp : defaulting to raw encoder

vncclient.cpp : failed to select raw encoder!

vncclient.cpp : rfbSetServerInput: inputs %s

vncclient.cpp : failed to close desktop

vncclient.cpp : client disconnected : %s (%hd)

vncclient.cpp : PostAddNewClient II

vncclient.cpp : vncClient() executing...

vncclient.cpp : TEST 4

vncclient.cpp : ~vncClient() executing...

vncclient.cpp : deleting socket

vncclient.cpp : client Kill() called

vncclient.cpp : FATAL! client update region is empty!

vncclient.cpp : updating local pixel format

vncclient.cpp : updating local pixel format and buffer size

vncclient.cpp : protocol enabled too many times!

vncclient.cpp : failed to send RFB message to client

vncclient.cpp : ******** Sending %d Cache Rects

vncclient.cpp : *** Sending CacheZip Rects=%d Size=%d (%d)

vncclient.cpp : Compress returned error in File Send :%d

%s%s%s%s

vncclient.cpp : %%%%%%%%%%%%% vncClient::DoFTUserImpersonation - Call

vncclient.cpp : %%%%%%%%%%%%% vncClient::DoFTUserImpersonation - 1

vncclient.cpp : %%%%%%%%%%%%% vncClient::DoFTUserImpersonation - WSLocked

vncclient.cpp : %%%%%%%%%%%%% vncClient::DoFTUserImpersonation - currentUser = %s

vncclient.cpp : %%%%%%%%%%%%% vncClient::DoFTUserImpersonation - OpenProcessToken Error

vncclient.cpp : %%%%%%%%%%%%% vncClient::DoFTUserImpersonation - ImpersonateLoggedOnUser Failed

vncclient.cpp : %%%%%%%%%%%%% vncClient::UNDoFTUserImpersonation - 1

vncclient.cpp : %%%%%%%%%%%%% vncClient::UNDoFTUserImpersonation - Impersonationtoken exists

Connect to Technical Support

WinVNC.Update.DrawRect

WinVNC.Update.CopyRect

WinVNC.Update.Mouse

vncdesktop.cpp : ### PixelsGrid %d created !

vncdesktop.cpp : ~vncDesktop

vncdesktop.cpp : Desktop thread running, force close

vncdesktop.cpp : ~vncDesktop Shutdown()

vncdesktop.cpp : delete ((RGBPixelList)

vncdesktop.cpp : ~vncDesktop m_lGridsList.clear

vncdesktop.cpp : ~vncDesktop:: second request to close InitWindowthread

vncdesktop.cpp : InitDesktop Failed

vncdesktop.cpp : InitVideo driver Called

vncdesktop.cpp : Driver option enabled

vncdesktop.cpp : no default desktop

vncdesktop.cpp : Driver option disabled

vncdesktop.cpp : Break log

vncdesktop.cpp : InitBitmap Failed

vncdesktop.cpp : ThunkBitmapInfo Failed

vncdesktop.cpp : Removing real Dib buffer and replace by driver communication buffer

vncdesktop.cpp : EnableOptimisedBlits Failed

vncdesktop.cpp : SetPixFormat Failed

vncdesktop.cpp : SetPixShift Failed

vncdesktop.cpp : SetPalette Failed

vncdesktop.cpp : failed to DeleteDC hrootdc

vncdesktop.cpp : failed to DeleteDC hmemdc

vncdesktop.cpp : failed to DeleteObject

vncdesktop.cpp : failed to close desktop

vncdesktop.cpp : InitDesktop...

WindowsScreenSaverClass

vncdesktop.cpp : KillScreenSaver...

vncdesktop.cpp : Killing ScreenSaver

vncdesktop.cpp : No driver used

vncdesktop.cpp : Failed m_rootdc

vncdesktop.cpp : bitmap dimensions are %d x %d

vncdesktop.cpp : failed to create compatibleDC(%d)

vncDesktop : root device doesn't support BitBlt

vncDesktop : memory device doesn't support GetDIBits

vncdesktop.cpp : failed to create memory bitmap(%d)

vncdesktop.cpp : created memory bitmap

vncdesktop.cpp : unable to get display format

vncdesktop.cpp : unable to get display colour info

vncdesktop.cpp : got bitmap format

vncdesktop.cpp : DBG:used/bits/planes/comp/size = %d/%d/%d/%d/%d

vncdesktop.cpp : DBG:display context has %d planes!

vncdesktop.cpp : DBG:memory context has %d planes!

unsupported truecolour pixel format for setpixshifts

vncdesktop.cpp : unable to allocate logical palette

vncdesktop.cpp : unable to get system palette entries

vncdesktop.cpp : unable to create HPALETTE

vncdesktop.cpp : unable to select() HPALETTE

vncdesktop.cpp : warning - failed to RealizePalette

vncdesktop.cpp : initialised palette OK

vncdesktop.cpp : framebuffer has %u palette entries

vncdesktop.cpp : unable to create temporary DC

vncdesktop.cpp : unable to select DIB section into temporary DC

vncdesktop.cpp : unable to set DIB section palette

vncdesktop.cpp : unable to restore temporary DC bitmap

vncdesktop.cpp : no palette data for truecolour display

vncdesktop.cpp : attempting to enable DIBsection blits

vncdesktop.cpp : failed to build DIB section - reverting to slow blits

vncdesktop.cpp : enabled slow blits OK

vncdesktop.cpp : enabled fast DIBsection blits OK

vncdesktop.cpp : initialising desktop handler

vncdesktop.cpp : failed to start hook thread

vncdesktop.cpp : Set extended clipboard data

vncdesktop.cpp : Failed to set extended clipboard data

vncdesktop.cpp : SetBlankMonitor: monitor %s, using alpha %s

vncdesktop.cpp : Driver option is enabled

vncdesktop.cpp : Closing pending driver driver version

vncdesktop.cpp : Start Mirror driver

vncdesktop.cpp : Start Mirror driver Failed

vncdesktop.cpp : Using non driver mode

vncdesktop.cpp : Driver Used

vncdesktop.cpp : Shared memory mapped

vncdesktop.cpp : SethookMechanism called

vncdesktop.cpp : Sethook_restart_wanted hook=%d driver=%d

vncdesktop.cpp : Hookdll status changed

vncdesktop.cpp : Driver Status changed

\16bithlp.exe

vncdesktop.cpp : set ddihooks Failed

vncdesktop.cpp : set ddihooks OK

vncdesktopsink.cpp : ShutdownInitWindowthread

vncdesktopsink.cpp : ~vncDesktop::Tell initwindowthread to close

vncdesktopsink.cpp : ~vncDesktop::ERROR: messageloop blocked

vncdesktopsink.cpp : ~vncDesktop:: iniwindowthread proper closed

vncdesktopsink.cpp : initwindowthread already closed

vncdesktopsink.cpp : StartInitWindowthread

vncdesktopsink.cpp : StartInitWindowthread default desk

vncdesktopsink.cpp : ERROR: initwindowthread failed to start

vncdesktopsink.cpp : StartInitWindowthread started

vncdesktopsink.cpp : StartInitWindowthread reactivate

vncdesktopsink.cpp : StartInitWindowthread no default desk

vncdesktopsink.cpp : wmcreate

vncdesktopsink.cpp : set W8 hooks OK

vncdesktopsink.cpp : set SC hooks OK

vncdesktopsink.cpp : failed to set system hooks

vncdesktopsink.cpp : set hooks OK

vncdesktopsink.cpp : unset W8 hooks OK

vncdesktopsink.cpp : unset SC hooks OK

vncdesktopsink.cpp : Unsethooks Failed

vncdesktopsink.cpp : Unsethooks OK

vncdesktopsink.cpp : WM_DESTROY

vncdesktopsink.cpp : Monitor22 %i

vncdesktopsink.cpp : Monitor3 %i %i

vncdesktopsink.cpp : Monitor222 %i

vncdesktopsink.cpp : Power3 %i %i

vncdesktopsink.cpp : WM_DISPLAYCHANGE

vncdesktopsink.cpp : Resolution switch detected, driver active

vncdesktopsink.cpp : Resolution switch by driver activation removed

vncdesktopsink.cpp : Resolution switch detected, driver NOT active

vncdesktopsink.cpp : InitWindow called

vncdesktopsink.cpp : InitWindow:OpenInputdesktop Error

vncdesktopsink.cpp : InitWindow:OpenInputdesktop OK

vncdesktopsink.cpp : InitWindow:!GetUserObjectInformation

vncdesktopsink.cpp : InitWindow:SelectHDESK to %s (%x) from %x

vncdesktopsink.cpp : InitWindow:SelectHDESK:!SetThreadDesktop

vncdesktopsink.cpp : failed to register window class

vncdesktopsink.cpp : failed to create hook window

vncdesktopsink.cpp : OOOOOOOOOOOO load hookdll's

\vnchooks.dll

\schook.dll

\w8hook.dll

SetKeyboardFilterHook

vncdesktopsink.cpp : OOOOOOOOOOOO start dispatch

vncdesktopsink.cpp : OOOOOOOOOOOO %i %i

vncdesktopsink.cpp : OOOOOOOOOOOO called wm_quit

vncdesktopsink.cpp : OOOOOOOOOOOO called wm_user 4

vncdesktopsink.cpp : RFB_SCREEN_UPDATE

vncdesktopsink.cpp : REct3 %i %i %i %i

vncdesktopsink.cpp : RFB_MOUSE_UPDATE

vncdesktopsink.cpp : OOOOOOOOOOOO called wm_user 3

vncdesktopsink.cpp : OOOOOOOOOOOO end dispatch

vncDesktopSW.cpp : SWinit

vncDesktopSW.cpp : GetQuarterSize

UAC protected windows.

vncdesktopthread.cpp : threadHandle stop

vncdesktopthread.cpp : Wait for viewer init

vncdesktopthread.cpp : Screensize changed

vncdesktopthread.cpp : m_SWtoDesktop

vncdesktopthread.cpp : m_hookswitch

vncdesktopthread.cpp : desktop switch %i %i

vncdesktopthread.cpp : InputDesktopSelected

vncdesktopthread.cpp : m_desktop->Shutdown

vncdesktopthread.cpp : Shutdown KillAuthClients

vncdesktopthread.cpp : m_desktop->Startup

vncdesktopthread.cpp : Startup KillAuthClients

vncdesktopthread.cpp : m_videodriver == NULL

vncdesktopthread.cpp : threadHandle

vncdesktopthread.cpp : threadHandle2

vncdesktopthread.cpp : SCR: new screen format %dx%dx%d

vncdesktopthread.cpp : Size changed

vncdesktopthread.cpp : Request Monitor %d

vncdesktopthread.cpp : First two Monitor: width = %d height = %d

vncdesktopthread.cpp : Last two monitor: width = %d height = %d

vncdesktopthread.cpp : Monitor %d: width = %d height = %d

vncdesktopthread.cpp : ***********###############************ %i %i %i %i %i %i

vncdesktopthread.cpp : Format changed

vncdesktopthread.cpp : Hook changed 1

vncdesktopthread.cpp : Hook changed 2

vncdesktopthread.cpp : Hook changed

vncdesktopthread.cpp : quitting desktop server thread

vncdesktopthread.cpp : quitting desktop server thread:SetBlockInputState

vncdesktopthread.cpp : quitting desktop server thread:ClearShiftKeys

vncdesktopthread.cpp : quitting desktop server thread:g_DesktopThread_running=false

vncdesktopthread.cpp : quitting desktop server thread:m_desktop->Shutdown

getBgColour: bpp %d?

%s: unusual colour = %d

vncencoder.cpp : remote palette data requested

vncencoder.cpp : generating BGR233 palette data

vncencoder.cpp : generating 8-bit palette data

vncencoder.cpp : failed to obtain colour map data!

vncencoder.cpp : settranslatefunction called

vncencoder.cpp : only 8, 16 or 32 bits supported remotely - %d requested

vncencoder.cpp : only 8, 16 or 32 bits supported locally - %d in use

vncencoder.cpp : only 8-bit palette format supported remotely

vncencoder.cpp : only 8-bit palette format supported locally

vncencoder.cpp : no encoding required - both 8-bit palettized

vncencoder.cpp : local truecolour, remote palettized. using BGR233 palette

vncencoder.cpp : unknown local pixel format in use!

vncencoder.cpp : using 8-bit colourmap to truecolour translation

vncencoder.cpp : no translation required

vncencoder.cpp : single LUT used

vncencoder.cpp : triple LUT used

vncencoderCursor.cpp : cursor handle is NULL.

vncencoderCursor.cpp : GetIconInfo() failed.

vncencoderCursor.cpp : cursor bitmap handle is NULL.

vncencoderCursor.cpp : GetObject() for bitmap failed.

vncencoderCursor.cpp : incorrect data in cursor bitmap.

vncencoderCursor.cpp : GetBitmapBits() failed.

vncencoderCursor.cpp : vncDesktop::GetRichCursorData() failed.

vncEncodeTight.cpp : calling deflateInit2 with zlib level:%d

vncEncodeTight.cpp : deflateInit2 returned error:%d:%s

vncEncodeTight.cpp : calling deflateParams with zlib level:%d

vncEncodeTight.cpp : deflateParams returned error:%d:%s

vncEncodeTight.cpp : deflate() call failed.

vncEncodeUltra.cpp : Memory error

vncEncodeUltra.cpp : Ultra encoder stats: rawdata=%d protocol=%d compressed=%d transmitted=%d

vncEncodeUltra.cpp : Ultra encoder efficiency: %.3f%%

vncEncodeUltra.cpp : ********QUEUEQUEUE********** %d %d %d

vncEncodeZlib.cpp : Memory error

vncEncodeZlib.cpp : Zlib Xor encoder stats: rawdata=%d protocol=%d compressed=%d transmitted=%d

vncEncodeZlib.cpp : Zlib Xor encoder efficiency: %.3f%%

vncEncodeZlib.cpp : deflateInit2 returned error:%d:%s

vncEncodeZlib.cpp : deflate returned error:%d:%s

vncEncodeZlib.cpp : compression error

vncEncodeZlib.cpp : ********QUEUEQUEUE********** %d %d %d

vncEncodeZlibHex.cpp : Memory error

vncEncodeZlibHex.cpp : calling deflateInit2 with zlib level:%d

vncEncodeZlibHex.cpp : deflateInit2 returned error:%d:%s

vncEncodeZlibHex.cpp : deflate returned error:%d:%s

/FTPFRame$StrComp.class

/DH.class

/FTPFrame.class

/SessionRecorder.class

/RecordingFrame.class

/ButtonPanel.class

/VncViewer.class

/VncCanvas.class

/RfbProto.class

/OptionsFrame.class

/DesCipher.class

/ClipboardFrame.class

/AuthPanel.class

/VncViewer.jar

vnchttpconnect.cpp : started HTTP server thread

vnchttpconnect.cpp : HTTP client connected

vnchttpconnect.cpp : quitting HTTP server thread

GET %s

vnchttpconnect.cpp : file %s requested

vnchttpconnect.cpp : parameters read

vnchttpconnect.cpp : filename didn't begin with '/'

vnchttpconnect.cpp : sending main page

vnchttpconnect.cpp : sent page

vnchttpconnect.cpp : requested file recognised

vnchttpconnect.cpp : sending file...

