Trojan.Generic.5567254_3dee39f954 – Adaware

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.
IRCBot	A bot can communicate with command and control servers via IRC channel.
UDPFlooder	This program can make a UDP flood. A UDP flood attack is a denial-of-service attack using the User Datagram Protocol (UDP). It can be initiated by sending a large number of UDP packets to random ports on a remote host.
USBInfector	A program can register a device notification with the help of RegisterDeviceNotification. So it is notified when a USB device is plugged and then the worm copies itself to the USB device plugged into the affected computer.

Process activity

The Trojan creates the following process(es):

Lskmkx.exe:1396
Lskmkx.exe:944
%original file name%.exe:1068
%original file name%.exe:212

The Trojan injects its code into the following process(es):

mscorsvw.exe:1912
Explorer.EXE:128
csrss.exe:692
winlogon.exe:716
services.exe:760
lsass.exe:772
svchost.exe:928
svchost.exe:1008
svchost.exe:1096
svchost.exe:1140
svchost.exe:1220
spoolsv.exe:1424
jqs.exe:1960

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:212 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe (1281 bytes)

Registry activity

The process Lskmkx.exe:1396 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EB A2 8E 68 E7 2B DD 11 DA 5E 15 34 83 FD 2E 70"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process Lskmkx.exe:944 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "10 47 04 7D BE BE 05 96 49 21 80 C2 27 4F 8B 5F"

The process %original file name%.exe:1068 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "03 95 25 9A E6 D3 A8 D4 55 84 16 BD D7 A2 6D AE"

The process %original file name%.exe:212 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "22 A2 CF 96 47 D6 BF EE 46 EC 94 BD E4 34 9D B5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"Shell" = "explorer.exe,%Documents and Settings%\%current user%\Application Data\Lskmkx.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"Shell" = "explorer.exe,%Documents and Settings%\%current user%\Application Data\Lskmkx.exe"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Lskmkx" = "%Documents and Settings%\%current user%\Application Data\Lskmkx.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Lskmkx" = "%Documents and Settings%\%current user%\Application Data\Lskmkx.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Lskmkx" = "%Documents and Settings%\%current user%\Application Data\Lskmkx.exe"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Trojan installs the following user-mode hooks in WININET.dll:

HttpSendRequestW
InternetWriteFile
HttpSendRequestA

The Trojan installs the following user-mode hooks in WS2_32.dll:

send

The Trojan installs the following user-mode hooks in kernel32.dll:

MoveFileA
CopyFileW
CopyFileA
MoveFileW
CreateFileW
CreateFileA

The Trojan installs the following user-mode hooks in ntdll.dll:

LdrLoadDll
NtResumeThread
NtQueryDirectoryFile
NtEnumerateValueKey

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.A program can register a device notification with the help of RegisterDeviceNotification. So it is notified when a USB device is plugged and then the worm copies itself to the USB device plugged into the affected computer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):
Lskmkx.exe:1396
Lskmkx.exe:944
%original file name%.exe:1068
%original file name%.exe:212
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Application Data\Lskmkx.exe (1281 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Lskmkx" = "%Documents and Settings%\%current user%\Application Data\Lskmkx.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Lskmkx" = "%Documents and Settings%\%current user%\Application Data\Lskmkx.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Lskmkx" = "%Documents and Settings%\%current user%\Application Data\Lskmkx.exe"
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Beepa Pty Ltd
Product Name: FRAPS
Product Version:
Legal Copyright: Copyright (c) Beepa Pty Ltd 2010
Legal Trademarks: Fraps is a trademark of Beepa Pty Ltd
Original Filename:
Internal Name:
File Version: 3.2.6.12176
File Description: Fraps Installer
Comments:
Language: Russian (Russia)

Company Name: Beepa Pty LtdProduct Name: FRAPSProduct Version: Legal Copyright: Copyright (c) Beepa Pty Ltd 2010Legal Trademarks: Fraps is a trademark of Beepa Pty LtdOriginal Filename: Internal Name: File Version: 3.2.6.12176File Description: Fraps InstallerComments: Language: Russian (Russia)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	1105920	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	1110016	167936	164352	5.54296	6e48319396f46c68d2b8ca6a40ffc092
.rsrc	1277952	36864	35840	3.3196	bf2267da4323076791d77bbe85f1ac85

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

Explorer.EXE_128_rwx_01880000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%WinDir%\Explorer.EXE

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

Lskmkx.exe

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\explorer.exe

csrss.exe_692_rwx_00D40000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

\??\%System%\csrss.exe

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\csrss.exe

winlogon.exe_716_rwx_00AD0000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

\??\%System%\winlogon.exe

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\winlogon.exe

services.exe_760_rwx_006E0000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\services.exe

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

o\Device\HarddiskVolume1\WINDOWS\system32\services.exe

lsass.exe_772_rwx_009D0000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\lsass.exe

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\lsass.exe

svchost.exe_928_rwx_00940000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\svchost.exe

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe

svchost.exe_1008_rwx_00B50000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\svchost.exe

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe

svchost.exe_1096_rwx_025F0000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%WinDir%\System32\svchost.exe

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe

svchost.exe_1140_rwx_00870000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\svchost.exe

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe

svchost.exe_1220_rwx_00B80000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\svchost.exe

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe

spoolsv.exe_1424_rwx_00B70000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\spoolsv.exe

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\spoolsv.exe

mscorsvw.exe_1912_rwx_008E0000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%WinDir%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

jqs.exe_1960_rwx_010C0000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%Program Files%\Java\jre6\bin\jqs.exe

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\Program Files\Java\jre6\bin\jqs.exe

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps