Trojan.Win32.Swrort.3.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 66f786d36aa126cbaa9eadae5821e993
SHA1: dfb0bf7c515cd05c1120ed25579db3e8f69f9fe9
SHA256: c809e80ed2a0e9b79fd5796cfa4c5a7fa65c2712007814b6671639f00dbb19fa
SSDeep: 3072:fM1BjoYNXoKDIJBXJP7b7abWsqfW9X25rplo6sOvuP4hc1HGr M9pj8uZtM8/Tjh:fMMYNXqBB7bsdrmlopP4hc1HGr ej8iP
Size: 172478 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Xacti, LLC
Created at: 2014-10-07 07:40:10
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
WebProtectorPlus.exe:644
f4.exe:428
f1.exe:1340
%original file name%.exe:316
wmic.exe:1852
LiveUpdateWPP.exe:928
LiveUpdateWPP.exe:312
schtasks.exe:1076
schtasks.exe:1072
f5.exe:1312
find.exe:1800
The Trojan injects its code into the following process(es):
ntvdm.exe:640
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process WebProtectorPlus.exe:644 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Program Files%\WebProtectorPlus\SetupComponents.exe (177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pin[1].gif (34 bytes)
The process f4.exe:428 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\ns6.tmp (6 bytes)
%Program Files%\LiveUpdateWPP\LiveUpdateWPP.exe (11656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\System.dll (11 bytes)
%Program Files%\LiveUpdateWPP\LiveUpdateWPP_uninstaller.exe (4164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\ns7.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\safed.dll (4092 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsi4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\ns6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\ns7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\safed.dll (0 bytes)
The process f1.exe:1340 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Program Files%\WebProtector\ToolbarData.ini (847 bytes)
%Program Files%\WebProtector\WebProtector.dll (3073 bytes)
%Program Files%\WebProtector\webprotector_uninstaller.exe (1279 bytes)
%Program Files%\WebProtector\WebProtector_new.dll (9765 bytes)
%Program Files%\WebProtector\hotbtn.ico (1 bytes)
%Program Files%\WebProtector\btn.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nstE.tmp\System.dll (11 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nstE.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nstE.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsdD.tmp (0 bytes)
The process ntvdm.exe:640 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\ (4 bytes)
%WinDir%\Temp\scs11.tmp (10145 bytes)
%System%\wbem\Logs (4 bytes)
%Documents and Settings%\%current user%\FAVORITES (4 bytes)
%WinDir%\Temp\scs10.tmp (33880 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (4 bytes)
%Program Files%\Internet Explorer (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (4 bytes)
%Program Files%\WebProtectorPlus (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (676 bytes)
%System%\wbem\Repository\FS (4 bytes)
%Documents and Settings%\%current user%\Local Settings (4 bytes)
%Program Files%\WebProtector (4 bytes)
%Documents and Settings%\All Users (4 bytes)
%WinDir% (480 bytes)
C:\$Directory (1284 bytes)
%System% (5152 bytes)
%WinDir%\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pin[1].gif (4 bytes)
%WinDir%\Prefetch\IEXPLORE.EXE-27122324.pf (1072 bytes)
C:\PROGRAM FILES (8 bytes)
%Documents and Settings%\All Users\Documents (4 bytes)
%Documents and Settings%\%current user%\My Documents (4 bytes)
%Documents and Settings%\%current user%\APPLICATION DATA (4 bytes)
%System%\config (8 bytes)
%System%\wbem (864 bytes)
%Documents and Settings%\All Users\Start Menu (4 bytes)
%WinDir%\Temp\Perflib_Perfdata_678.dat (4 bytes)
%Documents and Settings%\%current user% (4 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (4 bytes)
%Program Files%\Common Files\Adobe\Acrobat\ActiveX (4 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (4 bytes)
%Documents and Settings%\All Users\Start Menu\Programs (4 bytes)
%Documents and Settings%\%current user%\Cookies (96 bytes)
The Trojan deletes the following file(s):
%WinDir%\Temp\scs10.tmp (0 bytes)
%WinDir%\Temp\scs11.tmp (0 bytes)
The process %original file name%.exe:316 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc8.tmp (156 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\f4.exe (46772 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\nsProcess.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\f5.exe (33956 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\Fpc2F4x.dll (5621 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sprF.tmp (34 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\f1.exe (37172 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\spr3.tmp (34 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\f1.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\f4.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\nsProcess.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\f5.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\Fpc2F4x.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sprF.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\spr3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsk1.tmp (0 bytes)
The process wmic.exe:1852 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Program Files%\WebProtectorPlus\TempWmicBatchFile.bat (0 bytes)
The process f5.exe:1312 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Program Files%\WebProtectorPlus\Setup32.bat (457 bytes)
%Program Files%\WebProtectorPlus\uninstall.exe (877 bytes)
%Program Files%\WebProtectorPlus\SetupVista32.bat (449 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB.tmp\nsC.tmp (6 bytes)
%Program Files%\WebProtectorPlus\SetupOld32.bat (429 bytes)
%Program Files%\WebProtectorPlus\Setup64.bat (466 bytes)
%Program Files%\WebProtectorPlus\SetupVista64.bat (458 bytes)
%Program Files%\WebProtectorPlus\uninst.bat (135 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Web Protector Plus\Uninstall.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nssA.tmp (12336 bytes)
%Program Files%\WebProtectorPlus\SetupOld64.bat (438 bytes)
%Program Files%\WebProtectorPlus\WebProtectorPlus.exe (9320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB.tmp\System.dll (11 bytes)
%Program Files%\WebProtectorPlus\verdata (16 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB.tmp\nsC.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc9.tmp (0 bytes)
Registry activity
The process WebProtectorPlus.exe:644 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\WebProtectorPlus]
"SetupComponents.exe" = "SetupComponents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\WebProtectorPlus\Notify]
"iData" = "1446831959"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7C 9C 60 1B AD FF 16 F0 DB DB B8 0F 85 EF B9 6F"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process f4.exe:428 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "48 11 B3 FC AC 58 09 D2 B6 84 20 BF B3 8B 9F 90"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\LiveUpdateWPP\LiveUpdateWPP]
"urls" = "3Kbcuty63L7cvd203aHdodyj3K/cqtyv3Kncr9y93K3cr9y83Krcodyj3K/cp9yg3aDcrdyh3KPdody93KvcvNy43aDcvtym3L4="
"ID" = "{9797C852-D94F-40EA-8E5F-7345C207D60A}"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LiveUpdateWPP]
"Publisher" = "Anti-phishing database updater for Web Protector Plus. This service keeps your computer updated with the newest database of known Internet threats."
[HKLM\SOFTWARE\LiveUpdateWPP\LiveUpdateWPP]
"lcid" = "10"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\LiveUpdateWPP\LiveUpdateWPP]
"last" = "0"
"IDIR" = "%Program Files%\LiveUpdateWPP"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\LiveUpdateWPP\LiveUpdateWPP]
"inter" = "43200"
"Src" = "9804"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LiveUpdateWPP]
"DisplayName" = "LiveUpdateWPP"
"UninstallString" = "%Program Files%\LiveUpdateWPP\LiveUpdateWPP_uninstaller.exe"
The process f1.exe:1340 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"Icon" = "%Program Files%\WebProtector\btn.ico"
[HKCR\TypeLib\{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}\1.0\FLAGS]
"(Default)" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"DisplayName" = "WebProtect IE"
[HKCR\Interface\{3050F25E-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"Version" = "1.0"
[HKCR\Interface\{3050F3EE-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"Version" = "1.0"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"Default Visible" = "yes"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\UrlSearchHooks]
"(Default)" = "{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}"
[HKCR\TypeLib\{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}\1.0]
"(Default)" = "sf_tblib"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}]
"(Default)" = "WebProtector"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"NoRepair" = "1"
[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\Instance]
"(Default)" = ""
[HKLM\SOFTWARE\WebProtector]
"Path" = "%Program Files%\WebProtector"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"ClsidExtension" = "{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}"
[HKCR\TypeLib\{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}\1.0\HELPDIR]
"(Default)" = "%Program Files%\WebProtector"
[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"ButtonText" = "Web Protector"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"URLInfoAbout" = "http://web-protector.net"
"DisplayIcon" = "%Program Files%\WebProtector\webprotector_uninstaller.exe"
"Publisher" = "WebProtector"
"UninstallString" = "%Program Files%\WebProtector\webprotector_uninstaller.exe"
[HKCR\Interface\{3050F1FF-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"(Default)" = "{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"HotIcon" = "%Program Files%\WebProtector\hotbtn.ico"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"DisplayVersion" = "4.2.0.2645"
[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\ProgID]
"(Default)" = "WebProtector.toolbar.1"
[HKCR\Interface\{3050F1FF-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"Version" = "1.0"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"CLSID" = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\UrlSearchHooks]
"{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}" = ""
[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\TypeLib]
"(Default)" = "{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}"
[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}]
"(Default)" = "IToolbarMainBrowser"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}" = "Web Protector Toolbar"
[HKCR\Interface\{3050F25E-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"(Default)" = "{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}"
[HKCR\Interface\{3050F3EE-98B5-11CF-BB82-00AA00BDCE0B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3B C4 83 49 35 A7 93 B3 31 3E D5 85 F3 46 68 99"
[HKCR\TypeLib\{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}\1.0\0\win32]
"(Default)" = "%Program Files%\WebProtector\WebProtector.dll"
[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\VersionIndependentProgID]
"(Default)" = "WebProtector.toolbar"
[HKCR\Interface\{3050F3EE-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"(Default)" = "{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}"
[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\TypeLib]
"Version" = "1.0"
[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\InprocServer32]
"(Default)" = "%Program Files%\WebProtector\WebProtector.dll"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"NoModify" = "1"
[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\Instance\InitPropertyBag]
"URL" = "about:blank"
The Trojan deletes the following registry key(s):
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
The process %original file name%.exe:316 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "ED 92 8B 8D ED 8A C1 92 58 53 F7 0C AB B8 0C F8"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa2.tmp\nsProcess.dll,"
[HKLM\SOFTWARE\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko]
"update_url" = "http://clients2.google.com/service/update2/crx"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko]
"update_url" = "http://clients2.google.com/service/update2/crx"
[HKLM\SOFTWARE\WebProtectorPlus]
"SID" = "OTgwNA=="
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\WebProtectorPlus]
"Gid" = "40008F10-885F-465A-A235-D4AB1F3555A7"
The process wmic.exe:1852 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F1 EE A6 C1 BF E2 F0 06 0D C8 FC 7B 75 F2 8C 6B"
The process LiveUpdateWPP.exe:928 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3C C6 D8 A4 6F F3 27 B2 45 6D 79 D9 0F 9B 78 67"
The process LiveUpdateWPP.exe:312 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7B D2 20 3D CB 23 B6 29 0F 28 49 49 4A 6D 30 AB"
The process schtasks.exe:1076 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AA 2C 4D 4C 1E 7D 0C 6B 82 09 78 91 1C 08 E5 F2"
The process schtasks.exe:1072 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "66 F5 55 CE D5 12 EC 20 49 4A 30 0B 2C 19 F7 0A"
The process f5.exe:1312 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtectorPlus]
"DisplayName" = "Web Protector Plus (uninstall only)"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtectorPlus]
"UninstallString" = "%Program Files%\WebProtectorPlus\uninstall.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E2 D7 1A 4A 08 CC 0B F0 C7 C0 84 9D E9 31 D4 0F"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\WebProtectorPlus\Uninst]
"Install_Dir" = "%Program Files%\WebProtectorPlus"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Web Protector Plus Agent" = "%Program Files%\WebProtectorPlus\WebProtectorPlus.exe"
The process find.exe:1800 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BF 8C 3D 08 9C 7D 5F 5B 1C 10 B2 E1 C8 EF B3 D0"
Dropped PE files
MD5 | File path |
---|---|
05450face243b3a7472407b999b03a72 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsa2.tmp\nsProcess.dll |
b3d29c207eff7bc122d334b7a138f30f | c:\Program Files\LiveUpdateWPP\LiveUpdateWPP.exe |
dbb70815d2fa1a03d0cc7222383ee36f | c:\Program Files\LiveUpdateWPP\LiveUpdateWPP_uninstaller.exe |
935bf11b38f5c90c69fff0730d716ac7 | c:\Program Files\WebProtectorPlus\WebProtectorPlus.exe |
8e3ce468b29c2e5419c24e4e1c060438 | c:\Program Files\WebProtectorPlus\uninstall.exe |
9f3d46fff506a4878d3ced167ffc84b3 | c:\Program Files\WebProtector\WebProtector.dll |
9f3d46fff506a4878d3ced167ffc84b3 | c:\Program Files\WebProtector\WebProtector_new.dll |
c2c4b5ce6c49484a1d5a05ba642a3b12 | c:\Program Files\WebProtector\webprotector_uninstaller.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
WebProtectorPlus.exe:644
f4.exe:428
f1.exe:1340
%original file name%.exe:316
wmic.exe:1852
LiveUpdateWPP.exe:928
LiveUpdateWPP.exe:312
schtasks.exe:1076
schtasks.exe:1072
f5.exe:1312
find.exe:1800 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Program Files%\WebProtectorPlus\SetupComponents.exe (177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pin[1].gif (34 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\ns6.tmp (6 bytes)
%Program Files%\LiveUpdateWPP\LiveUpdateWPP.exe (11656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\System.dll (11 bytes)
%Program Files%\LiveUpdateWPP\LiveUpdateWPP_uninstaller.exe (4164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\ns7.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp\safed.dll (4092 bytes)
%Program Files%\WebProtector\ToolbarData.ini (847 bytes)
%Program Files%\WebProtector\WebProtector.dll (3073 bytes)
%Program Files%\WebProtector\webprotector_uninstaller.exe (1279 bytes)
%Program Files%\WebProtector\WebProtector_new.dll (9765 bytes)
%Program Files%\WebProtector\hotbtn.ico (1 bytes)
%Program Files%\WebProtector\btn.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nstE.tmp\System.dll (11 bytes)
%WinDir%\Temp\scs11.tmp (10145 bytes)
%System%\wbem\Logs (4 bytes)
%Documents and Settings%\%current user%\FAVORITES (4 bytes)
%WinDir%\Temp\scs10.tmp (33880 bytes)
%Program Files%\Internet Explorer (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (676 bytes)
%System%\wbem\Repository\FS (4 bytes)
%Documents and Settings%\All Users (4 bytes)
C:\$Directory (1284 bytes)
%WinDir%\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773 (4 bytes)
%WinDir%\Prefetch\IEXPLORE.EXE-27122324.pf (1072 bytes)
C:\PROGRAM FILES (8 bytes)
%Documents and Settings%\All Users\Documents (4 bytes)
%Documents and Settings%\%current user%\My Documents (4 bytes)
%Documents and Settings%\%current user%\APPLICATION DATA (4 bytes)
%System%\config (8 bytes)
%Documents and Settings%\All Users\Start Menu (4 bytes)
%WinDir%\Temp\Perflib_Perfdata_678.dat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (4 bytes)
%Program Files%\Common Files\Adobe\Acrobat\ActiveX (4 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (4 bytes)
%Documents and Settings%\All Users\Start Menu\Programs (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc8.tmp (156 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\f4.exe (46772 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\nsProcess.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\f5.exe (33956 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\Fpc2F4x.dll (5621 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sprF.tmp (34 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\f1.exe (37172 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\spr3.tmp (34 bytes)
%Program Files%\WebProtectorPlus\TempWmicBatchFile.bat (0 bytes)
%Program Files%\WebProtectorPlus\Setup32.bat (457 bytes)
%Program Files%\WebProtectorPlus\uninstall.exe (877 bytes)
%Program Files%\WebProtectorPlus\SetupVista32.bat (449 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB.tmp\nsC.tmp (6 bytes)
%Program Files%\WebProtectorPlus\SetupOld32.bat (429 bytes)
%Program Files%\WebProtectorPlus\Setup64.bat (466 bytes)
%Program Files%\WebProtectorPlus\SetupVista64.bat (458 bytes)
%Program Files%\WebProtectorPlus\uninst.bat (135 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Web Protector Plus\Uninstall.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nssA.tmp (12336 bytes)
%Program Files%\WebProtectorPlus\SetupOld64.bat (438 bytes)
%Program Files%\WebProtectorPlus\WebProtectorPlus.exe (9320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxB.tmp\System.dll (11 bytes)
%Program Files%\WebProtectorPlus\verdata (16 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Web Protector Plus Agent" = "%Program Files%\WebProtectorPlus\WebProtectorPlus.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: wprotectplusin4.2.0.1924
Product Name: mwprotectplusin4.2.0.1924p
Product Version: 4.2.0.1924
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 4.2.0.1924
File Description:
Comments:
Language: Language Neutral
Company Name: wprotectplusin4.2.0.1924Product Name: mwprotectplusin4.2.0.1924pProduct Version: 4.2.0.1924Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 4.2.0.1924File Description: Comments: Language: Language Neutral
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 23164 | 23552 | 4.45156 | 71ecbec9470d0e846ce5d68f3bbdbddf |
.rdata | 28672 | 4558 | 4608 | 3.62903 | 640f709ec19b4ed0455a4c64e5934d5e |
.data | 36864 | 108504 | 1024 | 3.4406 | bc7151fcf37fc84430446d29785eaf5d |
.ndata | 147456 | 53248 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.rsrc | 200704 | 3008 | 3072 | 2.86482 | 2b9a898f2d25642ceb0b889adc2c15cb |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 2
777a1efb6dde482d64e6724bffa444b2
1335a16c91bc63153524ffa5ffaa6103
Network Activity
URLs
URL | IP |
---|---|
hxxp://stat.webprotectionfree.com/pin.gif?e=start&s=9804&i=40008F10-885F-465A-A235-D4AB1F3555A7&adv=&v=4.2.0.1924 | 37.58.109.2 |
hxxp://stat.webprotectionfree.com/node/?s=9804&br=4 | 37.58.109.2 |
hxxp://stat.webprotectionfree.com/c/LiveUpdateWPP_is.exe | 37.58.109.2 |
hxxp://stat.webprotectionfree.com/node/?s=9804&br=5 | 37.58.109.2 |
hxxp://stat.webprotectionfree.com/c/SetupWPP.exe | 37.58.109.2 |
hxxp://stat.webprotectionfree.com/node/?s=9804&br=1 | 37.58.109.2 |
hxxp://stat.webprotectionfree.com/c/webprotector_installer.exe | 37.58.109.2 |
hxxp://stat.webprotectionfree.com/pin.gif?e=installer&s=9804&i=40008F10-885F-465A-A235-D4AB1F3555A7&adv=&v=4.2.0.1924 | 37.58.109.2 |
hxxp://stat.webprotectionfree.com/pin.gif?e=tracking&s=9804&i=40008F10-885F-465A-A235-D4AB1F3555A7&t=0&v=6.0.2900.5512&b=ie&ai=wppapp1.06&os=5.1x32&osv=2600 | 37.58.109.2 |
hxxp://stat.webprotectionfree.com/c/SetupComponents.exe | 37.58.109.2 |
hxxp://webprotectionfree.com/node/?s=9804&br=1 | 37.58.109.2 |
hxxp://webprotectionfree.com/c/LiveUpdateWPP_is.exe | 37.58.109.2 |
hxxp://webprotectionfree.com/c/SetupWPP.exe | 37.58.109.2 |
hxxp://webprotectionfree.com/node/?s=9804&br=4 | 37.58.109.2 |
hxxp://webprotectionfree.com/node/?s=9804&br=5 | 37.58.109.2 |
hxxp://webprotectionfree.com/c/SetupComponents.exe | 37.58.109.2 |
hxxp://webprotectionfree.com/c/webprotector_installer.exe | 37.58.109.2 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /c/SetupComponents.exe HTTP/1.1
User-Agent: Microsoft Internet Explorer
Host: webprotectionfree.com
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Server: nginx/1.4.6 (Ubuntu)
Date: Fri, 06 Nov 2015 17:45:52 GMT
Content-Type: text/html
Content-Length: 177
Connection: keep-alive
<html>..<head><title>403 Forbidden</title></head>..<body bgcolor="white">..<center><h1>403 Forbidden</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>..HTTP/1.1 403 Forbidden..Server: nginx/1.4.6 (Ubuntu)..Date: Fri, 06 Nov 2015 17:45:52 GMT..Content-Type: text/html..Content-Length: 177..Connection: keep-alive..<html>..<head><title>403 Forbidden</title></head>..<body bgcolor="white">..<center><h1>403 Forbidden</h1></center>..<hr><center>nginx/1.4.6 (Ubuntu)</center>..</body>..</html>....
GET /pin.gif?e=tracking&s=9804&i=40008F10-885F-465A-A235-D4AB1F3555A7&t=0&v=6.0.2900.5512&b=ie&ai=wppapp1.06&os=5.1x32&osv=2600 HTTP/1.1
User-Agent: Microsoft Internet Explorer
Host: stat.webprotectionfree.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Fri, 06 Nov 2015 17:45:52 GMT
Content-Type: image/gif
Content-Length: 34
Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT
Connection: keep-alive
ETag: "54bfc526-22"
Accept-Ranges: bytes
GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6 (Ubuntu)..Date: Fri, 06 Nov 2015 17:45:52 GMT..Content-Type: image/gif..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..Connection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF89a.............,...........C.;..
GET /node/?s=9804&br=4 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0
Host: webprotectionfree.com
Connection: Keep-Alive
HTTP/1.1 301 Moved Permanently
Server: nginx/1.4.6 (Ubuntu)
Date: Fri, 06 Nov 2015 17:45:31 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Location: ../c/LiveUpdateWPP_is.exe
0......
GET /c/LiveUpdateWPP_is.exe HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0
Host: webprotectionfree.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Fri, 06 Nov 2015 17:45:31 GMT
Content-Type: application/octet-stream
Content-Length: 365343
Last-Modified: Tue, 21 Jul 2015 11:42:33 GMT
Connection: keep-alive
ETag: "55ae3029-5931f"
Accept-Ranges: bytes
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................^...........0.......p....@..........................................................................t..........8............................................................................p...............................text...L\.......^.................. ..`.rdata.......p.......b..............@..@.data...X\...........v..............@....ndata...................................rsrc...8............z..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H....h.B..H.P.u..u..u...Hr@..B...SV.5p.B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h`.B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....
<<< skipped >>>
GET /node/?s=9804&br=5 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0
Host: webprotectionfree.com
Connection: Keep-Alive
HTTP/1.1 301 Moved Permanently
Server: nginx/1.4.6 (Ubuntu)
Date: Fri, 06 Nov 2015 17:45:48 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Location: ../c/SetupWPP.exe
0......
GET /c/SetupWPP.exe HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0
Host: webprotectionfree.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Fri, 06 Nov 2015 17:45:48 GMT
Content-Type: application/octet-stream
Content-Length: 257237
Last-Modified: Sun, 22 Feb 2015 09:29:46 GMT
Connection: keep-alive
ETag: "54e9a18a-3ecd5"
Accept-Ranges: bytes
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................\..........<2.......p....@..........................................................................s..........(............................................................................p...............................text...ZZ.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata.......@...........................rsrc...(............v..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....>B..H.P.u..u..u...Hr@..B...SV.5.>B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>
GET /node/?s=9804&br=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0
Host: webprotectionfree.com
Connection: Keep-Alive
HTTP/1.1 301 Moved Permanently
Server: nginx/1.4.6 (Ubuntu)
Date: Fri, 06 Nov 2015 17:45:49 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Location: ../c/webprotector_installer.exe
0......
GET /c/webprotector_installer.exe HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0
Host: webprotectionfree.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Fri, 06 Nov 2015 17:45:49 GMT
Content-Type: application/octet-stream
Content-Length: 288291
Last-Modified: Wed, 14 Oct 2015 14:06:25 GMT
Connection: keep-alive
ETag: "561e6161-46623"
Accept-Ranges: bytes
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..iu..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L....n3T.................\...........0.......p....@.......................................@..................................s...........C...........................................................................p...............................text...|Z.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata...@...@...........................rsrc....C.......D...v..............@..@........................................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....6B..H.P.u..u..u....r@..B...SV.5.6B..E.WP.u....r@..e...E..E.P.u....r@..}..e....Lp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Tp@..E...E.P.E.P.u....r@..u....E..9}...w....~X.te.v4..Dp@....E.tU.}.j.W.E......E.......@p@..vXW..Hp@..u..5<p@.W...E..E.h ...Pj.h..B.W...r@..u.W...u....E.P.u...\r@._^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>
GET /pin.gif?e=start&s=9804&i=40008F10-885F-465A-A235-D4AB1F3555A7&adv=&v=4.2.0.1924 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0
Host: stat.webprotectionfree.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Fri, 06 Nov 2015 17:45:31 GMT
Content-Type: image/gif
Content-Length: 34
Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT
Connection: keep-alive
ETag: "54bfc526-22"
Accept-Ranges: bytes
GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6 (Ubuntu)..Date: Fri, 06 Nov 2015 17:45:31 GMT..Content-Type: image/gif..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..Connection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF89a.............,...........C.;....
GET /pin.gif?e=installer&s=9804&i=40008F10-885F-465A-A235-D4AB1F3555A7&adv=&v=4.2.0.1924 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 5.1) MSIE 10.0
Host: stat.webprotectionfree.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Fri, 06 Nov 2015 17:45:52 GMT
Content-Type: image/gif
Content-Length: 34
Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT
Connection: keep-alive
ETag: "54bfc526-22"
Accept-Ranges: bytes
GIF89a.............,...........C.;..
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
LiveUpdateWPP.exe_928:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
j.Yf;
j.Yf;
_tcPVj@
_tcPVj@
.PjRW
.PjRW
function not supported
function not supported
operation canceled
operation canceled
address_family_not_supported
address_family_not_supported
operation_in_progress
operation_in_progress
operation_not_supported
operation_not_supported
protocol_not_supported
protocol_not_supported
operation_would_block
operation_would_block
address family not supported
address family not supported
broken pipe
broken pipe
inappropriate io control operation
inappropriate io control operation
not supported
not supported
operation in progress
operation in progress
operation not permitted
operation not permitted
operation not supported
operation not supported
operation would block
operation would block
protocol not supported
protocol not supported
%b %d %H : %M : %S %Y
%b %d %H : %M : %S %Y
%m / %d / %y
%m / %d / %y
%I : %M : %S %p
%I : %M : %S %p
%d / %m / %y
%d / %m / %y
0123456789-
0123456789-
GetProcessWindowStation
GetProcessWindowStation
operator
operator
()$^.* ?[]|\-{},:=!
()$^.* ?[]|\-{},:=!
C:\src\similar\client-updater\bin\Release\LiveUpdateWPP.pdb
C:\src\similar\client-updater\bin\Release\LiveUpdateWPP.pdb
WTSAPI32.dll
WTSAPI32.dll
USERENV.dll
USERENV.dll
WinHttpReceiveResponse
WinHttpReceiveResponse
WinHttpSetOption
WinHttpSetOption
WinHttpSendRequest
WinHttpSendRequest
WinHttpConnect
WinHttpConnect
WinHttpCloseHandle
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpOpen
WinHttpOpenRequest
WinHttpOpenRequest
WinHttpCrackUrl
WinHttpCrackUrl
WinHttpReadData
WinHttpReadData
WINHTTP.dll
WINHTTP.dll
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
ReportEventW
ReportEventW
RegOpenKeyExW
RegOpenKeyExW
RegCloseKey
RegCloseKey
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
GetCPInfo
GetCPInfo
GetProcessHeap
GetProcessHeap
zcÃ
zcÃ
.?AVARegKey@@
.?AVARegKey@@
.?AVASysWriteKey@@
.?AVASysWriteKey@@
.?AVASysRegKey@@
.?AVASysRegKey@@
11
11
3O5X5
3O5X5
:%:):/:3:(?
:%:):/:3:(?
1 1$1(1,1014181
1 1$1(1,1014181
: :@:\:`:
: :@:\:`:
? ?$?(?,?0?4?`?
? ?$?(?,?0?4?`?
Ckernel32.dll
Ckernel32.dll
Emscoree.dll
Emscoree.dll
- CRT not initialized
- CRT not initialized
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- floating point support not loaded
- floating point support not loaded
USER32.DLL
USER32.DLL
portuguese-brazilian
portuguese-brazilian
{"protocol":{ "version": "1","command":"status"},"service":{"version":"1","id":"%s","src":"%s"},"status":{"code":"%d","cid":"%s"},"client":{"version":"%s"}}
{"protocol":{ "version": "1","command":"status"},"service":{"version":"1","id":"%s","src":"%s"},"status":{"code":"%d","cid":"%s"},"client":{"version":"%s"}}
{"protocol":{ "version": "1","command":"ping"},"service":{"version":"1","id":"%s","src":"%s","lcid":"%s"},"client":{"version":"%s"}}
{"protocol":{ "version": "1","command":"ping"},"service":{"version":"1","id":"%s","src":"%s","lcid":"%s"},"client":{"version":"%s"}}
urls
urls
Anti-phishing database updater for Web Protector Plus. This service keeps your computer updated with the newest database of known Internet threats.
Anti-phishing database updater for Web Protector Plus. This service keeps your computer updated with the newest database of known Internet threats.
AgentTask::Execute :
AgentTask::Execute :
MainTask::Execute
MainTask::Execute
Software\Mozilla\Mozilla Firefox
Software\Mozilla\Mozilla Firefox
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
Mozilla/4.0 (compatible; __LOCAL__; __WIN_VER__) __DEFAULT_BROWSER__
Mozilla/4.0 (compatible; __LOCAL__; __WIN_VER__) __DEFAULT_BROWSER__
Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice
Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice
Software\Clients\Windows\StartMenuInternet
Software\Clients\Windows\StartMenuInternet
http\shell\open\command
http\shell\open\command
firefox
firefox
Firefox/
Firefox/
chrome
chrome
Chrome/
Chrome/
opera
opera
OPERA
OPERA
Windows NT
Windows NT
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
ul_cmd
ul_cmd
%s : %s
%s : %s
2.1.1.22
2.1.1.22
%Program Files%\LiveUpdateWPP\LiveUpdateWPP.exe
%Program Files%\LiveUpdateWPP\LiveUpdateWPP.exe
Maintains your Web Protector Plus synchronized.
Maintains your Web Protector Plus synchronized.
LiveUpdateWPP.exe
LiveUpdateWPP.exe
WebProtectorPlus.exe_644:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
vSSSh
vSSSh
FTPjK
FTPjK
FtPj;
FtPj;
C.PjRV
C.PjRV
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
portuguese-brazilian
portuguese-brazilian
operator
operator
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
X-X-X-XX-XXXXXX
X-X-X-XX-XXXXXX
SOFTWARE\WebProtectorPlus\Notify\
SOFTWARE\WebProtectorPlus\Notify\
SOFTWARE\WebProtectorPlus\
SOFTWARE\WebProtectorPlus\
SOFTWARE\Microsoft\Windows NT\CurrentVersion\
SOFTWARE\Microsoft\Windows NT\CurrentVersion\
SOFTWARE\Microsoft\Windows NT\
SOFTWARE\Microsoft\Windows NT\
hXXp://stat.webprotectionfree.com/pin.gif?e=remove&s=
hXXp://stat.webprotectionfree.com/pin.gif?e=remove&s=
hXXp://stat.webprotectionfree.com/pin.gif?e=tracking&s=
hXXp://stat.webprotectionfree.com/pin.gif?e=tracking&s=
Shell32.dll
Shell32.dll
hXXp://webprotectorplus.com
hXXp://webprotectorplus.com
hXXp://webprotectionfree.com/c/SetupComponents.exe
hXXp://webprotectionfree.com/c/SetupComponents.exe
SetupComponents.exe
SetupComponents.exe
Software\WebProtectorPlus\Notify
Software\WebProtectorPlus\Notify
d:\Project\_Bibyte\WebProtectorPlus NO DLL\Release\WebProtectorPlus NO DLL.pdb
d:\Project\_Bibyte\WebProtectorPlus NO DLL\Release\WebProtectorPlus NO DLL.pdb
COMCTL32.dll
COMCTL32.dll
InternetOpenUrlA
InternetOpenUrlA
WININET.dll
WININET.dll
SHLWAPI.dll
SHLWAPI.dll
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegCreateKeyExA
RegCreateKeyExA
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
GetCPInfo
GetCPInfo
GetConsoleOutputCP
GetConsoleOutputCP
zcÃ
zcÃ
%Program Files%\WebProtectorPlus\WebProtectorPlus.exe
%Program Files%\WebProtectorPlus\WebProtectorPlus.exe
mscoree.dll
mscoree.dll
KERNEL32.DLL
KERNEL32.DLL
ntvdm.exe_640:
.text
.text
`.data
`.data
.rsrc
.rsrc
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
ADVAPI32.dll
ADVAPI32.dll
GDI32.dll
GDI32.dll
USER32.dll
USER32.dll
SoftPC
SoftPC
mscoree.dll
mscoree.dll
Please contact the application's support team for more information.
Please contact the application's support team for more information.
GetProcessWindowStation
GetProcessWindowStation
user32.dll
user32.dll
BIOS keyboard buffer overflow
BIOS keyboard buffer overflow
hardware keyboard buffer overflow
hardware keyboard buffer overflow
%s Mouse %d.01 already installed
%s Mouse %d.01 already installed
%s Mouse %d.01 installed
%s Mouse %d.01 installed
d:\xpsp\base\mvdm\softpc.new\host\src\nt_timer.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_timer.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_eoi.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_eoi.c
C:\IBMBIO.SYS
C:\IBMBIO.SYS
C:\IO.SYS
C:\IO.SYS
C:\IBMDOS.SYS
C:\IBMDOS.SYS
C:\MSDOS.SYS
C:\MSDOS.SYS
\ntio404.sys
\ntio404.sys
\ntio411.sys
\ntio411.sys
\ntio412.sys
\ntio412.sys
\ntio804.sys
\ntio804.sys
\ntio.sys
\ntio.sys
VJOY.DLL
VJOY.DLL
%s %lxh
%s %lxh
d:\xpsp\base\mvdm\softpc.new\host\src\nt_com.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_com.c
d:\xpsp\base\mvdm\softpc.new\host\src\config.c
d:\xpsp\base\mvdm\softpc.new\host\src\config.c
Software\Microsoft\Windows NT\CurrentVersion\WOW\Console
Software\Microsoft\Windows NT\CurrentVersion\WOW\Console
\\.\$VDMLPT2
\\.\$VDMLPT2
\\.\$VDMLPT3
\\.\$VDMLPT3
\\.\$VDMLPT1
\\.\$VDMLPT1
FONT.NT
FONT.NT
\ega.cpi
\ega.cpi
d:\xpsp\base\mvdm\softpc.new\host\src\nt_fulsc.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_fulsc.c
Drive %c:
Drive %c:
Incompatible DOS diskette, C H R N = %d %d %d %d
Incompatible DOS diskette, C H R N = %d %d %d %d
\\.\A:
\\.\A:
\\.\?:
\\.\?:
d:\xpsp\base\mvdm\softpc.new\host\src\nt_event.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_event.c
WINDOWS VMM 4.0
WINDOWS VMM 4.0
WINDOWS NT 3.1
WINDOWS NT 3.1
WINDOWS 386 3.0
WINDOWS 386 3.0
WINDOWS 286 3.0
WINDOWS 286 3.0
\_default.pif
\_default.pif
d:\xpsp\base\mvdm\softpc.new\host\src\nt_det.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_det.c
VrRemoveOpenNamedPipeInfo
VrRemoveOpenNamedPipeInfo
VrConvertLocalNtPipeName
VrConvertLocalNtPipeName
VrAddOpenNamedPipeInfo
VrAddOpenNamedPipeInfo
VrIsNamedPipeHandle
VrIsNamedPipeHandle
VrIsNamedPipeName
VrIsNamedPipeName
VrWriteNamedPipe
VrWriteNamedPipe
VrReadNamedPipe
VrReadNamedPipe
midiOutShortMsg
midiOutShortMsg
midiOutLongMsg
midiOutLongMsg
WINMM.DLL
WINMM.DLL
d:\xpsp\base\mvdm\softpc.new\host\src\nt_hosts.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_hosts.c
NtDeviceIoControlFile failed %x
NtDeviceIoControlFile failed %x
d:\xpsp\base\mvdm\softpc.new\host\src\nt_sec.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_sec.c
SoftPc: NtDeCommitVirtualMemory failed !!!! Status = %lx
SoftPc: NtDeCommitVirtualMemory failed !!!! Status = %lx
NTVDMD.DLL
NTVDMD.DLL
Check Keyboard Status
Check Keyboard Status
\ntdos404.sys
\ntdos404.sys
\ntdos411.sys
\ntdos411.sys
\ntdos412.sys
\ntdos412.sys
\ntdos804.sys
\ntdos804.sys
\ntdos.sys
\ntdos.sys
demDosDispCall %s
demDosDispCall %s
config.nt
config.nt
PIPE
PIPE
%c:%sNUL
%c:%sNUL
Software\Microsoft\Windows\CurrentVersion\Setup
Software\Microsoft\Windows\CurrentVersion\Setup
Unimplemented SVC %d
Unimplemented SVC %d
Software\Microsoft\Windows NT\CurrentVersion\WOW\CmdLine
Software\Microsoft\Windows NT\CurrentVersion\WOW\CmdLine
%s=%s%s /p %s\system32
%s=%s%s /p %s\system32
%s=%3.3u,%3.3u,%s\system32\%s.sys%s
%s=%3.3u,%3.3u,%s\system32\%s.sys%s
KEYB
KEYB
\KEYBOARD.SYS
\KEYBOARD.SYS
\KEYJ31.SYS
\KEYJ31.SYS
\KEY02.SYS
\KEY02.SYS
\KEY01.SYS
\KEY01.SYS
\KEYAX.SYS
\KEYAX.SYS
%s,%d,%s
%s,%d,%s
\KB16.COM
\KB16.COM
DosKeybIDs
DosKeybIDs
System\CurrentControlSet\Control\Keyboard Layout\
System\CurrentControlSet\Control\Keyboard Layout\
DosKeybCodes
DosKeybCodes
00000409
00000409
Software\Microsoft\Windows NT\CurrentVersion\WOW\Compatibility
Software\Microsoft\Windows NT\CurrentVersion\WOW\Compatibility
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
ega.rom
ega.rom
vga.rom
vga.rom
v7vga.rom
v7vga.rom
bios4.rom
bios4.rom
bios1.rom
bios1.rom
profile.spc
profile.spc
.spcprofile
.spcprofile
d:\xpsp\base\mvdm\softpc.new\host\src\x86_emm.c
d:\xpsp\base\mvdm\softpc.new\host\src\x86_emm.c
CS:x IP:x OP:x x x x x
CS:x IP:x OP:x x x x x
ntvdm.pdb
ntvdm.pdb
Ut.Ht$Ht
Ut.Ht$Ht
ItKIt9It.IIt
ItKIt9It.IIt
tK
tK
HHt7Ht.Ht
HHt7Ht.Ht
YYt%F
YYt%F
SSSSSh
SSSSSh
s*f;O%s$
s*f;O%s$
V
V
t.HtHHt(Ht
t.HtHHt(Ht
GetCPInfo
GetCPInfo
NtEnumerateValueKey
NtEnumerateValueKey
NtOpenKey
NtOpenKey
ntdll.dll
ntdll.dll
RegCloseKey
RegCloseKey
RegQueryInfoKeyA
RegQueryInfoKeyA
RegOpenKeyExA
RegOpenKeyExA
GetConsoleOutputCP
GetConsoleOutputCP
GetSystemWindowsDirectoryA
GetSystemWindowsDirectoryA
GetWindowsDirectoryA
GetWindowsDirectoryA
SetConsoleKeyShortcuts
SetConsoleKeyShortcuts
VDMConsoleOperation
VDMConsoleOperation
GetConsoleKeyboardLayoutNameA
GetConsoleKeyboardLayoutNameA
EnumWindows
EnumWindows
GetKeyState
GetKeyState
VkKeyScanW
VkKeyScanW
MapVirtualKeyA
MapVirtualKeyA
GetKeyboardType
GetKeyboardType
NtQueryValueKey
NtQueryValueKey
GetProcessHeap
GetProcessHeap
ntvdm.exe
ntvdm.exe
SoftPcEoi
SoftPcEoi
cmdCheckTemp
cmdCheckTemp
cmdCheckTempInit
cmdCheckTempInit
demIsShortPathName
demIsShortPathName
'?--?1-?6-?:-??-??-:?-6?-1?--?1-?6-?:-??-:?-6?-1?--?--?1-?6-?:-??-:?-6?-1?
'?--?1-?6-?:-??-??-:?-6?-1?--?1-?6-?:-??-:?-6?-1?--?--?1-?6-?:-??-:?-6?-1?
$$$(((---222888???
$$$(((---222888???
!"#$%&'(
!"#$%&'(
SoftPC-AT Version 3
SoftPC-AT Version 3
89:;?
89:;?
autoexec.nt
autoexec.nt
00030
00030
30333
30333
?0?3???
?0?3???
!"#$%&'()
!"#$%&'()
Userenv.dll
Userenv.dll
Software\Microsoft\Windows NT\CurrentVersion\Terminal Server
Software\Microsoft\Windows NT\CurrentVersion\Terminal Server
%SystemRoot%
%SystemRoot%
\System32\command.com
\System32\command.com
%System%\ntvdm.exe
%System%\ntvdm.exe
\\.\B:
\\.\B:
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
%WinDir%
%WinDir%
NTVDM.EXE
NTVDM.EXE
5.1.2600.5512 (xpsp.080413-2111)
5.1.2600.5512 (xpsp.080413-2111)
Windows
Windows
Operating System
Operating System
5.1.2600.5512
5.1.2600.5512
5The NTVDM CPU has encountered an illegal instruction."Internal error in NTVDM procedure.#NTVDM does not support a ROM BASIC.BFailure to allocate the requested number of Expanded Memory pages.*A continuous RESET state has been entered.,The CMOS file cmos.ram could not be created.,The CMOS file cmos.ram could not be updated.
5The NTVDM CPU has encountered an illegal instruction."Internal error in NTVDM procedure.#NTVDM does not support a ROM BASIC.BFailure to allocate the requested number of Expanded Memory pages.*A continuous RESET state has been entered.,The CMOS file cmos.ram could not be created.,The CMOS file cmos.ram could not be updated.
LAn installation file required by NTVDM is missing, execution must terminate.
LAn installation file required by NTVDM is missing, execution must terminate.
Insufficient memory resources.=The NTVDM CPU has encountered an unsupported 386 instruction.TThe EMM command line in your config.nt contains invalid parameters or syntax errors.5The NTVDM CPU has encountered an unhandled exception.t
Insufficient memory resources.=The NTVDM CPU has encountered an unsupported 386 instruction.TThe EMM command line in your config.nt contains invalid parameters or syntax errors.5The NTVDM CPU has encountered an unhandled exception.t
MS-DOS program files must end with the extension .EXE, .COM, or .BAT.
MS-DOS program files must end with the extension .EXE, .COM, or .BAT.
vAn application has attempted to %s, which cannot be supported. This may cause the application to function incorrectly./directly access an incompatible diskette format
vAn application has attempted to %s, which cannot be supported. This may cause the application to function incorrectly./directly access an incompatible diskette format
16 bit Windows Subsystem
16 bit Windows Subsystem
VThe system file is not suitable for running MS-DOS and Microsoft Windows applications."Memory error during intialization.
VThe system file is not suitable for running MS-DOS and Microsoft Windows applications."Memory error during intialization.
Unable to lock for exclusive access. Another application may be using the drive. When the other application has finished using the drive you may retry the operation.
Unable to lock for exclusive access. Another application may be using the drive. When the other application has finished using the drive you may retry the operation.
Drive %c: ZThe Application attempted to enable DOS graphics mode. DOS graphics mode is not supported.
Drive %c: ZThe Application attempted to enable DOS graphics mode. DOS graphics mode is not supported.
Function failed$NTVDM has encountered a System Error*Driver does not support selected Baud Rate
Function failed$NTVDM has encountered a System Error*Driver does not support selected Baud Rate
ntvdm.exe_640_rwx_00000000_00010000:
C:\PROGRA~1\WEBPRO~1\SETUPC~1.EXE
C:\PROGRA~1\WEBPRO~1\SETUPC~1.EXE
SETUPC~1EXE
SETUPC~1EXE
."/\[]:| =;,
."/\[]:| =;,
c:\wina20.386
c:\wina20.386
%WinDir%\SYSTEM32\COUNTRY.SYS
%WinDir%\SYSTEM32\COUNTRY.SYS
89:;?
89:;?
1234567890-=
1234567890-=
!@#$%^&*()_
!@#$%^&*()_
789-456 1230.
789-456 1230.
!"#$%&,-./012
!"#$%&,-./012
C:\PROGRA~1\WEBPRO~1
C:\PROGRA~1\WEBPRO~1
%WinDir%\SYSTEM32\COMMAND.COM
%WinDir%\SYSTEM32\COMMAND.COM
%File allocation table bad, drive %1
%File allocation table bad, drive %1
Invalid COMMAND.COM
Invalid COMMAND.COM
!Press any key to continue . . .
!Press any key to continue . . .
Cannot execute %1
Cannot execute %1
Error in EXE file
Error in EXE file
%WinDir%\TEMP\scs11.tmp
%WinDir%\TEMP\scs11.tmp
arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
OS=Windows_NT
OS=Windows_NT
PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1
PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
SYSTEMROOT=%WinDir%
SYSTEMROOT=%WinDir%
TEMP=%WinDir%\TEMP
TEMP=%WinDir%\TEMP
TMP=%WinDir%\TEMP
TMP=%WinDir%\TEMP
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
nginx/1.4.6 (Ubuntu)
nginx/1.4.6 (Ubuntu)
\COMMAND.COM
\COMMAND.COM
COMSPEC=\COMMAND.COM
COMSPEC=\COMMAND.COM
BMicrosoft(R) Windows DOS
BMicrosoft(R) Windows DOS
FCOMMAND [[drive:]path] [device] [/E:nnnnn] [/P] [/C string] [/MSG]
FCOMMAND [[drive:]path] [device] [/E:nnnnn] [/P] [/C string] [/MSG]
H [drive:]path Specifies the directory containing COMMAND.COM file.
H [drive:]path Specifies the directory containing COMMAND.COM file.
N /MSG Specifies that all error messages be stored in memory. You
N /MSG Specifies that all error messages be stored in memory. You
%Intermediate file error during pipe
%Intermediate file error during pipe
Switches may be preset in the DIRCMD environment variable. Override
Switches may be preset in the DIRCMD environment variable. Override
>Quits the COMMAND.COM program (command interpreter).
>Quits the COMMAND.COM program (command interpreter).
]Displays or sets a search path for executable files.
]Displays or sets a search path for executable files.
$B | (pipe)
$B | (pipe)
%Displays the MS-DOS version.
%Displays the MS-DOS version.
LRecords comments (remarks) in a batch file or CONFIG.SYS.
LRecords comments (remarks) in a batch file or CONFIG.SYS.
key to continue...."
key to continue...."
PATH=PROMPT=COMSPEC=DIRCMD=
PATH=PROMPT=COMSPEC=DIRCMD=
.COM.EXE.BAT?VBAPWRHSvDANEDSG
.COM.EXE.BAT?VBAPWRHSvDANEDSG
%WinDir%\SYSTEM32
%WinDir%\SYSTEM32
[]| =;"
[]| =;"
ntvdm.exe_640_rwx_00010000_00090000:
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
%WinDir%\TEMP\scs11.tmp
%WinDir%\TEMP\scs11.tmp
89:;?
89:;?
0WINDOWS MS-DOS STARTUP FILE
0WINDOWS MS-DOS STARTUP FILE
0CONFIG.SYS VS CONFIG.NT
0CONFIG.SYS VS CONFIG.NT
0CONFIG.SYS IS NOT USED TO INITIALIZE THE MS-DOS ENVIRONMENT.
0CONFIG.SYS IS NOT USED TO INITIALIZE THE MS-DOS ENVIRONMENT.
0CONFIG.NT IS USED TO INITIALIZE THE MS-DOS ENVIRONMENT UNLESS A
0CONFIG.NT IS USED TO INITIALIZE THE MS-DOS ENVIRONMENT UNLESS A
0IS INITIALIZED. TO DISPLAY CONFIG.NT/AUTOEXEC.NT INFORMATION, ADD
0IS INITIALIZED. TO DISPLAY CONFIG.NT/AUTOEXEC.NT INFORMATION, ADD
0THE COMMAND ECHOCONFIG TO CONFIG.NT OR OTHER STARTUP FILE.
0THE COMMAND ECHOCONFIG TO CONFIG.NT OR OTHER STARTUP FILE.
0NTCMDPROMPT
0NTCMDPROMPT
0MS-DOS-BASED APPLICATION, WINDOWS RUNS COMMAND.COM. THIS ALLOWS THE
0MS-DOS-BASED APPLICATION, WINDOWS RUNS COMMAND.COM. THIS ALLOWS THE
0TSR TO REMAIN ACTIVE. TO RUN CMD.EXE, THE WINDOWS COMMAND PROMPT,
0TSR TO REMAIN ACTIVE. TO RUN CMD.EXE, THE WINDOWS COMMAND PROMPT,
0RATHER THAN COMMAND.COM, ADD THE COMMAND NTCMDPROMPT TO CONFIG.NT OR
0RATHER THAN COMMAND.COM, ADD THE COMMAND NTCMDPROMPT TO CONFIG.NT OR
0COMMAND.COM. IF YOU START AN APPLICATION OTHER THAN AN MS-DOS-BASED
0COMMAND.COM. IF YOU START AN APPLICATION OTHER THAN AN MS-DOS-BASED
0CONFIG.NT OR OTHER STARTUP FILE.
0CONFIG.NT OR OTHER STARTUP FILE.
0WANT THE SYSTEM TO SUPPORT. 1
0WANT THE SYSTEM TO SUPPORT. 1
0AND LEAVE THE RESTS(IF AVAILABLE) TO BE USED BY DOS TO SUPPORT
0AND LEAVE THE RESTS(IF AVAILABLE) TO BE USED BY DOS TO SUPPORT
0WITH YOUR APPLICATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE
0WITH YOUR APPLICATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE
D%WinDir%\SYSTEM32\HIMEM.SYS
D%WinDir%\SYSTEM32\HIMEM.SYS
Q001,437,%WinDir%\SYSTEM32\COUNTRY.SYS
Q001,437,%WinDir%\SYSTEM32\COUNTRY.SYS
S%WinDir%\SYSTEM32\COMMAND.COM
S%WinDir%\SYSTEM32\COMMAND.COM
/P %WinDir%\SYSTEM32
/P %WinDir%\SYSTEM32
ATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE
ATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE
DEVICE=%WinDir%\SYSTEM32\HIMEM.SYS
DEVICE=%WinDir%\SYSTEM32\HIMEM.SYS
COUNTRY=001,437,%WinDir%\SYSTEM32\COUNTRY.SYS
COUNTRY=001,437,%WinDir%\SYSTEM32\COUNTRY.SYS
SHELL=%WinDir%\SYSTEM32\COMMAND.COM /P %WinDir%\SYSTEM32
SHELL=%WinDir%\SYSTEM32\COMMAND.COM /P %WinDir%\SYSTEM32
%WinDir%\SYSTEM32\COUNTRY.SYS
%WinDir%\SYSTEM32\COUNTRY.SYS
[]| =;"
[]| =;"
%WinDir%\TEMP\scs10.tmp
%WinDir%\TEMP\scs10.tmp
%WinDir%\SYSTEM32\COMMAND.COM
%WinDir%\SYSTEM32\COMMAND.COM
NTCMDPROMPTT
NTCMDPROMPTT
Unrecognized command in CONFIG.SYS
Unrecognized command in CONFIG.SYS
Insufficient memory for COUNTRY.SYS file
Insufficient memory for COUNTRY.SYS file
Incorrect order in CONFIG.SYS line $Error in CONFIG.SYS line $WARNING! Logical drives past Z: exist and will be ignored
Incorrect order in CONFIG.SYS line $Error in CONFIG.SYS line $WARNING! Logical drives past Z: exist and will be ignored
1234567890-=
1234567890-=
!@#$%^&*()_
!@#$%^&*()_
789-456 1230.
789-456 1230.
!"#$%&,-./012
!"#$%&,-./012
00030
00030
30333
30333
?0?3???
?0?3???
Windows NT MS-DOS subsystem Mouse Driver
Windows NT MS-DOS subsystem Mouse Driver
/)()(00)(
/)()(00)(
/@%}-{.Nb#b
/@%}-{.Nb#b
!Press any key to continue . . .
!Press any key to continue . . .
%Intermediate file error during pipe
%Intermediate file error during pipe
Switches may be preset in the DIRCMD environment variable. Override
Switches may be preset in the DIRCMD environment variable. Override
>Quits the COMMAND.COM program (command interpreter).
>Quits the COMMAND.COM program (command interpreter).
]Displays or sets a search path for executable files.
]Displays or sets a search path for executable files.
$B | (pipe)
$B | (pipe)
%Displays the MS-DOS version.
%Displays the MS-DOS version.
LRecords comments (remarks) in a batch file or CONFIG.SYS.
LRecords comments (remarks) in a batch file or CONFIG.SYS.
key to continue...."
key to continue...."
PATH=PROMPT=COMSPEC=DIRCMD=
PATH=PROMPT=COMSPEC=DIRCMD=
.COM.EXE.BAT?VBAPWRHSvDANEDSG
.COM.EXE.BAT?VBAPWRHSvDANEDSG
%WinDir%\SYSTEM32\DOSX
%WinDir%\SYSTEM32\DOSX
NT.EXE
NT.EXE
C:\PROGRA~1\WEBPRO~1\SETUPC~1.EXE
C:\PROGRA~1\WEBPRO~1\SETUPC~1.EXE
nt.exe
nt.exe
DOSX.EXE
DOSX.EXE
ntvdm.exe_640_rwx_000A0000_00020000:
66666666
66666666
6666666
6666666
6666666666666666
6666666666666666
6666666676666666
6666666676666666
6666667076666666
6666667076666666
ntvdm.exe_640_rwx_000C9000_00013000:
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
OS=Windows_NT
OS=Windows_NT
PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1
PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
SYSTEMROOT=%WinDir%
SYSTEMROOT=%WinDir%
TEMP=%WinDir%\TEMP
TEMP=%WinDir%\TEMP
TMP=%WinDir%\TEMP
TMP=%WinDir%\TEMP
%System%\DOSX.EXE
%System%\DOSX.EXE
%System%\mscdexnt.exe
%System%\mscdexnt.exe
VCDEX.DLL
VCDEX.DLL
%System%\redir
%System%\redir
(load before dosx.exe)
(load before dosx.exe)
C:\LANMAN.DOS
C:\LANMAN.DOS
%System%\dosx
%System%\dosx
%System%\krnl386.exe
%System%\krnl386.exe
krnl386.exe
krnl386.exe
SYSTEM.INI
SYSTEM.INI
ntvdm.exe_640_rwx_000E8000_00008000:
00030
00030
30333
30333
?0?3???
?0?3???
Windows NT MS-DOS subsystem Mouse Driver
Windows NT MS-DOS subsystem Mouse Driver
ntvdm.exe_640_rwx_00100000_00010000:
C:\PROGRA~1\WEBPRO~1\SETUPC~1.EXE
C:\PROGRA~1\WEBPRO~1\SETUPC~1.EXE
SETUPC~1EXE
SETUPC~1EXE
."/\[]:| =;,
."/\[]:| =;,
c:\wina20.386
c:\wina20.386
%WinDir%\SYSTEM32\COUNTRY.SYS
%WinDir%\SYSTEM32\COUNTRY.SYS
89:;?
89:;?
1234567890-=
1234567890-=
!@#$%^&*()_
!@#$%^&*()_
789-456 1230.
789-456 1230.
!"#$%&,-./012
!"#$%&,-./012
C:\PROGRA~1\WEBPRO~1
C:\PROGRA~1\WEBPRO~1
%WinDir%\SYSTEM32\COMMAND.COM
%WinDir%\SYSTEM32\COMMAND.COM
%File allocation table bad, drive %1
%File allocation table bad, drive %1
Invalid COMMAND.COM
Invalid COMMAND.COM
!Press any key to continue . . .
!Press any key to continue . . .
Cannot execute %1
Cannot execute %1
Error in EXE file
Error in EXE file
%WinDir%\TEMP\scs11.tmp
%WinDir%\TEMP\scs11.tmp
arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
OS=Windows_NT
OS=Windows_NT
PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1
PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
SYSTEMROOT=%WinDir%
SYSTEMROOT=%WinDir%
TEMP=%WinDir%\TEMP
TEMP=%WinDir%\TEMP
TMP=%WinDir%\TEMP
TMP=%WinDir%\TEMP
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
nginx/1.4.6 (Ubuntu)
nginx/1.4.6 (Ubuntu)
\COMMAND.COM
\COMMAND.COM
COMSPEC=\COMMAND.COM
COMSPEC=\COMMAND.COM
BMicrosoft(R) Windows DOS
BMicrosoft(R) Windows DOS
FCOMMAND [[drive:]path] [device] [/E:nnnnn] [/P] [/C string] [/MSG]
FCOMMAND [[drive:]path] [device] [/E:nnnnn] [/P] [/C string] [/MSG]
H [drive:]path Specifies the directory containing COMMAND.COM file.
H [drive:]path Specifies the directory containing COMMAND.COM file.
N /MSG Specifies that all error messages be stored in memory. You
N /MSG Specifies that all error messages be stored in memory. You
%Intermediate file error during pipe
%Intermediate file error during pipe
Switches may be preset in the DIRCMD environment variable. Override
Switches may be preset in the DIRCMD environment variable. Override
>Quits the COMMAND.COM program (command interpreter).
>Quits the COMMAND.COM program (command interpreter).
]Displays or sets a search path for executable files.
]Displays or sets a search path for executable files.
$B | (pipe)
$B | (pipe)
%Displays the MS-DOS version.
%Displays the MS-DOS version.
LRecords comments (remarks) in a batch file or CONFIG.SYS.
LRecords comments (remarks) in a batch file or CONFIG.SYS.
key to continue...."
key to continue...."
PATH=PROMPT=COMSPEC=DIRCMD=
PATH=PROMPT=COMSPEC=DIRCMD=
.COM.EXE.BAT?VBAPWRHSvDANEDSG
.COM.EXE.BAT?VBAPWRHSvDANEDSG
%WinDir%\SYSTEM32
%WinDir%\SYSTEM32
[]| =;"
[]| =;"