Trojan.Win32.RBot.jo (Kaspersky), Trojan.GenericKD.1798413 (AdAware), Rbot.YR, BackdoorIRC.YR, GenericIRCBot.YR (Lavasoft MAS)Behaviour: Trojan, Backdoor, IRCBot
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 729977ff3d75e5c57337a99e7a2c7ebe
SHA1: 0448be1ec0a9fd36fd55bf9d3818fa4f3603fc4e
SHA256: 8c0014ee5ae9cff2aa4807fa52eb40de2fe592f5ce31697a2cd76ff18bfeba41
SSDeep: 12288:qK2mhAMJ/cPlhdRvox0B2Jhz oLW0162ZQRQwJlAQbZyE3K/DoikMRSN3rA:b2O/Glh6XgoLH1MJCQbtK/EiN43rA
Size: 519083 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2012-06-09 16:19:49
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
| Behaviour | Description |
|---|---|
| IRCBot | A bot can communicate with command and control servers via IRC channel. |
Process activity
The Trojan creates the following process(es):
%original file name%.exe:560
uibtrym.exe:484
erg45.exe:716
erg45.exe:1156
The Trojan injects its code into the following process(es):
uibtrym.exe:1388
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:560 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\O49A\erg45.exe (9665 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\O49A\__tmp_rar_sfx_access_check_831750 (0 bytes)
The process uibtrym.exe:484 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\P31R87.QX5 (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (1249 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\P31R87.QX5 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (0 bytes)
The process erg45.exe:716 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\P31R87.QX5 (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (1249 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\P31R87.QX5 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (0 bytes)
The process erg45.exe:1156 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%System%\uibtrym.exe (5441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
Registry activity
The process %original file name%.exe:560 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "03 4A CA 53 24 D5 44 DA 64 B5 13 FF A1 E3 39 A0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\O49A]
"erg45.exe" = "erg45"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process uibtrym.exe:484 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5B 33 A6 CA 46 1E 42 99 0F 49 7D 64 C6 0A F0 55"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process uibtrym.exe:1388 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKCU\Software\Microsoft\yOLE]
"Supports RAS Connections" = "uibtrym.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKCU\SYSTEM\CurrentControlSet\Control\Lsa]
"Supports RAS Connections" = "uibtrym.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\yOLE]
"Supports RAS Connections" = "uibtrym.exe"
[HKLM\System\CurrentControlSet\Control\Lsa]
"Supports RAS Connections" = "uibtrym.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "31 99 AC 2D A1 AE E4 84 BF 17 39 32 66 DF FC 23"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices]
"Supports RAS Connections" = "uibtrym.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Supports RAS Connections" = "uibtrym.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Supports RAS Connections" = "uibtrym.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices]
"Supports RAS Connections" = "uibtrym.exe"
The process erg45.exe:716 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0B C6 FF 96 FA C7 56 65 3F 21 12 7D 23 D2 47 A7"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process erg45.exe:1156 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6B 3B 91 7B 71 E0 B5 71 3A AD 4F 2E 04 4E 4B 8B"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
Dropped PE files
| MD5 | File path |
|---|---|
| 8ccbc3c304389b001b9a17423c7d4964 | c:\Documents and Settings\"%CurrentUserName%"\O49A\erg45.exe |
| 8ccbc3c304389b001b9a17423c7d4964 | c:\WINDOWS\system32\uibtrym.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:560
uibtrym.exe:484
erg45.exe:716
erg45.exe:1156 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\O49A\erg45.exe (9665 bytes)
%Documents and Settings%\%current user%\P31R87.QX5 (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (1249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (1249 bytes)
%System%\uibtrym.exe (5441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices]
"Supports RAS Connections" = "uibtrym.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Supports RAS Connections" = "uibtrym.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Supports RAS Connections" = "uibtrym.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices]
"Supports RAS Connections" = "uibtrym.exe" - Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments:
Language: Language Neutral
Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: File Description: Comments: Language: Language Neutral
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 74526 | 74752 | 4.54396 | a8692f5ba740240ef0f9a827376f76f9 |
| .rdata | 81920 | 7445 | 7680 | 3.46159 | d4f36accffde0bf520f52486679ccf0d |
| .data | 90112 | 96036 | 512 | 2.46008 | b6c7edb5b7fec47a37a622cc5d71f3f4 |
| .CRT | 188416 | 32 | 512 | 0.273198 | 439411041ee0b8261668525c5c132cd9 |
| .rsrc | 192512 | 16660 | 16896 | 3.47969 | 8f2199f3e22b10e4cf713c481e6f7e84 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
uibtrym.exe_1388:
.text
.text
`.rdata
`.rdata
@.data
@.data
_WSSh
_WSSh
t1SSSSh
t1SSSSh
PeekNamedPipe
PeekNamedPipe
CreatePipe
CreatePipe
KERNEL32.dll
KERNEL32.dll
WS2_32.dll
WS2_32.dll
GetCPInfo
GetCPInfo
%d. %s = %s
%d. %s = %s
[%.2d-%.2d-M %.2d:%.2d:%.2d] %s
[%.2d-%.2d-M %.2d:%.2d:%.2d] %s
[DDoS]: Send error: .
[DDoS]: Send error: .
ddos.random
ddos.random
ddos.ack
ddos.ack
ddos.syn
ddos.syn
[DOWNLOAD]: Bad URL, or DNS Error: %s.
[DOWNLOAD]: Bad URL, or DNS Error: %s.
[UPDATE]: Update failed: Error executing file: %s.
[UPDATE]: Update failed: Error executing file: %s.
[UPDATE]: Downloaded %.1fKB to %s @ %.1fKB/sec. Updating.
[UPDATE]: Downloaded %.1fKB to %s @ %.1fKB/sec. Updating.
[DOWNLOAD]: Opened: %s.
[DOWNLOAD]: Opened: %s.
[DOWNLOAD]: Downloaded %.1f KB to %s @ %.1f KB/sec.
[DOWNLOAD]: Downloaded %.1f KB to %s @ %.1f KB/sec.
[DOWNLOAD]: CRC Failed (%d != %d).
[DOWNLOAD]: CRC Failed (%d != %d).
[DOWNLOAD]: Filesize is incorrect: (%d != %d).
[DOWNLOAD]: Filesize is incorrect: (%d != %d).
[DOWNLOAD]: Update: %s (%dKB transferred).
[DOWNLOAD]: Update: %s (%dKB transferred).
[DOWNLOAD]: File download: %s (%dKB transferred).
[DOWNLOAD]: File download: %s (%dKB transferred).
[DOWNLOAD]: Couldn't open file: %s.
[DOWNLOAD]: Couldn't open file: %s.
[IDENTD]: Error: server failed, returned: .
[IDENTD]: Error: server failed, returned: .
: USERID : UNIX : %s
: USERID : UNIX : %s
[IDENTD]: Client connection from IP: %s:%d.
[IDENTD]: Client connection from IP: %s:%d.
%s %s :%s
%s %s :%s
PRIVMSG
PRIVMSG
avicap32.dll
avicap32.dll
SQLDisconnect
SQLDisconnect
SQLFreeHandle
SQLFreeHandle
SQLAllocHandle
SQLAllocHandle
SQLExecDirect
SQLExecDirect
SQLSetEnvAttr
SQLSetEnvAttr
SQLDriverConnect
SQLDriverConnect
odbc32.dll
odbc32.dll
ShellExecuteA
ShellExecuteA
shell32.dll
shell32.dll
mpr.dll
mpr.dll
iphlpapi.dll
iphlpapi.dll
dnsapi.dll
dnsapi.dll
netapi32.dll
netapi32.dll
icmp.dll
icmp.dll
Mozilla/4.0 (compatible)
Mozilla/4.0 (compatible)
InternetCrackUrlA
InternetCrackUrlA
InternetOpenUrlA
InternetOpenUrlA
HttpSendRequestA
HttpSendRequestA
HttpOpenRequestA
HttpOpenRequestA
wininet.dll
wininet.dll
ws2_32.dll
ws2_32.dll
gdi32.dll
gdi32.dll
RegCloseKey
RegCloseKey
RegCreateKeyExA
RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyExA
advapi32.dll
advapi32.dll
ExitWindowsEx
ExitWindowsEx
user32.dll
user32.dll
kernel32.dll
kernel32.dll
Avicap32.dll failed.
Avicap32.dll failed.
Odbc32.dll failed.
Odbc32.dll failed.
Shell32.dll failed.
Shell32.dll failed.
Mpr32.dll failed.
Mpr32.dll failed.
Iphlpapi.dll failed.
Iphlpapi.dll failed.
Dnsapi.dll failed.
Dnsapi.dll failed.
Netapi32.dll failed.
Netapi32.dll failed.
Icmp.dll failed.
Icmp.dll failed.
Wininet.dll failed.
Wininet.dll failed.
Ws2_32.dll failed.
Ws2_32.dll failed.
Gdi32.dll failed.
Gdi32.dll failed.
Advapi32.dll failed.
Advapi32.dll failed.
User32.dll failed.
User32.dll failed.
Kernel32.dll failed.
Kernel32.dll failed.
videos.p0rn-lover.us
videos.p0rn-lover.us
support.exe
support.exe
Supports RAS Connections
Supports RAS Connections
g.dat
g.dat
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\RunServices
Software\Microsoft\Windows\CurrentVersion\RunServices
winpass
winpass
sqlpassoainstall
sqlpassoainstall
databasepassword
databasepassword
databasepass
databasepass
dbpassword
dbpassword
dbpass
dbpass
domainpassword
domainpassword
domainpass
domainpass
loginpass
loginpass
login
login
windows
windows
1234567890
1234567890
123456789
123456789
12345678
12345678
1234567
1234567
pass1234
pass1234
passwd
passwd
password
password
password1
password1
*@fbi.edu
*@fbi.edu
à %dh %dm
à %dh %dm
[NETINFO]: [Type]: %s (%s). [IP Address]: %s. [Hostname]: %s.
[NETINFO]: [Type]: %s (%s). [IP Address]: %s. [Hostname]: %s.
[IDENTD]: Failed to start server, error: .
[IDENTD]: Failed to start server, error: .
[IDENTD]: Server running on Port: 113.
[IDENTD]: Server running on Port: 113.
%s %d "%s"
%s %d "%s"
%s\%s
%s\%s
[MAIN]: Connected to %s.
[MAIN]: Connected to %s.
NICK %s
NICK %s
USER %s 0 0 :%s
USER %s 0 0 :%s
PASS %s
PASS %s
MODE %s %s
MODE %s %s
USERHOST %s
USERHOST %s
[MAIN]: User: %s logged in.
[MAIN]: User: %s logged in.
[MAIN]: Password accepted.
[MAIN]: Password accepted.
[MAIN]: *Failed host auth by: (%s!%s).
[MAIN]: *Failed host auth by: (%s!%s).
NOTICE %s :Host Auth failed (%s!%s).
NOTICE %s :Host Auth failed (%s!%s).
[MAIN]: *Failed pass auth by: (%s!%s).
[MAIN]: *Failed pass auth by: (%s!%s).
NOTICE %s :Your attempt has been logged.
NOTICE %s :Your attempt has been logged.
NOTICE %s :Pass auth failed (%s!%s).
NOTICE %s :Pass auth failed (%s!%s).
[MAIN]: Random nick change: %s
[MAIN]: Random nick change: %s
[FTP]: Uploading file: %s to: %s failed.
[FTP]: Uploading file: %s to: %s failed.
[FTP]: Uploading file: %s to: %s
[FTP]: Uploading file: %s to: %s
PTF.exe
PTF.exe
-s:%s
-s:%s
open %s
open %s
put %s
put %s
%s\%i%i%i.dll
%s\%i%i%i.dll
[FTP]: File not found: %s.
[FTP]: File not found: %s.
[MAIN]: Invalid login slot number: %d.
[MAIN]: Invalid login slot number: %d.
[MAIN]: No user logged in at slot: %d.
[MAIN]: No user logged in at slot: %d.
[MAIN]: %s
[MAIN]: %s
QUIT :%s
QUIT :%s
[MAIN]: Status: Ready. Bot Uptime: %s.
[MAIN]: Status: Ready. Bot Uptime: %s.
[MAIN]: Bot ID: %s.
[MAIN]: Bot ID: %s.
[THREADS]: Failed to start list thread, error: .
[THREADS]: Failed to start list thread, error: .
[MAIN]: Uptime: %s.
[MAIN]: Uptime: %s.
[CMD]: Remote shell ready.
[CMD]: Remote shell ready.
[CMD]: Couldn't open remote shell.
[CMD]: Couldn't open remote shell.
[CMD]: Remote shell already running.
[CMD]: Remote shell already running.
[TFTP]: Failed to start server thread, error: .
[TFTP]: Failed to start server thread, error: .
[TFTP]: Server started on Port: %d, File: %s, Request: %s.
[TFTP]: Server started on Port: %d, File: %s, Request: %s.
[TFTP]: Already running.
[TFTP]: Already running.
[MAIN]: Nick changed to: '%s'.
[MAIN]: Nick changed to: '%s'.
[MAIN]: Joined channel: '%s'.
[MAIN]: Joined channel: '%s'.
[MAIN]: Parted channel: '%s'.
[MAIN]: Parted channel: '%s'.
[MAIN]: IRC Raw: %s.
[MAIN]: IRC Raw: %s.
[THREADS]: Failed to kill thread: %s.
[THREADS]: Failed to kill thread: %s.
[THREADS]: Killed thread: %s.
[THREADS]: Killed thread: %s.
[THREADS]: Stopped: %d thread(s).
[THREADS]: Stopped: %d thread(s).
[MAIN]: Prefix changed to: '%c'.
[MAIN]: Prefix changed to: '%c'.
[SHELL]: Couldn't open file: %s
[SHELL]: Couldn't open file: %s
[SHELL]: File opened: %s
[SHELL]: File opened: %s
[MAIN]: Server changed to: '%s'.
[MAIN]: Server changed to: '%s'.
[DNS]: Lookup: %s -> %s.
[DNS]: Lookup: %s -> %s.
[FILE]: Deleted '%s'.
[FILE]: Deleted '%s'.
[VISIT]: Failed to start connection thread, error: .
[VISIT]: Failed to start connection thread, error: .
[VISIT]: URL: %s.
[VISIT]: URL: %s.
[CMD]: Commands: %s
[CMD]: Commands: %s
[CMD]: Error sending to remote shell.
[CMD]: Error sending to remote shell.
[MAIN]: Read file failed: %s
[MAIN]: Read file failed: %s
[MAIN]: Read file complete: %s
[MAIN]: Read file complete: %s
[MAIN]: Gethost: %s.
[MAIN]: Gethost: %s.
[MAIN]: Gethost: %s, Command: %s
[MAIN]: Gethost: %s, Command: %s
[MAIN]: Alias added: %s.
[MAIN]: Alias added: %s.
[MAIN]: Privmsg: %s: %s.
[MAIN]: Privmsg: %s: %s.
[MAIN]: Action: %s: %s.
[MAIN]: Action: %s: %s.
PART %s
PART %s
[MAIN]: Mode change: %s
[MAIN]: Mode change: %s
MODE %s
MODE %s
[CLONE]: Raw (%s): %s
[CLONE]: Raw (%s): %s
[CLONE]: Mode (%s): %s
[CLONE]: Mode (%s): %s
[CLONE]: Nick (%s): %s
[CLONE]: Nick (%s): %s
JOIN %s %s
JOIN %s %s
[MAIN]: Repeat not allowed in command line: %s
[MAIN]: Repeat not allowed in command line: %s
[MAIN]: Repeat: %s
[MAIN]: Repeat: %s
%s %s %s :%s
%s %s %s :%s
[UPDATE]: Failed to start download thread, error: .
[UPDATE]: Failed to start download thread, error: .
[UPDATE]: Downloading update from: %s.
[UPDATE]: Downloading update from: %s.
%s%s.exe
%s%s.exe
[EXEC]: Commands: %s
[EXEC]: Commands: %s
[EXEC]: Couldn't execute file.
[EXEC]: Couldn't execute file.
[CLONES]: Failed to start clone thread, error: .
[CLONES]: Failed to start clone thread, error: .
[CLONES]: Created on %s:%d, in channel %s.
[CLONES]: Created on %s:%d, in channel %s.
[DDoS]: Failed to start flood thread, error: .
[DDoS]: Failed to start flood thread, error: .
[DDoS]: Flooding: (%s:%s) for %s seconds.
[DDoS]: Flooding: (%s:%s) for %s seconds.
[DOWNLOAD]: Failed to start transfer thread, error: .
[DOWNLOAD]: Failed to start transfer thread, error: .
[DOWNLOAD]: Downloading URL: %s to: %s.
[DOWNLOAD]: Downloading URL: %s to: %s.
[REDIRECT]: Failed to start redirection thread, error: .
[REDIRECT]: Failed to start redirection thread, error: .
[REDIRECT]: TCP redirect created from: %s:%d to: %s:%d.
[REDIRECT]: TCP redirect created from: %s:%d to: %s:%d.
[SCAN]: Failed to start scan thread, error: .
[SCAN]: Failed to start scan thread, error: .
[SCAN]: Port scan started: %s:%d with delay: %d(ms).
[SCAN]: Port scan started: %s:%d with delay: %d(ms).
[%s] %s
[%s] %s
[%s] * %s %s
[%s] * %s %s
ACTION %s
ACTION %s
[UDP]: Failed to start flood thread, error: .
[UDP]: Failed to start flood thread, error: .
[UDP]: Sending %d packets to: %s. Packet size: %d, Delay: %d(ms).
[UDP]: Sending %d packets to: %s. Packet size: %d, Delay: %d(ms).
ICMP.dll not available
ICMP.dll not available
[PING]: Failed to start flood thread, error: .
[PING]: Failed to start flood thread, error: .
[PING]: Sending %d pings to %s. packet size: %d, timeout: %d(ms).
[PING]: Sending %d pings to %s. packet size: %d, timeout: %d(ms).
[EMAIL]: Message sent to %s.
[EMAIL]: Message sent to %s.
helo $rndnick
helo $rndnick
mail from:
mail from:
rcpt to:
rcpt to:
subject: %s
subject: %s
from: %s
from: %s
udpflood
udpflood
c_privmsg
c_privmsg
. Failed to start flood thread, error: .
. Failed to start flood thread, error: .
. Flooding: (%s:%s) for %s seconds.
. Flooding: (%s:%s) for %s seconds.
ddos.supersyn
ddos.supersyn
c_join
c_join
c_nick
c_nick
privmsg
privmsg
[IDENT]: Server stopped. (%d thread(s) stopped.)
[IDENT]: Server stopped. (%d thread(s) stopped.)
mirccmd
mirccmd
c_rndnick
c_rndnick
join
join
nick
nick
tftp
tftp
tftpserver
tftpserver
[MAIN]: Login list complete.
[MAIN]: Login list complete.
%d. %s
%d. %s
-[Login List]-
-[Login List]-
[CMD]
[CMD]
cmdstop
cmdstop
ocmd
ocmd
opencmd
opencmd
[TFTP]
[TFTP]
tftpstop
tftpstop
supersyn.stop
supersyn.stop
TCP redirect
TCP redirect
rndnick
rndnick
$rndnick
$rndnick
NOTICE %s :
NOTICE %s :
PING %s
PING %s
VERSION %s
VERSION %s
[MAIN]: Joined channel: %s.
[MAIN]: Joined channel: %s.
[MAIN]: User: %s logged out.
[MAIN]: User: %s logged out.
:%s%s
:%s%s
NICK
NICK
NOTICE %s :%s
NOTICE %s :%s
[MAIN]: User %s logged out.
[MAIN]: User %s logged out.
PONG %s
PONG %s
%s Error: %s .
%s Error: %s .
explorer.exe
explorer.exe
%%comspec%% /c %s %s
%%comspec%% /c %s %s
del "%s"
del "%s"
%sdel.bat
%sdel.bat
%d.%d.%d.%d
%d.%d.%d.%d
[PING]: Finished sending pings to %s.
[PING]: Finished sending pings to %s.
[PING]: Error sending pings to %s.
[PING]: Error sending pings to %s.
[UDP]: Finished sending packets to %s.
[UDP]: Finished sending packets to %s.
[UDP]: Error sending pings to %s.
[UDP]: Error sending pings to %s.
[REDIRECT]: Failed to start client thread, error: .
[REDIRECT]: Failed to start client thread, error: .
[REDIRECT]: Client connection from IP: %s:%d, Server thread: %d.
[REDIRECT]: Client connection from IP: %s:%d, Server thread: %d.
[REDIRECT]: Failed to start connection thread, error: .
[REDIRECT]: Failed to start connection thread, error: .
[REDIRECT]: Client connection to IP: %s:%d, Server thread: %d.
[REDIRECT]: Client connection to IP: %s:%d, Server thread: %d.
PRIVMSG %s :%s
PRIVMSG %s :%s
[CMD]: Could not read data from proccess.
[CMD]: Could not read data from proccess.
[CMD]: Proccess has terminated.
[CMD]: Proccess has terminated.
[CMD]: Could not read data from proccess
[CMD]: Could not read data from proccess
[CMD]: Failed to start IO thread, error: .
[CMD]: Failed to start IO thread, error: .
[CMD]: Remote Command Prompt
[CMD]: Remote Command Prompt
cmd.exe
cmd.exe
[%s]|
[%s]|
[%d]%s
[%d]%s
[SCAN]: IP: %s Port: %d is open.
[SCAN]: IP: %s Port: %d is open.
[SCAN]: Scanning IP: %s, Port: %d.
[SCAN]: Scanning IP: %s, Port: %d.
tPTF.exe -i get
tPTF.exe -i get
IP: %s
IP: %s
[TFTP]: Failed to open file: %s.
[TFTP]: Failed to open file: %s.
[TFTP]: Error: socket() failed, returned: .
[TFTP]: Error: socket() failed, returned: .
%s: No %s thread found.
%s: No %s thread found.
%s: %s stopped. (%d thread(s) stopped.)
%s: %s stopped. (%d thread(s) stopped.)
[VISIT]: Failed to connect to HTTP server.
[VISIT]: Failed to connect to HTTP server.
[VISIT]: Invalid URL.
[VISIT]: Invalid URL.
[VISIT]: Failed to get requested URL from HTTP server.
[VISIT]: Failed to get requested URL from HTTP server.
[VISIT]: URL visited.
[VISIT]: URL visited.
zcÃ
zcÃ
[12-09-2014 15:36:21] [IDENTD]: Server running on Port: 113.
[12-09-2014 15:36:21] [IDENTD]: Server running on Port: 113.
%System%\uibtrym.exe
%System%\uibtrym.exe
uibtrym.exe_1388_rwx_00400000_0009C000:
.text
.text
`.rdata
`.rdata
@.data
@.data
_WSSh
_WSSh
t1SSSSh
t1SSSSh
PeekNamedPipe
PeekNamedPipe
CreatePipe
CreatePipe
KERNEL32.dll
KERNEL32.dll
WS2_32.dll
WS2_32.dll
GetCPInfo
GetCPInfo
%d. %s = %s
%d. %s = %s
[%.2d-%.2d-M %.2d:%.2d:%.2d] %s
[%.2d-%.2d-M %.2d:%.2d:%.2d] %s
[DDoS]: Send error: .
[DDoS]: Send error: .
ddos.random
ddos.random
ddos.ack
ddos.ack
ddos.syn
ddos.syn
[DOWNLOAD]: Bad URL, or DNS Error: %s.
[DOWNLOAD]: Bad URL, or DNS Error: %s.
[UPDATE]: Update failed: Error executing file: %s.
[UPDATE]: Update failed: Error executing file: %s.
[UPDATE]: Downloaded %.1fKB to %s @ %.1fKB/sec. Updating.
[UPDATE]: Downloaded %.1fKB to %s @ %.1fKB/sec. Updating.
[DOWNLOAD]: Opened: %s.
[DOWNLOAD]: Opened: %s.
[DOWNLOAD]: Downloaded %.1f KB to %s @ %.1f KB/sec.
[DOWNLOAD]: Downloaded %.1f KB to %s @ %.1f KB/sec.
[DOWNLOAD]: CRC Failed (%d != %d).
[DOWNLOAD]: CRC Failed (%d != %d).
[DOWNLOAD]: Filesize is incorrect: (%d != %d).
[DOWNLOAD]: Filesize is incorrect: (%d != %d).
[DOWNLOAD]: Update: %s (%dKB transferred).
[DOWNLOAD]: Update: %s (%dKB transferred).
[DOWNLOAD]: File download: %s (%dKB transferred).
[DOWNLOAD]: File download: %s (%dKB transferred).
[DOWNLOAD]: Couldn't open file: %s.
[DOWNLOAD]: Couldn't open file: %s.
[IDENTD]: Error: server failed, returned: .
[IDENTD]: Error: server failed, returned: .
: USERID : UNIX : %s
: USERID : UNIX : %s
[IDENTD]: Client connection from IP: %s:%d.
[IDENTD]: Client connection from IP: %s:%d.
%s %s :%s
%s %s :%s
PRIVMSG
PRIVMSG
avicap32.dll
avicap32.dll
SQLDisconnect
SQLDisconnect
SQLFreeHandle
SQLFreeHandle
SQLAllocHandle
SQLAllocHandle
SQLExecDirect
SQLExecDirect
SQLSetEnvAttr
SQLSetEnvAttr
SQLDriverConnect
SQLDriverConnect
odbc32.dll
odbc32.dll
ShellExecuteA
ShellExecuteA
shell32.dll
shell32.dll
mpr.dll
mpr.dll
iphlpapi.dll
iphlpapi.dll
dnsapi.dll
dnsapi.dll
netapi32.dll
netapi32.dll
icmp.dll
icmp.dll
Mozilla/4.0 (compatible)
Mozilla/4.0 (compatible)
InternetCrackUrlA
InternetCrackUrlA
InternetOpenUrlA
InternetOpenUrlA
HttpSendRequestA
HttpSendRequestA
HttpOpenRequestA
HttpOpenRequestA
wininet.dll
wininet.dll
ws2_32.dll
ws2_32.dll
gdi32.dll
gdi32.dll
RegCloseKey
RegCloseKey
RegCreateKeyExA
RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyExA
advapi32.dll
advapi32.dll
ExitWindowsEx
ExitWindowsEx
user32.dll
user32.dll
kernel32.dll
kernel32.dll
Avicap32.dll failed.
Avicap32.dll failed.
Odbc32.dll failed.
Odbc32.dll failed.
Shell32.dll failed.
Shell32.dll failed.
Mpr32.dll failed.
Mpr32.dll failed.
Iphlpapi.dll failed.
Iphlpapi.dll failed.
Dnsapi.dll failed.
Dnsapi.dll failed.
Netapi32.dll failed.
Netapi32.dll failed.
Icmp.dll failed.
Icmp.dll failed.
Wininet.dll failed.
Wininet.dll failed.
Ws2_32.dll failed.
Ws2_32.dll failed.
Gdi32.dll failed.
Gdi32.dll failed.
Advapi32.dll failed.
Advapi32.dll failed.
User32.dll failed.
User32.dll failed.
Kernel32.dll failed.
Kernel32.dll failed.
videos.p0rn-lover.us
videos.p0rn-lover.us
support.exe
support.exe
Supports RAS Connections
Supports RAS Connections
g.dat
g.dat
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\RunServices
Software\Microsoft\Windows\CurrentVersion\RunServices
winpass
winpass
sqlpassoainstall
sqlpassoainstall
databasepassword
databasepassword
databasepass
databasepass
dbpassword
dbpassword
dbpass
dbpass
domainpassword
domainpassword
domainpass
domainpass
loginpass
loginpass
login
login
windows
windows
1234567890
1234567890
123456789
123456789
12345678
12345678
1234567
1234567
pass1234
pass1234
passwd
passwd
password
password
password1
password1
*@fbi.edu
*@fbi.edu
à %dh %dm
à %dh %dm
[NETINFO]: [Type]: %s (%s). [IP Address]: %s. [Hostname]: %s.
[NETINFO]: [Type]: %s (%s). [IP Address]: %s. [Hostname]: %s.
[IDENTD]: Failed to start server, error: .
[IDENTD]: Failed to start server, error: .
[IDENTD]: Server running on Port: 113.
[IDENTD]: Server running on Port: 113.
%s %d "%s"
%s %d "%s"
%s\%s
%s\%s
[MAIN]: Connected to %s.
[MAIN]: Connected to %s.
NICK %s
NICK %s
USER %s 0 0 :%s
USER %s 0 0 :%s
PASS %s
PASS %s
MODE %s %s
MODE %s %s
USERHOST %s
USERHOST %s
[MAIN]: User: %s logged in.
[MAIN]: User: %s logged in.
[MAIN]: Password accepted.
[MAIN]: Password accepted.
[MAIN]: *Failed host auth by: (%s!%s).
[MAIN]: *Failed host auth by: (%s!%s).
NOTICE %s :Host Auth failed (%s!%s).
NOTICE %s :Host Auth failed (%s!%s).
[MAIN]: *Failed pass auth by: (%s!%s).
[MAIN]: *Failed pass auth by: (%s!%s).
NOTICE %s :Your attempt has been logged.
NOTICE %s :Your attempt has been logged.
NOTICE %s :Pass auth failed (%s!%s).
NOTICE %s :Pass auth failed (%s!%s).
[MAIN]: Random nick change: %s
[MAIN]: Random nick change: %s
[FTP]: Uploading file: %s to: %s failed.
[FTP]: Uploading file: %s to: %s failed.
[FTP]: Uploading file: %s to: %s
[FTP]: Uploading file: %s to: %s
PTF.exe
PTF.exe
-s:%s
-s:%s
open %s
open %s
put %s
put %s
%s\%i%i%i.dll
%s\%i%i%i.dll
[FTP]: File not found: %s.
[FTP]: File not found: %s.
[MAIN]: Invalid login slot number: %d.
[MAIN]: Invalid login slot number: %d.
[MAIN]: No user logged in at slot: %d.
[MAIN]: No user logged in at slot: %d.
[MAIN]: %s
[MAIN]: %s
QUIT :%s
QUIT :%s
[MAIN]: Status: Ready. Bot Uptime: %s.
[MAIN]: Status: Ready. Bot Uptime: %s.
[MAIN]: Bot ID: %s.
[MAIN]: Bot ID: %s.
[THREADS]: Failed to start list thread, error: .
[THREADS]: Failed to start list thread, error: .
[MAIN]: Uptime: %s.
[MAIN]: Uptime: %s.
[CMD]: Remote shell ready.
[CMD]: Remote shell ready.
[CMD]: Couldn't open remote shell.
[CMD]: Couldn't open remote shell.
[CMD]: Remote shell already running.
[CMD]: Remote shell already running.
[TFTP]: Failed to start server thread, error: .
[TFTP]: Failed to start server thread, error: .
[TFTP]: Server started on Port: %d, File: %s, Request: %s.
[TFTP]: Server started on Port: %d, File: %s, Request: %s.
[TFTP]: Already running.
[TFTP]: Already running.
[MAIN]: Nick changed to: '%s'.
[MAIN]: Nick changed to: '%s'.
[MAIN]: Joined channel: '%s'.
[MAIN]: Joined channel: '%s'.
[MAIN]: Parted channel: '%s'.
[MAIN]: Parted channel: '%s'.
[MAIN]: IRC Raw: %s.
[MAIN]: IRC Raw: %s.
[THREADS]: Failed to kill thread: %s.
[THREADS]: Failed to kill thread: %s.
[THREADS]: Killed thread: %s.
[THREADS]: Killed thread: %s.
[THREADS]: Stopped: %d thread(s).
[THREADS]: Stopped: %d thread(s).
[MAIN]: Prefix changed to: '%c'.
[MAIN]: Prefix changed to: '%c'.
[SHELL]: Couldn't open file: %s
[SHELL]: Couldn't open file: %s
[SHELL]: File opened: %s
[SHELL]: File opened: %s
[MAIN]: Server changed to: '%s'.
[MAIN]: Server changed to: '%s'.
[DNS]: Lookup: %s -> %s.
[DNS]: Lookup: %s -> %s.
[FILE]: Deleted '%s'.
[FILE]: Deleted '%s'.
[VISIT]: Failed to start connection thread, error: .
[VISIT]: Failed to start connection thread, error: .
[VISIT]: URL: %s.
[VISIT]: URL: %s.
[CMD]: Commands: %s
[CMD]: Commands: %s
[CMD]: Error sending to remote shell.
[CMD]: Error sending to remote shell.
[MAIN]: Read file failed: %s
[MAIN]: Read file failed: %s
[MAIN]: Read file complete: %s
[MAIN]: Read file complete: %s
[MAIN]: Gethost: %s.
[MAIN]: Gethost: %s.
[MAIN]: Gethost: %s, Command: %s
[MAIN]: Gethost: %s, Command: %s
[MAIN]: Alias added: %s.
[MAIN]: Alias added: %s.
[MAIN]: Privmsg: %s: %s.
[MAIN]: Privmsg: %s: %s.
[MAIN]: Action: %s: %s.
[MAIN]: Action: %s: %s.
PART %s
PART %s
[MAIN]: Mode change: %s
[MAIN]: Mode change: %s
MODE %s
MODE %s
[CLONE]: Raw (%s): %s
[CLONE]: Raw (%s): %s
[CLONE]: Mode (%s): %s
[CLONE]: Mode (%s): %s
[CLONE]: Nick (%s): %s
[CLONE]: Nick (%s): %s
JOIN %s %s
JOIN %s %s
[MAIN]: Repeat not allowed in command line: %s
[MAIN]: Repeat not allowed in command line: %s
[MAIN]: Repeat: %s
[MAIN]: Repeat: %s
%s %s %s :%s
%s %s %s :%s
[UPDATE]: Failed to start download thread, error: .
[UPDATE]: Failed to start download thread, error: .
[UPDATE]: Downloading update from: %s.
[UPDATE]: Downloading update from: %s.
%s%s.exe
%s%s.exe
[EXEC]: Commands: %s
[EXEC]: Commands: %s
[EXEC]: Couldn't execute file.
[EXEC]: Couldn't execute file.
[CLONES]: Failed to start clone thread, error: .
[CLONES]: Failed to start clone thread, error: .
[CLONES]: Created on %s:%d, in channel %s.
[CLONES]: Created on %s:%d, in channel %s.
[DDoS]: Failed to start flood thread, error: .
[DDoS]: Failed to start flood thread, error: .
[DDoS]: Flooding: (%s:%s) for %s seconds.
[DDoS]: Flooding: (%s:%s) for %s seconds.
[DOWNLOAD]: Failed to start transfer thread, error: .
[DOWNLOAD]: Failed to start transfer thread, error: .
[DOWNLOAD]: Downloading URL: %s to: %s.
[DOWNLOAD]: Downloading URL: %s to: %s.
[REDIRECT]: Failed to start redirection thread, error: .
[REDIRECT]: Failed to start redirection thread, error: .
[REDIRECT]: TCP redirect created from: %s:%d to: %s:%d.
[REDIRECT]: TCP redirect created from: %s:%d to: %s:%d.
[SCAN]: Failed to start scan thread, error: .
[SCAN]: Failed to start scan thread, error: .
[SCAN]: Port scan started: %s:%d with delay: %d(ms).
[SCAN]: Port scan started: %s:%d with delay: %d(ms).
[%s] %s
[%s] %s
[%s] * %s %s
[%s] * %s %s
ACTION %s
ACTION %s
[UDP]: Failed to start flood thread, error: .
[UDP]: Failed to start flood thread, error: .
[UDP]: Sending %d packets to: %s. Packet size: %d, Delay: %d(ms).
[UDP]: Sending %d packets to: %s. Packet size: %d, Delay: %d(ms).
ICMP.dll not available
ICMP.dll not available
[PING]: Failed to start flood thread, error: .
[PING]: Failed to start flood thread, error: .
[PING]: Sending %d pings to %s. packet size: %d, timeout: %d(ms).
[PING]: Sending %d pings to %s. packet size: %d, timeout: %d(ms).
[EMAIL]: Message sent to %s.
[EMAIL]: Message sent to %s.
helo $rndnick
helo $rndnick
mail from:
mail from:
rcpt to:
rcpt to:
subject: %s
subject: %s
from: %s
from: %s
udpflood
udpflood
c_privmsg
c_privmsg
. Failed to start flood thread, error: .
. Failed to start flood thread, error: .
. Flooding: (%s:%s) for %s seconds.
. Flooding: (%s:%s) for %s seconds.
ddos.supersyn
ddos.supersyn
c_join
c_join
c_nick
c_nick
privmsg
privmsg
[IDENT]: Server stopped. (%d thread(s) stopped.)
[IDENT]: Server stopped. (%d thread(s) stopped.)
mirccmd
mirccmd
c_rndnick
c_rndnick
join
join
nick
nick
tftp
tftp
tftpserver
tftpserver
[MAIN]: Login list complete.
[MAIN]: Login list complete.
%d. %s
%d. %s
-[Login List]-
-[Login List]-
[CMD]
[CMD]
cmdstop
cmdstop
ocmd
ocmd
opencmd
opencmd
[TFTP]
[TFTP]
tftpstop
tftpstop
supersyn.stop
supersyn.stop
TCP redirect
TCP redirect
rndnick
rndnick
$rndnick
$rndnick
NOTICE %s :
NOTICE %s :
PING %s
PING %s
VERSION %s
VERSION %s
[MAIN]: Joined channel: %s.
[MAIN]: Joined channel: %s.
[MAIN]: User: %s logged out.
[MAIN]: User: %s logged out.
:%s%s
:%s%s
NICK
NICK
NOTICE %s :%s
NOTICE %s :%s
[MAIN]: User %s logged out.
[MAIN]: User %s logged out.
PONG %s
PONG %s
%s Error: %s .
%s Error: %s .
explorer.exe
explorer.exe
%%comspec%% /c %s %s
%%comspec%% /c %s %s
del "%s"
del "%s"
%sdel.bat
%sdel.bat
%d.%d.%d.%d
%d.%d.%d.%d
[PING]: Finished sending pings to %s.
[PING]: Finished sending pings to %s.
[PING]: Error sending pings to %s.
[PING]: Error sending pings to %s.
[UDP]: Finished sending packets to %s.
[UDP]: Finished sending packets to %s.
[UDP]: Error sending pings to %s.
[UDP]: Error sending pings to %s.
[REDIRECT]: Failed to start client thread, error: .
[REDIRECT]: Failed to start client thread, error: .
[REDIRECT]: Client connection from IP: %s:%d, Server thread: %d.
[REDIRECT]: Client connection from IP: %s:%d, Server thread: %d.
[REDIRECT]: Failed to start connection thread, error: .
[REDIRECT]: Failed to start connection thread, error: .
[REDIRECT]: Client connection to IP: %s:%d, Server thread: %d.
[REDIRECT]: Client connection to IP: %s:%d, Server thread: %d.
PRIVMSG %s :%s
PRIVMSG %s :%s
[CMD]: Could not read data from proccess.
[CMD]: Could not read data from proccess.
[CMD]: Proccess has terminated.
[CMD]: Proccess has terminated.
[CMD]: Could not read data from proccess
[CMD]: Could not read data from proccess
[CMD]: Failed to start IO thread, error: .
[CMD]: Failed to start IO thread, error: .
[CMD]: Remote Command Prompt
[CMD]: Remote Command Prompt
cmd.exe
cmd.exe
[%s]|
[%s]|
[%d]%s
[%d]%s
[SCAN]: IP: %s Port: %d is open.
[SCAN]: IP: %s Port: %d is open.
[SCAN]: Scanning IP: %s, Port: %d.
[SCAN]: Scanning IP: %s, Port: %d.
tPTF.exe -i get
tPTF.exe -i get
IP: %s
IP: %s
[TFTP]: Failed to open file: %s.
[TFTP]: Failed to open file: %s.
[TFTP]: Error: socket() failed, returned: .
[TFTP]: Error: socket() failed, returned: .
%s: No %s thread found.
%s: No %s thread found.
%s: %s stopped. (%d thread(s) stopped.)
%s: %s stopped. (%d thread(s) stopped.)
[VISIT]: Failed to connect to HTTP server.
[VISIT]: Failed to connect to HTTP server.
[VISIT]: Invalid URL.
[VISIT]: Invalid URL.
[VISIT]: Failed to get requested URL from HTTP server.
[VISIT]: Failed to get requested URL from HTTP server.
[VISIT]: URL visited.
[VISIT]: URL visited.
zcÃ
zcÃ
[12-09-2014 15:36:21] [IDENTD]: Server running on Port: 113.
[12-09-2014 15:36:21] [IDENTD]: Server running on Port: 113.
%System%\uibtrym.exe
%System%\uibtrym.exe