vnchttpconnect.cpp : file successfully sent

fake %d down

fake %d up

Found dead key 0x%x '%c'

keysym 0x%x

************** DEAD KEY

Compose dead 0x%x 0x%x

Composed 0x%x

Found key

Simulating ALT %d%d%d

ignoring unrecognised Latin-1 keysym 0x%x

latin-1 key: keysym %d(0x%x) vkCode 0x%x down %d capslockOn %d

ignoring unknown keysym %d

taskmgr.exe

vnckeymap.cpp : setshiftstate %d - (%s->%s)

vnckeymap.cpp : new state %d (%s)

fh is %d

WinVNC.log

Error opening log file %s

error code 0xX

codec.cfg

WinVNC.AddClient.Message.Init

WinVNC.AddClient.Message

WinVNC.AddAutoClient.Message

WinVNC.AddStopClient.Message

WinVNC.AddStopAllClient.Message

WinVNC.AddRepeaterID.Message

WinVNC.TrayIconBalloon2.Message

UltraVNC.Viewer.FileTransferSendPacketMessage

dwmapi.dll

vncmenu.cpp : DisableAero %i

vncmenu.cpp : Reset %i

vncmenu.cpp : vncmenu(server)

wtsapi32.dll

icon1.ico

icon2.ico

vncmenu.cpp : vncmenu killed

vncmenu.cpp : ########### Shell_TrayWnd found %i

vncmenu.cpp : IP interface change detected %s %s

vncmenu.cpp : IsIconSet

vncmenu.cpp : Failed IsIconSet

vncmenu.cpp : vncMenu::Shutdown: Close menu - Disconnect all - Shutdown server

vncmenu.cpp : WM_TASKBARCREATED

vncmenu.cpp : ############## Kill vncMenu thread

vncmenu.cpp : Add client reconnect from timer

vncmenu.cpp : user name has changed

vncmenu.cpp : show default properties requested

vncmenu.cpp : show user properties requested

vncmenu.cpp : KillAuthClients() ID_KILLCLIENTS

vncmenu.cpp : KillAuthClients() ID_CLOSE

vncmenu.cpp : no submenu available

vncmenu.cpp : vncMenu WM_CLOSE call - All cleanup done

vncmenu.cpp : quitting from WM_DESTROY

vncmenu.cpp : SHUTDOWN OS detected

vncmenu.cpp : Session ID %i

vncmenu.cpp : WM_QUERYENDSESSION session!=0

vncmenu.cpp : WM_ENDSESSION

vncmenu.cpp : ############### Usernames change: old="%s", new="%s"

vncmenu.cpp : Warning: exception handling balloon message

Activeds.dll

netapi32.dll

radmin32.dll

\authSSP.dll

vncntlm.cpp : GetProcAddress

CheckUserPasswordSDUni result=%i

You selected ms-logon, but authSSP.dll

was not found.Check you installation

\authadmin.dll

authadmin.dll not found

\workgrpdomnt4.dll

workgrpdomnt4.dll not found

\ldapauth.dll

ldapauth.dll not found

\ldapauthnt4.dll

ldapauthnt4.dll not found

\ldapauth9x.dll

ldapauth9x.dll not found

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncpasswd.h : PASSWD : FromText called

c:\users\rudi\desktop\ultravnc_installer_other\ultravnc\ultravnc project root\ultravnc\winvnc\winvnc\vncpasswd.h : PASSWD : FromClear called

vncproperties.cpp : show per-user Properties

vncproperties.cpp : show default system Properties

vncproperties.cpp : dialog result = %d

vncproperties.cpp : warning - empty password

vncproperties.cpp : no password - QUITTING

vncproperties.cpp : INITDIALOG properties

View only and full password are the same

vncproperties.cpp : enddialog (OK)

vncproperties.cpp : enddialog (CANCEL)

NoPassword,

Password

Password2

vncproperties.cpp : ***** DBG - Entering Load

vncproperties.cpp : ***** DBG - User mode

vncproperties.cpp : ***** DBG - Service mode

vncproperties.cpp : ***** DBG - NO current user

vncproperties.cpp : ***** DBG - Force USER SYSTEM 1

vncproperties.cpp : ***** DBG - UserName = %s

vncproperties.cpp : ***** DBG - Machine level prefs

vncproperties.cpp : loading local-only settings

vncproperties.cpp : ***** DBG - Load User Preferences

vncproperties.cpp : clearing user settings

vncproperties.cpp : ***** DBG - Local Preferences - Default

vncproperties.cpp : loading DEFAULT local settings

vncproperties.cpp : ***** DBG - User Settings on

vncproperties.cpp : ***** DBG - LoadUser Preferences

vncproperties.cpp : loading "%s" local settings

vncproperties.cpp : ***** DBG - Override system settings with users settings

vncproperties.cpp : loading "%s" global settings

vncproperties.cpp : ***** DBG - User Settings off

vncproperties.cpp : bypassing user-specific settings (both local and global)

vncproperties.cpp : $$$$$$$$$$ ApplyUserPrefs - Plugin Enabled - Call SetDSMPlugin()

vncproperties.cpp : $$$$$$$$$$ ApplyUserPrefs - Plugin NOT enabled

vncproperties.cpp : saving current settings to registry

vncproperties.cpp : ***** DBG - Force USER SYSTEM 2

vncproperties.cpp : file %s not writable, error saving new settings

vncpropertiesPoll.cpp : show per-user Properties

vncpropertiesPoll.cpp : dialog result = %d

vncpropertiesPoll.cpp : Error while reading Window Name %d

vncpropertiesPoll.cpp : enddialog (OK)

vncpropertiesPoll.cpp : enddialog (CANCEL)

vncpropertiesPoll.cpp : Reset Reg

vncpropertiesPoll.cpp : clearing user settings

vncpropertiesPoll.cpp : loading DEFAULT local settings

vncpropertiesPoll.cpp : loading "%s" local settings

vncpropertiesPoll.cpp : loading "%s" global settings

vncpropertiesPoll.cpp : file %s not writable, error saving new settings

vncserver.cpp : shutting down server object1

vncserver.cpp : Waiting for desktop to shutdown

vncserver.cpp : ~server m_pDSMPlugin = NULL

vncserver.cpp : shutting down server object2

vncserver.cpp : ShutdownServer m_pDSMPlugin = NULL

vncserver.cpp : AddClient() started

vncserver.cpp : failed to initialise client object

vncserver.cpp : AddClient() done

vncserver.cpp : Desktop init failed, unlock in application mode ?

Remote user successfully connected (%s) and is currently sharing your desktop.

vncserver.cpp : Authenticated() done

vncserver.cpp : killing unauth client

vncserver.cpp : killing auth client

vncserver.cpp : KillClient() done

vncserver.cpp : Killing client named: %s

vncserver.cpp : KillClient() from name done

vncserver.cpp : Client %s is not Ultra. Doesn't know TextChat

vncserver.cpp : TextChat with client named: %s

vncserver.cpp : KillAuthClients() done

%s - %s

vncserver.cpp : KillUnauthClients() done

vncserver.cpp : removing unauthorised client

vncserver.cpp : removing authorised client

vncserver.cpp : deleting desktop server

vncserver.cpp : client disconnect - failed to logoff user!

vncserver.cpp : desktop deleted

vncserver.cpp : RemoveClient() done

vncserver.cpp : SockConnect %d

vncserver.cpp : trying port number %d

vncserver.cpp : SockConnect Done %d

vncserver.cpp : KillAuthClients() fix up a lock-up

\xdmcp\xdmcp.exe

vncserver.cpp : Failed rootdc

vncserver.cpp : authhosts cleared

vncserver.cpp : authhosts set to "%s"

vncserver.cpp : client %s rejected due to blacklist entry

vncserver.cpp : verify failed - null hostname

vncserver.cpp : verify host - malformed AuthHosts string

vncserver.cpp : verify host - pattern processing failed!

vncserver.cpp : client %s verifiedHost %u prior to adjustment

vncserver.cpp : client %s verifiedHost %u after adjustment

vncserver.cpp : Unable to set new desktop size

vncserver.cpp : $$$$$$$$$$ SetDSMPlugin - Entry

vncserver.cpp : $$$$$$$$$$ SetDSMPlugin - Enabled

vncserver.cpp : $$$$$$$$$$ SetDSMPlugin - Is Loaded

vncserver.cpp : $$$$$$$$$$ SetDSMPlugin - FORCE RELOADING OF THE PLUGIN

vncserver.cpp : $$$$$$$$$$ SetDSMPlugin - New one - Unload the current

vncserver.cpp : $$$$$$$$$$ SetDSMPlugin - Plugin NOT loaded - Try to load it

vncserver.cpp : $$$$$$$$$$ DSMPlugin cannot be loaded

vncserver.cpp : $$$$$$$$$$ SetDSMPlugin - Plugin successfully loaded

vncserver.cpp : $$$$$$$$$$ SetDSMPlugin - Init plugin call

VNCPasswordNeeded

NoPassword

vncserver.cpp : $$$$$$$$$$ SetDSMPlugin - SetPluginParams call

vncserver.cpp : DSMPlugin Params OK

vncserver.cpp : Unable to set DSMPlugin Params

vncserver.cpp : Unable to init DSMPlugin

vncserver.cpp : AutoConnectRetry(): started

vncserver.cpp : Attempting AutoReconnect....

explorer.exe

vncservice.cpp : @@@@@@@@@@@@@ GetCurrentUser - ERROR : No window station

vncservice.cpp : @@@@@@@@@@@@@ GetCurrentUser - Error: Usersize 0

vncservice.cpp : @@@@@@@@@@@@@ GetCurrentUser - Error: NOT impersonating user

vncservice.cpp : @@@@@@@@@@@@@ GetCurrentUser - Error: No user logged on

vncservice.cpp : getusername error %d

vncservice.cpp : @@@@@@@@@@@@@ GetCurrentUser - UserNAme found: %s

vncservice.cpp : @@@@@@@@@@@@@ GetCurrentUser - Error: Unknown OS

vncservice.cpp : !GetUserObjectInformation

vncservice.cpp : SelectHDESK to %s (%x) from %x

vncservice.cpp : SelectHDESK:!SetThreadDesktop

vncservice.cpp : SelectDesktop

vncservice.cpp : OpenInputdesktop2 named

vncservice.cpp : OpenInputdesktop2 NULL

vncservice.cpp : OpenInputdesktop2

vncservice.cpp : OpenInputdesktop2 OK

vncservice.cpp : SelectDesktop failed to close desktop

vncservice.cpp : OpenInputDesktop %i I

vncservice.cpp : OpenInputDesktop II

vncservice.cpp : failed to close input desktop

vncservice.cpp : !GetUserObjectInformation(threaddesktop

vncservice.cpp : !GetUserObjectInformation(inputdesktop

vncservice.cpp : threadname, inputname differ

vncservice.cpp : failed to select logon desktop

vncservice.cpp : generating ctrl-alt-del

vncservice.cpp : preparing to generate ctrl-alt-del

vncservice.cpp : spawn ctrl-alt-del thread...

vncservice.cpp : unable to lock workstation - not NT

vncservice.cpp : locking workstation

vncservice.cpp : unable to load User32 DLL (%u)

vncservice.cpp : unable to locate LockWorkStation - requires Windows 2000 or above (%u)

vncservice.cpp : call to LockWorkstation failed

vncservice.cpp : PostAddNewClient failed

vncsockconnect.cpp : started socket connection thread

vncsockconnect.cpp : accepted connection from %s

vncsockconnect.cpp : quitting socket connection thread

vsocket.cpp : VSocket() m_pDSMPlugin = NULL

Iphlpapi.dll

GetPerTcpConnectionEStats

SetPerTcpConnectionEStats

vsocket.cpp : closing socket

vsocket.cpp : shutdown socket

vsocket.cpp : WriteExact: DSMPlugin-RestoreBuffer Alloc Error

vsocket.cpp : zero bytes read1

vsocket.cpp : socket error 1: %d

vsocket.cpp : zero bytes read2

vsocket.cpp : zero bytes read3

vsocket.cpp : HTTP socket error: %d

vnclang_server.dll

winvnc.cpp : test... %s %d

winvnc.cpp : PostAddNewClient III

winvnc.cpp : PostAddNewClient IIII

winvnc.cpp : PostAddNewRepeaterClient I

winvnc.cpp : OpenInputdesktop Error

winvnc.cpp : OpenInputdesktop OK

winvnc.cpp : !GetUserObjectInformation

winvnc.cpp : SelectHDESK to %s (%x) from %x

winvnc.cpp : SelectHDESK:!SetThreadDesktop

winvnc.cpp : getusername error %d

winvnc.cpp : Username %s

winvnc.cpp : failed to create tray menu

winvnc.cpp : PostAddNewClient IIIII

winvnc.cpp : PostAddNewRepeaterClient II

winvnc.cpp : ****************** WaitForSingleObject - Shutdown server

winvnc.cpp : ****************** Init SDTimer

winvnc.cpp : ****************** Kill SDTimer

winvnc.cpp : ***** DBG - WinVNCAPPMain

winvnc.cpp : %s -- exiting

winvnc.cpp : server created ok

winvnc.cpp : ***************** SDEvent created

winvnc.cpp : ################## Closing Imp Thread

winvnc.cpp : ################## SHUTING DOWN SERVER ####################

Enter password for:

Password incorrect--reenter:

%sEmpty zipfile.

warning: cannot set time for %s

[ %s ]

warning (%d): could not set file attributes

CreateFile() error %d when trying set file time

SetFileTime failed: %d

warning: CreateFile() error %d (set file times for %s)

warning: SetFileTime() for %s error %d

warning: skipped "../" path component(s) in %s

warning (%d): could not set file attributes for %s

mapname: conversion of %s failed

labelling %s %-22s

checkdir error: path too long: %s

checkdir error: cannot create %s

unable to process %s.

checkdir error: %s exists but is not directory

-> %s

checkdir: cannot create extraction directory: %s

Skipping %s

XABKEY

%u.%u

.r.-... %u.%u

%s %s %8lu

=%%

%s %s

Unable to allocate memory in zip library at %s

wiz.exe

Verify password:

Enter password:

zip error: %s (%s)

attempting to restore %s to its previous state

zip warning: %s%s

.Z:.zip:.zoo:.arc:.lzh:.arj

was getting encryption password

zero length password not allowed

was verifying encryption password

password verification failed

mm not supported

no such option: %c

M----

--M

-M not supported, use -MM for Must Match

zip diagnostic: %s %s

freshening: %s

updating: %s

was zipping %s

was copying %s

deleting: %s

User terminated operation

adding: %s

Enter comment for %s:

total bytes=%lu, compressed=%lu -> %d%% savings

excluding %s

replace: can't open %s

made by version %d.%d on system type %d:

needs unzip %d.%d on system type %d:

local flags = 0xx, central = 0xx:

undefined bits used in flags = 0xx:

unknown compression method %u:

starts on disk %u:

unknown internal attributes = 0xx:

zip info: %s%s

zip info: %s has %ld bytes of %sextra data

zip: reading %s

compressed size %ld, actual size %ld for %s

zip warning: %s %s truncated.

%s: adjusting offsets for a preamble of %lu bytes

offset %u--local = x, central = x

%s: %s a preamble of %lu bytes

zip diagnostic: deleting file %s

deleting directory %s (if empty)

zip diagnostic: %scluding %s

zip -0 not supported for I/O on pipes or devices

(deflated %d%%)

C:\Users\rudi\Desktop\UltraVNC_INSTALLER_OTHER\ultravnc\UltraVNC Project Root\UltraVNC\winvnc\Release\winvnc.pdb

WS2_32.dll

WINMM.dll

VERSION.dll

USERENV.dll

WinExec

WaitNamedPipeW

SetProcessShutdownParameters

KERNEL32.dll

ExitWindowsEx

GetKeyState

keybd_event

GetKeyboardState

EnumWindows

EnumDesktopWindows

VkKeyScanA

MapVirtualKeyA

GetAsyncKeyState

USER32.dll

GDI32.dll

RegOpenKeyExA

RegCloseKey

RegDeleteKeyA

RegCreateKeyExA

RegCreateKeyA

ADVAPI32.dll

ShellExecuteA

ShellExecuteExA

SHFileOperationA

SHELL32.dll

ole32.dll

IMM32.dll

GetProcessHeap

GetCPInfo

PeekNamedPipe

:;,= "[]|

%ld%c

Bogus message code %d

Invalid component ID %d in SOS

IDCT output block size %d not supported

Wrong JPEG library version: library is %d, caller expects %d

Invalid memory pool code %d

Unsupported JPEG data precision %d

Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d

Invalid progressive parameters at scan script entry %d

Invalid scan script at entry %d

Improper call to JPEG library in state %d

JPEG parameter struct mismatch: library thinks size is %u, caller expects %u

Buffer passed to JPEG library is too small

Too many color components: %d, max %d

Unsupported color conversion request

Bogus DAC index %d

Bogus DAC value 0x%x

Bogus DHT index %d

Bogus DQT index %d

Empty JPEG image (DNL not supported)

Maximum supported image dimension is %u pixels

Cannot transcode due to multiple use of quantization table %d

Backing store not supported

Huffman table 0xx was not defined

Quantization table 0xx was not defined

Not a JPEG file: starts with 0xx 0xx

Insufficient memory (case %d)

Cannot quantize more than %d color components

Cannot quantize to fewer than %d colors

Cannot quantize to more than %d colors

Unsupported JPEG process: SOF type 0xx

Failed to create temporary file %s

Unsupported marker type 0xx

Unknown APP0 marker (not JFIF), length %u

Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d

Unknown APP14 marker (not Adobe), length %u

Define Arithmetic Table 0xx: 0xx

Define Huffman Table 0xx

Define Quantization Table %d precision %d

Define Restart Interval %u

Freed EMS handle %u

Obtained EMS handle %u

= = = = = = = =

JFIF APP0 marker: version %d.d, density %dx%d %d

Warning: thumbnail image size does not match data length %u

JFIF extension marker: type 0xx, length %u

with %d x %d thumbnail image

Miscellaneous marker 0xx, length %u

Unexpected marker 0xx

%4u %4u %4u %4u %4u %4u %4u %4u

Quantizing to %d = %d*%d*%d colors

Quantizing to %d colors

Selected %d colors for quantization

At marker 0xx, recovery action %d

RST%d

Smoothing not supported with nonstandard sampling ratios

Start Of Frame 0xx: width=%u, height=%u, components=%d

Component %d: %dhx%dv q=%d

Start Of Scan: %d components

Component %d: dc=%d ac=%d

Ss=%d, Se=%d, Ah=%d, Al=%d

Closed temporary file %s

Opened temporary file %s

JFIF extension marker: palette thumbnail image, length %u

JFIF extension marker: JPEG-compressed thumbnail image, length %u

JFIF extension marker: RGB thumbnail image, length %u

Unrecognized component IDs %d %d %d, assuming YCbCr

Freed XMS handle %u

Obtained XMS handle %u

Unknown Adobe color transform code %d

Corrupt JPEG data: %u extraneous bytes before marker 0xx

Inconsistent progression sequence for component %d coefficient %d

Warning: unknown JFIF revision number %d.d

Corrupt JPEG data: found marker 0xx instead of RST%d

;3 #>6.&

'2, / 0&7!4-)1#

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Tavsegitseg_Temp_Files\WinVNC.log

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Tavsegitseg_Temp_Files

.?AVvncHTTPConnectThread@@

.?AVvncHTTPConnect@@

.?AVvncTimedMsgBoxThread@@

zcÃ

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Tavsegitseg_Temp_Files\TavsegitsegServer.exe

192.168.11.129

elso.vitarex.hu

It presumably does not support TextChat

You selected ms-logon, but the auth.dll

WARNING : Running WinVNC without setting a password is a dangerous security risk!

Until you set a password, WinVNC will not accept incoming connections.

Unable to load the Rich Edit (RICHED32.DLL) control!

You selected ms-logon, but the authad.dll

WARNING : This machine has no default password set. WinVNC will present the Default Properties dialog now to allow one to be entered.

Chat with - UltraVNC

No password has been set & this machine has been preconfigured to prevent users from setting their own.

META-INF/MANIFEST.MFu

META-INF/_51B5489.SFu

META-INF/_51B5489.RSA

~Ã‡"

AuthPanel.class}V[\

ButtonPanel.classuV]p

ClipboardFrame.class

DesCipher.class

D\%D$

DH.classmV

FTPFrame$StrComp.classeQ

FTPFrame.class

$[KeY

OptionsFrame.class

~.rER

RecordingFrame.class

<.vf>

RfbProto.class

.PiVB\

SessionRecorder.class

VncCanvas.class

Qu0%C

Voq'%f

VncViewer.class

D.Ll1

META-INF/MANIFEST.MFPK

META-INF/_51B5489.SFPK

META-INF/_51B5489.RSAPK

AuthPanel.classPK

ButtonPanel.classPK

ClipboardFrame.classPK

DesCipher.classPK

DH.classPK

FTPFrame$StrComp.classPK

FTPFrame.classPK

OptionsFrame.classPK

RecordingFrame.classPK

RfbProto.classPK

SessionRecorder.classPK

VncCanvas.classPK

VncViewer.classPK

.TGUej[

^.Zua

,du.bSq

l%csU

RecordingFrame.java

user.dir

file.separator

vncsession.fbs

SessionRecorder.java

password

moveFocusToPasswordField

AuthPanel.java

Password:

ClipboardFrame.java

OptionsFrame.java

versionMsg

KeyboardEvent

sz_rfbFileTransferMsg

rfbRErrorUnknownCmd

rfbRErrorCmd

port

brokenKeyPressed

readVersionMsg

writeVersionMsg

readRfbFileTransferMsg

writeRfbFileTransferMsg

"writeRfbFileTransferMsgForSendFile

readFTPMsgDriveList

readFTPMsgDirectoryList

readFTPMsgDirectoryListContent

!readFTPMsgDirectoryListEndContent

readFTPMsgDirectorydriveNotReady

writeKeyEvent

(Ljava/awt/event/KeyEvent;)V

writeModifierKeyEvents

RfbProto.java

PORT:

REPEATERPORT:

port

LFTPFrame;

FTPFrame

java/awt/event/KeyEvent

getKeyChar

getKeyCode

isActionKey

keyPressed

keyReleased

keyTyped

processLocalKeyEvent

VncCanvas.java

java/awt/event/KeyListener

addKeyListener

(Ljava/awt/event/KeyListener;)V

repeaterPort

passwordParam

encPasswordParam

VncViewer.java

%RFB server supports protocol version

cThe current authentication method does not transfer your password securely.Do you want to continue?

, key=

PORT

PORT PARAM :

REPEATERPORT

REPEATERPORT PARAM :

ENCPASSWORD

PASSWORD

createInterKey

createEncryptionKey

()Ljava/net/URL;

java/net/URL

ftpButton

ButtonPanel.java

encryptKeys

decryptKeys

setKey

deskey

cookey

DesCipher.java

FTPFrame.java

FTPFrame$StrComp

setDefaultCloseOperation

(LFTPFrame;)V

setViewportView

DH_KEY

createKeys

DH.java

interKey too large

! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! !

*** --,

00---,---...431

00/000111221##

1%%&%%&

33#((( (

!z{{zz{{P. .Pz

2244444422

vw%u!'yu

''&(''&(''&(''&(''&(''&(''&(''&(''&(''&(''&(''&(''&(''&(''&"$$$

(-55577555-(

&'((&'((&'((&'((&'((&'((&'((&'((&'((&'((&'((&'((&'((&'((&''"#$%

1$2.2_2|2

4L4

;';4;@;\

0 121]1~1

6:6@6\6}6

9â€”9f9y9

1 2/2k2v2{2

0 0$0(0,0004080

2'2-2B2U2q2w2}2

0'1-1B1d1l1}1

?%?-?5?=?

;

: :(:0:8:@:

4$4(4,4044484

5(5/54585

5&6,6064686

9%9X9

>|>6???

5 6,6064686

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

\winsta.dll

\\.\Pipe\TerminalServer\SystemExecSrvr\%d

(&) 0,5-?.1

"'#,$1%

Poll Console Windows Only

UltraVNC Win32 Server 1.1.9.3

Display Number or Ports to use:

Ports

Http:

Enable JavaViewer (Http Connect)

Keyboard && Mouse

Alternate keyboard method

VNC Password:

View-Only Password:

Require MS Logon (User/Pass./Domain)

New MS Logon (supports multiple domains)

Log debug infos to the WinVNC.log file

This machine has been preconfigured with WinVNC settings, which cannot be overridden by individual users. The preconfigured settings may be modified only by a System Administrator.DThe WinVNC settings for the current user are unavailable at present.PYou do not have sufficient priviliges to edit the default local WinVNC settings.

Until you set a password, WinVNC will not accept incoming connections.9The Plugin cannot be loaded.

WVNCNYou selected ms-logon, but the authad.dll

WARNINGLYou selected ms-logon, but the auth.dll

was not found.Check you installationevncDesktop : root device doesn't support BitBlt

WinVNC cannot be used with this graphic device driverkvncDesktop : memory device doesn't support GetDIBits

Unable to process MS logon4Unable to load the Rich Edit (RICHED32.DLL) control!

AutoAccept:%u Ctrl-alt-del require service, no permission;The file cad.exe was not found in the same folder as winvncsPermission denied on cad.exe, UltraVNC must be installed in "program files" else special cad permission is refused.

1.1.9.3

WinVNC.exe