Trojan.Ciusky.Gen.7_986e2c6fd0 – Adaware

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.
IRCBot	A bot can communicate with command and control servers via IRC channel.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1456
youtube_downloader_hd_setup1.exe:1316
netsh.exe:1852
netsh.exe:1816
mscorsvw.exe:1912
service.exe:1488
WinServices.exe:1256
WinServices.exe:664

The Trojan injects its code into the following process(es):

RunDll32.exe:1068
RunDll32.exe:628
service.exe:496
youtube_downloader_hd_setup1.tmp:912

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1456 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

The Trojan deletes the following file(s):

The process youtube_downloader_hd_setup1.exe:1316 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-D10QC.tmp\youtube_downloader_hd_setup1.tmp (5442 bytes)

The process RunDll32.exe:1068 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%System%\wbem\Logs\wbemprox.log (658 bytes)

The process RunDll32.exe:628 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\wbem\Logs\wbemprox.log (26488 bytes)

The process WinServices.exe:1256 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\service.exe (7726 bytes)

The process youtube_downloader_hd_setup1.tmp:912 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-MMMT0.tmp\OCSetupHlp.dll (6841 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-MMMT0.tmp\_isetup\_RegDLL.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-MMMT0.tmp\_isetup\_shfoldr.dll (23 bytes)

Registry activity

The process %original file name%.exe:1456 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FB 39 DA 5D 71 CE B0 F1 27 F1 F1 B1 43 5C 17 9A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\D:\Documents and Settings\"%CurrentUserName%"\WinServices]
"winservices.exe" = "WinServices"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\D:\Documents and Settings\"%CurrentUserName%"\WinServices]
"youtube_downloader_hd_setup1.exe" = "Youtube Downloader HD Setup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process youtube_downloader_hd_setup1.exe:1316 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "63 DF AE 3F A6 F1 03 47 1A 93 6E BD 63 68 74 3B"

The process netsh.exe:1852 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"BitNames" = " NAP_TRACE_BASE NAP_TRACE_NETSH"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"Guid" = "710adbf0-ce88-40b4-a50d-231ada6593f0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"Guid" = "b0278a28-76f1-4e15-b1df-14b209a12613"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6D 27 53 50 8B A9 CE 8A AE 7C 19 28 FA 0C E8 B1"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

The process netsh.exe:1816 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"BitNames" = " NAP_TRACE_BASE NAP_TRACE_NETSH"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"Guid" = "710adbf0-ce88-40b4-a50d-231ada6593f0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"Guid" = "b0278a28-76f1-4e15-b1df-14b209a12613"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "93 04 B8 1C 87 7A C2 8B CF A7 DD 00 F1 D7 BF AD"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

The process RunDll32.exe:1068 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5F 52 35 E2 79 BF 15 32 E1 7C 4D 0D 73 B4 5A 5D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process RunDll32.exe:628 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\is-MMMT0.tmp"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCR\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0]
"(Default)" = "OCVBValidateLib"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0\FLAGS]
"(Default)" = "0"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows Script\Settings]
"JITDebug" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 17 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A7 F3 20 4E 3A 7D D2 F9 4B 90 8E 7B 28 A6 85 F1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCR\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\is-MMMT0.tmp\OCSetupHlp.dll"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following registry key(s):

[HKCR\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0\FLAGS]
[HKCR\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0\HELPDIR]
[HKCR\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0]
[HKCR\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0\0\win32]
[HKCR\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}]
[HKCR\TypeLib\{1A720F5A-8FE4-4A0F-9B3A-494BF58B0813}\1.0\0]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process mscorsvw.exe:1912 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\State]
"AccumulatedWaitIdleTime" = "2340000"

The process service.exe:496 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 18 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6A 33 67 9F E3 37 81 CE 90 CE E4 53 DD 82 D7 C9"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Win - Services" = "service.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices]
"Win - Services" = "service.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Win - Services" = "service.exe"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process service.exe:1488 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "60 EB 4C 22 DD DB 3B D1 F1 9E AD 25 21 EA FC A2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WinServices" = "C:\DOCUME~1\"%CurrentUserName%"\WinServices\WinServices.exe"

The process WinServices.exe:1256 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C6 F1 00 22 17 31 1A C4 F8 DA 93 07 EA EE C0 F8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

The process WinServices.exe:664 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1B 77 DE A2 F5 27 9F 2E F6 33 14 D3 F1 7B 4A B6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WinServices" = "C:\DOCUME~1\"%CurrentUserName%"\WinServices\WinServices.exe"

The process youtube_downloader_hd_setup1.tmp:912 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "31 14 49 FD F1 4E 51 98 B1 4C 29 FE BB 10 45 C1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

Dropped PE files

MD5	File path
e51ea3eedbf0065bd0e1b837e6b43086	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\is-D10QC.tmp\youtube_downloader_hd_setup1.tmp
a5b88a7e99f6bb3017d04b689afe42eb	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\is-MMMT0.tmp\OCSetupHlp.dll
0ee914c6f0bb93996c75941e1ad629c6	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\is-MMMT0.tmp\_isetup\_RegDLL.tmp
92dc6ef532fbb4a5c3201469a5b5eb63	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\is-MMMT0.tmp\_isetup\_shfoldr.dll
709e489388e6fe5c0553c8349db3e937	c:\WINDOWS\system32\service.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1456
youtube_downloader_hd_setup1.exe:1316
netsh.exe:1852
netsh.exe:1816
mscorsvw.exe:1912
service.exe:1488
WinServices.exe:1256
WinServices.exe:664
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\is-D10QC.tmp\youtube_downloader_hd_setup1.tmp (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%System%\wbem\Logs\wbemprox.log (658 bytes)
%System%\service.exe (7726 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-MMMT0.tmp\OCSetupHlp.dll (6841 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-MMMT0.tmp\_isetup\_RegDLL.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-MMMT0.tmp\_isetup\_shfoldr.dll (23 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Win - Services" = "service.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices]
"Win - Services" = "service.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Win - Services" = "service.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WinServices" = "C:\DOCUME~1\"%CurrentUserName%"\WinServices\WinServices.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	74526	74752	4.54396	a8692f5ba740240ef0f9a827376f76f9
.rdata	81920	7445	7680	3.46159	d4f36accffde0bf520f52486679ccf0d
.data	90112	96036	512	2.46008	b6c7edb5b7fec47a37a622cc5d71f3f4
.CRT	188416	32	512	0.273198	439411041ee0b8261668525c5c132cd9
.rsrc	192512	21440	21504	3.58037	0d498d13c02bd930d48405a3c11eeb71

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 1
5d35329ccc9712ccf7676cf85ef40239

Network Activity

URLs

URL	IP
hxxp://api.opencandy.com/?bn=3&bv=6.00.2900.5512&clientv=40&cltzone=120&csk=06456538756839525933-12365717287063912902&language=en,en&method=get_offers&mstime=0.968&os=WIN5.1SP3&product_key=b6e7f294ab12f3477346b5f53eed5fd5&v=1.0&signature=c12b7e412d505c46427a0b5b7f89d2b9	162.209.122.21
hxxp://api.opencandy.com/?bn=3&bv=6.00.2900.5512&clientv=40&cltzone=120&csk=06456538756839525933-12365717287063912902&language=en,en&method=get_offers&mstime=0.406&os=WIN5.1SP3&product_key=fdeb68345c10f37356b66f7a9ff895fb&v=1.0&signature=16ade015fd3dbcd8437b19dc36a2ce10	162.209.122.21
hxxp://a469.d.akamai.net/templates/3212/0/63289.png
hxxp://a469.d.akamai.net/templates/7201/0/56564.png
hxxp://cdn3.opencandy.com/templates/7201/0/56564.png	184.84.243.41
hxxp://cdn3.opencandy.com/templates/3212/0/63289.png	184.84.243.41

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /templates/7201/0/56564.png HTTP/1.1

Host: cdn3.opencandy.com

Accept: */*

HTTP/1.1 200 OK

x-amz-id-2: mkWvH5okw/8CW/ESXmmDuviUjIZ7o6GP51qnUN1CvoPlMd2AIwh dNhdPPZEMkUQ

x-amz-request-id: DEA0CAD6BC0666A3

Last-Modified: Sat, 12 Jul 2014 12:06:59 GMT

ETag: "b3a16b36134e272508820d78cac3333a"

Accept-Ranges: bytes

Content-Type: image/png

Content-Length: 23193

Server: AmazonS3

Cache-Control: max-age=300

Date: Mon, 17 Nov 2014 06:19:13 GMT

Connection: keep-alive

.PNG........IHDR.......;........8.. .IDATx...{\Tu....HHx.d.iB......"!*.V./yI..L.o.ff.V.r..\/[..ii...jjd......7$......,...h......p...8....x...s>.......8g.y.......B.!t.R...!...4...!..:..U.!...l.B.!..ds.B.!t&...B..3.\..B....*..B.L6W!..Bg...!..:.u.....0..xyy....\...`.`0.c.....U...[......k:.!...i.\-...;w.`0...Cvv....O...`.....G.V9 .....h.r[.....c0.X.|yM..Yi......P....i.\]\\X.x1u........7..../.z.j.F..A........;..7.....r[..y....._.!.g.o....a6..X.~=.N.b.....y.OOO.|.M.._....c..........2..Jo..........e.....".z.!. X.[..V..l6..... W.r..S.L! .///....5k.%%%.c.......///|||........c..;...g.y...H..=...d..m...c2..6m..<G9.HLL.W.^.L&.1.V."88...|.f....`.o....edd.......i..5....*..(..c4....F...INN...(....e./...3..s.7o...7......;.M.6.0{.l.4iBaa!O=...6mb..Y\.x....3s.Lf.....C..................y.&%%%.....>...K.r..E.6m.{.....3 .k.X.X,l...../.l.2..?....9p....rss..........c..4........R\\... ..{...$%Â¦.9v.....\.x.i.........B.....?.>yyyl...B<..........3i.$RRR....p.3......5k.9r$.~.-/....<. W!....6W///.....g.}.6!!!..=....x...{......#...`..1..X.....*...?..K.........9}.4.=.....4h..!C...y....uq!11...`....:t(M.6.../.t.wHH...........O@@........N.<.)........xxx.......111,\.Ps.>...~..........qss.I.&e.qv>J...cG....{>..#Myvww.....B..:{Bll,........,Y...w..5m........7o.....<..C..6((.....p..1...;g..J].rE....w....s..)~..G.]...z.Y...<..Xqq1.}..`?.O<.....].}..<..CDEE1k.,.....u.f.....1.by...*.g.A......,.\......U.....v.j.s.v...Q.YO.n...m.....U.........LBB..'O.......UKl`?........ m...N.:....|..G..1Bs...wuu.......<.n

<<< skipped >>>

GET /?bn=3&bv=6.00.2900.5512&clientv=40&cltzone=120&csk=06456538756839525933-12365717287063912902&language=en,en&method=get_offers&mstime=0.968&os=WIN5.1SP3&product_key=b6e7f294ab12f3477346b5f53eed5fd5&v=1.0&signature=c12b7e412d505c46427a0b5b7f89d2b9 HTTP/1.1

Host: api.opencandy.com

Accept: */*

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Date: Mon, 17 Nov 2014 06:18:54 GMT

Server: Apache

X-Robots-Tag: noindex

Last-Modified: Mon, 17 Nov 2014 06:18:54 GMT

Cache-Control: no-store, no-cache, must-revalidate

Cache-Control: post-check=0, pre-check=0

Pragma: no-cache

Connection: close

Transfer-Encoding: chunked

Content-Type: text/xml

2000..<?xml version="1.0"?>.<get_offers>. <installer_md5s>. <md5>0</md5>. </installer_md5s>. <session_key>2111ba69daa39bd9bcdcbcbc24b8a6bb</session_key><product_name><![CDATA[Youtube Downloader HD]]></product_name>. <offer id="7364" instance_id="57378" language="en" advertiser_id="1034"> . <name><![CDATA[Entrusted Search Protect]]></name>. <exclusions tags="cat_search,cat_homepage"/>. <filters applies="" keys=""/>. <package_url>hXXp://cdn3.opencandy.com/p/1213/dl/dm319g.exe</package_url>. <package_md5>5902902ecbf5633ef7116409f8c0fe45</package_md5>. <package_filesize>307672</package_filesize>. <package_tool_version/>.<styles><image_source name="imgsrc">hXXp://cdn3.opencandy.com/templates/7364/0/57378.png</image_source></styles>. <banner_title><![CDATA[Install Entrusted Search Protect]]></banner_title>. <banner_description><![CDATA[Recommended by Youtube Downloader HD]]></banner_description>.<offer_settings pass_selected="true" concat_selected_separator=";" selected_prefix="/OCCHECKS="/><panel>.......<image name="main" imagesource="imgsrc" size="471,220" position="0,0" normalimagefrom="0,0"/> ..<image imagesource="imgsrc" size="420x15" position="5000,134" normalimagefrom="38,259" triggers="offershown:any:show,se

<<< skipped >>>

GET /?bn=3&bv=6.00.2900.5512&clientv=40&cltzone=120&csk=06456538756839525933-12365717287063912902&language=en,en&method=get_offers&mstime=0.406&os=WIN5.1SP3&product_key=fdeb68345c10f37356b66f7a9ff895fb&v=1.0&signature=16ade015fd3dbcd8437b19dc36a2ce10 HTTP/1.1

Host: api.opencandy.com

Accept: */*

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Date: Mon, 17 Nov 2014 06:18:54 GMT

Server: Apache

X-Robots-Tag: noindex

Last-Modified: Mon, 17 Nov 2014 06:18:54 GMT

Cache-Control: no-store, no-cache, must-revalidate

Cache-Control: post-check=0, pre-check=0

Pragma: no-cache

Connection: close

Transfer-Encoding: chunked

Content-Type: text/xml

2000..<?xml version="1.0"?>.<get_offers>. <installer_md5s>. <md5>0</md5>. </installer_md5s>. <session_key>294fda649a19d6b8e8a46b1799ae3cbb</session_key><product_name><![CDATA[Youtube Downloader HD]]></product_name>. <offer id="3212" instance_id="63289" language="en" advertiser_id="667"> . <name><![CDATA[SpeedUpMyPC 2014 ]]></name>. <exclusions tags="cat_utility_registry"/>. <filters applies="" keys=""/>. <package_url>hXXp://cdn3.opencandy.com/p/1213/dl/dm319g.exe</package_url>. <package_md5>5902902ecbf5633ef7116409f8c0fe45</package_md5>. <package_filesize>307672</package_filesize>. <package_tool_version/>.<styles><image_source name="imgsrc">hXXp://cdn3.opencandy.com/templates/3212/0/63289.png</image_source></styles>. <banner_title><![CDATA[Install SpeedUpMyPC 2014 ]]></banner_title>. <banner_description><![CDATA[Recommended by Youtube Downloader HD]]></banner_description>.<offer_settings pass_selected="true" concat_selected_separator=";" selected_prefix="/OCCHECKS="/><panel>.......<image name="main" imagesource="imgsrc" size="471,220" position="0,0" normalimagefrom="0,0"/> ..<image imagesource="imgsrc" size="432x50" position="18,70" normalimagefrom="36,226" triggers="offershown:any:show,select:304:show,select:

<<< skipped >>>

GET /templates/3212/0/63289.png HTTP/1.1

Host: cdn3.opencandy.com

Accept: */*

HTTP/1.1 200 OK

x-amz-id-2: eHIbA/THfo27QIJ4amsYABjyuXIy/MJi2/6T/IuaUKDi7xlxgrQobzcSh5uktAiXGHTJT1YtaEY=

x-amz-request-id: CE2191C328D26881

Last-Modified: Wed, 29 Oct 2014 21:55:03 GMT

ETag: "b6bdeb14f47bcd070156d9394127c7ef"

Accept-Ranges: bytes

Content-Type: image/png

Content-Length: 18683

Server: AmazonS3

Cache-Control: max-age=296

Date: Mon, 17 Nov 2014 06:18:59 GMT

Connection: keep-alive

.PNG........IHDR.......h........a.. .IDATx...{\T.......xa.h..(...".H..(.!.^.F /......G...%.L....i...Hy...F.o...H!..M.""...............~>~.={......3{...........H2&M........ .....\...$..JDD$1&W""".1....I.....HbL.DDD.cr%""... ........................;.....G.... W.<......$K..N..L&.....O..%.....\...G7u(.$OOO..;..}.QS.BD..2..1....<yR.&%...........6n.8............!"z.<...3f...q..................C.B..#$$.eeeHOOG.~.....n...../_.'''..."**....EEE....\...............kkkt.........,Y.'''(...x......:.C...7o..M.....<.r.......5k`oo.///......X,.......J..\.Gxx8...........=.J#3.......fff...FJJ.D....."ir....k...3g..,X....c...x....h.".o....]...sQXX. .Z...P\\.w.y..N....;......l.={....HJJBll,\\\PTT...h\.pAp[]g..E..=jm3....x.......(....u..e..dff...c8r....8...x..Z....s.....k.B.....spuu...[..G,..c...PPP...J|.....};RRRp...dgg.....D............\.DDO..r[x................t899............# .J..={......`..m..m..-......b......F.>}...ob...z.....@..mkm3....|DFF...^......9r$lll..o...........R.777..\.....ann....C.Vk.5.ONN.`,^^^pvv.........j..'O...Q...q........5,--q..5.9$"..I.\.4k..&&&.y.......h......w."&&F..G.=........(DDD`..i..t.i..`.......F.f....}...g.F.......D......$==...7o...p.......=...H..k\.zU..........ZYY.w.y.;v.........z.*...q...|.......;.o..X.v-...Q]].m..!11. V....71e..DDD //Op[]].t...'Dc../ ..6l...........6m.Z.FII.6o......f.p,b<<<.............S.......?...R).x...$.^..|.Z.{.....@HH.<==.z.j......?FQQ.z....W."""....8t.P..T*........../..............q..E...../.@VV........V.....j..dL........../* 1h. ......Spw

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

youtube_downloader_hd_setup1.exe_1316:

.idata

.rdata

P.reloc

P.rsrc

kernel32.dll

.DEFAULT\Control Panel\International

File I/O error %d

lzmadecompsmall: Compressed data is corrupted (%d)

lzmadecompsmall: %s

LzmaDecode failed (%d)

shell32.dll

/SL5="$%x,%d,%d,

Inno Setup Setup Data (5.4.2)

Inno Setup Messages (5.1.11)

user32.dll

oleaut32.dll

advapi32.dll

RegOpenKeyExA

RegCloseKey

GetWindowsDirectoryA

MsgWaitForMultipleObjects

ExitWindowsEx

comctl32.dll

name="JR.Inno.Setup"

version="1.0.0.0"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

true

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and time

I/O error %d

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

External exception %x

YoutubeDownloaderHD.com

2.9.9.13

youtube_downloader_hd_setup1.tmp_912:

.idata

.rdata

P.reloc

P.rsrc

kernel32.dll

%s_%d

EInvalidOperation

TKeyEvent

TKeyPressEvent

crSQLWait

t.HtR

EInvalidGraphicOperation

TWindowState

poProportional

KeyPreview

WindowState

OnKeyDown

OnKeyPress

OnKeyUp

CTL3D32.DLL

PasswordChar

ssHorizontal

OnKeyUpheB

RegDeleteKeyExA

advapi32.dll

.DEFAULT\Control Panel\International

user32.dll

shlwapi.dll

TPSExec

TPSRuntimeClassImporter

TPSExportedVar

Cannot Import

Interface not supported

Uh.oD

TPSCustomDebugExec

TPSDebugExec

uxtheme.dll

oleacc.dll

RICHED20.DLL

RICHED32.DLL

File I/O error %d

Messages file "%s" is missing. Please correct the problem or obtain a new copy of the program.

shell32.dll

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

WININIT.INI

t.Htb

Software\Microsoft\Windows\CurrentVersion\SharedDLLs

RegCreateKeyEx

RegOpenKeyEx

sfc.dll

cmd.exe" /C "

COMMAND.COM" /C

PendingFileRenameOperations

PendingFileRenameOperations2

Software\Microsoft\Windows\CurrentVersion\Fonts

Software\Microsoft\Windows NT\CurrentVersion\Fonts

IPropertyStore::SetValue(PKEY_AppUserModel_ID)

IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall)

OLEAUT32.DLL

Uh.kE

Log opened. (Time zone: UTC%s%.2u:%.2u)

%s Log %s #%.3u.txt

MsgWaitForMultipleObjects

regsvr32.exe"

Spawning _RegDLL.tmp

_isetup\_RegDLL.tmp

_RegDLL.tmp %u %u

REGDLL failed with exit code 0x%x

REGDLL mutex wait failed (%d, %d)

REGDLL returned unknown result code %d

Cannot register 64-bit DLLs on this version of Windows

HELPER_EXE_AMD64

Cannot utilize 64-bit features on this version of Windows

64-bit helper EXE wasn't extracted

\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x

CreateNamedPipe

SetNamedPipeHandleState

helper %d 0x%x

Helper process PID: %u

Stopping 64-bit helper process. (PID: %u)

Helper process exited with failure code: 0x%x

TransactNamedPipe

TransactNamedPipe/GetOverlappedResult

Helper: Command did not execute

SOFTWARE\Microsoft\.NETFramework

.NET Framework not found

SOFTWARE\Microsoft\.NETFramework\Policy\v4.0

v4.0.30319

SOFTWARE\Microsoft\.NETFramework\Policy\v2.0

v2.0.50727

SOFTWARE\Microsoft\.NETFramework\Policy\v1.1

v1.1.4322

.NET Framework version %s not found

Fusion.dll

Failed to load .NET Framework DLL "%s"

Failed to get address of .NET Framework CreateAssemblyCache function

.NET Framework CreateAssemblyCache function failed

MoveFileEx failed (%d).

Deleting directory: %s

Failed to delete directory (%d). Will retry later.

Failed to delete directory (%d). Will delete on restart (if empty).

Failed to delete directory (%d).

Deleting file: %s

Failed to delete the file; it may be in use (%d).

ExtractRecData: Unicode data unsupported by this build

The file appears to be in use (%d). Will delete on restart.

Decrementing shared count (%d-bit): %s

Unregistering 64-bit DLL/OCX: %s

Unregistering 32-bit DLL/OCX: %s

Not unregistering DLL/OCX again: %s

Unregistering 64-bit type library: %s

Unregistering 32-bit type library: %s

Uninstalling from GAC: %s

Running Exec filename:

Running Exec parameters:

CreateProcess failed (%d).

Process exit code: %u

Running ShellExec filename:

Running ShellExec parameters:

ShellExecuteEx failed (%d).

Skipping RunOnceId "%s" filename: %s

Unregistering font: %s

zlib: Internal error. Code %d

1.2.1

bzlib: Internal error. Code %d

lzmadecomp: %s

lzmadecomp: Compressed data is corrupted (%d)

DecodeToBuf failed (%d)

TPasswordEdit

PasswordEdit(

Password

c:\directory

Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

PasswordPage

PasswordLabel

PasswordEdit

PasswordEditLabel$

Could not find page with ID %d

Software\Microsoft\Windows\CurrentVersion\Uninstall

%s\%s_is1

CheckPassword

PrepareToInstall failed: %s

Need to restart Windows? %s

/:*?"|

\/:*?"|

%s-%d.bin

%s-%d%s.bin

..\DISK%d\

Asking user for new disk containing "%s".

Cannot read an encrypted file before the key has been set

LoggedMsgBox returned an unexpected value. Assuming Abort.

Software\Microsoft\Windows\CurrentVersion\Uninstall\

5.4.3 (a)

URLInfoAbout

URLUpdateInfo

Creating directory: %s

Setting permissions on directory: %s

Failed to set permissions on directory (%d).

Setting NTFS compression on directory: %s

Unsetting NTFS compression on directory: %s

Failed to set NTFS compression state (%d).

IMsg

Failed to set value in Fonts registry key.

Failed to open Fonts registry key.

Setting permissions on file: %s

Failed to set permissions on file (%d).

Setting NTFS compression on file: %s

Unsetting NTFS compression on file: %s

Dest filename: %s

Dest file is protected by Windows File Protection.

