Susp_Dropper (Kaspersky), Trojan.Generic.7395307 (B) (Emsisoft), Trojan.Generic.7395307 (AdAware), Backdoor.Win32.PcClient.FD, Worm.Win32.Dorkbot.FD, WormDorkbot.YR, GenericUDPFlooder.YR, GenericIRCBot.YR, GenericMSNWorm.YR, GenericUSBInfector.YR, GenericDNSBlocker.YR, GenericAutorunWorm.YR, GenericSYNFlooder.YR, GenericInjector.YR, BankerGeneric.YR, GenericProxy.YR, GenericPhysicalDrive0.YR (Lavasoft MAS)Behaviour: Banker, Trojan, Backdoor, Flooder, Worm, WormAutorun, IRCBot, MSNWorm, DNSBlocker, UDPFlooder, SYNFlooder, Trojan-Proxy, USBInfector
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: fece4f67f6a2c52c9eb7885ab1bdccec
SHA1: 2c57902195466f8de6bed04693d43c8257d0ff3a
SHA256: f2bc5c8ee948c148bc0d7aa958aee70252f27789a16955d46b483cb6fa900242
SSDeep: 3072:3Pz3bKIDJofjswlZrHO7cA2DIUFQiKojOJ9ou5g:3jbEfjq03FQWs9oy
Size: 107520 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: home
Created at: 2011-04-14 23:42:36
Analyzed on: WindowsXPESX SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer. |
IRCBot | A bot can communicate with command and control servers via IRC channel. |
MSNWorm | A worm can spread its copies through the MSN Messanger. |
DNSBlocker | A program can block designated DNS servers for making it difficult for users to locate specific domains or web sites on the Internet. |
UDPFlooder | This program can make a UDP flood. A UDP flood attack is a denial-of-service attack using the User Datagram Protocol (UDP). It can be initiated by sending a large number of UDP packets to random ports on a remote host. |
SYNFlooder | This program can make a SYN flood. It is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic. |
Trojan-Proxy | This program can launch a proxy server (SOCKS4) on a designated TCP port. |
USBInfector | A program can register a device notification with the help of RegisterDeviceNotification. So it is notified when a USB device is plugged and then the worm copies itself to the USB device plugged into the affected computer. |
Process activity
The Trojan creates the following process(es):
imapi.exe:1280
%original file name%.exe:1336
Yukmkk.exe:332
drwtsn32.exe:1060
The Trojan injects its code into the following process(es):
mscorsvw.exe:1920
rundll32.exe:1776
explorer.exe:488
csrss.exe:700
winlogon.exe:724
wmiprvse.exe:752
services.exe:768
svchost.exe:936
svchost.exe:1016
svchost.exe:1104
svchost.exe:1156
svchost.exe:1228
spoolsv.exe:1436
jqs.exe:1968
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process imapi.exe:1280 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\Temp\7pf8i2gi.TMP (146970 bytes)
The process %original file name%.exe:1336 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\Yukmkk.exe (601 bytes)
The process drwtsn32.exe:1060 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\All Users\Application Data\Microsoft\Dr Watson\user.dmp (184192 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\Dr Watson\drwtsn32.log (389768 bytes)
Registry activity
The process imapi.exe:1280 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "95 E4 53 70 F0 DC A4 6A 34 58 A1 6C 8A 36 ED 8A"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi]
"ControlFlags" = "1"
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi\ImapiSvc]
"BitNames" = " ImapiDebugError ImapiDebugWarning ImapiDebugTrace ImapiDebugInfo ImapiDebugX ImapiDebugSort"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi]
"LogSessionName" = "stdout"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi\ImapiSvc]
"Guid" = "8107d8e9-e323-49f5-bba2-abc35c243dca"
The process %original file name%.exe:1336 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "44 9F 35 17 7D CA A8 48 ED 57 5D E6 2A 68 1D 98"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Yukmkk" = "%Documents and Settings%\%current user%\Application Data\Yukmkk.exe"
The process rundll32.exe:1776 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A8 F0 6D 0E F9 CB 2C C9 E8 62 21 4D AE AA C4 B1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The process Yukmkk.exe:332 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E1 30 03 16 CF 52 CA 43 9C E1 00 AB 9C C6 E6 19"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
The process drwtsn32.exe:1060 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FC 94 33 93 9D 4F 0C F2 D1 8A CD 53 D9 83 3B AE"
[HKLM\SOFTWARE\Microsoft\DrWatson]
"NumberOfCrashes" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
Dropped PE files
There are no dropped PE files.
HOSTS file anomalies
No changes have been detected.
Rootkit activity
The Trojan installs the following user-mode hooks in WININET.dll:
HttpSendRequestW
InternetWriteFile
HttpSendRequestA
The Trojan installs the following user-mode hooks in ADVAPI32.dll:
RegCreateKeyExA
RegCreateKeyExW
The Trojan installs the following user-mode hooks in WS2_32.dll:
send
GetAddrInfoW
The Trojan installs the following user-mode hooks in kernel32.dll:
MoveFileA
CopyFileW
CopyFileA
MoveFileW
CreateFileW
CreateFileA
The Trojan installs the following user-mode hooks in ntdll.dll:
LdrLoadDll
NtResumeThread
NtQueryDirectoryFile
NtEnumerateValueKey
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.A program can register a device notification with the help of RegisterDeviceNotification. So it is notified when a USB device is plugged and then the worm copies itself to the USB device plugged into the affected computer.A worm can spread its copies through the MSN Messanger.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
imapi.exe:1280
%original file name%.exe:1336
Yukmkk.exe:332
drwtsn32.exe:1060 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%WinDir%\Temp\7pf8i2gi.TMP (146970 bytes)
%Documents and Settings%\%current user%\Application Data\Yukmkk.exe (601 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\Dr Watson\user.dmp (184192 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\Dr Watson\drwtsn32.log (389768 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Yukmkk" = "%Documents and Settings%\%current user%\Application Data\Yukmkk.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: Paragon Software Group
Product Name: Carrie
Product Version: 8.6
Legal Copyright:
Legal Trademarks:
Original Filename: Tyqugdc55v.exe
Internal Name: Fort Moles Mcgee
File Version: 8.6
File Description: Ely Bumps Breed
Comments:
Language: English (United States)
Company Name: Paragon Software GroupProduct Name: CarrieProduct Version: 8.6Legal Copyright: Legal Trademarks: Original Filename: Tyqugdc55v.exeInternal Name: Fort Moles McgeeFile Version: 8.6File Description: Ely Bumps BreedComments: Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
UPX0 | 4096 | 167936 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
UPX1 | 172032 | 106496 | 104960 | 5.5406 | a6fe6f6f1e358726a150607d352ec76a |
.rsrc | 278528 | 40560 | 1536 | 1.94667 | 8eb8a225003c24aa5ddea705676a92d0 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 1
030aba06f91d849896c26498fd208cbf
Network Activity
URLs
URL | IP |
---|---|
hxxp://api.wipmania.com/ |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET / HTTP/1.1
User-Agent: Mozilla/4.0
Host: api.wipmania.com
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 18 Nov 2014 19:18:53 GMT
Content-Type: text/html
Content-Length: 19
Connection: keep-alive
Keep-Alive: timeout=20
"%local server IP%"<br>CA..
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
explorer.exe_488:
.text
.text
`.data
`.data
.rsrc
.rsrc
@.reloc
@.reloc
ADVAPI32.dll
ADVAPI32.dll
BROWSEUI.dll
BROWSEUI.dll
GDI32.dll
GDI32.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
msvcrt.dll
msvcrt.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
SHDOCVW.dll
SHDOCVW.dll
SHELL32.dll
SHELL32.dll
SHLWAPI.dll
SHLWAPI.dll
USER32.dll
USER32.dll
UxTheme.dll
UxTheme.dll
FTSSh
FTSSh
t0SSh
t0SSh
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
SShwk
SShwk
98~%SP
98~%SP
ExplorerStartMsgLoop
ExplorerStartMsgLoop
PSSh;
PSSh;
6SSSSh
6SSSSh
SSSSh
SSSSh
SPSSSShL
SPSSSShL
u%SSh
u%SSh
t.WWWW
t.WWWW
xpsp2res.dll
xpsp2res.dll
xpsp3res.dll
xpsp3res.dll
tbSSh
tbSSh
Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartMenu
Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartMenu
Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartPanel
Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartPanel
kernel32.dll
kernel32.dll
GetSystemWindowsDirectoryW
GetSystemWindowsDirectoryW
NetGetJoinInformation
NetGetJoinInformation
WINMM.dll
WINMM.dll
SETUPAPI.dll
SETUPAPI.dll
WINSTA.dll
WINSTA.dll
OLEACC.dll
OLEACC.dll
USERENV.dll
USERENV.dll
ntdll.dll
ntdll.dll
RegEnumKeyExW
RegEnumKeyExW
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegOpenKeyExA
RegOpenKeyExA
RegEnumKeyW
RegEnumKeyW
RegCloseKey
RegCloseKey
RegCreateKeyW
RegCreateKeyW
RegQueryInfoKeyW
RegQueryInfoKeyW
RegOpenKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCreateKeyExW
OffsetViewportOrgEx
OffsetViewportOrgEx
GetViewportOrgEx
GetViewportOrgEx
SetViewportOrgEx
SetViewportOrgEx
SetProcessShutdownParameters
SetProcessShutdownParameters
GetProcessHeap
GetProcessHeap
GetWindowsDirectoryW
GetWindowsDirectoryW
CreateIoCompletionPort
CreateIoCompletionPort
ShellExecuteExW
ShellExecuteExW
SHRegCloseUSKey
SHRegCloseUSKey
SHRegCreateUSKeyW
SHRegCreateUSKeyW
AssocQueryKeyW
AssocQueryKeyW
SHRegOpenUSKeyW
SHRegOpenUSKeyW
SHDeleteKeyW
SHDeleteKeyW
TileWindows
TileWindows
ExitWindowsEx
ExitWindowsEx
RegisterHotKey
RegisterHotKey
UnregisterHotKey
UnregisterHotKey
EnumChildWindows
EnumChildWindows
GetKeyState
GetKeyState
GetAsyncKeyState
GetAsyncKeyState
CascadeWindows
CascadeWindows
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
EnumWindows
EnumWindows
explorer.pdb
explorer.pdb
name="Microsoft.Windows.Shell.explorer"
name="Microsoft.Windows.Shell.explorer"
version="5.1.0.0"
version="5.1.0.0"
Windows Shell
Windows Shell
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
]]"```^]]\
]]"```^]]\
3333333330
3333333330
3333330
3333330
333333334
333333334
)@. '5 !*
)@. '5 !*
.DEHHF>?/
.DEHHF>?/
2
2
&$%Uooqkezs
&$%Uooqkezs
['$$#%&(4
['$$#%&(4
3333333333333333333
3333333333333333333
33333333333330
33333333333330
7''''))
7''''))
3'')))33.
3'')))33.
222`444(555
222`444(555
%%%{///-
%%%{///-
000000000
000000000
00000000
00000000
`[66...00
`[66...00
0000000
0000000
`]66./.000
`]66./.000
/./././././././.
/./././././././.
66///0000
66///0000
0000000000000
0000000000000
0000000000
0000000000
6666,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,0.010.010.010.010.010.010.010.010.010.010.001
6666,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,0.010.010.010.010.010.010.010.010.010.010.001
4366666666K,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6.010.010.010.010.010.010.010.010.010.010.000
4366666666K,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6.010.010.010.010.010.010.010.010.010.010.000
:;
:;
) ) ) ) )
) ) ) ) )
|2222'2'2'2'2'2'2'2'2'2'2'2'2'2'2'2',),),),),),),),),),),),),),),),),),),),),),,
|2222'2'2'2'2'2'2'2'2'2'2'2'2'2'2'2',),),),),),),),),),),),),),),),),),),),),),,
22222222222
22222222222
3333333
3333333
.SB99;;;99twv}ut{oxt~
.SB99;;;99twv}ut{oxt~
.SB;;;:::2:w}{{qddgghg
.SB;;;:::2:w}{{qddgghg
" """ """ """ """ "" #
" """ """ """ """ "" #
""" """ """ "#
""" """ """ "#
.SG>''';;9::p
.SG>''';;9::p
:5:5:5:5:5:5:5:5:5:5#"
:5:5:5:5:5:5:5:5:5:5#"
# # # # # # # # # # # # # # # # # # # # # ##$
# # # # # # # # # # # # # # # # # # # # # ##$
( # # # # # # # # # # # # # # # # # # # # ###
( # # # # # # # # # # # # # # # # # # # # ###
1232123212321232123
1232123212321232123
(&(((&(((&(((&(((&((&&)
(&(((&(((&(((&(((&((&&)
&(((&(((&(((&()
&(((&(((&(((&()
`,''')))
`,''')))
'4,4'4,4'4,4'4,4'4,4)(
'4,4'4,4'4,4'4,4'4,4)(
55///0000
55///0000
5555-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-0
5555-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-0
555555555
555555555
55555555
55555555
5555555
5555555
14441444144414441
14441444144414441
4343434343434343
4343434343434343
5555555555555
5555555555555
5555555555
5555555555
-,-,-,-,-,-,-,-,-,-,-*.
-,-,-,-,-,-,-,-,-,-,-*.
..............................JFJFJFJFJFJFJFJFJFJFJ.-
..............................JFJFJFJFJFJFJFJFJFJFJ.-
{22*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-../
{22*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-../
|ujjjjuhF..BBBBBBBBBBBBT
|ujjjjuhF..BBBBBBBBBBBBT
~j|F.BB*BBB*BBB*Bwop
~j|F.BB*BBB*BBB*Bwop
&!!!&!!!&
&!!!&!!!&
44466666
44466666
44444444416
44444444416
4446666
4446666
66666666
66666666
|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |=
|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |=
|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |=
|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |=
DDDDE%CTDD@
DDDDE%CTDD@
A%US$
A%US$
%UUUU
%UUUU
%%UUU
%%UUU
33U
33U
""2222!!
""2222!!
!"!"%UUR""
!"!"%UUR""
!""!"#2"""
!""!"#2"""
"!!"#3"!"
"!!"#3"!"
dnnnnn:n.nfCnmddddd
dnnnnn:n.nfCnmddddd
////;/;;88
////;/;;88
;888;;!/
;888;;!/
!//!!;;^
!//!!;;^
:;:!::!!!
:;:!::!!!
.88.88.8
.88.88.8
.N.NN.M
.N.NN.M
::8.8...
::8.8...
:::!;;:!
:::!;;:!
//!!;888
//!!;888
.8.8.88...
.8.8.88...
:;!::!!;!//!;
:;!::!!;!//!;
!!;:!!::
!!;:!!::
.88..8..
.88..8..
!!:::/^!
!!:::/^!
!;/;!;;;!!!:
!;/;!;;;!!!:
.8:!!!!^
.8:!!!!^
!!:;:::..
!!:;:::..
/:!^^!;{8{../
/:!^^!;{8{../
...:::.-
...:::.-
**6***66*6**6566*5666 ,
**6***66*6**6566*5666 ,
6*6666*6*6 655*65
6*6666*6*6 655*65
6*65 56*5 55 555 *5 6
6*65 56*5 55 555 *5 6
555( 55 (5 5(
555( 55 (5 5(
76 5 66 555*677
76 5 66 555*677
6*6 5 5(5 (55( '5((5 (556 ('5
6*6 5 5(5 (55( '5((5 (556 ('5
665**6(('S((((((S(((]('((@('SS((S(((((((6C-.NEC66S5sU
665**6(('S((((((S(((]('((@('SS((S(((((((6C-.NEC66S5sU
555(555(5((5(5(5(
555(555(5((5(5(5(
5 5 5 5555 (555(555'(((5(5('55(((
5 5 5 5555 (555(555'(((5(5('55(((
((''('5'5(5('('('('('((''('(((@(((('&(((&
((''('5'5(5('('('('('((''('(((@(((('&(((&
%&&%&&&&3>&3&3&33&3&3333&&3>3333
%&&%&&&&3>&3&3&33&3&3333&&3>3333
'(3&'&3&
'(3&'&3&
3&33&&((
3&33&&((
3323>33>%>3%>3>33>3%3&%
3323>33>%>3%>3>33>3%3&%
*5'(('((&@3(
*5'(('((&@3(
,63%3>323>3%>&>33323>>%>
,63%3>323>3%>&>33323>>%>
3(3'(((@@'5('@(@(&('(
3(3'(((@@'5('@(@(&('(
>2>323%>3
>2>323%>3
75((((@3&333&3&&&%&3&&3&33>33%3>23%>3
75((((@3&333&3&&&%&3&&3&33>33%3>23%>3
>2%$32%>2>%>2$3>
>2%$32%>2>%>2$3>
3&%&&3&33>3>33
3&%&&3&33>3>33
3>%>3%&3$23>23$2>2%$>2>
3>%>3%&3$23>23$2>2%$>2>
)4433((&(&('*
)4433((&(&('*
('((((''(**6(('' *
('((((''(**6(('' *
32323>3>
32323>3>
2$%>22%>%3' (
2$%>22%>%3' (
&(&''((5(5 *
&(&''((5(5 *
'(&(&((&('''
'(&(&((&('''
&&%&3&&%3%
&&%&3&&%3%
2%>22>22
2%>22>22
5''3(((3(('&(&'&
5''3(((3(('&(&'&
3%%3%3%2#$
3%%3%3%2#$
22$22$2%$22$2%2%$2%$2$222%$22
22$22$2%$22$2%2%$2%$2$222%$22
&>2$2$2$222$22$%%
&>2$2$2$222$22$%%
:7'((('(3('(3(&(&
:7'((('(3('(3(&(&
222222222222
222222222222
22222222222222
22222222222222
222222222222222
222222222222222
22$22$22$22$
22$22$22$22$
&(%3%&&&&3&&&3%3
&(%3%&&&&3&&&3%3
222222222222222222
222222222222222222
&&(&3(&(&'('((3'(&&
&&(&3(&(&'('((3'(&&
2222222
2222222
22$
22$
&&(3(3('(&'
&&(3(3('(&'
222"2212
222"2212
22
22
(&(3(3((
(&(3(3((
((565 ((( 6
((565 ((( 6
333&33(&&
333&33(&&
'(('('(('(
'(('('(('(
'&%%"$
'&%%"$
2"2"22"2
2"2"22"2
2222
2222
"2"22
"2"22
2%('(3'32222?&'
2%('(3'32222?&'
2"2"2"121212
2"2"2"121212
2"2"2$"?
2"2"2$"?
%%22%2
%%22%2
&3(3(3((&
&3(3(3((&
"2"
"2"
1"?((&21
1"?((&21
22
22
2%""22&&
2%""22&&
2
2
'&('(3(''
'&('(3(''
((%%%"
((%%%"
5(3%"%
5(3%"%
"2%5*67
"2%5*67
))) ))))
))) ))))
""**
""**
"*
"*
#2#---2222-222442-
#2#---2222-222442-
---(-%
---(-%
$/222(--444222!
$/222(--444222!
#&-221269924999;
#&-221269924999;
&$-22-($2%
&$-22-($2%
#(2---222622212-
#(2---222622212-
#2221299629968
#2221299629968
#&--%#(2##!
#&--%#(2##!
-222422422426662-%
-222422422426662-%
"2-##&
"2-##&
!##-#-&%---#---#&-219662%
!##-#-&%---#---#&-219662%
$&-(151,44.9
$&-(151,44.9
&1242662-
&1242662-
-(..19.19
-(..19.19
,4492.12
,4492.12
12-$-,-,
12-$-,-,
-, $$----
-, $$----
#%#-15/-&
#%#-15/-&
-,(,,(,(,
-,(,,(,(,
$$11651566/,$&&
$$11651566/,$&&
,2592&&&-
,2592&&&-
2466/!$$
2466/!$$
""*
""*
) '????[
) '????[
&&&$-556>>61,,5994511-
&&&$-556>>61,,5994511-
$(//$$$(6>6/,$,-$
$(//$$$(6>6/,$,-$
#$-22692/,,$,-&
#$-22692/,,$,-&
-266661..4514#
-266661..4514#
&,2-&#
&,2-&#
&-222,22--#
&-222,22--#
#&&---2-,-&$&(,,291.566..BNNNTNNNNNAABIAA88
#&&---2-,-&$&(,,291.566..BNNNTNNNNNAABIAA88
&!#&!-##
&!#&!-##
--//11468>885882&
--//11468>885882&
$266961$&--$&%
$266961$&--$&%
,1661,!-((#
,1661,!-((#
&$,4255$,92
&$,4255$,92
&$,44..&
&$,44..&
""**""***""
""**""***""
"****
"****
"**""""*""""
"**""""*""""
&-569./-,16522$
&-569./-,16522$
.BAA=86546888=AAAEAAEMNRMQQSWZZ\]gk__m__\
.BAA=86546888=AAAEAAEMNRMQQSWZZ\]gk__m__\
bTRHHHHHQQHQJQWJSSSSSSSSSSSSSSSSWWSSSS\\V]VZW8,.FW]\\]\]\]\\ZZ\\WFR>38(
bTRHHHHHQQHQJQWJSSSSSSSSSSSSSSSSWWSSSS\\V]VZW8,.FW]\\]\]\]\\ZZ\\WFR>38(
.BTTkgn]ktvgmvvvvvmvvvsvzzzyzyzyzyyyzmkkkkkZSRA816;F87
.BTTkgn]ktvgmvvvvvmvvvsvzzzyzyzyzyyyzmkkkkkZSRA816;F87
yzyzyzym^Z]WN3 $&$.Wt\
yzyzyzym^Z]WN3 $&$.Wt\
""*"""****""""
""*"""****""""
"***"**""**
"***"**""**
$5612,.2,
$5612,.2,
&$$,,,5]
&$$,,,5]
$]t.Ft
$]t.Ft
7%8U8
7%8U8
3 303
3 303
2
8 8$8(8,80848885%5,575{67 7$7(7,70747rundll32.exeSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AdvancedSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPageSoftware\Microsoft\Windows\CurrentVersion\Explorer\Advanced::{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}::{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}::{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}::{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}::{D20EA4E1-3957-11d2-A40B-0C5020524153}::{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}{208D2C60-3AEA-1069-A2D7-08002B30309D}{20D04FE0-3AEA-1069-A2D8-08002B30309D}Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites{450D8FBA-AD25-11D0-98A8-0800361B1103}CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}Software\Microsoft\Windows\CurrentVersion\RunOnceSoftware\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoadSoftware\Microsoft\Windows\CurrentVersion\Explorer\DontShowMeThisDialogAgainSoftware\Microsoft\Windows\CurrentVersion\Explorer\Desktop\CleanupWiz\\.\WMIDataDeviceSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Policies\Explorer\RunSoftware\Microsoft\Windows NT\CurrentVersion\WindowsExplorerIsShellMutexdesk.cplSoftware\Microsoft\Windows\CurrentVersion\Explorertourstart.exetourstart.exe,0Microsoft.OfferTourWINWORD.EXESoftware\Microsoft\Windows\CurrentVersion\AppletsSoftware\Microsoft\Windows\CurrentVersion\Applets\Tourexplorer.exe,9Microsoft.FixScreenResolutionshell:::{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociationSoftware\Microsoft\Windows NT\CurrentVersionshell:::{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}Software\Microsoft\Windows\CurrentVersion\Explorer\StartPageSoftware\Microsoft\Windows\CurrentVersion\Policies\ExplorerDDEEXECUTESHORTCIRCUIThttp\shellIEXPLORE.EXESoftware\Microsoft\Windows\CurrentVersion\Explorer\Streams\DesktopSoftware\Microsoft\Windows\CurrentVersion\RunOnceExcomctl32.dllSoftware\Microsoft\Windows\Internet SettingsAutoConfigURLsystem.iniAppEvents\Schemes\Apps\.Default\%s\.currentSoftware\Microsoft\Windows\CurrentVersion\Explorer\TrayNotifyMSShellRunDlgReadyres://mys.dll/mys.hta /explorermshta.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\WelcomeSoftware\Microsoft\Windows\CurrentVersion\Explorer\TipsSOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\MYScys.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\srvWizinstall.exeSOFTWARE\Microsoft\Windows\CurrentVersion\Control PanelOUTLOOK.EXEexplorer.exe,16iernonce.dllWININET.DLLUpdateURLWindowsUpdateHWND%xSoftware\Microsoft\Windows\CurrentVersion\OemStartMenuDatafldrclnr.dll,Wizard_RunDLLiexplore.exewinbrand.dllSoftware\Microsoft\Windows\CurrentVersion\Explorer\Remote\%dshell32.dllnusrmgr.cpl ,initialTask=ChangePictureNewExeNameWindowsediskeer.dlltimedate.cplSoftware\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\LastVisitedMRUSoftware\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\OpenSaveMRUSoftware\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRUSoftware\Microsoft\Windows\CurrentVersion\Explorer\RunMRUSoftware\Microsoft\Internet Explorer\TypedURLs%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Calculator.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Games\Solitaire.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Paint.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\WordPad.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Files and Settings Transfer Wizard.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Windows Movie Maker.lnk%USERPROFILE%\Start Menu\Programs\Accessories\Tour Windows XP.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Windows Messenger.lnk%USERPROFILE%\Start Menu\Programs\Windows Media Player.lnk%ALLUSERSPROFILE%\Start Menu\Programs\MSN.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Get Online with MSN.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Get Going with Tablet PC.lnk%ALLUSERSPROFILE%\Start Menu\Set Program Access and Defaults.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Windows Journal.lnk%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Media Center\Media Center.lnk%USERPROFILE%\Start Menu\Programs\Internet Explorer.lnkSoftware\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanelTSAppCMP.DLLnetapi32.dll%SystemRoot%\system32\restore\rstrui.exeRunDLL32.EXE Shell32.DLL,ShellExec_RunDLL ?0x%X?%sRunDLL32.EXE%s%d%sSoftware\Microsoft\Windows\CurrentVersion\Policies\Systemsettings.dllexplorer.exe "explorer.exe /e, "WindowsLogonWindowsLogoff%s %sSoftware\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\CountuAppWiz.Cpl\explorer.exeSoftware\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu::{20D04FE0-3AEA-1069-A2D8-08002B30309D}taskmgr.exeShellExecuteSoftware\Microsoft\Windows\CurrentVersion\Explorer\AppKey\%d\WindowsShell.ManifestGet Online with MSN.lnkSet Program Access and Defaults.lnkLink%dOEM%dSoftware\Microsoft\Windows\CurrentVersion\SMDEn::{D20EA4E1-3957-11d2-A40B-0C5020524152}%WinDir%\explorer.exeThere is a file or folder on your computer called "%s" which could cause certain applications to not function correctly. Renaming it to "%s" would solve this problem. Would you like to rename it now?Ca&scade WindowsTile Windows &HorizontallyTile Windows V&ertically&Windows Security...&Help and Support&Log Off %s...Windows Explorer6.00.2900.5512 (xpsp.080413-2105)EXPLORER.EXEWindowsOperating System6.00.2900.5512Keep the &taskbar on top of other windowsTo remove records of recently accessed documents, programs, and Web sites, click Clear.Windows displays icons for active and urgent notifications, and hides inactive ones. You can change this behavior for items in the list below.Select this option to use the menu style from earlier versions of Windows.6There is not enough memory to complete this operation.8Unable to run command.The folder '%1' has been removed.WMy Computer or Windows Explorer has not been properly initialized yet. Try again later.&Undo %sWindows is running in safe mode.This special diagnostic mode of Windows enables you to fix a problem which may be caused by your network or hardware settings. Make sure these settings are correct in Control Panel, and then try starting Windows again. While in safe mode, some of your devices may not be available.startRThere was an internal error and one of the windows you were using has been closed.Restrictions{This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.&Show Open WindowsWindows was unable to change the display settings for the new configuration. Return the computer to the previous state, shut down Windows, and restart the computer in the desired configuration.There may be a problem with your display settings if you continue. To safely change to a new configuration, you should shut down Windows and restart the computer in the desired configuration. Do you want to continue anyway?This pre-release version of "Internet Explorer 4.0" Desktop/Explorer has expired. Please update to the latest release of "Internet Explorer 4.0" from WWW.MICROSOFT.COMhelpctr.exe>-FromStartHelpTake a tour of Windows XPNOpens a window where you can pick search options and work with search results.aOpens a central location for Help topics, tutorials, troubleshooting, and other support services./Opens a program, folder, document, or Web site.Provides options for closing your programs and logging off, or for leaving your programs running and switching to another user.lProvides options for turning off or restarting your computer, or for activating Stand By or Hibernate modes.RDisconnects your session. You can reconnect to the session when you log on again.&Windows SecurityiOpens the My Documents folder, where you can store letters, reports, notes, and other kinds of documents./Displays recently opened documents and folders.KOpens the My Music folder, where you can store music and other audio files.]Opens the My Pictures folder, where you can store digital photos, images, and graphics files.zGives access to, and information about, the disk drives, cameras, scanners, and other hardware connected to your computer.MGives access to, and information about, folders and files on other computers.8Connects to other computers, networks, and the Internet.explorer.exe_488_rwx_000A0000_00029000:.text`.rdata@.data.reloc:.datttBtoSSSSSSSSSShShellExecuteASHELL32.dllHttpQueryInfoAInternetOpenUrlAHttpQueryInfoWWININET.dllSHLWAPI.dllntdll.dllWS2_32.dllMSVCRT.dllGetWindowsDirectoryWGetProcessHeapConnectNamedPipeCreateNamedPipeADisconnectNamedPipeGetWindowsDirectoryAKERNEL32.dllUSER32.dllRegCloseKeyRegCreateKeyExWADVAPI32.dllole32.dll%s.%s%s.%S%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!autorun.inf%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!%s.Blocked "%s" from removing our bot file!%s.Blocked "%S" from removing our bot file!%s.%s ->> %s : %s%s-%s-%s%s.Blocked "%s" from moving our bot file%s.Blocked "%S" from moving our bot file%s.%s%s%S%s%s%s.%S%S%S%S%S%s.p10-> Message hijacked!%s.p10-> Message to %s hijacked!%s.p21-> Message hijacked!msnmsgCAL %d %6sJOIN #%s.Detected process "%S" sending an IRC packet to server %s:%d.PRIVMSG #%s:%d%s.PTF://%s:%s@%s:%d (p='%S')%s:%s@%s:%dPASS %sUSER %sftpgrab%s.Blocked possible browser exploit pack call on URL '%s'hXXp://%s.Blocked possible browser exploit pack call on URL '%S'ng.bestgamesever.bizng.xmyserverx.infong.idolmovies.comng.furioshizzle.infong.studyingcenter-org.comfbi.gov1.0.3msn.setmsn.inthttp.sethttp.inthttp.injloginswebroot.virusbuster.nprotect.heck.tconecare.live.RSSR %s 0 0 :%sKCIK %sSEND %s %sPART %sPRIVMSG %s :%sQUIT :%sPONG %sPRIVMSG[v="%s" c="%s" h="%s" p="%S"][d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d[Slowloris]: Starting flood on "%s" for %d minute(s)[Slowloris]: Finished flood on "%s"[UDP]: Starting flood on "%s:%d" for %d second(s)[UDP]: Finished flood on "%s:%d"[SYN]: Starting flood on "%s:%d" for %d second(s)[SYN]: Finished flood on "%s:%d"[USB]: Infected %s[MSN]: Updated MSN spread message to "%s"[MSN]: Updated MSN spread interval to "%s"[HTTP]: Updated HTTP spread message to "%s"[HTTP]: Injected value is now %s.[HTTP]: Updated HTTP spread interval to "%s"[Visit]: Visited "%s"[DNS]: Blocked "%s"[usb="%d" msn="%d" http="%d" total="%d"][ftp="%d" http="%d" total="%d"][RSOCK4]: Started rsock4 on "%s:%d"[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)[d="%s"] Error downloading file [e="%d"][d="%s"] Error writing download to "%S" [e="%d"][d="%s" s="%d bytes"] Error creating process "%S" [e="%d"][d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"][d="%s"] Error getting temporary filename. [e="%d"][d='%s"] Error getting application data path [e="%d"][Visit]: Error visitng "%s"[FTP Login]: %s[FTP Infect]: %s was iframed[HTTP Login]: %s[HTTP Traffic]: %s[Ruskill]: Detected File: "%s"[Ruskill]: Detected DNS: "%s"[Ruskill]: Detected Reg: "%s"[PDef ]: %s[DNS]: Blocked DNS "%s"[MSN]: %s[HTTP]: %sftplogftpinfecthttploginhttptraffhttpspreadhXXp://api.wipmania.com/\\.\pipe\%s_ipc*officebanking.cl/*login.asp**secure.logmein.*/*logincheck**megaupload.*/*loginloginUserPasswordloginUserName*loginUserPassword=**fileserve.*/login*session[password]*password]=**twitter.com/sessions*:2086/login**:2083/login*Password*&Password=**.alertpay.*/*login.aspxtxtPassword*&txtPassword=**.moneybookers.*/*login.pl*runescape*/*weblogin**&password=**no-ip*/login**steampowered*/login*quick_password*hackforums.*/member.php*facebook.*/login.php**login.yahoo.*/*login*passwdlogin*passwd=**login.live.*/*post.srf*TextfieldPassword*TextfieldPassword=**gmx.*/*FormLogin**Passwd=*FLN-Password*FLN-Password=**pass=**bigstring.*/*index.php**screenname.aol.*/login.psp*passwordloginId*password=**aol.*/*login.psp*Passwd*google.*/*ServiceLoginAuth*login_passwordlogin_email*login_password=**paypal.*/webscr?cmd=_login-submit*%s / ?%d HTTP/1.1Host: %sUser-Agent: %sMozilla/4.0-\\.\PHYSICALDRIVE0state_%sshell32.dllhttpidnsapi.dllhXXp://%s/%shXXp://%s/POST /23s{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s[DNS]: Redirecting "%s" to "%s"%s|%s[Logins]: Cleared %d loginsexplorer.exe[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)[Logins]: %s[DNS]: Blocked %d domain(s) - Redirected %d domain(s)icon=shell32.dll,7shellexecute=%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %Ã%%%s/c "start %Ã%%RECYCLER\%s\\.\%c:%s\%s%sautorun.tmp%sautorun.inf%0x.exeMSG %d %s %dMSG %d %1sSDG %d %dContent-Length: %dSDG %d%s_0xXRegCreateKeyExAURLDownloadToFileWURLDownloadToFileAHttpSendRequestWHttpSendRequestANtEnumerateValueKey%s-Mutex%s_%d%s_%lukernel32.dll%WinDir%\explorer.exewinlogon.exe%Documents and Settings%\%current user%\Application Data\Yukmkk.exe%WinDir%40109cb.exe0 0F0K0Q0e0r0x0~0\\.\pipenwlcomm.exemsmsgs.exemsnmsgr.exepidgin.exexchat.exemirc.exeiexplore.exefirefox.exeSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Policies\System.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Runcipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exel"%s" %SInternet Explorer\iexplore.exelol.exe%s:Zone.IdentifierAadvapi32.dllurlmon.dllnspr4.dllwininet.dllws2_32.dllAkernel23.dllyntdll.dllskype.exelsass.exe\Device\HarddiskVolume1\WINDOWS\explorer.exerundll32.exe_1776:.text`.data.rsrcmsvcrt.dllKERNEL32.dllNTDLL.DLLGDI32.dllUSER32.dllIMAGEHLP.dllrundll32.pdb.....eZXnnnnnnnnnnnn3....eDXnnnnnnnnnnnn3...eDXnnnnnnnnnnnn,.eDXnnnnnnnnnnnn,%Xnnnnnnnnnnnnnnn1O3$dS7"%U9.manifest5.1.2600.5512 (xpsp.080413-2105)RUNDLL.EXEWindowsOperating System5.1.2600.5512YThere is not enough memory to run the file %s.Please close other windows and try again.9The file %s or one of its components could not be opened.0The file %s or one of its components cannot run.MThe file %s or one of its components requires a different version of Windows.UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"Error in %sMissing entry:%sError loading %srundll32.exe_1776_rwx_000A0000_00029000:.text`.rdata@.data.reloc:.datttBtoSSSSSSSSSShShellExecuteASHELL32.dllHttpQueryInfoAInternetOpenUrlAHttpQueryInfoWWININET.dllSHLWAPI.dllntdll.dllWS2_32.dllMSVCRT.dllGetWindowsDirectoryWGetProcessHeapConnectNamedPipeCreateNamedPipeADisconnectNamedPipeGetWindowsDirectoryAKERNEL32.dllUSER32.dllRegCloseKeyRegCreateKeyExWADVAPI32.dllole32.dll%s.%s%s.%S%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!autorun.inf%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!%s.Blocked "%s" from removing our bot file!%s.Blocked "%S" from removing our bot file!%s.%s ->> %s : %s%s-%s-%s%s.Blocked "%s" from moving our bot file%s.Blocked "%S" from moving our bot file%s.%s%s%S%s%s%s.%S%S%S%S%S%s.p10-> Message hijacked!%s.p10-> Message to %s hijacked!%s.p21-> Message hijacked!msnmsgCAL %d %6sJOIN #%s.Detected process "%S" sending an IRC packet to server %s:%d.PRIVMSG #%s:%d%s.PTF://%s:%s@%s:%d (p='%S')%s:%s@%s:%dPASS %sUSER %sftpgrab%s.Blocked possible browser exploit pack call on URL '%s'hXXp://%s.Blocked possible browser exploit pack call on URL '%S'ng.bestgamesever.bizng.xmyserverx.infong.idolmovies.comng.furioshizzle.infong.studyingcenter-org.comfbi.gov1.0.3msn.setmsn.inthttp.sethttp.inthttp.injloginswebroot.virusbuster.nprotect.heck.tconecare.live.RSSR %s 0 0 :%sKCIK %sSEND %s %sPART %sPRIVMSG %s :%sQUIT :%sPONG %sPRIVMSG[v="%s" c="%s" h="%s" p="%S"][d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d[Slowloris]: Starting flood on "%s" for %d minute(s)[Slowloris]: Finished flood on "%s"[UDP]: Starting flood on "%s:%d" for %d second(s)[UDP]: Finished flood on "%s:%d"[SYN]: Starting flood on "%s:%d" for %d second(s)[SYN]: Finished flood on "%s:%d"[USB]: Infected %s[MSN]: Updated MSN spread message to "%s"[MSN]: Updated MSN spread interval to "%s"[HTTP]: Updated HTTP spread message to "%s"[HTTP]: Injected value is now %s.[HTTP]: Updated HTTP spread interval to "%s"[Visit]: Visited "%s"[DNS]: Blocked "%s"[usb="%d" msn="%d" http="%d" total="%d"][ftp="%d" http="%d" total="%d"][RSOCK4]: Started rsock4 on "%s:%d"[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)[d="%s"] Error downloading file [e="%d"][d="%s"] Error writing download to "%S" [e="%d"][d="%s" s="%d bytes"] Error creating process "%S" [e="%d"][d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"][d="%s"] Error getting temporary filename. [e="%d"][d='%s"] Error getting application data path [e="%d"][Visit]: Error visitng "%s"[FTP Login]: %s[FTP Infect]: %s was iframed[HTTP Login]: %s[HTTP Traffic]: %s[Ruskill]: Detected File: "%s"[Ruskill]: Detected DNS: "%s"[Ruskill]: Detected Reg: "%s"[PDef ]: %s[DNS]: Blocked DNS "%s"[MSN]: %s[HTTP]: %sftplogftpinfecthttploginhttptraffhttpspreadhXXp://api.wipmania.com/\\.\pipe\%s_ipc*officebanking.cl/*login.asp**secure.logmein.*/*logincheck**megaupload.*/*loginloginUserPasswordloginUserName*loginUserPassword=**fileserve.*/login*session[password]*password]=**twitter.com/sessions*:2086/login**:2083/login*Password*&Password=**.alertpay.*/*login.aspxtxtPassword*&txtPassword=**.moneybookers.*/*login.pl*runescape*/*weblogin**&password=**no-ip*/login**steampowered*/login*quick_password*hackforums.*/member.php*facebook.*/login.php**login.yahoo.*/*login*passwdlogin*passwd=**login.live.*/*post.srf*TextfieldPassword*TextfieldPassword=**gmx.*/*FormLogin**Passwd=*FLN-Password*FLN-Password=**pass=**bigstring.*/*index.php**screenname.aol.*/login.psp*passwordloginId*password=**aol.*/*login.psp*Passwd*google.*/*ServiceLoginAuth*login_passwordlogin_email*login_password=**paypal.*/webscr?cmd=_login-submit*%s / ?%d HTTP/1.1Host: %sUser-Agent: %sMozilla/4.0-\\.\PHYSICALDRIVE0state_%sshell32.dllhttpidnsapi.dllhXXp://%s/%shXXp://%s/POST /23s{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s[DNS]: Redirecting "%s" to "%s"%s|%s[Logins]: Cleared %d loginsexplorer.exe[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)[Logins]: %s[DNS]: Blocked %d domain(s) - Redirected %d domain(s)icon=shell32.dll,7shellexecute=%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %Ã%%%s/c "start %Ã%%RECYCLER\%s\\.\%c:%s\%s%sautorun.tmp%sautorun.inf%0x.exeMSG %d %s %dMSG %d %1sSDG %d %dContent-Length: %dSDG %d%s_0xXRegCreateKeyExAURLDownloadToFileWURLDownloadToFileAHttpSendRequestWHttpSendRequestANtEnumerateValueKey%s-Mutex%s_%d%s_%lukernel32.dll%System%\rundll32.exe%Documents and Settings%\%current user%\Application Data\Yukmkk.exe%WinDir%0 0F0K0Q0e0r0x0~0\\.\pipenwlcomm.exemsmsgs.exemsnmsgr.exepidgin.exexchat.exemirc.exeiexplore.exefirefox.exeSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Policies\System.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Runcipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exel"%s" %SInternet Explorer\iexplore.exelol.exe%s:Zone.Identifierwinlogon.exeAadvapi32.dllurlmon.dllnspr4.dllwininet.dllws2_32.dllAkernel23.dllyntdll.dllskype.exelsass.exe\Device\HarddiskVolume1\WINDOWS\system32\rundll32.execsrss.exe_700_rwx_00AD0000_00029000:.text`.rdata@.data.reloc:.datttBtoSSSSSSSSSShShellExecuteASHELL32.dllHttpQueryInfoAInternetOpenUrlAHttpQueryInfoWWININET.dllSHLWAPI.dllntdll.dllWS2_32.dllMSVCRT.dllGetWindowsDirectoryWGetProcessHeapConnectNamedPipeCreateNamedPipeADisconnectNamedPipeGetWindowsDirectoryAKERNEL32.dllUSER32.dllRegCloseKeyRegCreateKeyExWADVAPI32.dllole32.dll%s.%s%s.%S%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!autorun.inf%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!%s.Blocked "%s" from removing our bot file!%s.Blocked "%S" from removing our bot file!%s.%s ->> %s : %s%s-%s-%s%s.Blocked "%s" from moving our bot file%s.Blocked "%S" from moving our bot file%s.%s%s%S%s%s%s.%S%S%S%S%S%s.p10-> Message hijacked!%s.p10-> Message to %s hijacked!%s.p21-> Message hijacked!msnmsgCAL %d %6sJOIN #%s.Detected process "%S" sending an IRC packet to server %s:%d.PRIVMSG #%s:%d%s.PTF://%s:%s@%s:%d (p='%S')%s:%s@%s:%dPASS %sUSER %sftpgrab%s.Blocked possible browser exploit pack call on URL '%s'hXXp://%s.Blocked possible browser exploit pack call on URL '%S'ng.bestgamesever.bizng.xmyserverx.infong.idolmovies.comng.furioshizzle.infong.studyingcenter-org.comfbi.gov1.0.3msn.setmsn.inthttp.sethttp.inthttp.injloginswebroot.virusbuster.nprotect.heck.tconecare.live.RSSR %s 0 0 :%sKCIK %sSEND %s %sPART %sPRIVMSG %s :%sQUIT :%sPONG %sPRIVMSG[v="%s" c="%s" h="%s" p="%S"][d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d[Slowloris]: Starting flood on "%s" for %d minute(s)[Slowloris]: Finished flood on "%s"[UDP]: Starting flood on "%s:%d" for %d second(s)[UDP]: Finished flood on "%s:%d"[SYN]: Starting flood on "%s:%d" for %d second(s)[SYN]: Finished flood on "%s:%d"[USB]: Infected %s[MSN]: Updated MSN spread message to "%s"[MSN]: Updated MSN spread interval to "%s"[HTTP]: Updated HTTP spread message to "%s"[HTTP]: Injected value is now %s.[HTTP]: Updated HTTP spread interval to "%s"[Visit]: Visited "%s"[DNS]: Blocked "%s"[usb="%d" msn="%d" http="%d" total="%d"][ftp="%d" http="%d" total="%d"][RSOCK4]: Started rsock4 on "%s:%d"[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)[d="%s"] Error downloading file [e="%d"][d="%s"] Error writing download to "%S" [e="%d"][d="%s" s="%d bytes"] Error creating process "%S" [e="%d"][d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"][d="%s"] Error getting temporary filename. [e="%d"][d='%s"] Error getting application data path [e="%d"][Visit]: Error visitng "%s"[FTP Login]: %s[FTP Infect]: %s was iframed[HTTP Login]: %s[HTTP Traffic]: %s[Ruskill]: Detected File: "%s"[Ruskill]: Detected DNS: "%s"[Ruskill]: Detected Reg: "%s"[PDef ]: %s[DNS]: Blocked DNS "%s"[MSN]: %s[HTTP]: %sftplogftpinfecthttploginhttptraffhttpspreadhXXp://api.wipmania.com/\\.\pipe\%s_ipc*officebanking.cl/*login.asp**secure.logmein.*/*logincheck**megaupload.*/*loginloginUserPasswordloginUserName*loginUserPassword=**fileserve.*/login*session[password]*password]=**twitter.com/sessions*:2086/login**:2083/login*Password*&Password=**.alertpay.*/*login.aspxtxtPassword*&txtPassword=**.moneybookers.*/*login.pl*runescape*/*weblogin**&password=**no-ip*/login**steampowered*/login*quick_password*hackforums.*/member.php*facebook.*/login.php**login.yahoo.*/*login*passwdlogin*passwd=**login.live.*/*post.srf*TextfieldPassword*TextfieldPassword=**gmx.*/*FormLogin**Passwd=*FLN-Password*FLN-Password=**pass=**bigstring.*/*index.php**screenname.aol.*/login.psp*passwordloginId*password=**aol.*/*login.psp*Passwd*google.*/*ServiceLoginAuth*login_passwordlogin_email*login_password=**paypal.*/webscr?cmd=_login-submit*%s / ?%d HTTP/1.1Host: %sUser-Agent: %sMozilla/4.0-\\.\PHYSICALDRIVE0state_%sshell32.dllhttpidnsapi.dllhXXp://%s/%shXXp://%s/POST /23s{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s[DNS]: Redirecting "%s" to "%s"%s|%s[Logins]: Cleared %d loginsexplorer.exe[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)[Logins]: %s[DNS]: Blocked %d domain(s) - Redirected %d domain(s)icon=shell32.dll,7shellexecute=%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %Ã%%%s/c "start %Ã%%RECYCLER\%s\\.\%c:%s\%s%sautorun.tmp%sautorun.inf%0x.exeMSG %d %s %dMSG %d %1sSDG %d %dContent-Length: %dSDG %d%s_0xXRegCreateKeyExAURLDownloadToFileWURLDownloadToFileAHttpSendRequestWHttpSendRequestANtEnumerateValueKey%s-Mutex%s_%d%s_%lukernel32.dll\??\%System%\csrss.exe%Documents and Settings%\%current user%\Application Data\Yukmkk.exe%WinDir%0 0F0K0Q0e0r0x0~0\\.\pipenwlcomm.exemsmsgs.exemsnmsgr.exepidgin.exexchat.exemirc.exeiexplore.exefirefox.exeSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Policies\System.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Runcipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exel"%s" %SInternet Explorer\iexplore.exelol.exe%s:Zone.Identifierwinlogon.exeAadvapi32.dllurlmon.dllnspr4.dllwininet.dllws2_32.dllAkernel23.dllyntdll.dllskype.exelsass.exe\Device\HarddiskVolume1\WINDOWS\system32\csrss.exewinlogon.exe_724_rwx_00AD0000_00029000:.text`.rdata@.data.reloc:.datttBtoSSSSSSSSSShShellExecuteASHELL32.dllHttpQueryInfoAInternetOpenUrlAHttpQueryInfoWWININET.dllSHLWAPI.dllntdll.dllWS2_32.dllMSVCRT.dllGetWindowsDirectoryWGetProcessHeapConnectNamedPipeCreateNamedPipeADisconnectNamedPipeGetWindowsDirectoryAKERNEL32.dllUSER32.dllRegCloseKeyRegCreateKeyExWADVAPI32.dllole32.dll%s.%s%s.%S%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!autorun.inf%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!%s.Blocked "%s" from removing our bot file!%s.Blocked "%S" from removing our bot file!%s.%s ->> %s : %s%s-%s-%s%s.Blocked "%s" from moving our bot file%s.Blocked "%S" from moving our bot file%s.%s%s%S%s%s%s.%S%S%S%S%S%s.p10-> Message hijacked!%s.p10-> Message to %s hijacked!%s.p21-> Message hijacked!msnmsgCAL %d %6sJOIN #%s.Detected process "%S" sending an IRC packet to server %s:%d.PRIVMSG #%s:%d%s.PTF://%s:%s@%s:%d (p='%S')%s:%s@%s:%dPASS %sUSER %sftpgrab%s.Blocked possible browser exploit pack call on URL '%s'hXXp://%s.Blocked possible browser exploit pack call on URL '%S'ng.bestgamesever.bizng.xmyserverx.infong.idolmovies.comng.furioshizzle.infong.studyingcenter-org.comfbi.gov1.0.3msn.setmsn.inthttp.sethttp.inthttp.injloginswebroot.virusbuster.nprotect.heck.tconecare.live.RSSR %s 0 0 :%sKCIK %sSEND %s %sPART %sPRIVMSG %s :%sQUIT :%sPONG %sPRIVMSG[v="%s" c="%s" h="%s" p="%S"][d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d[Slowloris]: Starting flood on "%s" for %d minute(s)[Slowloris]: Finished flood on "%s"[UDP]: Starting flood on "%s:%d" for %d second(s)[UDP]: Finished flood on "%s:%d"[SYN]: Starting flood on "%s:%d" for %d second(s)[SYN]: Finished flood on "%s:%d"[USB]: Infected %s[MSN]: Updated MSN spread message to "%s"[MSN]: Updated MSN spread interval to "%s"[HTTP]: Updated HTTP spread message to "%s"[HTTP]: Injected value is now %s.[HTTP]: Updated HTTP spread interval to "%s"[Visit]: Visited "%s"[DNS]: Blocked "%s"[usb="%d" msn="%d" http="%d" total="%d"][ftp="%d" http="%d" total="%d"][RSOCK4]: Started rsock4 on "%s:%d"[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)[d="%s"] Error downloading file [e="%d"][d="%s"] Error writing download to "%S" [e="%d"][d="%s" s="%d bytes"] Error creating process "%S" [e="%d"][d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"][d="%s"] Error getting temporary filename. [e="%d"][d='%s"] Error getting application data path [e="%d"][Visit]: Error visitng "%s"[FTP Login]: %s[FTP Infect]: %s was iframed[HTTP Login]: %s[HTTP Traffic]: %s[Ruskill]: Detected File: "%s"[Ruskill]: Detected DNS: "%s"[Ruskill]: Detected Reg: "%s"[PDef ]: %s[DNS]: Blocked DNS "%s"[MSN]: %s[HTTP]: %sftplogftpinfecthttploginhttptraffhttpspreadhXXp://api.wipmania.com/\\.\pipe\%s_ipc*officebanking.cl/*login.asp**secure.logmein.*/*logincheck**megaupload.*/*loginloginUserPasswordloginUserName*loginUserPassword=**fileserve.*/login*session[password]*password]=**twitter.com/sessions*:2086/login**:2083/login*Password*&Password=**.alertpay.*/*login.aspxtxtPassword*&txtPassword=**.moneybookers.*/*login.pl*runescape*/*weblogin**&password=**no-ip*/login**steampowered*/login*quick_password*hackforums.*/member.php*facebook.*/login.php**login.yahoo.*/*login*passwdlogin*passwd=**login.live.*/*post.srf*TextfieldPassword*TextfieldPassword=**gmx.*/*FormLogin**Passwd=*FLN-Password*FLN-Password=**pass=**bigstring.*/*index.php**screenname.aol.*/login.psp*passwordloginId*password=**aol.*/*login.psp*Passwd*google.*/*ServiceLoginAuth*login_passwordlogin_email*login_password=**paypal.*/webscr?cmd=_login-submit*%s / ?%d HTTP/1.1Host: %sUser-Agent: %sMozilla/4.0-\\.\PHYSICALDRIVE0state_%sshell32.dllhttpidnsapi.dllhXXp://%s/%shXXp://%s/POST /23s{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s[DNS]: Redirecting "%s" to "%s"%s|%s[Logins]: Cleared %d loginsexplorer.exe[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)[Logins]: %s[DNS]: Blocked %d domain(s) - Redirected %d domain(s)icon=shell32.dll,7shellexecute=%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %Ã%%%s/c "start %Ã%%RECYCLER\%s\\.\%c:%s\%s%sautorun.tmp%sautorun.inf%0x.exeMSG %d %s %dMSG %d %1sSDG %d %dContent-Length: %dSDG %d%s_0xXRegCreateKeyExAURLDownloadToFileWURLDownloadToFileAHttpSendRequestWHttpSendRequestANtEnumerateValueKey%s-Mutex%s_%d%s_%lukernel32.dll\??\%System%\winlogon.exe%Documents and Settings%\%current user%\Application Data\Yukmkk.exe%WinDir%0 0F0K0Q0e0r0x0~0\\.\pipenwlcomm.exemsmsgs.exemsnmsgr.exepidgin.exexchat.exemirc.exeiexplore.exefirefox.exeSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Policies\System.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Runcipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exel"%s" %SInternet Explorer\iexplore.exelol.exe%s:Zone.Identifierwinlogon.exeAadvapi32.dllurlmon.dllnspr4.dllwininet.dllws2_32.dllAkernel23.dllyntdll.dllskype.exelsass.exe\Device\HarddiskVolume1\WINDOWS\system32\winlogon.exewmiprvse.exe_752_rwx_00DE0000_00029000:.text`.rdata@.data.reloc:.datttBtoSSSSSSSSSShShellExecuteASHELL32.dllHttpQueryInfoAInternetOpenUrlAHttpQueryInfoWWININET.dllSHLWAPI.dllntdll.dllWS2_32.dllMSVCRT.dllGetWindowsDirectoryWGetProcessHeapConnectNamedPipeCreateNamedPipeADisconnectNamedPipeGetWindowsDirectoryAKERNEL32.dllUSER32.dllRegCloseKeyRegCreateKeyExWADVAPI32.dllole32.dll%s.%s%s.%S%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!autorun.inf%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!%s.Blocked "%s" from removing our bot file!%s.Blocked "%S" from removing our bot file!%s.%s ->> %s : %s%s-%s-%s%s.Blocked "%s" from moving our bot file%s.Blocked "%S" from moving our bot file%s.%s%s%S%s%s%s.%S%S%S%S%S%s.p10-> Message hijacked!%s.p10-> Message to %s hijacked!%s.p21-> Message hijacked!msnmsgCAL %d %6sJOIN #%s.Detected process "%S" sending an IRC packet to server %s:%d.PRIVMSG #%s:%d%s.PTF://%s:%s@%s:%d (p='%S')%s:%s@%s:%dPASS %sUSER %sftpgrab%s.Blocked possible browser exploit pack call on URL '%s'hXXp://%s.Blocked possible browser exploit pack call on URL '%S'ng.bestgamesever.bizng.xmyserverx.infong.idolmovies.comng.furioshizzle.infong.studyingcenter-org.comfbi.gov1.0.3msn.setmsn.inthttp.sethttp.inthttp.injloginswebroot.virusbuster.nprotect.heck.tconecare.live.RSSR %s 0 0 :%sKCIK %sSEND %s %sPART %sPRIVMSG %s :%sQUIT :%sPONG %sPRIVMSG[v="%s" c="%s" h="%s" p="%S"][d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d[Slowloris]: Starting flood on "%s" for %d minute(s)[Slowloris]: Finished flood on "%s"[UDP]: Starting flood on "%s:%d" for %d second(s)[UDP]: Finished flood on "%s:%d"[SYN]: Starting flood on "%s:%d" for %d second(s)[SYN]: Finished flood on "%s:%d"[USB]: Infected %s[MSN]: Updated MSN spread message to "%s"[MSN]: Updated MSN spread interval to "%s"[HTTP]: Updated HTTP spread message to "%s"[HTTP]: Injected value is now %s.[HTTP]: Updated HTTP spread interval to "%s"[Visit]: Visited "%s"[DNS]: Blocked "%s"[usb="%d" msn="%d" http="%d" total="%d"][ftp="%d" http="%d" total="%d"][RSOCK4]: Started rsock4 on "%s:%d"[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)[d="%s"] Error downloading file [e="%d"][d="%s"] Error writing download to "%S" [e="%d"][d="%s" s="%d bytes"] Error creating process "%S" [e="%d"][d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"][d="%s"] Error getting temporary filename. [e="%d"][d='%s"] Error getting application data path [e="%d"][Visit]: Error visitng "%s"[FTP Login]: %s[FTP Infect]: %s was iframed[HTTP Login]: %s[HTTP Traffic]: %s[Ruskill]: Detected File: "%s"[Ruskill]: Detected DNS: "%s"[Ruskill]: Detected Reg: "%s"[PDef ]: %s[DNS]: Blocked DNS "%s"[MSN]: %s[HTTP]: %sftplogftpinfecthttploginhttptraffhttpspreadhXXp://api.wipmania.com/\\.\pipe\%s_ipc*officebanking.cl/*login.asp**secure.logmein.*/*logincheck**megaupload.*/*loginloginUserPasswordloginUserName*loginUserPassword=**fileserve.*/login*session[password]*password]=**twitter.com/sessions*:2086/login**:2083/login*Password*&Password=**.alertpay.*/*login.aspxtxtPassword*&txtPassword=**.moneybookers.*/*login.pl*runescape*/*weblogin**&password=**no-ip*/login**steampowered*/login*quick_password*hackforums.*/member.php*facebook.*/login.php**login.yahoo.*/*login*passwdlogin*passwd=**login.live.*/*post.srf*TextfieldPassword*TextfieldPassword=**gmx.*/*FormLogin**Passwd=*FLN-Password*FLN-Password=**pass=**bigstring.*/*index.php**screenname.aol.*/login.psp*passwordloginId*password=**aol.*/*login.psp*Passwd*google.*/*ServiceLoginAuth*login_passwordlogin_email*login_password=**paypal.*/webscr?cmd=_login-submit*%s / ?%d HTTP/1.1Host: %sUser-Agent: %sMozilla/4.0-\\.\PHYSICALDRIVE0state_%sshell32.dllhttpidnsapi.dllhXXp://%s/%shXXp://%s/POST /23s{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s[DNS]: Redirecting "%s" to "%s"%s|%s[Logins]: Cleared %d loginsexplorer.exe[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)[Logins]: %s[DNS]: Blocked %d domain(s) - Redirected %d domain(s)icon=shell32.dll,7shellexecute=%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %Ã%%%s/c "start %Ã%%RECYCLER\%s\\.\%c:%s\%s%sautorun.tmp%sautorun.inf%0x.exeMSG %d %s %dMSG %d %1sSDG %d %dContent-Length: %dSDG %d%s_0xXRegCreateKeyExAURLDownloadToFileWURLDownloadToFileAHttpSendRequestWHttpSendRequestANtEnumerateValueKey%s-Mutex%s_%d%s_%lukernel32.dll%System%\wbem\wmiprvse.exe%Documents and Settings%\%current user%\Application Data\Yukmkk.exe%WinDir%0 0F0K0Q0e0r0x0~0\\.\pipenwlcomm.exemsmsgs.exemsnmsgr.exepidgin.exexchat.exemirc.exeiexplore.exefirefox.exeSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Policies\System.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Runcipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exel"%s" %SInternet Explorer\iexplore.exelol.exe%s:Zone.Identifierwinlogon.exeAadvapi32.dllurlmon.dllnspr4.dllwininet.dllws2_32.dllAkernel23.dllyntdll.dllskype.exelsass.exe\Device\HarddiskVolume1\WINDOWS\system32\wbem\wmiprvse.exeservices.exe_768_rwx_006F0000_00029000:.text`.rdata@.data.reloc:.datttBtoSSSSSSSSSShShellExecuteASHELL32.dllHttpQueryInfoAInternetOpenUrlAHttpQueryInfoWWININET.dllSHLWAPI.dllntdll.dllWS2_32.dllMSVCRT.dllGetWindowsDirectoryWGetProcessHeapConnectNamedPipeCreateNamedPipeADisconnectNamedPipeGetWindowsDirectoryAKERNEL32.dllUSER32.dllRegCloseKeyRegCreateKeyExWADVAPI32.dllole32.dll%s.%s%s.%S%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!autorun.inf%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!%s.Blocked "%s" from removing our bot file!%s.Blocked "%S" from removing our bot file!%s.%s ->> %s : %s%s-%s-%s%s.Blocked "%s" from moving our bot file%s.Blocked "%S" from moving our bot file%s.%s%s%S%s%s%s.%S%S%S%S%S%s.p10-> Message hijacked!%s.p10-> Message to %s hijacked!%s.p21-> Message hijacked!msnmsgCAL %d %6sJOIN #%s.Detected process "%S" sending an IRC packet to server %s:%d.PRIVMSG #%s:%d%s.PTF://%s:%s@%s:%d (p='%S')%s:%s@%s:%dPASS %sUSER %sftpgrab%s.Blocked possible browser exploit pack call on URL '%s'hXXp://%s.Blocked possible browser exploit pack call on URL '%S'ng.bestgamesever.bizng.xmyserverx.infong.idolmovies.comng.furioshizzle.infong.studyingcenter-org.comfbi.gov1.0.3msn.setmsn.inthttp.sethttp.inthttp.injloginswebroot.virusbuster.nprotect.heck.tconecare.live.RSSR %s 0 0 :%sKCIK %sSEND %s %sPART %sPRIVMSG %s :%sQUIT :%sPONG %sPRIVMSG[v="%s" c="%s" h="%s" p="%S"][d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d[Slowloris]: Starting flood on "%s" for %d minute(s)[Slowloris]: Finished flood on "%s"[UDP]: Starting flood on "%s:%d" for %d second(s)[UDP]: Finished flood on "%s:%d"[SYN]: Starting flood on "%s:%d" for %d second(s)[SYN]: Finished flood on "%s:%d"[USB]: Infected %s[MSN]: Updated MSN spread message to "%s"[MSN]: Updated MSN spread interval to "%s"[HTTP]: Updated HTTP spread message to "%s"[HTTP]: Injected value is now %s.[HTTP]: Updated HTTP spread interval to "%s"[Visit]: Visited "%s"[DNS]: Blocked "%s"[usb="%d" msn="%d" http="%d" total="%d"][ftp="%d" http="%d" total="%d"][RSOCK4]: Started rsock4 on "%s:%d"[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)[d="%s"] Error downloading file [e="%d"][d="%s"] Error writing download to "%S" [e="%d"][d="%s" s="%d bytes"] Error creating process "%S" [e="%d"][d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"][d="%s"] Error getting temporary filename. [e="%d"][d='%s"] Error getting application data path [e="%d"][Visit]: Error visitng "%s"[FTP Login]: %s[FTP Infect]: %s was iframed[HTTP Login]: %s[HTTP Traffic]: %s[Ruskill]: Detected File: "%s"[Ruskill]: Detected DNS: "%s"[Ruskill]: Detected Reg: "%s"[PDef ]: %s[DNS]: Blocked DNS "%s"[MSN]: %s[HTTP]: %sftplogftpinfecthttploginhttptraffhttpspreadhXXp://api.wipmania.com/\\.\pipe\%s_ipc*officebanking.cl/*login.asp**secure.logmein.*/*logincheck**megaupload.*/*loginloginUserPasswordloginUserName*loginUserPassword=**fileserve.*/login*session[password]*password]=**twitter.com/sessions*:2086/login**:2083/login*Password*&Password=**.alertpay.*/*login.aspxtxtPassword*&txtPassword=**.moneybookers.*/*login.pl*runescape*/*weblogin**&password=**no-ip*/login**steampowered*/login*quick_password*hackforums.*/member.php*facebook.*/login.php**login.yahoo.*/*login*passwdlogin*passwd=**login.live.*/*post.srf*TextfieldPassword*TextfieldPassword=**gmx.*/*FormLogin**Passwd=*FLN-Password*FLN-Password=**pass=**bigstring.*/*index.php**screenname.aol.*/login.psp*passwordloginId*password=**aol.*/*login.psp*Passwd*google.*/*ServiceLoginAuth*login_passwordlogin_email*login_password=**paypal.*/webscr?cmd=_login-submit*%s / ?%d HTTP/1.1Host: %sUser-Agent: %sMozilla/4.0-\\.\PHYSICALDRIVE0state_%sshell32.dllhttpidnsapi.dllhXXp://%s/%shXXp://%s/POST /23s{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s[DNS]: Redirecting "%s" to "%s"%s|%s[Logins]: Cleared %d loginsexplorer.exe[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)[Logins]: %s[DNS]: Blocked %d domain(s) - Redirected %d domain(s)icon=shell32.dll,7shellexecute=%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %Ã%%%s/c "start %Ã%%RECYCLER\%s\\.\%c:%s\%s%sautorun.tmp%sautorun.inf%0x.exeMSG %d %s %dMSG %d %1sSDG %d %dContent-Length: %dSDG %d%s_0xXRegCreateKeyExAURLDownloadToFileWURLDownloadToFileAHttpSendRequestWHttpSendRequestANtEnumerateValueKey%s-Mutex%s_%d%s_%lukernel32.dll%System%\services.exe%Documents and Settings%\%current user%\Application Data\Yukmkk.exe%WinDir%0 0F0K0Q0e0r0x0~0\\.\pipenwlcomm.exemsmsgs.exemsnmsgr.exepidgin.exexchat.exemirc.exeiexplore.exefirefox.exeSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Policies\System.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Runcipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exel"%s" %SInternet Explorer\iexplore.exelol.exe%s:Zone.Identifierwinlogon.exeAadvapi32.dllurlmon.dllnspr4.dllwininet.dllws2_32.dllAkernel23.dllyntdll.dllskype.exelsass.exep\Device\HarddiskVolume1\WINDOWS\system32\services.exesvchost.exe_936_rwx_00940000_00029000:.text`.rdata@.data.reloc:.datttBtoSSSSSSSSSShShellExecuteASHELL32.dllHttpQueryInfoAInternetOpenUrlAHttpQueryInfoWWININET.dllSHLWAPI.dllntdll.dllWS2_32.dllMSVCRT.dllGetWindowsDirectoryWGetProcessHeapConnectNamedPipeCreateNamedPipeADisconnectNamedPipeGetWindowsDirectoryAKERNEL32.dllUSER32.dllRegCloseKeyRegCreateKeyExWADVAPI32.dllole32.dll%s.%s%s.%S%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!autorun.inf%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!%s.Blocked "%s" from removing our bot file!%s.Blocked "%S" from removing our bot file!%s.%s ->> %s : %s%s-%s-%s%s.Blocked "%s" from moving our bot file%s.Blocked "%S" from moving our bot file%s.%s%s%S%s%s%s.%S%S%S%S%S%s.p10-> Message hijacked!%s.p10-> Message to %s hijacked!%s.p21-> Message hijacked!msnmsgCAL %d %6sJOIN #%s.Detected process "%S" sending an IRC packet to server %s:%d.PRIVMSG #%s:%d%s.PTF://%s:%s@%s:%d (p='%S')%s:%s@%s:%dPASS %sUSER %sftpgrab%s.Blocked possible browser exploit pack call on URL '%s'hXXp://%s.Blocked possible browser exploit pack call on URL '%S'ng.bestgamesever.bizng.xmyserverx.infong.idolmovies.comng.furioshizzle.infong.studyingcenter-org.comfbi.gov1.0.3msn.setmsn.inthttp.sethttp.inthttp.injloginswebroot.virusbuster.nprotect.heck.tconecare.live.RSSR %s 0 0 :%sKCIK %sSEND %s %sPART %sPRIVMSG %s :%sQUIT :%sPONG %sPRIVMSG[v="%s" c="%s" h="%s" p="%S"][d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d[Slowloris]: Starting flood on "%s" for %d minute(s)[Slowloris]: Finished flood on "%s"[UDP]: Starting flood on "%s:%d" for %d second(s)[UDP]: Finished flood on "%s:%d"[SYN]: Starting flood on "%s:%d" for %d second(s)[SYN]: Finished flood on "%s:%d"[USB]: Infected %s[MSN]: Updated MSN spread message to "%s"[MSN]: Updated MSN spread interval to "%s"[HTTP]: Updated HTTP spread message to "%s"[HTTP]: Injected value is now %s.[HTTP]: Updated HTTP spread interval to "%s"[Visit]: Visited "%s"[DNS]: Blocked "%s"[usb="%d" msn="%d" http="%d" total="%d"][ftp="%d" http="%d" total="%d"][RSOCK4]: Started rsock4 on "%s:%d"[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)[d="%s"] Error downloading file [e="%d"][d="%s"] Error writing download to "%S" [e="%d"][d="%s" s="%d bytes"] Error creating process "%S" [e="%d"][d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"][d="%s"] Error getting temporary filename. [e="%d"][d='%s"] Error getting application data path [e="%d"][Visit]: Error visitng "%s"[FTP Login]: %s[FTP Infect]: %s was iframed[HTTP Login]: %s[HTTP Traffic]: %s[Ruskill]: Detected File: "%s"[Ruskill]: Detected DNS: "%s"[Ruskill]: Detected Reg: "%s"[PDef ]: %s[DNS]: Blocked DNS "%s"[MSN]: %s[HTTP]: %sftplogftpinfecthttploginhttptraffhttpspreadhXXp://api.wipmania.com/\\.\pipe\%s_ipc*officebanking.cl/*login.asp**secure.logmein.*/*logincheck**megaupload.*/*loginloginUserPasswordloginUserName*loginUserPassword=**fileserve.*/login*session[password]*password]=**twitter.com/sessions*:2086/login**:2083/login*Password*&Password=**.alertpay.*/*login.aspxtxtPassword*&txtPassword=**.moneybookers.*/*login.pl*runescape*/*weblogin**&password=**no-ip*/login**steampowered*/login*quick_password*hackforums.*/member.php*facebook.*/login.php**login.yahoo.*/*login*passwdlogin*passwd=**login.live.*/*post.srf*TextfieldPassword*TextfieldPassword=**gmx.*/*FormLogin**Passwd=*FLN-Password*FLN-Password=**pass=**bigstring.*/*index.php**screenname.aol.*/login.psp*passwordloginId*password=**aol.*/*login.psp*Passwd*google.*/*ServiceLoginAuth*login_passwordlogin_email*login_password=**paypal.*/webscr?cmd=_login-submit*%s / ?%d HTTP/1.1Host: %sUser-Agent: %sMozilla/4.0-\\.\PHYSICALDRIVE0state_%sshell32.dllhttpidnsapi.dllhXXp://%s/%shXXp://%s/POST /23s{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s[DNS]: Redirecting "%s" to "%s"%s|%s[Logins]: Cleared %d loginsexplorer.exe[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)[Logins]: %s[DNS]: Blocked %d domain(s) - Redirected %d domain(s)icon=shell32.dll,7shellexecute=%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %Ã%%%s/c "start %Ã%%RECYCLER\%s\\.\%c:%s\%s%sautorun.tmp%sautorun.inf%0x.exeMSG %d %s %dMSG %d %1sSDG %d %dContent-Length: %dSDG %d%s_0xXRegCreateKeyExAURLDownloadToFileWURLDownloadToFileAHttpSendRequestWHttpSendRequestANtEnumerateValueKey%s-Mutex%s_%d%s_%lukernel32.dll%System%\svchost.exe%Documents and Settings%\%current user%\Application Data\Yukmkk.exe%WinDir%0 0F0K0Q0e0r0x0~0\\.\pipenwlcomm.exemsmsgs.exemsnmsgr.exepidgin.exexchat.exemirc.exeiexplore.exefirefox.exeSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Policies\System.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Runcipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exel"%s" %SInternet Explorer\iexplore.exelol.exe%s:Zone.Identifierwinlogon.exeAadvapi32.dllurlmon.dllnspr4.dllwininet.dllws2_32.dllAkernel23.dllyntdll.dllskype.exelsass.exe\Device\HarddiskVolume1\WINDOWS\system32\svchost.exesvchost.exe_1016_rwx_00B50000_00029000:.text`.rdata@.data.reloc:.datttBtoSSSSSSSSSShShellExecuteASHELL32.dllHttpQueryInfoAInternetOpenUrlAHttpQueryInfoWWININET.dllSHLWAPI.dllntdll.dllWS2_32.dllMSVCRT.dllGetWindowsDirectoryWGetProcessHeapConnectNamedPipeCreateNamedPipeADisconnectNamedPipeGetWindowsDirectoryAKERNEL32.dllUSER32.dllRegCloseKeyRegCreateKeyExWADVAPI32.dllole32.dll%s.%s%s.%S%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!autorun.inf%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!%s.Blocked "%s" from removing our bot file!%s.Blocked "%S" from removing our bot file!%s.%s ->> %s : %s%s-%s-%s%s.Blocked "%s" from moving our bot file%s.Blocked "%S" from moving our bot file%s.%s%s%S%s%s%s.%S%S%S%S%S%s.p10-> Message hijacked!%s.p10-> Message to %s hijacked!%s.p21-> Message hijacked!msnmsgCAL %d %6sJOIN #%s.Detected process "%S" sending an IRC packet to server %s:%d.PRIVMSG #%s:%d%s.PTF://%s:%s@%s:%d (p='%S')%s:%s@%s:%dPASS %sUSER %sftpgrab%s.Blocked possible browser exploit pack call on URL '%s'hXXp://%s.Blocked possible browser exploit pack call on URL '%S'ng.bestgamesever.bizng.xmyserverx.infong.idolmovies.comng.furioshizzle.infong.studyingcenter-org.comfbi.gov1.0.3msn.setmsn.inthttp.sethttp.inthttp.injloginswebroot.virusbuster.nprotect.heck.tconecare.live.RSSR %s 0 0 :%sKCIK %sSEND %s %sPART %sPRIVMSG %s :%sQUIT :%sPONG %sPRIVMSG[v="%s" c="%s" h="%s" p="%S"][d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d[Slowloris]: Starting flood on "%s" for %d minute(s)[Slowloris]: Finished flood on "%s"[UDP]: Starting flood on "%s:%d" for %d second(s)[UDP]: Finished flood on "%s:%d"[SYN]: Starting flood on "%s:%d" for %d second(s)[SYN]: Finished flood on "%s:%d"[USB]: Infected %s[MSN]: Updated MSN spread message to "%s"[MSN]: Updated MSN spread interval to "%s"[HTTP]: Updated HTTP spread message to "%s"[HTTP]: Injected value is now %s.[HTTP]: Updated HTTP spread interval to "%s"[Visit]: Visited "%s"[DNS]: Blocked "%s"[usb="%d" msn="%d" http="%d" total="%d"][ftp="%d" http="%d" total="%d"][RSOCK4]: Started rsock4 on "%s:%d"[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)[d="%s"] Error downloading file [e="%d"][d="%s"] Error writing download to "%S" [e="%d"][d="%s" s="%d bytes"] Error creating process "%S" [e="%d"][d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"][d="%s"] Error getting temporary filename. [e="%d"][d='%s"] Error getting application data path [e="%d"][Visit]: Error visitng "%s"[FTP Login]: %s[FTP Infect]: %s was iframed[HTTP Login]: %s[HTTP Traffic]: %s[Ruskill]: Detected File: "%s"[Ruskill]: Detected DNS: "%s"[Ruskill]: Detected Reg: "%s"[PDef ]: %s[DNS]: Blocked DNS "%s"[MSN]: %s[HTTP]: %sftplogftpinfecthttploginhttptraffhttpspreadhXXp://api.wipmania.com/\\.\pipe\%s_ipc*officebanking.cl/*login.asp**secure.logmein.*/*logincheck**megaupload.*/*loginloginUserPasswordloginUserName*loginUserPassword=**fileserve.*/login*session[password]*password]=**twitter.com/sessions*:2086/login**:2083/login*Password*&Password=**.alertpay.*/*login.aspxtxtPassword*&txtPassword=**.moneybookers.*/*login.pl*runescape*/*weblogin**&password=**no-ip*/login**steampowered*/login*quick_password*hackforums.*/member.php*facebook.*/login.php**login.yahoo.*/*login*passwdlogin*passwd=**login.live.*/*post.srf*TextfieldPassword*TextfieldPassword=**gmx.*/*FormLogin**Passwd=*FLN-Password*FLN-Password=**pass=**bigstring.*/*index.php**screenname.aol.*/login.psp*passwordloginId*password=**aol.*/*login.psp*Passwd*google.*/*ServiceLoginAuth*login_passwordlogin_email*login_password=**paypal.*/webscr?cmd=_login-submit*%s / ?%d HTTP/1.1Host: %sUser-Agent: %sMozilla/4.0-\\.\PHYSICALDRIVE0state_%sshell32.dllhttpidnsapi.dllhXXp://%s/%shXXp://%s/POST /23s{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s[DNS]: Redirecting "%s" to "%s"%s|%s[Logins]: Cleared %d loginsexplorer.exe[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)[Logins]: %s[DNS]: Blocked %d domain(s) - Redirected %d domain(s)icon=shell32.dll,7shellexecute=%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %Ã%%%s/c "start %Ã%%RECYCLER\%s\\.\%c:%s\%s%sautorun.tmp%sautorun.inf%0x.exeMSG %d %s %dMSG %d %1sSDG %d %dContent-Length: %dSDG %d%s_0xXRegCreateKeyExAURLDownloadToFileWURLDownloadToFileAHttpSendRequestWHttpSendRequestANtEnumerateValueKey%s-Mutex%s_%d%s_%lukernel32.dll%System%\svchost.exe%Documents and Settings%\%current user%\Application Data\Yukmkk.exe%WinDir%0 0F0K0Q0e0r0x0~0\\.\pipenwlcomm.exemsmsgs.exemsnmsgr.exepidgin.exexchat.exemirc.exeiexplore.exefirefox.exeSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Policies\System.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Runcipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exel"%s" %SInternet Explorer\iexplore.exelol.exe%s:Zone.Identifierwinlogon.exeAadvapi32.dllurlmon.dllnspr4.dllwininet.dllws2_32.dllAkernel23.dllyntdll.dllskype.exelsass.exe\Device\HarddiskVolume1\WINDOWS\system32\svchost.exesvchost.exe_1104_rwx_01630000_00029000:.text`.rdata@.data.reloc:.datttBQh$%du7hl%dRPht%dtoSSSSSSSSSSh/hd%dShellExecuteASHELL32.dllHttpQueryInfoAInternetOpenUrlAHttpQueryInfoWWININET.dllSHLWAPI.dllntdll.dllWS2_32.dllMSVCRT.dllGetWindowsDirectoryWGetProcessHeapConnectNamedPipeCreateNamedPipeADisconnectNamedPipeGetWindowsDirectoryAKERNEL32.dllUSER32.dllRegCloseKeyRegCreateKeyExWADVAPI32.dllole32.dll%s.%s%s.%S%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!autorun.inf%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!%s.Blocked "%s" from removing our bot file!%s.Blocked "%S" from removing our bot file!%s.%s ->> %s : %s%s-%s-%s%s.Blocked "%s" from moving our bot file%s.Blocked "%S" from moving our bot file%s.%s%s%S%s%s%s.%S%S%S%S%S%s.p10-> Message hijacked!%s.p10-> Message to %s hijacked!%s.p21-> Message hijacked!msnmsgCAL %d %6sJOIN #%s.Detected process "%S" sending an IRC packet to server %s:%d.PRIVMSG #%s:%d%s.PTF://%s:%s@%s:%d (p='%S')%s:%s@%s:%dPASS %sUSER %sftpgrab%s.Blocked possible browser exploit pack call on URL '%s'hXXp://%s.Blocked possible browser exploit pack call on URL '%S'ng.bestgamesever.bizng.xmyserverx.infong.idolmovies.comng.furioshizzle.infong.studyingcenter-org.comfbi.gov1.0.3msn.setmsn.inthttp.sethttp.inthttp.injloginswebroot.virusbuster.nprotect.heck.tconecare.live.RSSR %s 0 0 :%sKCIK %sSEND %s %sPART %sPRIVMSG %s :%sQUIT :%sPONG %sPRIVMSG[v="%s" c="%s" h="%s" p="%S"][d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d[Slowloris]: Starting flood on "%s" for %d minute(s)[Slowloris]: Finished flood on "%s"[UDP]: Starting flood on "%s:%d" for %d second(s)[UDP]: Finished flood on "%s:%d"[SYN]: Starting flood on "%s:%d" for %d second(s)[SYN]: Finished flood on "%s:%d"[USB]: Infected %s[MSN]: Updated MSN spread message to "%s"[MSN]: Updated MSN spread interval to "%s"[HTTP]: Updated HTTP spread message to "%s"[HTTP]: Injected value is now %s.[HTTP]: Updated HTTP spread interval to "%s"[Visit]: Visited "%s"[DNS]: Blocked "%s"[usb="%d" msn="%d" http="%d" total="%d"][ftp="%d" http="%d" total="%d"][RSOCK4]: Started rsock4 on "%s:%d"[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)[d="%s"] Error downloading file [e="%d"][d="%s"] Error writing download to "%S" [e="%d"][d="%s" s="%d bytes"] Error creating process "%S" [e="%d"][d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"][d="%s"] Error getting temporary filename. [e="%d"][d='%s"] Error getting application data path [e="%d"][Visit]: Error visitng "%s"[FTP Login]: %s[FTP Infect]: %s was iframed[HTTP Login]: %s[HTTP Traffic]: %s[Ruskill]: Detected File: "%s"[Ruskill]: Detected DNS: "%s"[Ruskill]: Detected Reg: "%s"[PDef ]: %s[DNS]: Blocked DNS "%s"[MSN]: %s[HTTP]: %sftplogftpinfecthttploginhttptraffhttpspreadhXXp://api.wipmania.com/\\.\pipe\%s_ipc*officebanking.cl/*login.asp**secure.logmein.*/*logincheck**megaupload.*/*loginloginUserPasswordloginUserName*loginUserPassword=**fileserve.*/login*session[password]*password]=**twitter.com/sessions*:2086/login**:2083/login*Password*&Password=**.alertpay.*/*login.aspxtxtPassword*&txtPassword=**.moneybookers.*/*login.pl*runescape*/*weblogin**&password=**no-ip*/login**steampowered*/login*quick_password*hackforums.*/member.php*facebook.*/login.php**login.yahoo.*/*login*passwdlogin*passwd=**login.live.*/*post.srf*TextfieldPassword*TextfieldPassword=**gmx.*/*FormLogin**Passwd=*FLN-Password*FLN-Password=**pass=**bigstring.*/*index.php**screenname.aol.*/login.psp*passwordloginId*password=**aol.*/*login.psp*Passwd*google.*/*ServiceLoginAuth*login_passwordlogin_email*login_password=**paypal.*/webscr?cmd=_login-submit*%s / ?%d HTTP/1.1Host: %sUser-Agent: %sMozilla/4.0-\\.\PHYSICALDRIVE0state_%sshell32.dllhttpidnsapi.dllhXXp://%s/%shXXp://%s/POST /23s{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s[DNS]: Redirecting "%s" to "%s"%s|%s[Logins]: Cleared %d loginsexplorer.exe[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)[Logins]: %s[DNS]: Blocked %d domain(s) - Redirected %d domain(s)icon=shell32.dll,7shellexecute=%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %Ã%%%s/c "start %Ã%%RECYCLER\%s\\.\%c:%s\%s%sautorun.tmp%sautorun.inf%0x.exeMSG %d %s %dMSG %d %1sSDG %d %dContent-Length: %dSDG %d%s_0xXRegCreateKeyExAURLDownloadToFileWURLDownloadToFileAHttpSendRequestWHttpSendRequestANtEnumerateValueKey%s-Mutex%s_%d%s_%lukernel32.dll%WinDir%\System32\svchost.exe%Documents and Settings%\%current user%\Application Data\Yukmkk.exe%WinDir%0 0F0K0Q0e0r0x0~0\\.\pipenwlcomm.exemsmsgs.exemsnmsgr.exepidgin.exexchat.exemirc.exeiexplore.exefirefox.exeSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Policies\System.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Runcipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exel"%s" %SInternet Explorer\iexplore.exelol.exe%s:Zone.Identifierwinlogon.exeAadvapi32.dllurlmon.dllnspr4.dllwininet.dllws2_32.dllAkernel23.dllyntdll.dllskype.exelsass.exe\Device\HarddiskVolume1\WINDOWS\system32\svchost.exesvchost.exe_1156_rwx_007F0000_00029000:.text`.rdata@.data.reloc:.datttBtoSSSSSSSSSShShellExecuteASHELL32.dllHttpQueryInfoAInternetOpenUrlAHttpQueryInfoWWININET.dllSHLWAPI.dllntdll.dllWS2_32.dllMSVCRT.dllGetWindowsDirectoryWGetProcessHeapConnectNamedPipeCreateNamedPipeADisconnectNamedPipeGetWindowsDirectoryAKERNEL32.dllUSER32.dllRegCloseKeyRegCreateKeyExWADVAPI32.dllole32.dll%s.%s%s.%S%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!autorun.inf%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!%s.Blocked "%s" from removing our bot file!%s.Blocked "%S" from removing our bot file!%s.%s ->> %s : %s%s-%s-%s%s.Blocked "%s" from moving our bot file%s.Blocked "%S" from moving our bot file%s.%s%s%S%s%s%s.%S%S%S%S%S%s.p10-> Message hijacked!%s.p10-> Message to %s hijacked!%s.p21-> Message hijacked!msnmsgCAL %d %6sJOIN #%s.Detected process "%S" sending an IRC packet to server %s:%d.PRIVMSG #%s:%d%s.PTF://%s:%s@%s:%d (p='%S')%s:%s@%s:%dPASS %sUSER %sftpgrab%s.Blocked possible browser exploit pack call on URL '%s'hXXp://%s.Blocked possible browser exploit pack call on URL '%S'ng.bestgamesever.bizng.xmyserverx.infong.idolmovies.comng.furioshizzle.infong.studyingcenter-org.comfbi.gov1.0.3msn.setmsn.inthttp.sethttp.inthttp.injloginswebroot.virusbuster.nprotect.heck.tconecare.live.RSSR %s 0 0 :%sKCIK %sSEND %s %sPART %sPRIVMSG %s :%sQUIT :%sPONG %sPRIVMSG[v="%s" c="%s" h="%s" p="%S"][d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d[Slowloris]: Starting flood on "%s" for %d minute(s)[Slowloris]: Finished flood on "%s"[UDP]: Starting flood on "%s:%d" for %d second(s)[UDP]: Finished flood on "%s:%d"[SYN]: Starting flood on "%s:%d" for %d second(s)[SYN]: Finished flood on "%s:%d"[USB]: Infected %s[MSN]: Updated MSN spread message to "%s"[MSN]: Updated MSN spread interval to "%s"[HTTP]: Updated HTTP spread message to "%s"[HTTP]: Injected value is now %s.[HTTP]: Updated HTTP spread interval to "%s"[Visit]: Visited "%s"[DNS]: Blocked "%s"[usb="%d" msn="%d" http="%d" total="%d"][ftp="%d" http="%d" total="%d"][RSOCK4]: Started rsock4 on "%s:%d"[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)[d="%s"] Error downloading file [e="%d"][d="%s"] Error writing download to "%S" [e="%d"][d="%s" s="%d bytes"] Error creating process "%S" [e="%d"][d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"][d="%s"] Error getting temporary filename. [e="%d"][d='%s"] Error getting application data path [e="%d"][Visit]: Error visitng "%s"[FTP Login]: %s[FTP Infect]: %s was iframed[HTTP Login]: %s[HTTP Traffic]: %s[Ruskill]: Detected File: "%s"[Ruskill]: Detected DNS: "%s"[Ruskill]: Detected Reg: "%s"[PDef ]: %s[DNS]: Blocked DNS "%s"[MSN]: %s[HTTP]: %sftplogftpinfecthttploginhttptraffhttpspreadhXXp://api.wipmania.com/\\.\pipe\%s_ipc*officebanking.cl/*login.asp**secure.logmein.*/*logincheck**megaupload.*/*loginloginUserPasswordloginUserName*loginUserPassword=**fileserve.*/login*session[password]*password]=**twitter.com/sessions*:2086/login**:2083/login*Password*&Password=**.alertpay.*/*login.aspxtxtPassword*&txtPassword=**.moneybookers.*/*login.pl*runescape*/*weblogin**&password=**no-ip*/login**steampowered*/login*quick_password*hackforums.*/member.php*facebook.*/login.php**login.yahoo.*/*login*passwdlogin*passwd=**login.live.*/*post.srf*TextfieldPassword*TextfieldPassword=**gmx.*/*FormLogin**Passwd=*FLN-Password*FLN-Password=**pass=**bigstring.*/*index.php**screenname.aol.*/login.psp*passwordloginId*password=**aol.*/*login.psp*Passwd*google.*/*ServiceLoginAuth*login_passwordlogin_email*login_password=**paypal.*/webscr?cmd=_login-submit*%s / ?%d HTTP/1.1Host: %sUser-Agent: %sMozilla/4.0-\\.\PHYSICALDRIVE0state_%sshell32.dllhttpidnsapi.dllhXXp://%s/%shXXp://%s/POST /23s{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s[DNS]: Redirecting "%s" to "%s"%s|%s[Logins]: Cleared %d loginsexplorer.exe[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)[Logins]: %s[DNS]: Blocked %d domain(s) - Redirected %d domain(s)icon=shell32.dll,7shellexecute=%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %Ã%%%s/c "start %Ã%%RECYCLER\%s\\.\%c:%s\%s%sautorun.tmp%sautorun.inf%0x.exeMSG %d %s %dMSG %d %1sSDG %d %dContent-Length: %dSDG %d%s_0xXRegCreateKeyExAURLDownloadToFileWURLDownloadToFileAHttpSendRequestWHttpSendRequestANtEnumerateValueKey%s-Mutex%s_%d%s_%lukernel32.dll%System%\svchost.exe%Documents and Settings%\%current user%\Application Data\Yukmkk.exe%WinDir%0 0F0K0Q0e0r0x0~0\\.\pipenwlcomm.exemsmsgs.exemsnmsgr.exepidgin.exexchat.exemirc.exeiexplore.exefirefox.exeSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Policies\System.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Runcipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exel"%s" %SInternet Explorer\iexplore.exelol.exe%s:Zone.Identifierwinlogon.exeAadvapi32.dllurlmon.dllnspr4.dllwininet.dllws2_32.dllAkernel23.dllyntdll.dllskype.exelsass.exe\Device\HarddiskVolume1\WINDOWS\system32\svchost.exesvchost.exe_1228_rwx_00B80000_00029000:.text`.rdata@.data.reloc:.datttBtoSSSSSSSSSShShellExecuteASHELL32.dllHttpQueryInfoAInternetOpenUrlAHttpQueryInfoWWININET.dllSHLWAPI.dllntdll.dllWS2_32.dllMSVCRT.dllGetWindowsDirectoryWGetProcessHeapConnectNamedPipeCreateNamedPipeADisconnectNamedPipeGetWindowsDirectoryAKERNEL32.dllUSER32.dllRegCloseKeyRegCreateKeyExWADVAPI32.dllole32.dll%s.%s%s.%S%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!autorun.inf%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!%s.Blocked "%s" from removing our bot file!%s.Blocked "%S" from removing our bot file!%s.%s ->> %s : %s%s-%s-%s%s.Blocked "%s" from moving our bot file%s.Blocked "%S" from moving our bot file%s.%s%s%S%s%s%s.%S%S%S%S%S%s.p10-> Message hijacked!%s.p10-> Message to %s hijacked!%s.p21-> Message hijacked!msnmsgCAL %d %6sJOIN #%s.Detected process "%S" sending an IRC packet to server %s:%d.PRIVMSG #%s:%d%s.PTF://%s:%s@%s:%d (p='%S')%s:%s@%s:%dPASS %sUSER %sftpgrab%s.Blocked possible browser exploit pack call on URL '%s'hXXp://%s.Blocked possible browser exploit pack call on URL '%S'ng.bestgamesever.bizng.xmyserverx.infong.idolmovies.comng.furioshizzle.infong.studyingcenter-org.comfbi.gov1.0.3msn.setmsn.inthttp.sethttp.inthttp.injloginswebroot.virusbuster.nprotect.heck.tconecare.live.RSSR %s 0 0 :%sKCIK %sSEND %s %sPART %sPRIVMSG %s :%sQUIT :%sPONG %sPRIVMSG[v="%s" c="%s" h="%s" p="%S"][d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d[Slowloris]: Starting flood on "%s" for %d minute(s)[Slowloris]: Finished flood on "%s"[UDP]: Starting flood on "%s:%d" for %d second(s)[UDP]: Finished flood on "%s:%d"[SYN]: Starting flood on "%s:%d" for %d second(s)[SYN]: Finished flood on "%s:%d"[USB]: Infected %s[MSN]: Updated MSN spread message to "%s"[MSN]: Updated MSN spread interval to "%s"[HTTP]: Updated HTTP spread message to "%s"[HTTP]: Injected value is now %s.[HTTP]: Updated HTTP spread interval to "%s"[Visit]: Visited "%s"[DNS]: Blocked "%s"[usb="%d" msn="%d" http="%d" total="%d"][ftp="%d" http="%d" total="%d"][RSOCK4]: Started rsock4 on "%s:%d"[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)[d="%s"] Error downloading file [e="%d"][d="%s"] Error writing download to "%S" [e="%d"][d="%s" s="%d bytes"] Error creating process "%S" [e="%d"][d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"][d="%s"] Error getting temporary filename. [e="%d"][d='%s"] Error getting application data path [e="%d"][Visit]: Error visitng "%s"[FTP Login]: %s[FTP Infect]: %s was iframed[HTTP Login]: %s[HTTP Traffic]: %s[Ruskill]: Detected File: "%s"[Ruskill]: Detected DNS: "%s"[Ruskill]: Detected Reg: "%s"[PDef ]: %s[DNS]: Blocked DNS "%s"[MSN]: %s[HTTP]: %sftplogftpinfecthttploginhttptraffhttpspreadhXXp://api.wipmania.com/\\.\pipe\%s_ipc*officebanking.cl/*login.asp**secure.logmein.*/*logincheck**megaupload.*/*loginloginUserPasswordloginUserName*loginUserPassword=**fileserve.*/login*session[password]*password]=**twitter.com/sessions*:2086/login**:2083/login*Password*&Password=**.alertpay.*/*login.aspxtxtPassword*&txtPassword=**.moneybookers.*/*login.pl*runescape*/*weblogin**&password=**no-ip*/login**steampowered*/login*quick_password*hackforums.*/member.php*facebook.*/login.php**login.yahoo.*/*login*passwdlogin*passwd=**login.live.*/*post.srf*TextfieldPassword*TextfieldPassword=**gmx.*/*FormLogin**Passwd=*FLN-Password*FLN-Password=**pass=**bigstring.*/*index.php**screenname.aol.*/login.psp*passwordloginId*password=**aol.*/*login.psp*Passwd*google.*/*ServiceLoginAuth*login_passwordlogin_email*login_password=**paypal.*/webscr?cmd=_login-submit*%s / ?%d HTTP/1.1Host: %sUser-Agent: %sMozilla/4.0-\\.\PHYSICALDRIVE0state_%sshell32.dllhttpidnsapi.dllhXXp://%s/%shXXp://%s/POST /23s{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s[DNS]: Redirecting "%s" to "%s"%s|%s[Logins]: Cleared %d loginsexplorer.exe[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)[Logins]: %s[DNS]: Blocked %d domain(s) - Redirected %d domain(s)icon=shell32.dll,7shellexecute=%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %Ã%%%s/c "start %Ã%%RECYCLER\%s\\.\%c:%s\%s%sautorun.tmp%sautorun.inf%0x.exeMSG %d %s %dMSG %d %1sSDG %d %dContent-Length: %dSDG %d%s_0xXRegCreateKeyExAURLDownloadToFileWURLDownloadToFileAHttpSendRequestWHttpSendRequestANtEnumerateValueKey%s-Mutex%s_%d%s_%lukernel32.dll%System%\svchost.exe%Documents and Settings%\%current user%\Application Data\Yukmkk.exe%WinDir%0 0F0K0Q0e0r0x0~0\\.\pipenwlcomm.exemsmsgs.exemsnmsgr.exepidgin.exexchat.exemirc.exeiexplore.exefirefox.exeSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Policies\System.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Runcipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exel"%s" %SInternet Explorer\iexplore.exelol.exe%s:Zone.Identifierwinlogon.exeAadvapi32.dllurlmon.dllnspr4.dllwininet.dllws2_32.dllAkernel23.dllyntdll.dllskype.exelsass.exe\Device\HarddiskVolume1\WINDOWS\system32\svchost.exespoolsv.exe_1436_rwx_009B0000_00029000:.text`.rdata@.data.reloc:.datttBtoSSSSSSSSSShShellExecuteASHELL32.dllHttpQueryInfoAInternetOpenUrlAHttpQueryInfoWWININET.dllSHLWAPI.dllntdll.dllWS2_32.dllMSVCRT.dllGetWindowsDirectoryWGetProcessHeapConnectNamedPipeCreateNamedPipeADisconnectNamedPipeGetWindowsDirectoryAKERNEL32.dllUSER32.dllRegCloseKeyRegCreateKeyExWADVAPI32.dllole32.dll%s.%s%s.%S%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!autorun.inf%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!%s.Blocked "%s" from removing our bot file!%s.Blocked "%S" from removing our bot file!%s.%s ->> %s : %s%s-%s-%s%s.Blocked "%s" from moving our bot file%s.Blocked "%S" from moving our bot file%s.%s%s%S%s%s%s.%S%S%S%S%S%s.p10-> Message hijacked!%s.p10-> Message to %s hijacked!%s.p21-> Message hijacked!msnmsgCAL %d %6sJOIN #%s.Detected process "%S" sending an IRC packet to server %s:%d.PRIVMSG #%s:%d%s.PTF://%s:%s@%s:%d (p='%S')%s:%s@%s:%dPASS %sUSER %sftpgrab%s.Blocked possible browser exploit pack call on URL '%s'hXXp://%s.Blocked possible browser exploit pack call on URL '%S'ng.bestgamesever.bizng.xmyserverx.infong.idolmovies.comng.furioshizzle.infong.studyingcenter-org.comfbi.gov1.0.3msn.setmsn.inthttp.sethttp.inthttp.injloginswebroot.virusbuster.nprotect.heck.tconecare.live.RSSR %s 0 0 :%sKCIK %sSEND %s %sPART %sPRIVMSG %s :%sQUIT :%sPONG %sPRIVMSG[v="%s" c="%s" h="%s" p="%S"][d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d[Slowloris]: Starting flood on "%s" for %d minute(s)[Slowloris]: Finished flood on "%s"[UDP]: Starting flood on "%s:%d" for %d second(s)[UDP]: Finished flood on "%s:%d"[SYN]: Starting flood on "%s:%d" for %d second(s)[SYN]: Finished flood on "%s:%d"[USB]: Infected %s[MSN]: Updated MSN spread message to "%s"[MSN]: Updated MSN spread interval to "%s"[HTTP]: Updated HTTP spread message to "%s"[HTTP]: Injected value is now %s.[HTTP]: Updated HTTP spread interval to "%s"[Visit]: Visited "%s"[DNS]: Blocked "%s"[usb="%d" msn="%d" http="%d" total="%d"][ftp="%d" http="%d" total="%d"][RSOCK4]: Started rsock4 on "%s:%d"[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)[d="%s"] Error downloading file [e="%d"][d="%s"] Error writing download to "%S" [e="%d"][d="%s" s="%d bytes"] Error creating process "%S" [e="%d"][d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"][d="%s"] Error getting temporary filename. [e="%d"][d='%s"] Error getting application data path [e="%d"][Visit]: Error visitng "%s"[FTP Login]: %s[FTP Infect]: %s was iframed[HTTP Login]: %s[HTTP Traffic]: %s[Ruskill]: Detected File: "%s"[Ruskill]: Detected DNS: "%s"[Ruskill]: Detected Reg: "%s"[PDef ]: %s[DNS]: Blocked DNS "%s"[MSN]: %s[HTTP]: %sftplogftpinfecthttploginhttptraffhttpspreadhXXp://api.wipmania.com/\\.\pipe\%s_ipc*officebanking.cl/*login.asp**secure.logmein.*/*logincheck**megaupload.*/*loginloginUserPasswordloginUserName*loginUserPassword=**fileserve.*/login*session[password]*password]=**twitter.com/sessions*:2086/login**:2083/login*Password*&Password=**.alertpay.*/*login.aspxtxtPassword*&txtPassword=**.moneybookers.*/*login.pl*runescape*/*weblogin**&password=**no-ip*/login**steampowered*/login*quick_password*hackforums.*/member.php*facebook.*/login.php**login.yahoo.*/*login*passwdlogin*passwd=**login.live.*/*post.srf*TextfieldPassword*TextfieldPassword=**gmx.*/*FormLogin**Passwd=*FLN-Password*FLN-Password=**pass=**bigstring.*/*index.php**screenname.aol.*/login.psp*passwordloginId*password=**aol.*/*login.psp*Passwd*google.*/*ServiceLoginAuth*login_passwordlogin_email*login_password=**paypal.*/webscr?cmd=_login-submit*%s / ?%d HTTP/1.1Host: %sUser-Agent: %sMozilla/4.0-\\.\PHYSICALDRIVE0state_%sshell32.dllhttpidnsapi.dllhXXp://%s/%shXXp://%s/POST /23s{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s[DNS]: Redirecting "%s" to "%s"%s|%s[Logins]: Cleared %d loginsexplorer.exe[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)[Logins]: %s[DNS]: Blocked %d domain(s) - Redirected %d domain(s)icon=shell32.dll,7shellexecute=%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %Ã%%%s/c "start %Ã%%RECYCLER\%s\\.\%c:%s\%s%sautorun.tmp%sautorun.inf%0x.exeMSG %d %s %dMSG %d %1sSDG %d %dContent-Length: %dSDG %d%s_0xXRegCreateKeyExAURLDownloadToFileWURLDownloadToFileAHttpSendRequestWHttpSendRequestANtEnumerateValueKey%s-Mutex%s_%d%s_%lukernel32.dll%System%\spoolsv.exe%Documents and Settings%\%current user%\Application Data\Yukmkk.exe%WinDir%0 0F0K0Q0e0r0x0~0\\.\pipenwlcomm.exemsmsgs.exemsnmsgr.exepidgin.exexchat.exemirc.exeiexplore.exefirefox.exeSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Policies\System.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Runcipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exel"%s" %SInternet Explorer\iexplore.exelol.exe%s:Zone.Identifierwinlogon.exeAadvapi32.dllurlmon.dllnspr4.dllwininet.dllws2_32.dllAkernel23.dllyntdll.dllskype.exelsass.exe\Device\HarddiskVolume1\WINDOWS\system32\spoolsv.exemscorsvw.exe_1920_rwx_008E0000_00029000:.text`.rdata@.data.reloc:.datttBtoSSSSSSSSSShShellExecuteASHELL32.dllHttpQueryInfoAInternetOpenUrlAHttpQueryInfoWWININET.dllSHLWAPI.dllntdll.dllWS2_32.dllMSVCRT.dllGetWindowsDirectoryWGetProcessHeapConnectNamedPipeCreateNamedPipeADisconnectNamedPipeGetWindowsDirectoryAKERNEL32.dllUSER32.dllRegCloseKeyRegCreateKeyExWADVAPI32.dllole32.dll%s.%s%s.%S%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!autorun.inf%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!%s.Blocked "%s" from removing our bot file!%s.Blocked "%S" from removing our bot file!%s.%s ->> %s : %s%s-%s-%s%s.Blocked "%s" from moving our bot file%s.Blocked "%S" from moving our bot file%s.%s%s%S%s%s%s.%S%S%S%S%S%s.p10-> Message hijacked!%s.p10-> Message to %s hijacked!%s.p21-> Message hijacked!msnmsgCAL %d %6sJOIN #%s.Detected process "%S" sending an IRC packet to server %s:%d.PRIVMSG #%s:%d%s.PTF://%s:%s@%s:%d (p='%S')%s:%s@%s:%dPASS %sUSER %sftpgrab%s.Blocked possible browser exploit pack call on URL '%s'hXXp://%s.Blocked possible browser exploit pack call on URL '%S'ng.bestgamesever.bizng.xmyserverx.infong.idolmovies.comng.furioshizzle.infong.studyingcenter-org.comfbi.gov1.0.3msn.setmsn.inthttp.sethttp.inthttp.injloginswebroot.virusbuster.nprotect.heck.tconecare.live.RSSR %s 0 0 :%sKCIK %sSEND %s %sPART %sPRIVMSG %s :%sQUIT :%sPONG %sPRIVMSG[v="%s" c="%s" h="%s" p="%S"][d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d[Slowloris]: Starting flood on "%s" for %d minute(s)[Slowloris]: Finished flood on "%s"[UDP]: Starting flood on "%s:%d" for %d second(s)[UDP]: Finished flood on "%s:%d"[SYN]: Starting flood on "%s:%d" for %d second(s)[SYN]: Finished flood on "%s:%d"[USB]: Infected %s[MSN]: Updated MSN spread message to "%s"[MSN]: Updated MSN spread interval to "%s"[HTTP]: Updated HTTP spread message to "%s"[HTTP]: Injected value is now %s.[HTTP]: Updated HTTP spread interval to "%s"[Visit]: Visited "%s"[DNS]: Blocked "%s"[usb="%d" msn="%d" http="%d" total="%d"][ftp="%d" http="%d" total="%d"][RSOCK4]: Started rsock4 on "%s:%d"[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)[d="%s"] Error downloading file [e="%d"][d="%s"] Error writing download to "%S" [e="%d"][d="%s" s="%d bytes"] Error creating process "%S" [e="%d"][d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"][d="%s"] Error getting temporary filename. [e="%d"][d='%s"] Error getting application data path [e="%d"][Visit]: Error visitng "%s"[FTP Login]: %s[FTP Infect]: %s was iframed[HTTP Login]: %s[HTTP Traffic]: %s[Ruskill]: Detected File: "%s"[Ruskill]: Detected DNS: "%s"[Ruskill]: Detected Reg: "%s"[PDef ]: %s[DNS]: Blocked DNS "%s"[MSN]: %s[HTTP]: %sftplogftpinfecthttploginhttptraffhttpspreadhXXp://api.wipmania.com/\\.\pipe\%s_ipc*officebanking.cl/*login.asp**secure.logmein.*/*logincheck**megaupload.*/*loginloginUserPasswordloginUserName*loginUserPassword=**fileserve.*/login*session[password]*password]=**twitter.com/sessions*:2086/login**:2083/login*Password*&Password=**.alertpay.*/*login.aspxtxtPassword*&txtPassword=**.moneybookers.*/*login.pl*runescape*/*weblogin**&password=**no-ip*/login**steampowered*/login*quick_password*hackforums.*/member.php*facebook.*/login.php**login.yahoo.*/*login*passwdlogin*passwd=**login.live.*/*post.srf*TextfieldPassword*TextfieldPassword=**gmx.*/*FormLogin**Passwd=*FLN-Password*FLN-Password=**pass=**bigstring.*/*index.php**screenname.aol.*/login.psp*passwordloginId*password=**aol.*/*login.psp*Passwd*google.*/*ServiceLoginAuth*login_passwordlogin_email*login_password=**paypal.*/webscr?cmd=_login-submit*%s / ?%d HTTP/1.1Host: %sUser-Agent: %sMozilla/4.0-\\.\PHYSICALDRIVE0state_%sshell32.dllhttpidnsapi.dllhXXp://%s/%shXXp://%s/POST /23s{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s[DNS]: Redirecting "%s" to "%s"%s|%s[Logins]: Cleared %d loginsexplorer.exe[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)[Logins]: %s[DNS]: Blocked %d domain(s) - Redirected %d domain(s)icon=shell32.dll,7shellexecute=%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %Ã%%%s/c "start %Ã%%RECYCLER\%s\\.\%c:%s\%s%sautorun.tmp%sautorun.inf%0x.exeMSG %d %s %dMSG %d %1sSDG %d %dContent-Length: %dSDG %d%s_0xXRegCreateKeyExAURLDownloadToFileWURLDownloadToFileAHttpSendRequestWHttpSendRequestANtEnumerateValueKey%s-Mutex%s_%d%s_%lukernel32.dll%WinDir%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe%Documents and Settings%\%current user%\Application Data\Yukmkk.exe%WinDir%0 0F0K0Q0e0r0x0~0\\.\pipenwlcomm.exemsmsgs.exemsnmsgr.exepidgin.exexchat.exemirc.exeiexplore.exefirefox.exeSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Policies\System.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Runcipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exel"%s" %SInternet Explorer\iexplore.exelol.exe%s:Zone.Identifierwinlogon.exeAadvapi32.dllurlmon.dllnspr4.dllwininet.dllws2_32.dllAkernel23.dllyntdll.dllskype.exelsass.exe\Device\HarddiskVolume1\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exejqs.exe_1968_rwx_010C0000_00029000:.text`.rdata@.data.reloc:.datttBtoSSSSSSSSSShShellExecuteASHELL32.dllHttpQueryInfoAInternetOpenUrlAHttpQueryInfoWWININET.dllSHLWAPI.dllntdll.dllWS2_32.dllMSVCRT.dllGetWindowsDirectoryWGetProcessHeapConnectNamedPipeCreateNamedPipeADisconnectNamedPipeGetWindowsDirectoryAKERNEL32.dllUSER32.dllRegCloseKeyRegCreateKeyExWADVAPI32.dllole32.dll%s.%s%s.%S%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!autorun.inf%s.Blocked "%S" from creating "%S"%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!%s.Blocked "%s" from removing our bot file!%s.Blocked "%S" from removing our bot file!%s.%s ->> %s : %s%s-%s-%s%s.Blocked "%s" from moving our bot file%s.Blocked "%S" from moving our bot file%s.%s%s%S%s%s%s.%S%S%S%S%S%s.p10-> Message hijacked!%s.p10-> Message to %s hijacked!%s.p21-> Message hijacked!msnmsgCAL %d %6sJOIN #%s.Detected process "%S" sending an IRC packet to server %s:%d.PRIVMSG #%s:%d%s.PTF://%s:%s@%s:%d (p='%S')%s:%s@%s:%dPASS %sUSER %sftpgrab%s.Blocked possible browser exploit pack call on URL '%s'hXXp://%s.Blocked possible browser exploit pack call on URL '%S'ng.bestgamesever.bizng.xmyserverx.infong.idolmovies.comng.furioshizzle.infong.studyingcenter-org.comfbi.gov1.0.3msn.setmsn.inthttp.sethttp.inthttp.injloginswebroot.virusbuster.nprotect.heck.tconecare.live.RSSR %s 0 0 :%sKCIK %sSEND %s %sPART %sPRIVMSG %s :%sQUIT :%sPONG %sPRIVMSG[v="%s" c="%s" h="%s" p="%S"][d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d[Slowloris]: Starting flood on "%s" for %d minute(s)[Slowloris]: Finished flood on "%s"[UDP]: Starting flood on "%s:%d" for %d second(s)[UDP]: Finished flood on "%s:%d"[SYN]: Starting flood on "%s:%d" for %d second(s)[SYN]: Finished flood on "%s:%d"[USB]: Infected %s[MSN]: Updated MSN spread message to "%s"[MSN]: Updated MSN spread interval to "%s"[HTTP]: Updated HTTP spread message to "%s"[HTTP]: Injected value is now %s.[HTTP]: Updated HTTP spread interval to "%s"[Visit]: Visited "%s"[DNS]: Blocked "%s"[usb="%d" msn="%d" http="%d" total="%d"][ftp="%d" http="%d" total="%d"][RSOCK4]: Started rsock4 on "%s:%d"[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)[d="%s"] Error downloading file [e="%d"][d="%s"] Error writing download to "%S" [e="%d"][d="%s" s="%d bytes"] Error creating process "%S" [e="%d"][d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"][d="%s"] Error getting temporary filename. [e="%d"][d='%s"] Error getting application data path [e="%d"][Visit]: Error visitng "%s"[FTP Login]: %s[FTP Infect]: %s was iframed[HTTP Login]: %s[HTTP Traffic]: %s[Ruskill]: Detected File: "%s"[Ruskill]: Detected DNS: "%s"[Ruskill]: Detected Reg: "%s"[PDef ]: %s[DNS]: Blocked DNS "%s"[MSN]: %s[HTTP]: %sftplogftpinfecthttploginhttptraffhttpspreadhXXp://api.wipmania.com/\\.\pipe\%s_ipc*officebanking.cl/*login.asp**secure.logmein.*/*logincheck**megaupload.*/*loginloginUserPasswordloginUserName*loginUserPassword=**fileserve.*/login*session[password]*password]=**twitter.com/sessions*:2086/login**:2083/login*Password*&Password=**.alertpay.*/*login.aspxtxtPassword*&txtPassword=**.moneybookers.*/*login.pl*runescape*/*weblogin**&password=**no-ip*/login**steampowered*/login*quick_password*hackforums.*/member.php*facebook.*/login.php**login.yahoo.*/*login*passwdlogin*passwd=**login.live.*/*post.srf*TextfieldPassword*TextfieldPassword=**gmx.*/*FormLogin**Passwd=*FLN-Password*FLN-Password=**pass=**bigstring.*/*index.php**screenname.aol.*/login.psp*passwordloginId*password=**aol.*/*login.psp*Passwd*google.*/*ServiceLoginAuth*login_passwordlogin_email*login_password=**paypal.*/webscr?cmd=_login-submit*%s / ?%d HTTP/1.1Host: %sUser-Agent: %sMozilla/4.0-\\.\PHYSICALDRIVE0state_%sshell32.dllhttpidnsapi.dllhXXp://%s/%shXXp://%s/POST /23s{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s[DNS]: Redirecting "%s" to "%s"%s|%s[Logins]: Cleared %d loginsexplorer.exe[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)[Logins]: %s[DNS]: Blocked %d domain(s) - Redirected %d domain(s)icon=shell32.dll,7shellexecute=%windir%\system32\cmd.exe&&%%windir%%\explorer.exe %Ã%%%s/c "start %Ã%%RECYCLER\%s\\.\%c:%s\%s%sautorun.tmp%sautorun.inf%0x.exeMSG %d %s %dMSG %d %1sSDG %d %dContent-Length: %dSDG %d%s_0xXRegCreateKeyExAURLDownloadToFileWURLDownloadToFileAHttpSendRequestWHttpSendRequestANtEnumerateValueKey%s-Mutex%s_%d%s_%lukernel32.dll%Program Files%\Java\jre6\bin\jqs.exe%Documents and Settings%\%current user%\Application Data\Yukmkk.exe%WinDir%0 0F0K0Q0e0r0x0~0\\.\pipenwlcomm.exemsmsgs.exemsnmsgr.exepidgin.exexchat.exemirc.exeiexplore.exefirefox.exeSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Policies\System.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Runcipconfig.exeverclsid.exeregedit.exerundll32.execmd.exeregsvr32.exel"%s" %SInternet Explorer\iexplore.exelol.exe%s:Zone.Identifierwinlogon.exeAadvapi32.dllurlmon.dllnspr4.dllwininet.dllws2_32.dllAkernel23.dllyntdll.dllskype.exelsass.exe\Device\HarddiskVolume1\Program Files\Java\jre6\bin\jqs.exe3>