Time stamp of our file: %s

Time stamp of existing file: %s

Version of our file: %u.%u.%u.%u

Version of existing file: %u.%u.%u.%u

Existing file is protected by Windows File Protection. Skipping.

Uninstaller requires administrator: %s

The existing file appears to be in use (%d). Will replace on restart.

The existing file appears to be in use (%d). Retrying.

Registering file as a font ("%s")

Cannot install files to 64-bit locations on this version of Windows

desktop.ini

.ShellClassInfo

{0AFACED1-E828-11D1-9187-B532F1E9575D}

target.lnk

Filename: %s

Desktop.ini

Software\Microsoft\Windows\CurrentVersion\App Paths\

Setting permissions on registry key: %s\%s

Could not set permissions on the registry key because it currently does not exist.

Failed to set permissions on registry key (%d).

Cannot access 64-bit registry keys on this version of Windows

Registration executable created: %s

Software\Microsoft\Windows\CurrentVersion\RunOnce

Registering 64-bit DLL/OCX: %s

Registering 32-bit DLL/OCX: %s

Registering 64-bit type library: %s

Registering 32-bit type library: %s

Directory for uninstall files: %s

Will append to existing uninstall log: %s

Will overwrite existing uninstall log: %s

Creating new uninstall log: %s

LoggedMsgBox returned an unexpected value. Assuming Cancel.

Fatal exception during installation process (%s):

ExtractTemporaryFile: The file "%s" was not found

Invalid symbol '%s' found

Invalid token '%s' found

QuerySpawnServer: Unexpected response: $%x

CallSpawnServer: Unexpected response: $%x

CallSpawnServer: Unexpected status: %d

ShellExecuteEx

ShellExecuteEx returned hProcess=0

Wnd=$%x

FormKeyDown

PasswordCheckHash

Expression error '%s'

Cannot evaluate "%s" constant during Uninstall

Cannot access a 64-bit key in a "reg" constant on this version of Windows

Unknown custom message name "%s" in "cm" constant

srcexe

Cannot expand "pf64" constant on this version of Windows

Cannot expand "cf64" constant on this version of Windows

uninstallexe

Cannot expand "dotnet2064" constant on this version of Windows

Cannot expand "dotnet4064" constant on this version of Windows

Failed to expand shell folder constant "%s"

Unknown constant "%s"

Software\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows NT\CurrentVersion

cmd.exe

COMMAND.COM

\_RegDLL.tmp

REGDLL_EXE

\_setup64.tmp

_isetup\_shfoldr.dll

Failed to get version numbers of _shfoldr.dll

shfolder.dll

Failed to load DLL "%s"

Found pending rename or delete that matches one of our files: %s

Windows version: %u.%u.%u%s (NT platform: %s)

64-bit Windows: %s

Processor architecture: %s

Defaulting to %s for suppressed message box (%s):

Message box (%s):

User chose %s.

MsgBox failed.

/SPAWNWND=$%x /NOTIFYWND=$%x

64-bit install mode: %s

%d.%d

_isetup\_isdecmp.dll

_isetup\_iscrypt.dll

/Password=

/SuppressMsgBoxes

/DETACHEDMSG

-0.bin

Setup version: Inno Setup version 5.4.3 (a)

Original Setup EXE:

Windows NT

Windows

Not restarting Windows because Setup is being run from the debugger.

Restarting Windows.

Inno Setup version 5.4.3 (a)

hXXp://VVV.innosetup.com/

hXXp://VVV.remobjects.com/ps

Cannot run files in 64-bit locations on this version of Windows

Type: Exec

Type: ShellExec

Will not restart Windows automatically.

System\CurrentControlSet\Control\Windows

TOutputMsgWizardPage

TOutputMsgMemoWizardPage

PasswordEdit

PasswordEditLabel

MsgLabel

Msg1Label

Msg2Label

function CreateOutputMsgPage(const AfterID: Integer; const ACaption, ADescription, AMsg: String): TOutputMsgWizardPage;

function CreateOutputMsgMemoPage(const AfterID: Integer; const ACaption, ADescription, ASubCaption: String; const AMsg: AnsiString): TOutputMsgMemoWizardPage;

function MsgBox(const Text: String; const Typ: TMsgBoxType; const Buttons: Integer): Integer;

function GetIniString(const Section, Key, Default, Filename: String): String;

function GetIniInt(const Section, Key: String; const Default, Min, Max: Longint; const Filename: String): Longint;

function GetIniBool(const Section, Key: String; const Default: Boolean; const Filename: String): Boolean;

function IniKeyExists(const Section, Key, Filename: String): Boolean;

function SetIniString(const Section, Key, Value, Filename: String): Boolean;

function SetIniInt(const Section, Key: String; const Value: Longint; const Filename: String): Boolean;

function SetIniBool(const Section, Key: String; const Value: Boolean; const Filename: String): Boolean;

procedure DeleteIniEntry(const Section, Key, Filename: String);

function GetCmdTail: String;

function StringChangeEx(var S: String; const FromStr, ToStr: String; const SupportDBCS: Boolean): Integer;

function RegValueExists(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;

function RegQueryStringValue(const RootKey: Integer; const SubKeyName, ValueName: String; var ResultStr: String): Boolean;

function RegQueryMultiStringValue(const RootKey: Integer; const SubKeyName, ValueName: String; var ResultStr: String): Boolean;

function RegDeleteKeyIncludingSubkeys(const RootKey: Integer; const SubkeyName: String): Boolean;

function RegDeleteKeyIfEmpty(const RootKey: Integer; const SubkeyName: String): Boolean;

function RegKeyExists(const RootKey: Integer; const SubKeyName: String): Boolean;

function RegDeleteValue(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;

function RegGetSubkeyNames(const RootKey: Integer; const SubKeyName: String; var Names: TArrayOfString): Boolean;

function RegGetValueNames(const RootKey: Integer; const SubKeyName: String; var Names: TArrayOfString): Boolean;

function RegQueryDWordValue(const RootKey: Integer; const SubKeyName, ValueName: String; var ResultDWord: Cardinal): Boolean;

function RegQueryBinaryValue(const RootKey: Integer; const SubKeyName, ValueName: String; var ResultStr: AnsiString): Boolean;

function RegWriteStringValue(const RootKey: Integer; const SubKeyName, ValueName, Data: String): Boolean;

function RegWriteExpandStringValue(const RootKey: Integer; const SubKeyName, ValueName, Data: String): Boolean;

function RegWriteMultiStringValue(const RootKey: Integer; const SubKeyName, ValueName, Data: String): Boolean;

function RegWriteDWordValue(const RootKey: Integer; const SubKeyName, ValueName: String; const Data: Cardinal): Boolean;

function RegWriteBinaryValue(const RootKey: Integer; const SubKeyName, ValueName: String; const Data: AnsiString): Boolean;

function CheckForMutexes(Mutexes: String): Boolean;

function Exec(const Filename, Params, WorkingDir: String; const ShowCmd: Integer; const Wait: TExecWait; var ResultCode: Integer): Boolean;

function ExecAsOriginalUser(const Filename, Params, WorkingDir: String; const ShowCmd: Integer; const Wait: TExecWait; var ResultCode: Integer): Boolean;

function ShellExec(const Verb, Filename, Params, WorkingDir: String; const ShowCmd: Integer; const Wait: TExecWait; var ErrorCode: Integer): Boolean;

function ShellExecAsOriginalUser(const Verb, Filename, Params, WorkingDir: String; const ShowCmd: Integer; const Wait: TExecWait; var ErrorCode: Integer): Boolean;

function MakePendingFileRenameOperationsChecksum: String;

function CreateShellLink(const Filename, Description, ShortcutTo, Parameters, WorkingDir, IconFilename: String; const IconIndex, ShowCmd: Integer): String;

function ExitSetupMsgBox: Boolean;

function GetWindowsVersion: Cardinal;

procedure GetWindowsVersionEx(var Version: TWindowsVersion);

function GetWindowsVersionString: String;

function SuppressibleMsgBox(const Text: String; const Typ: TMsgBoxType; const Buttons, Default: Integer): Integer;

function CustomMessage(const MsgName: String): String;

function SendMessage(const Wnd: HWND; const Msg, WParam, LParam: Longint): Longint;

function PostMessage(const Wnd: HWND; const Msg, WParam, LParam: Longint): Boolean;

function SendNotifyMessage(const Wnd: HWND; const Msg, WParam, LParam: Longint): Boolean;

function SendBroadcastMessage(const Msg, WParam, LParam: Longint): Longint;

function PostBroadcastMessage(const Msg, WParam, LParam: Longint): Boolean;

function SendBroadcastNotifyMessage(const Msg, WParam, LParam: Longint): Boolean;

procedure RaiseException(const Msg: String);

function SetPreviousData(const PreviousDataKey: Integer; const ValueName, ValueData: String): Boolean;

Cannot call "%s" function during Setup

Cannot call "%s" function during Uninstall

Cannot call "%s" function during non Unicode Setup or Uninstall

CREATEOUTPUTMSGPAGE

CREATEOUTPUTMSGMEMOPAGE

MSGBOX

Invalid RootKey value

INIKEYEXISTS

GETCMDTAIL

REGKEYEXISTS

REGDELETEKEYINCLUDINGSUBKEYS

REGDELETEKEYIFEMPTY

REGGETSUBKEYNAMES

CHECKFORMUTEXES

SHELLEXEC

SHELLEXECASORIGINALUSER

MAKEPENDINGFILERENAMEOPERATIONSCHECKSUM

Unknown custom message name "%s"

EXITSETUPMSGBOX

GETWINDOWSVERSION

GETWINDOWSVERSIONSTRING

%u.%.2u.%u

SUPPRESSIBLEMSGBOX

%u.%u.%u.%u

Cannot disable FS redirection on this version of Windows

GetWindowsVersionEx

Runtime Error (at %d:%d):

Exception "%s" at address %p

TScriptRunner.SetPSExecParameters: Invalid type

TScriptRunner.LoadScript failed

Remove shared file %s? User chose %s%s

/INITPROCWND=$%x

/SECONDPHASE="%s" /FIRSTPHASEWND=$%x

Original Uninstall EXE:

Install was done in 64-bit mode but not running 64-bit Windows now

Removed all? %s

Not restarting Windows because Uninstall is being run from the debugger.

IMsgt

isRS-???.tmp

isRS-%.3u.tmp

DisableProcessWindowsGhosting

FTPF0P

0123456789abcdefInno Setup Setup Data (5.4.2)

Inno Setup Messages (5.1.11)

oleaut32.dll

RegQueryInfoKeyA

RegOpenKeyExA

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyExA

RegCloseKey

GetWindowsDirectoryA

CreateNamedPipeA

mpr.dll

version.dll

gdi32.dll

SetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

MapVirtualKeyA

GetKeyState

GetKeyNameTextA

ExitWindowsEx

EnumWindows

EnumThreadWindows

comctl32.dll

ole32.dll

ShellExecuteExA

ShellExecuteA

comdlg32.dll

.text

`.rdata

@.data

.pdata

@.rsrc

COMCTL32.dll

SHLWAPI.dll

SetProcessShutdownParameters

KERNEL32.dll

ADVAPI32.dll

SHELL32.dll

OLEAUT32.dll

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

`.data

.rsrc

@.reloc

Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

SOFTWARE\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion\ProfileReconciliation

RegKey

GetWindowsDirectoryW

RegOpenKeyA

SHFOLDER.dll

dll\shfolder.dbg

Font.Color

Font.Height

Font.Name

Font.Style

name="JR.Inno.Setup"

version="1.0.0.0"

true

Cannot assign a %s to a %s

Cannot create file %s

Cannot open file %s

Stream write error Out of memory while expanding memory stream*Can't write to a read-only resource stream.WriteObject called twice for the same instance

Class %s not found

Resource %s not found!Resource %s is of incorrect class

List index out of bounds Operation not allowed on sorted string list%String list does not allow duplicates

Tab index out of bounds#A component named %s already exists$''%s'' is not a valid component name

A class named %s already exists#''%s'' is not a valid integer value

Error reading %s.%s: %s

Ancestor for '%s' not found

Bitmap is empty!Cannot change the size of an icon$Unknown picture file extension (.%s)

Unsupported clipboard format

Error creating window Cannot focus a disabled or invisible window!Control '%s' has no parent window

%s property out of range

%s on %s@GroupIndex cannot be less than a previous menu item's GroupIndex2Cannot have more than one MDI form per application

Could not load CARDS.DLL

Duplicate CardId found"An error returned from DDE ($0%x)/DDE Error - conversation not established ($0%x)0Error occurred when DDE ran out of memory ($0%x)"Unable to connect DDE conversation

Grid too large for operation Too many rows or columns deleted

%s on line %d

''%s'' expected

%s expected

Invalid input value7Invalid input value. Use escape key to abandon changes

Value must be between %d and %d

''%s'' is not a valid date

''%s'' is not a valid time#''%s'' is not a valid date and time

Invalid file name - %s

All files (*.*)|*.*

&Files: (*.*)

Invalid clipboard format Clipboard does not support Icons

Custom Colors Operation not supported on selected printer.There is no default printer currently selected

Unable to write to %s

Invalid data type for '%s'

Failed to create key %s

Failed to set data for '%s'

Failed to get data for '%s'9Synchronize called when main VCL thread in a WaitFor call0Unknown RichEdit conversion file extension (.%s)

/Menu '%s' is already being used by another form

Failed to Save Stream)StatusBar cannot have more than 64 panels!Error assigning Hot-Key to %s. %s

Hot-Key is invalid#Window is invalid or a child window%Hot-Key is assigned to another window %s is already associated with %s!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and time

I/O error %d

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

External exception %x

n%USERPROFILE%

r%SYSTEMROOT%

5.50.4807.2300

Microsoft(R) Windows (R) 2000 Operating System

Datos de programa%Configuraci

51.52.0.0

RunDll32.exe_628:

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

GDI32.dll

USER32.dll

IMAGEHLP.dll

rundll32.pdb

.....eZXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

...eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

%Xnnnnnnnnnnnnnnn1

O3$dS7"%U9

.manifest

5.1.2600.5512 (xpsp.080413-2105)

RUNDLL.EXE

Windows

Operating System

5.1.2600.5512

YThere is not enough memory to run the file %s.

Please close other windows and try again.

9The file %s or one of its components could not be opened.

0The file %s or one of its components cannot run.

MThe file %s or one of its components requires a different version of Windows.

UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"

Error in %s

Missing entry:%s

Error loading %s

RunDll32.exe_1068:

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

GDI32.dll

USER32.dll

IMAGEHLP.dll

rundll32.pdb

.....eZXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

...eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

%Xnnnnnnnnnnnnnnn1

O3$dS7"%U9

.manifest

5.1.2600.5512 (xpsp.080413-2105)

RUNDLL.EXE

Windows

Operating System

5.1.2600.5512

YThere is not enough memory to run the file %s.

Please close other windows and try again.

9The file %s or one of its components could not be opened.

0The file %s or one of its components cannot run.

MThe file %s or one of its components requires a different version of Windows.

UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"

Error in %s

Missing entry:%s

Error loading %s

service.exe_496:

.text

`.rdata

@.data

.idata

.rsrc

@.reloc

Invalid allocation size: %u bytes.

Client hook allocation failure at file %hs line %d.

_CrtCheckMemory()

_CrtIsValidHeapPointer(pUserData)

Allocation too large or negative: %u bytes.

Client hook re-allocation failure at file %hs line %d.

DAMAGE: after %hs block (#%d) at 0xX.

DAMAGE: before %hs block (#%d) at 0xX.

memory check error at 0xX = 0xX, should be 0xX.

%hs located at 0xX is %u bytes long.

%hs allocated at file %hs(%d).

DAMAGE: on top of Free block at 0xX.

Bad memory block found at 0xX.

_CrtMemCheckPoint: NULL state pointer.

_CrtMemDifference: NULL state pointer.

crt block at 0xX, subtype %x, %u bytes long.

normal block at 0xX, %u bytes long.

client block at 0xX, subtype %x, %u bytes long.

%hs(%d) :

#File Error#(%d) :

Data: %s

%s(%d) : %s

_CrtDbgReport: String too long or IO Error

Second Chance Assertion Failed: File %s, Line %d

user32.dll

Debug %s!

Program: %s%s%s%s%s%s%s%s%s%s%s

portuguese-brazilian

VVV.symantec.com

127.0.0.1

securityresponse.symantec.com

symantec.com

VVV.sophos.com

sophos.com

VVV.mcafee.com

mcafee.com

liveupdate.symantecliveupdate.com

VVV.viruslist.com

viruslist.com

f-secure.com

VVV.f-secure.com

kaspersky.com

kaspersky-labs.com

VVV.avp.com

VVV.kaspersky.com

avp.com

VVV.networkassociates.com

networkassociates.com

VVV.ca.com

ca.com

mast.mcafee.com

my-etrust.com

VVV.my-etrust.com

download.mcafee.com

dispatch.mcafee.com

secure.nai.com

nai.com

VVV.nai.com

update.symantec.com

updates.symantec.com

us.mcafee.com

liveupdate.symantec.com

customer.symantec.com

rads.mcafee.com

trendmicro.com

VVV.trendmicro.com

VVV.grisoft.com

CDKey

prvkey

Software\Microsoft\Windows\CurrentVersion

Microsoft Windows Product ID

codkey

Software\Electronic Arts\EA GAMES\Global Operations\ergc

Global Operations

Software\Electronic Arts\EA Sports\FIFA 2002\ergc

Software\Electronic Arts\EA Sports\FIFA 2003\ergc

Software\Electronic Arts\EA Sports\FIFA 2006\ergc

Software\Electronic Arts\EA Sports\NHL 2002\ergc

Software\Electronic Arts\EA Sports\NHL 2003\ergc

Software\Electronic Arts\EA Sports\Nascar Racing 2002\ergc

Software\Electronic Arts\EA Sports\Nascar Racing 2003\ergc

Software\Techland\Chrome

Chrome

base\mp\sof2key

nwncdkey.ini

Key1=

Key2=

Key3=

KeyCode

3DMark06 Key

Password

Nod32 Pass

%s\%s

%s CD Key: (%s).

NOTICE %s :Authentication failed (%s!%s).

NOTICE %s :Your attempt has been logged.

[MAIN]: Password accepted.

[MAIN]: Failed to login user: %s, too many logins already.

$rndnick

rndnick

NICK %s

[MAIN]: Random nick change to: %s.

QUIT :%s

[THREADS]: Failed to start list thread, error: .

[PROCS]: Failed to start listing thread, error: .

cdkeys

[CDKEYS]: Search completed.

.::[ PassStore Executed ]::.

firefox

FireFox

FireFox Executed.

firefoxstop

Firefox

[FLUSHDNS]: Failed to load dnsapi.dll.

nick

join

JOIN %s %s

PART %s

[MAIN]: Sent IRC Raw: %s.

[THREADS]: Stopped: %d thread(s).

[THREADS]: Killed thread: %s.

[THREADS]: Failed to kill thread: %s.

[MAIN]: Prefix changed to: '%c'.

[SHELL]: File opened: %s

[SHELL]: Couldn't open file: %s

[MAIN]: Server changed to: '%s'.

[DNS]: Lookup: %s -> %s.

[PROC]: Process killed: %s

[PROC]: Failed to terminate process: %s

[PROC]: Process killed ID: %s

[PROC]: Failed to terminate process ID: %s

[FILE]: Deleted '%s'.

[VISIT]: URL: %s.

[VISIT]: Failed to start connection thread, error: .

mirccmd

[PSNIFF]: Failed to start sniffer thread, error: .

[PSNIFF]: Carnivore stopped. (%d thread(s) stopped.)

keylog

[KeyLog] Already running.

[KeyLog] pay-sites keylogger active.

[KeyLog] Normal key logger active.

[KeyLog] Unknow mode type.

[KeyLog] Failed to start logging thread, error: .

[KeyLog] Missing mode type.

Keylog

[MAIN]: Unrecognized command: %s.

privmsg

ACTION %s

MODE %s

%s %s %s :%s

[MAIN]: Repeat: %s

[MAIN]: Repeat not allowed in command line: %s

%s%s.exe

[UPDATE]: Downloading update from: %s.

[UPDATE]: Failed to start download thread, error: .

[EXEC]: Couldn't execute file.

[EXEC]: Commands: %s

[FILE]: Rename: '%s' to: '%s'.

[ICMP]: Flooding: (%s) for %s seconds.

[ICMP]: Failed to start flood thread, error: .

utorrent.seed

[DOWNLOAD]: Downloading URL: %s to: %s.

[DOWNLOAD]: Failed to start transfer thread, error: .

helo $rndnick

mail from:

rcpt to:

subject: %s

from: %s

[EMAIL]: Message sent to %s.

PASS %s

USER %s 0 0 :%s

[DOWNLOAD]: Couldn't open file for writing: %s.

[DOWNLOAD]: Filesize is incorrect. (Recevied: %d bytes, Expected: %d bytes.)

[DOWNLOAD]: CRC32 is incorrect. (Local CRC32: %d, Expected CRC32: %d.)

[DOWNLOAD]: File download: %.1fKB to: %s @ %.1fKB/sec.

[DOWNLOAD]: Opened: %s.

[DOWNLOAD]: Update failed: Error executing file: %s.

[DOWNLOAD]: Bad URL or DNS Error: %s.

\Program Files\Mozilla Firefox\MOZCRT19.dll

\Program Files\Mozilla Firefox\sqlite3.dll

\Program Files\Mozilla Firefox\nspr4.dll

\Program Files\Mozilla Firefox\plds4.dll

\Program Files\Mozilla Firefox\plc4.dll

\Program Files\Mozilla Firefox\nssutil3.dll

Application Data\Mozilla\Firefox

\profiles.ini

SOFTWARE\Clients\StartMenuInternet\firefox.exe\shell\open\command

nspr4.dll

plc4.dll

plds4.dll

softokn3.dll

nss3.dll

PK11_GetInternalKeySlot

PK11_CheckUserPassword

/signons.txt

/signons2.txt

/signons3.txt

[ICMP]: Error: socket() failed, returned: .

[ICMP]: Error: setsockopt() failed, returned: .

[ICMP]: Error sending packets to IP: %s. Packets sent: %d. Returned: .

[ICMP]: Done with %s flood to IP: %s. Sent: %d packet(s) @ %dKB/sec (%dMB).

PRIVMSG

%s %s :%s

Login - PayPal

moneybookers.com

AlertPay.com-My Way To Pay

Login: Step 1

h4cky0u.org

Login

Warez-BB.org :: Log in

DirectAdmin Login

Invision Power Services :: Invision Power Services : Login

Rapidshare-Premium.com - FREE Rapidshare Premium Link Generator

Play.com (UK)

Admin Login

Administrator Login

amazon.com

MessengerFX.com - Web Messenger

ILoveIM.com Web Messenger

Web and Mobile messenger everywhere - eBuddy former e-messenger

meebo.com

Complete Web Solutions: domains, hosting, site builders and SSL.

[KeyLog] %s (%s)

[KeyLog] %s

[KeyLog] .

. (Changed Windows: %s)

. (Buffer full) (%s)

. (Return) (%s)

kernel32.dll

ExitWindowsEx

GetAsyncKeyState

GetKeyState

advapi32.dll

RegOpenKeyExA

RegCreateKeyExA

RegCloseKey

gdi32.dll

ws2_32.dll

wininet.dll

HttpOpenRequestA

HttpSendRequestA

FtpGetFileA

FtpPutFileA

InternetOpenUrlA

InternetCrackUrlA

Mozilla/4.0 (compatible)

icmp.dll

netapi32.dll

dnsapi.dll

iphlpapi.dll

mpr.dll

shell32.dll

ShellExecuteA

odbc32.dll

SQLDriverConnect

SQLSetEnvAttr

SQLExecDirect

SQLAllocHandle

SQLFreeHandle

SQLDisconnect

userenv.dll

avicap32.dll

Kernel32.dll failed.

User32.dll failed.

Advapi32.dll failed.

Gdi32.dll failed.

Ws2_32.dll failed.

Wininet.dll failed.

Icmp.dll failed.

Netapi32.dll failed.

Dnsapi.dll failed.

Iphlpapi.dll failed.

Mpr32.dll failed.

Shell32.dll failed.

Odbc32.dll failed.

Avicap32.dll failed.

%s%s%s

%s Error: %s .

explorer.exe

%s %s

%sdel.bat

del "%s"

%%comspec%% /c %s %s

netsh.exe firewall add allowedprogram RIOTBOT.exe RIOTBOT ENABLE

Software\Microsoft\Internet Explorer\New Windows

[Msn] Message sent to %d contacts!

[FLUSHDNS]: Error getting ARP cache: .

[FLUSHDNS]: Not supported by this system.

%d.%d.%d.%d

\Program Files\eDonkey2000\incoming

WinExec

AVPCC.EXE

ACKWIN32.EXE

ADAWARE.EXE

ADVXDWIN.EXE

AGENTSVR.EXE

AGENTW.EXE

ALERTSVC.EXE

ALEVIR.EXE

ALOGSERV.EXE

AMON9X.EXE

ANTI-TROJAN.EXE

ANTIVIRUS.EXE

ANTS.EXE

APIMONITOR.EXE

APLICA32.EXE

APVXDWIN.EXE

ARR.EXE

ATCON.EXE

ATGUARD.EXE

ATRO55EN.EXE

ATUPDATER.EXE

ATWATCH.EXE

AU.EXE

AUPDATE.EXE

AUTODOWN.EXE

AUTOTRACE.EXE

AUTOUPDATE.EXE

AVCONSOL.EXE

AVE32.EXE

AVGCC32.EXE

AVGCTRL.EXE

AVGNT.EXE

AVGSERV.EXE

AVGSERV9.EXE

AVGUARD.EXE

AVGW.EXE

AVKPOP.EXE

AVKSERV.EXE

AVKSERVICE.EXE

AVKWCTl9.EXE

AVLTMAIN.EXE

AVNT.EXE

AVP.EXE

AVP32.EXE

AVPDOS32.EXE

AVPM.EXE

AVPTC32.EXE

AVPUPD.EXE

AVSCHED32.EXE

AVSYNMGR.EXE

AVWIN95.EXE

AVWINNT.EXE

AVWUPD.EXE

AVWUPD32.EXE

AVWUPSRV.EXE

AVXMONITOR9X.EXE

AVXMONITORNT.EXE

AVXQUAR.EXE

BACKWEB.EXE

BARGAINS.EXE

BD_PROFESSIONAL.EXE

BEAGLE.EXE

BELT.EXE

BIDEF.EXE

BIDSERVER.EXE

BIPCP.EXE

BIPCPEVALSETUP.EXE

BISP.EXE

BLACKD.EXE

BLACKICE.EXE

BLSS.EXE

BOOTCONF.EXE

BOOTWARN.EXE

BORG2.EXE

BPC.EXE

BRASIL.EXE

BS120.EXE

BUNDLE.EXE

BVT.EXE

CCEVTMGR.EXECSINJECT.EXE

CCAPP.EXE

CCEVTMGR.EXE

CCPXYSVC.EXE

CDP.EXE

CFD.EXE

CFGWIZ.EXE

CFIADMIN.EXE

CFIAUDIT.EXE

CFINET.EXE

CFINET32.EXE

CLAW95CF.EXE

CLEAN.EXE

CLEANER.EXE

CLEANER3.EXE

CLEANPC.EXE

CLICK.EXE

CMD32.EXE

CMESYS.EXE

CMGRDIAN.EXE

CMON016.EXE

CONNECTIONMONITOR.EXE

CPD.EXE

CPF9X206.EXE

CPFNT206.EXE

CTRL.EXE

CV.EXE

CWNB181.EXE

CWNTDWMO.EXE

Claw95.EXE

DATEMANAGER.EXE

DCOMX.EXE

DEFALERT.EXE

DEFSCANGUI.EXE

DEFWATCH.EXE

DEPUTY.EXE

DIVX.EXE

DLLCACHE.EXE

DLLREG.EXE

DOORS.EXE

DPF.EXE

DPFSETUP.EXE

DPPS2.EXE

DRWATSON.EXE

DRWEB32.EXE

DRWEBUPW.EXE

DSSAGENT.EXE

DVP95.EXE

DVP95_0.EXE

ECENGINE.EXE

EFPEADM.EXE

EMSW.EXE

ENT.EXE

ESAFE.EXE

ESCANH95.EXE

ESCANHNT.EXE

ESCANV95.EXE

ESPWATCH.EXE

ETHEREAL.EXE

ETRUSTCIPE.EXE

EVPN.EXE

EXANTIVIRUS-CNET.EXE

EXE.AVXW.EXE

EXPERT.EXE

EXPLORE.EXE

F-RBOT.EXE

F-SDBOT.EXE

F-SPYBOT.EXE

F-AGOBOT.EXE

F-RXBOT.EXE

F-AV.EXE

F-PHATBOT.EXE

F-FW.EXE

F-AGNT95.EXE

F-PROT.EXE

F-PROT95.EXE

F-STOPW.EXE

FAMEH32.EXE

FAST.EXE

FCH32.EXE

FIH32.EXE

FINDVIRU.EXE

FIREWALL.EXE

FLOWPROTECTOR.EXE

FNRB32.EXE

FP-WIN.EXE

FP-WIN_TRIAL.EXE

FPROT.EXE

FRW.EXE

FSAA.EXE

FSAV.EXE

FSAV32.EXE

FSAV530STBYB.EXE

FSAV530WTBYB.EXE

FSAV95.EXE

FSGK32.EXE

FSM32.EXE

FSMA32.EXE

FSMB32.EXE

GATOR.EXE

GBMENU.EXE

GBPOLL.EXE

GENERICS.EXE

GMT.EXE

GUARD.EXE

GUARDDOG.EXE

HIJACKTHIS.EXE

HACKTRACERSETUP.EXE

HBINST.EXE

HBSRV.EXE

HOTACTIO.EXE

HOTPATCH.EXE

HTLOG.EXE

HTPATCH.EXE

HWPE.EXE

HXDL.EXE

HXIUL.EXE

IAMAPP.EXE

IAMSERV.EXE

IAMSTATS.EXE

IBMASN.EXE

IBMAVSP.EXE

ICLOAD95.EXE

ICLOADNT.EXE

ICMON.EXE

ICSUPP95.EXE

ICSUPPNT.EXE

IDLE.EXE

IEDLL.EXE

IEDRIVER.EXE

IEXPLORER.EXE

IFACE.EXE

IFW2000.EXE

INETLNFO.EXE

INFUS.EXE

INFWIN.EXE

INIT.EXE

INTDEL.EXE

INTREN.EXE

IOMON98.EXE

IPARMOR.EXE

IRIS.EXE

ISASS.EXE

ISRV95.EXE

ISTSVC.EXE

JAMMER.EXE

JDBGMRG.EXE

JEDI.EXE

KAVLITE40ENG.EXE

KAVPERS40ENG.EXE

KAVPF.EXE

KEENVALUE.EXE

KERIO-PF-213-EN-WIN.EXE

KERIO-WRL-421-EN-WIN.EXE

KERIO-WRP-421-EN-WIN.EXE

KERNEL32.EXE

KILLPROCESSSETUP161.EXE

LAUNCHER.EXE

LDNETMON.EXE

LDPRO.EXE

LDPROMENU.EXE

LDSCAN.EXE

LNETINFO.EXE

LOADER.EXE

LOCALNET.EXE

LOCKDOWN.EXE

LOCKDOWN2000.EXE

LOOKOUT.EXE

LORDPE.EXE

LSETUP.EXE

LUALL.EXE

LUAU.EXE

LUCOMSERVER.EXE

LUINIT.EXE

LUSPT.EXE

MAPISVC32.EXE

MCAGENT.EXE

MCMNHDLR.EXE

MCSHIELD.EXE

MCTOOL.EXE

MCUPDATE.EXE

MCVSRTE.EXE

MCVSSHLD.EXE

MD.EXE

MFIN32.EXE

MFW2EN.EXE

MFWENG3.02D30.EXE

MGAVRTCL.EXE

MGAVRTE.EXE

MGHTML.EXE

MGUI.EXE

MINILOG.EXE

MMOD.EXE

MONITOR.EXE

MOOLIVE.EXE

MOSTAT.EXE

MPFAGENT.EXE

MPFSERVICE.EXE

MPFTRAY.EXE

MRFLUX.EXE

MSCONFIG.EXEMSAPP.EXE

MSBB.EXE

MSBLAST.EXE

MSCACHE.EXE

MSCCN32.EXE

MSCMAN.EXE

MSDM.EXE

MSDOS.EXE

MSIEXEC16.EXE

MSINFO32.EXE

MSLAUGH.EXE

MSMGT.EXE

MSMSGRI32.EXE

MSSMMC32.EXE

MSSYS.EXE

MSVXD.EXE

MU0311AD.EXE

MWATCH.EXE

N32SCANW.EXE

NAV.EXE

AUTO-PROTECT.NAV80TRY.EXE

NAVAP.NAVAPSVC.EXE

NAVAPSVC.EXE

NAVAPW32.EXE

NAVDX.EXE

NAVENGNAVEX15.NAVLU32.EXE

NAVLU32.EXE

NAVNT.EXE

NAVSTUB.EXE

NAVW32.EXE

NAVWNT.EXE

NC2000.EXE

NCINST4.EXE

NDD32.EXE

NEOMONITOR.EXE

NEOWATCHLOG.EXE

NETSTAT.EXE

NETARMOR.EXE

NETD32.EXE

NETINFO.EXE

NETMON.EXE

NETSCANPRO.EXE

NETSPYHUNTER-1.2.EXE

NETUTILS.EXE

NISSERV.EXE

NISUM.EXE

NMAIN.EXE

NOD32.EXE

NORMIST.EXE

NORTON_INTERNET_SECU_3.0_407.EXE

NOTSTART.EXE

NPF40_TW_98_NT_ME_2K.EXE

NPFMESSENGER.EXE

NPROTECT.EXE

NPSCHECK.EXE

NPSSVC.EXE

NSCHED32.EXE

NSSYS32.EXE

NSTASK32.EXE

NSUPDATE.EXE

NT.EXE

NTRTSCAN.EXE

NTVDM.EXE

NTXconfig.EXE

NUI.EXE

NUPGRADE.EXE

NVARCH16.EXE

NVC95.EXE

NVSVC32.EXE

NWINST4.EXE

NWSERVICE.EXE

NWTOOL16.EXE

OGRC.EXE

OLLYDBG.EXE

ONSRVR.EXE

OPTIMIZE.EXE

OSTRONET.EXE

OTFIX.EXE

OUTPOST.EXE

OUTPOSTINSTALL.EXE

OUTPOSTPROINSTALL.EXE

PADMIN.EXE

PANIXK.EXE

PATCH.EXE

PAVCL.EXE

PAVPROXY.EXE

PAVSCHED.EXE

PAVW.EXE

PCC2002S902.EXE

PCC2K_76_1436.EXE

PCCIOMON.EXE

PCCNTMON.EXE

PCCWIN97.EXE

PCCWIN98.EXE

PCDSETUP.EXE

PCFWALLICON.EXE

PCIP10117_0.EXE

PCSCAN.EXE

PDSETUP.EXE

PENIS.EXE

PERISCOPE.EXE

PERSFW.EXE

PERSWF.EXE

PF2.EXE

PFWADMIN.EXE

PGMONITR.EXE

PINGSCAN.EXE

PLATIN.EXE

POP3TRAP.EXE

POPROXY.EXE

POPSCAN.EXE

PORTDETECTIVE.EXE

PORTMONITOR.EXE

POWERSCAN.EXE

PPINUPDT.EXE

PPTBC.EXE

PPVSTOP.EXE

PRIZESURFER.EXE

PRMT.EXE

PRMVR.EXE

PROCDUMP.EXE

PROCESSMONITOR.EXE

PROCEXPLORERV1.0.EXE

PROGRAMAUDITOR.EXE

PROPORT.EXE

PROTECTX.EXE

PSPF.EXE

PURGE.EXE

PUSSY.EXE

PVIEW95.EXE

QDCSFS.EXE

QCONSOLE.EXE

QSERVER.EXE

RAPAPP.EXE

RAV7.EXE

RAV7WIN.EXE

RAV8WIN32ENG.EXE

RAY.EXE

RB32.EXE

RCSYNC.EXE

REALMON.EXE

REGED.EXE

REGEDT32.EXE

REGEDIT.EXE

RESCUE.EXE

RESCUE32.EXE

RRGUARD.EXE

RSHELL.EXE

RTVSCAN.EXE

RTVSCN95.EXE

RULAUNCH.EXE

RUN32DLL.EXE

RUNDLL.EXE

RUNDLL16.EXE

RUXDLL32.EXE

SBSERV.EXE

SYMTRAY.EXE

SAFEWEB.EXE

SAHAGENT.EXE

SAVE.EXE

SAVENOW.EXE

SC.EXE

SCAM32.EXE

SCAN32.EXE

SCAN95.EXE

SCANPM.EXE

SCRSCAN.EXE

SCRSVR.EXE

SCVHOST.EXE

SD.EXE

SERV95.EXE

SERVICE.EXE

SERVLCE.EXE

SERVLCES.EXE

SETUPVAMEEVAL.EXE

SETUP_FLOWPROTECTOR_US.EXE

SFC.EXE

SGSSFW32.EXE

SH.EXE

SHELLSPYINSTALL.EXE

SHN.EXE

SHOWBEHIND.EXE

SMC.EXE

SMS.EXE

SMSS32.EXE

SOAP.EXE

SOFI.EXE

SPERM.EXE

SPF.EXE

SPHINX.EXE

SPOLER.EXE

SPOOLCV.EXE

SPOOLSV32.EXE

SPYXX.EXE

SREXE.EXE

SRNG.EXE

SS3EDIT.EXE

SSGRATE.EXE

SSG_4104.EXE

ST2.EXE

START.EXE

STCLOADER.EXE

SUPFTRL.EXE

SUPPORT.EXE

SUPPORTER5.EXE

SVC.EXE

SVCHOSTC.EXE

SVCHOSTS.EXE

SVSHOST.EXE

SWEEP95.EXE

SWEEPNET.SWEEPSRV.SYS.SWNETSUP.EXE

SYMPROXYSVC.EXE

SYSEDIT.EXE

SYSTEM.EXE

SYSTEM32.EXE

SYSUPD.EXE

TASKMG.EXE

TASKMO.EXE

TAUMON.EXE

TBSCAN.EXE

TC.EXE

TCA.EXE

TCM.EXE

TDS-3.EXE

TDS2-98.EXE

TDS2-NT.EXE

TEEKIDS.EXE

TFAK.EXE

TFAK5.EXE

TGBOB.EXE

TITANIN.EXE

TITANINXP.EXE

TRACERT.EXE

TRICKLER.EXE

TRJSCAN.EXE

TRJSETUP.EXE

TROJANTRAP3.EXE

TSADBOT.EXE

TVMD.EXE

TVTMD.EXE

UNDOBOOT.EXE

UPDAT.EXE

UPDATE.EXE

UPGRAD.EXE

UTPOST.EXE

VFY.EXE

VBCMSERV.EXE

VBCONS.EXE

VBUST.EXE

VBWIN9X.EXE

VBWINNTW.EXE

VCSETUP.EXE

VET32.EXE

VET95.EXE

VETTRAY.EXE

VFSETUP.EXE

VIR-HELP.EXE

VIRUSMDPERSONALFIREWALL.EXE

VNLAN300.EXE

VNPC3000.EXE

VPC32.EXE

VPC42.EXE

VPFW30S.EXE

VPTRAY.EXE

VSCAN40.EXE

VSCENU6.02D30.EXE

VSCHED.EXE

VSECOMR.EXE

VSHWIN32.EXE

VSISETUP.EXE

VSMAIN.EXE

VSMON.EXE

VSSTAT.EXE

VSWIN9XE.EXE

VSWINNTSE.EXE

VSWINPERSE.EXE

W32DSM89.EXE

W9X.EXE

WATCHDOG.EXE

WEBDAV.EXE

WEBSCANX.EXE

WEBTRAP.EXE

WFINDV32.EXE

WGFE95.EXE

WHOSWATCHINGME.EXE

WIMMUN32.EXE

WIN-BUGSFIX.EXE

WIN32.EXE

WIN32US.EXE

WINACTIVE.EXE

WINDOW.EXE

WINDOWS.EXE

WININETD.EXE

WININIT.EXE

WININITX.EXE

WINLOGIN.EXE

WINMAIN.EXE

WINNET.EXE

WINPPR32.EXE

WINRECON.EXE

WINSERVN.EXE

WINSSK32.EXE

WINSTART.EXE

WINSTART001.EXE

WINTSK32.EXE

WINUPDATE.EXE

WKUFIND.EXE

WNAD.EXE

WNT.EXE

WRADMIN.EXE

WRCTRL.EXE

WSBGATE.EXE

WUPDATER.EXE

WUPDT.EXE

WYVERNWORKSFIREWALL.EXE

XPF202EN.EXE

ZAPRO.EXE

ZAPSETUP3001.EXE

ZATUTOR.EXE

ZONALM2601.EXE

ZONEALARM.EXE

_AVP32.EXE

_AVPCC.EXE

_AVPM.EXE

%s (%d)

PONG %s

NOTICE %s :

VERSION %s

PING %s

[MAIN]: User: %s logged out.

NOTICE %s :%s

NICK

[MAIN]: Master: %s changed identity to: .

:%s%s

[MAIN]: Failed to change nick for Master: %s.

USERHOST %s

MODE %s %s

:.login

JOIN #

NICK

now an IRC Operator

Password

password

PASSWORD

login

Login

LOGIN

Login

LOGIN

login

PASSWORD

password

paypal.com

e-gold.com

alertpay.com

ebay.com

americabank.com

[PSNIFF]: Error: socket() failed, returned: .

[PSNIFF]: Error: bind() failed, returned: .

[PSNIFF]: Error: WSAIoctl() failed, returned: .

[PSNIFF]: Error: recv() failed, returned:

[PSNIFF]: Suspicious %s packet from: %s:%d to: %s:%d - %s

pstorec.dll

-=PSTORE=- %s %s:%s

http:/

https:/

superbotijos.zapto.org

superbotijos2.zapto.org

service.exe

servicex.log

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\RunServices

password1

passwd

pass1234

1234567

12345678

123456789

1234567890

12345678910

windows

loginpass

domainpass

domainpassword

dbpass

dbpassword

databasepass

databasepassword

sqlpassoainstall

winpass

%s %d "%s"

[%s]|

[%d]%s

%d. %s

%s: %s stopped. (%d thread(s) stopped.)

%s: No %s thread found.

\Desktop.ini

[.ShellClassInfo]

CLSID={645FF040-5081-101B-9F08-00AA002F954E}

icon=%SystemRoot%\system32\SHELL32.dll,4

\autorun.inf

[VISIT]: Invalid URL.

[VISIT]: Failed to connect to HTTP server.

[VISIT]: URL visited.

[VISIT]: Failed to get requested URL from HTTP server.

zcÃ

%System%\service.exe

EnumWindows

keybd_event

VkKeyScanA

USER32.dll

ole32.dll

OLEAUT32.dll

URLDownloadToFileA

urlmon.dll

GetCPInfo

KERNEL32.dll

6 6/6?6~6

8-9}9

2-2R2x2}2

:";(;,;0;4;

? ?4???[?

6 6$6(6,6064686

7074787

: :$:(:,:0:4:8:<:>

service.exe_496_rwx_00400000_00097000:

.text

`.rdata

@.data

.idata

.rsrc

@.reloc

Invalid allocation size: %u bytes.

Client hook allocation failure at file %hs line %d.

_CrtCheckMemory()

_CrtIsValidHeapPointer(pUserData)

Allocation too large or negative: %u bytes.

Client hook re-allocation failure at file %hs line %d.

DAMAGE: after %hs block (#%d) at 0xX.

DAMAGE: before %hs block (#%d) at 0xX.

memory check error at 0xX = 0xX, should be 0xX.

%hs located at 0xX is %u bytes long.

%hs allocated at file %hs(%d).

DAMAGE: on top of Free block at 0xX.

Bad memory block found at 0xX.

_CrtMemCheckPoint: NULL state pointer.

_CrtMemDifference: NULL state pointer.

crt block at 0xX, subtype %x, %u bytes long.

normal block at 0xX, %u bytes long.

client block at 0xX, subtype %x, %u bytes long.

%hs(%d) :

#File Error#(%d) :

Data: %s

%s(%d) : %s

_CrtDbgReport: String too long or IO Error

Second Chance Assertion Failed: File %s, Line %d

user32.dll

Debug %s!

Program: %s%s%s%s%s%s%s%s%s%s%s

portuguese-brazilian

VVV.symantec.com

127.0.0.1

securityresponse.symantec.com

symantec.com

VVV.sophos.com

sophos.com

VVV.mcafee.com

mcafee.com

liveupdate.symantecliveupdate.com

VVV.viruslist.com

viruslist.com

f-secure.com

VVV.f-secure.com

kaspersky.com

kaspersky-labs.com

VVV.avp.com

VVV.kaspersky.com

avp.com

VVV.networkassociates.com

networkassociates.com

VVV.ca.com

ca.com

mast.mcafee.com

my-etrust.com

VVV.my-etrust.com

download.mcafee.com

dispatch.mcafee.com

secure.nai.com

nai.com

VVV.nai.com

update.symantec.com

updates.symantec.com

us.mcafee.com

liveupdate.symantec.com

customer.symantec.com

rads.mcafee.com

trendmicro.com

VVV.trendmicro.com

VVV.grisoft.com

CDKey

prvkey

Software\Microsoft\Windows\CurrentVersion

Microsoft Windows Product ID

codkey

Software\Electronic Arts\EA GAMES\Global Operations\ergc

Global Operations

Software\Electronic Arts\EA Sports\FIFA 2002\ergc

Software\Electronic Arts\EA Sports\FIFA 2003\ergc

Software\Electronic Arts\EA Sports\FIFA 2006\ergc

Software\Electronic Arts\EA Sports\NHL 2002\ergc

Software\Electronic Arts\EA Sports\NHL 2003\ergc

Software\Electronic Arts\EA Sports\Nascar Racing 2002\ergc

Software\Electronic Arts\EA Sports\Nascar Racing 2003\ergc

Software\Techland\Chrome

Chrome

base\mp\sof2key

nwncdkey.ini

Key1=

Key2=

Key3=

KeyCode

3DMark06 Key

Password

Nod32 Pass

%s\%s

%s CD Key: (%s).

NOTICE %s :Authentication failed (%s!%s).

NOTICE %s :Your attempt has been logged.

[MAIN]: Password accepted.

[MAIN]: Failed to login user: %s, too many logins already.

$rndnick

rndnick

NICK %s

[MAIN]: Random nick change to: %s.

QUIT :%s

[THREADS]: Failed to start list thread, error: .

[PROCS]: Failed to start listing thread, error: .

cdkeys

[CDKEYS]: Search completed.

.::[ PassStore Executed ]::.

firefox

FireFox

FireFox Executed.

firefoxstop

Firefox

[FLUSHDNS]: Failed to load dnsapi.dll.

nick

join

JOIN %s %s

PART %s

[MAIN]: Sent IRC Raw: %s.

[THREADS]: Stopped: %d thread(s).

[THREADS]: Killed thread: %s.

[THREADS]: Failed to kill thread: %s.

[MAIN]: Prefix changed to: '%c'.

[SHELL]: File opened: %s

[SHELL]: Couldn't open file: %s

[MAIN]: Server changed to: '%s'.

[DNS]: Lookup: %s -> %s.

[PROC]: Process killed: %s

[PROC]: Failed to terminate process: %s

[PROC]: Process killed ID: %s

[PROC]: Failed to terminate process ID: %s

[FILE]: Deleted '%s'.

[VISIT]: URL: %s.

[VISIT]: Failed to start connection thread, error: .

mirccmd

[PSNIFF]: Failed to start sniffer thread, error: .

[PSNIFF]: Carnivore stopped. (%d thread(s) stopped.)

keylog

[KeyLog] Already running.

[KeyLog] pay-sites keylogger active.

[KeyLog] Normal key logger active.

[KeyLog] Unknow mode type.

[KeyLog] Failed to start logging thread, error: .

[KeyLog] Missing mode type.

Keylog

[MAIN]: Unrecognized command: %s.

privmsg

ACTION %s

MODE %s

%s %s %s :%s

[MAIN]: Repeat: %s

[MAIN]: Repeat not allowed in command line: %s

%s%s.exe

[UPDATE]: Downloading update from: %s.

[UPDATE]: Failed to start download thread, error: .

[EXEC]: Couldn't execute file.

[EXEC]: Commands: %s

[FILE]: Rename: '%s' to: '%s'.

[ICMP]: Flooding: (%s) for %s seconds.

[ICMP]: Failed to start flood thread, error: .

utorrent.seed

[DOWNLOAD]: Downloading URL: %s to: %s.

[DOWNLOAD]: Failed to start transfer thread, error: .

helo $rndnick

mail from:

rcpt to:

subject: %s

from: %s

[EMAIL]: Message sent to %s.

PASS %s

USER %s 0 0 :%s

[DOWNLOAD]: Couldn't open file for writing: %s.

[DOWNLOAD]: Filesize is incorrect. (Recevied: %d bytes, Expected: %d bytes.)

[DOWNLOAD]: CRC32 is incorrect. (Local CRC32: %d, Expected CRC32: %d.)

[DOWNLOAD]: File download: %.1fKB to: %s @ %.1fKB/sec.

[DOWNLOAD]: Opened: %s.

[DOWNLOAD]: Update failed: Error executing file: %s.

[DOWNLOAD]: Bad URL or DNS Error: %s.

\Program Files\Mozilla Firefox\MOZCRT19.dll

\Program Files\Mozilla Firefox\sqlite3.dll

\Program Files\Mozilla Firefox\nspr4.dll

\Program Files\Mozilla Firefox\plds4.dll

\Program Files\Mozilla Firefox\plc4.dll

\Program Files\Mozilla Firefox\nssutil3.dll

Application Data\Mozilla\Firefox

\profiles.ini

SOFTWARE\Clients\StartMenuInternet\firefox.exe\shell\open\command

nspr4.dll

plc4.dll

plds4.dll

softokn3.dll

nss3.dll

PK11_GetInternalKeySlot

PK11_CheckUserPassword

/signons.txt

/signons2.txt

/signons3.txt

[ICMP]: Error: socket() failed, returned: .

[ICMP]: Error: setsockopt() failed, returned: .

[ICMP]: Error sending packets to IP: %s. Packets sent: %d. Returned: .

[ICMP]: Done with %s flood to IP: %s. Sent: %d packet(s) @ %dKB/sec (%dMB).

PRIVMSG

%s %s :%s

Login - PayPal

moneybookers.com

AlertPay.com-My Way To Pay

Login: Step 1

h4cky0u.org

Login

Warez-BB.org :: Log in

DirectAdmin Login

Invision Power Services :: Invision Power Services : Login

Rapidshare-Premium.com - FREE Rapidshare Premium Link Generator

Play.com (UK)

Admin Login

Administrator Login

amazon.com

MessengerFX.com - Web Messenger

ILoveIM.com Web Messenger

Web and Mobile messenger everywhere - eBuddy former e-messenger

meebo.com

Complete Web Solutions: domains, hosting, site builders and SSL.

[KeyLog] %s (%s)

[KeyLog] %s

[KeyLog] .

. (Changed Windows: %s)

. (Buffer full) (%s)

. (Return) (%s)

kernel32.dll

ExitWindowsEx

GetAsyncKeyState

GetKeyState

advapi32.dll

RegOpenKeyExA

RegCreateKeyExA

RegCloseKey

gdi32.dll

ws2_32.dll

wininet.dll

HttpOpenRequestA

HttpSendRequestA

FtpGetFileA

FtpPutFileA

InternetOpenUrlA

InternetCrackUrlA

Mozilla/4.0 (compatible)

icmp.dll

netapi32.dll

dnsapi.dll

iphlpapi.dll

mpr.dll

shell32.dll

ShellExecuteA

odbc32.dll

SQLDriverConnect

SQLSetEnvAttr

SQLExecDirect

SQLAllocHandle

SQLFreeHandle

SQLDisconnect

userenv.dll

avicap32.dll

Kernel32.dll failed.

User32.dll failed.

Advapi32.dll failed.

Gdi32.dll failed.

Ws2_32.dll failed.

Wininet.dll failed.

Icmp.dll failed.

Netapi32.dll failed.

Dnsapi.dll failed.

Iphlpapi.dll failed.

Mpr32.dll failed.

Shell32.dll failed.

Odbc32.dll failed.

Avicap32.dll failed.

%s%s%s

%s Error: %s .

explorer.exe

%s %s

%sdel.bat

del "%s"

%%comspec%% /c %s %s

netsh.exe firewall add allowedprogram RIOTBOT.exe RIOTBOT ENABLE

Software\Microsoft\Internet Explorer\New Windows

[Msn] Message sent to %d contacts!

[FLUSHDNS]: Error getting ARP cache: .

[FLUSHDNS]: Not supported by this system.

%d.%d.%d.%d

\Program Files\eDonkey2000\incoming

WinExec

AVPCC.EXE

ACKWIN32.EXE

ADAWARE.EXE

ADVXDWIN.EXE

AGENTSVR.EXE

AGENTW.EXE

ALERTSVC.EXE

ALEVIR.EXE

ALOGSERV.EXE

AMON9X.EXE

ANTI-TROJAN.EXE

ANTIVIRUS.EXE

ANTS.EXE

APIMONITOR.EXE

APLICA32.EXE

APVXDWIN.EXE

ARR.EXE

ATCON.EXE

ATGUARD.EXE

ATRO55EN.EXE

ATUPDATER.EXE

ATWATCH.EXE

AU.EXE

AUPDATE.EXE

AUTODOWN.EXE

AUTOTRACE.EXE

AUTOUPDATE.EXE

AVCONSOL.EXE

AVE32.EXE

AVGCC32.EXE

AVGCTRL.EXE

AVGNT.EXE

AVGSERV.EXE

AVGSERV9.EXE

AVGUARD.EXE

AVGW.EXE

AVKPOP.EXE

AVKSERV.EXE

AVKSERVICE.EXE

AVKWCTl9.EXE

AVLTMAIN.EXE

AVNT.EXE

AVP.EXE

AVP32.EXE

AVPDOS32.EXE

AVPM.EXE

AVPTC32.EXE

AVPUPD.EXE

AVSCHED32.EXE

AVSYNMGR.EXE

AVWIN95.EXE

AVWINNT.EXE

AVWUPD.EXE

AVWUPD32.EXE

AVWUPSRV.EXE

AVXMONITOR9X.EXE

AVXMONITORNT.EXE

AVXQUAR.EXE

BACKWEB.EXE

BARGAINS.EXE

BD_PROFESSIONAL.EXE

BEAGLE.EXE

BELT.EXE

BIDEF.EXE

BIDSERVER.EXE

BIPCP.EXE

BIPCPEVALSETUP.EXE

BISP.EXE

BLACKD.EXE

BLACKICE.EXE

BLSS.EXE

BOOTCONF.EXE

BOOTWARN.EXE

BORG2.EXE

BPC.EXE

BRASIL.EXE

BS120.EXE

BUNDLE.EXE

BVT.EXE

CCEVTMGR.EXECSINJECT.EXE

CCAPP.EXE

CCEVTMGR.EXE

CCPXYSVC.EXE

CDP.EXE

CFD.EXE

CFGWIZ.EXE

CFIADMIN.EXE

CFIAUDIT.EXE

CFINET.EXE

CFINET32.EXE

CLAW95CF.EXE

CLEAN.EXE

CLEANER.EXE

CLEANER3.EXE

CLEANPC.EXE

CLICK.EXE

CMD32.EXE

CMESYS.EXE

CMGRDIAN.EXE

CMON016.EXE

CONNECTIONMONITOR.EXE

CPD.EXE

CPF9X206.EXE

CPFNT206.EXE

CTRL.EXE

CV.EXE

CWNB181.EXE

CWNTDWMO.EXE

Claw95.EXE

DATEMANAGER.EXE

DCOMX.EXE

DEFALERT.EXE

DEFSCANGUI.EXE

DEFWATCH.EXE

DEPUTY.EXE

DIVX.EXE

DLLCACHE.EXE

DLLREG.EXE

DOORS.EXE

DPF.EXE

DPFSETUP.EXE

DPPS2.EXE

DRWATSON.EXE

DRWEB32.EXE

DRWEBUPW.EXE

DSSAGENT.EXE

DVP95.EXE

DVP95_0.EXE

ECENGINE.EXE

EFPEADM.EXE

EMSW.EXE

ENT.EXE

ESAFE.EXE

ESCANH95.EXE

ESCANHNT.EXE

ESCANV95.EXE

ESPWATCH.EXE

ETHEREAL.EXE

ETRUSTCIPE.EXE

EVPN.EXE

EXANTIVIRUS-CNET.EXE

EXE.AVXW.EXE

EXPERT.EXE

EXPLORE.EXE

F-RBOT.EXE

F-SDBOT.EXE

F-SPYBOT.EXE

F-AGOBOT.EXE

F-RXBOT.EXE

F-AV.EXE

F-PHATBOT.EXE

F-FW.EXE

F-AGNT95.EXE

F-PROT.EXE

F-PROT95.EXE

F-STOPW.EXE

FAMEH32.EXE

FAST.EXE

FCH32.EXE

FIH32.EXE

FINDVIRU.EXE

FIREWALL.EXE

FLOWPROTECTOR.EXE

FNRB32.EXE

FP-WIN.EXE

FP-WIN_TRIAL.EXE

FPROT.EXE

FRW.EXE

FSAA.EXE

FSAV.EXE

FSAV32.EXE

FSAV530STBYB.EXE

FSAV530WTBYB.EXE

FSAV95.EXE

FSGK32.EXE

FSM32.EXE

FSMA32.EXE

FSMB32.EXE

GATOR.EXE

GBMENU.EXE

GBPOLL.EXE

GENERICS.EXE

GMT.EXE

GUARD.EXE

GUARDDOG.EXE

HIJACKTHIS.EXE

HACKTRACERSETUP.EXE

HBINST.EXE

HBSRV.EXE

HOTACTIO.EXE

HOTPATCH.EXE

HTLOG.EXE

HTPATCH.EXE

HWPE.EXE

HXDL.EXE

HXIUL.EXE

IAMAPP.EXE

IAMSERV.EXE

IAMSTATS.EXE

IBMASN.EXE

IBMAVSP.EXE

ICLOAD95.EXE

ICLOADNT.EXE

ICMON.EXE

ICSUPP95.EXE

ICSUPPNT.EXE

IDLE.EXE

IEDLL.EXE

IEDRIVER.EXE

IEXPLORER.EXE

IFACE.EXE

IFW2000.EXE

INETLNFO.EXE

INFUS.EXE

INFWIN.EXE

INIT.EXE

INTDEL.EXE

INTREN.EXE

IOMON98.EXE

IPARMOR.EXE

IRIS.EXE

ISASS.EXE

ISRV95.EXE

ISTSVC.EXE

JAMMER.EXE

JDBGMRG.EXE

JEDI.EXE

KAVLITE40ENG.EXE

KAVPERS40ENG.EXE

KAVPF.EXE

KEENVALUE.EXE

KERIO-PF-213-EN-WIN.EXE

KERIO-WRL-421-EN-WIN.EXE

KERIO-WRP-421-EN-WIN.EXE

KERNEL32.EXE

KILLPROCESSSETUP161.EXE

LAUNCHER.EXE

LDNETMON.EXE

LDPRO.EXE

LDPROMENU.EXE

LDSCAN.EXE

LNETINFO.EXE

LOADER.EXE

LOCALNET.EXE

LOCKDOWN.EXE

LOCKDOWN2000.EXE

LOOKOUT.EXE

LORDPE.EXE

LSETUP.EXE

LUALL.EXE

LUAU.EXE

LUCOMSERVER.EXE

LUINIT.EXE

LUSPT.EXE

MAPISVC32.EXE

MCAGENT.EXE

MCMNHDLR.EXE

MCSHIELD.EXE

MCTOOL.EXE

MCUPDATE.EXE

MCVSRTE.EXE

MCVSSHLD.EXE

MD.EXE

MFIN32.EXE

MFW2EN.EXE

MFWENG3.02D30.EXE

MGAVRTCL.EXE

MGAVRTE.EXE

MGHTML.EXE

MGUI.EXE

MINILOG.EXE

MMOD.EXE

MONITOR.EXE

MOOLIVE.EXE

MOSTAT.EXE

MPFAGENT.EXE

MPFSERVICE.EXE

MPFTRAY.EXE

MRFLUX.EXE

MSCONFIG.EXEMSAPP.EXE

MSBB.EXE

MSBLAST.EXE

MSCACHE.EXE

MSCCN32.EXE

MSCMAN.EXE

MSDM.EXE

MSDOS.EXE

MSIEXEC16.EXE

MSINFO32.EXE

MSLAUGH.EXE

MSMGT.EXE

MSMSGRI32.EXE

MSSMMC32.EXE

MSSYS.EXE

MSVXD.EXE

MU0311AD.EXE

MWATCH.EXE

N32SCANW.EXE

NAV.EXE

AUTO-PROTECT.NAV80TRY.EXE

NAVAP.NAVAPSVC.EXE

NAVAPSVC.EXE

NAVAPW32.EXE

NAVDX.EXE

NAVENGNAVEX15.NAVLU32.EXE

NAVLU32.EXE

NAVNT.EXE

NAVSTUB.EXE

NAVW32.EXE

NAVWNT.EXE

NC2000.EXE

NCINST4.EXE

NDD32.EXE

NEOMONITOR.EXE

NEOWATCHLOG.EXE

NETSTAT.EXE

NETARMOR.EXE

NETD32.EXE

NETINFO.EXE

NETMON.EXE

NETSCANPRO.EXE

NETSPYHUNTER-1.2.EXE

NETUTILS.EXE

NISSERV.EXE

NISUM.EXE

NMAIN.EXE

NOD32.EXE

NORMIST.EXE

NORTON_INTERNET_SECU_3.0_407.EXE

NOTSTART.EXE

NPF40_TW_98_NT_ME_2K.EXE

NPFMESSENGER.EXE

NPROTECT.EXE

NPSCHECK.EXE

NPSSVC.EXE

NSCHED32.EXE

NSSYS32.EXE

NSTASK32.EXE

NSUPDATE.EXE

NT.EXE

NTRTSCAN.EXE

NTVDM.EXE

NTXconfig.EXE

NUI.EXE

NUPGRADE.EXE

NVARCH16.EXE

NVC95.EXE

NVSVC32.EXE

NWINST4.EXE

NWSERVICE.EXE

NWTOOL16.EXE

OGRC.EXE

OLLYDBG.EXE

ONSRVR.EXE

OPTIMIZE.EXE

OSTRONET.EXE

OTFIX.EXE

OUTPOST.EXE

OUTPOSTINSTALL.EXE

OUTPOSTPROINSTALL.EXE

PADMIN.EXE

PANIXK.EXE

PATCH.EXE

PAVCL.EXE

PAVPROXY.EXE

PAVSCHED.EXE

PAVW.EXE

PCC2002S902.EXE

PCC2K_76_1436.EXE

PCCIOMON.EXE

PCCNTMON.EXE

PCCWIN97.EXE

PCCWIN98.EXE

PCDSETUP.EXE

PCFWALLICON.EXE

PCIP10117_0.EXE

PCSCAN.EXE

PDSETUP.EXE

PENIS.EXE

PERISCOPE.EXE

PERSFW.EXE

PERSWF.EXE

PF2.EXE

PFWADMIN.EXE

PGMONITR.EXE

PINGSCAN.EXE

PLATIN.EXE

POP3TRAP.EXE

POPROXY.EXE

POPSCAN.EXE

PORTDETECTIVE.EXE

PORTMONITOR.EXE

POWERSCAN.EXE

PPINUPDT.EXE

PPTBC.EXE

PPVSTOP.EXE

PRIZESURFER.EXE

PRMT.EXE

PRMVR.EXE

PROCDUMP.EXE

PROCESSMONITOR.EXE

PROCEXPLORERV1.0.EXE

PROGRAMAUDITOR.EXE

PROPORT.EXE

PROTECTX.EXE

PSPF.EXE

PURGE.EXE

PUSSY.EXE

PVIEW95.EXE

QDCSFS.EXE

QCONSOLE.EXE

QSERVER.EXE

RAPAPP.EXE

RAV7.EXE

RAV7WIN.EXE

RAV8WIN32ENG.EXE

RAY.EXE

RB32.EXE

RCSYNC.EXE

REALMON.EXE

REGED.EXE

REGEDT32.EXE

REGEDIT.EXE

RESCUE.EXE

RESCUE32.EXE

RRGUARD.EXE

RSHELL.EXE

RTVSCAN.EXE

RTVSCN95.EXE

RULAUNCH.EXE

RUN32DLL.EXE

RUNDLL.EXE

RUNDLL16.EXE

RUXDLL32.EXE

SBSERV.EXE

SYMTRAY.EXE

SAFEWEB.EXE

SAHAGENT.EXE

SAVE.EXE

SAVENOW.EXE

SC.EXE

SCAM32.EXE

SCAN32.EXE

SCAN95.EXE

SCANPM.EXE

SCRSCAN.EXE

SCRSVR.EXE

SCVHOST.EXE

SD.EXE

SERV95.EXE

SERVICE.EXE

SERVLCE.EXE

SERVLCES.EXE

SETUPVAMEEVAL.EXE

SETUP_FLOWPROTECTOR_US.EXE

SFC.EXE

SGSSFW32.EXE

SH.EXE

SHELLSPYINSTALL.EXE

SHN.EXE

SHOWBEHIND.EXE

SMC.EXE

SMS.EXE

SMSS32.EXE

SOAP.EXE

SOFI.EXE

SPERM.EXE

SPF.EXE

SPHINX.EXE

SPOLER.EXE

SPOOLCV.EXE

SPOOLSV32.EXE

SPYXX.EXE

SREXE.EXE

SRNG.EXE

SS3EDIT.EXE

SSGRATE.EXE

SSG_4104.EXE

ST2.EXE

START.EXE

STCLOADER.EXE

SUPFTRL.EXE

SUPPORT.EXE

SUPPORTER5.EXE

SVC.EXE

SVCHOSTC.EXE

SVCHOSTS.EXE

SVSHOST.EXE

SWEEP95.EXE

SWEEPNET.SWEEPSRV.SYS.SWNETSUP.EXE

SYMPROXYSVC.EXE

SYSEDIT.EXE

SYSTEM.EXE

SYSTEM32.EXE

SYSUPD.EXE

TASKMG.EXE

TASKMO.EXE

TAUMON.EXE

TBSCAN.EXE

TC.EXE

TCA.EXE

TCM.EXE

TDS-3.EXE

TDS2-98.EXE

TDS2-NT.EXE

TEEKIDS.EXE

TFAK.EXE

TFAK5.EXE

TGBOB.EXE

TITANIN.EXE

TITANINXP.EXE

TRACERT.EXE

TRICKLER.EXE

TRJSCAN.EXE

TRJSETUP.EXE

TROJANTRAP3.EXE

TSADBOT.EXE

TVMD.EXE

TVTMD.EXE

UNDOBOOT.EXE

UPDAT.EXE

UPDATE.EXE

UPGRAD.EXE

UTPOST.EXE

VFY.EXE

VBCMSERV.EXE

VBCONS.EXE

VBUST.EXE

VBWIN9X.EXE

VBWINNTW.EXE

VCSETUP.EXE

VET32.EXE

VET95.EXE

VETTRAY.EXE

VFSETUP.EXE

VIR-HELP.EXE

VIRUSMDPERSONALFIREWALL.EXE

VNLAN300.EXE

VNPC3000.EXE

VPC32.EXE

VPC42.EXE

VPFW30S.EXE

VPTRAY.EXE

VSCAN40.EXE

VSCENU6.02D30.EXE

VSCHED.EXE

VSECOMR.EXE

VSHWIN32.EXE

VSISETUP.EXE

VSMAIN.EXE

VSMON.EXE

VSSTAT.EXE

VSWIN9XE.EXE

VSWINNTSE.EXE

VSWINPERSE.EXE

W32DSM89.EXE

W9X.EXE

WATCHDOG.EXE

WEBDAV.EXE

WEBSCANX.EXE

WEBTRAP.EXE

WFINDV32.EXE

WGFE95.EXE

WHOSWATCHINGME.EXE

WIMMUN32.EXE

WIN-BUGSFIX.EXE

WIN32.EXE

WIN32US.EXE

WINACTIVE.EXE

WINDOW.EXE

WINDOWS.EXE

WININETD.EXE

WININIT.EXE

WININITX.EXE

WINLOGIN.EXE

WINMAIN.EXE

WINNET.EXE

WINPPR32.EXE

WINRECON.EXE

WINSERVN.EXE

WINSSK32.EXE

WINSTART.EXE

WINSTART001.EXE

WINTSK32.EXE

WINUPDATE.EXE

WKUFIND.EXE

WNAD.EXE

WNT.EXE

WRADMIN.EXE

WRCTRL.EXE

WSBGATE.EXE

WUPDATER.EXE

WUPDT.EXE

WYVERNWORKSFIREWALL.EXE

XPF202EN.EXE

ZAPRO.EXE

ZAPSETUP3001.EXE

ZATUTOR.EXE

ZONALM2601.EXE

ZONEALARM.EXE

_AVP32.EXE

_AVPCC.EXE

_AVPM.EXE

%s (%d)

PONG %s

NOTICE %s :

VERSION %s

PING %s

[MAIN]: User: %s logged out.

NOTICE %s :%s

NICK

[MAIN]: Master: %s changed identity to: .

:%s%s

[MAIN]: Failed to change nick for Master: %s.

USERHOST %s

MODE %s %s

:.login

JOIN #

NICK

now an IRC Operator

Password

password

PASSWORD

login

Login

LOGIN

Login

LOGIN

login

PASSWORD

password

paypal.com

e-gold.com

alertpay.com

ebay.com

americabank.com

[PSNIFF]: Error: socket() failed, returned: .

[PSNIFF]: Error: bind() failed, returned: .

[PSNIFF]: Error: WSAIoctl() failed, returned: .

[PSNIFF]: Error: recv() failed, returned:

[PSNIFF]: Suspicious %s packet from: %s:%d to: %s:%d - %s

pstorec.dll

-=PSTORE=- %s %s:%s

http:/

https:/

superbotijos.zapto.org

superbotijos2.zapto.org

service.exe

servicex.log

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\RunServices

password1

passwd

pass1234

1234567

12345678

123456789

1234567890

12345678910

windows

loginpass

domainpass

domainpassword

dbpass

dbpassword

databasepass

databasepassword

sqlpassoainstall

winpass

%s %d "%s"

[%s]|

[%d]%s

%d. %s

%s: %s stopped. (%d thread(s) stopped.)

%s: No %s thread found.

\Desktop.ini

[.ShellClassInfo]

CLSID={645FF040-5081-101B-9F08-00AA002F954E}

icon=%SystemRoot%\system32\SHELL32.dll,4

\autorun.inf

[VISIT]: Invalid URL.

[VISIT]: Failed to connect to HTTP server.

[VISIT]: URL visited.

[VISIT]: Failed to get requested URL from HTTP server.

zcÃ

%System%\service.exe

EnumWindows

keybd_event

VkKeyScanA

USER32.dll

ole32.dll

OLEAUT32.dll

URLDownloadToFileA

urlmon.dll

GetCPInfo

KERNEL32.dll

6 6/6?6~6

8-9}9

2-2R2x2}2

:";(;,;0;4;

? ?4???[?

6 6$6(6,6064686

7074787

: :$:(:,:0:4:8:<:>

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps