Gen.Variant.Inject.12_64ebbc6bcf – Adaware

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.
IRCBot	A bot can communicate with command and control servers via IRC channel.
UDPFlooder	This program can make a UDP flood. A UDP flood attack is a denial-of-service attack using the User Datagram Protocol (UDP). It can be initiated by sending a large number of UDP packets to random ports on a remote host.
USBInfector	A program can register a device notification with the help of RegisterDeviceNotification. So it is notified when a USB device is plugged and then the worm copies itself to the USB device plugged into the affected computer.

Process activity

The Trojan creates the following process(es):

Lskmkx.exe:1528
%original file name%.exe:120

The Trojan injects its code into the following process(es):

vmacthlp.exe:936
csrss.exe:696
winlogon.exe:720
services.exe:764
wmiprvse.exe:768
lsass.exe:776
svchost.exe:960
svchost.exe:1028
svchost.exe:1116
svchost.exe:1160
svchost.exe:1268
spoolsv.exe:1448
Explorer.EXE:1684
jqs.exe:1972

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:120 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe (673 bytes)

Registry activity

The process Lskmkx.exe:1528 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "97 58 BA A8 6A EB FC 02 98 4A E3 83 C6 AD 48 AD"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process %original file name%.exe:120 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BF 61 A3 C4 04 27 2B C7 05 BB 8A 00 8F 32 7A D5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"Shell" = "explorer.exe,%Documents and Settings%\%current user%\Application Data\Lskmkx.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"Shell" = "explorer.exe,%Documents and Settings%\%current user%\Application Data\Lskmkx.exe"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Lskmkx" = "%Documents and Settings%\%current user%\Application Data\Lskmkx.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Lskmkx" = "%Documents and Settings%\%current user%\Application Data\Lskmkx.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Lskmkx" = "%Documents and Settings%\%current user%\Application Data\Lskmkx.exe"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Trojan installs the following user-mode hooks in WININET.dll:

HttpSendRequestW
InternetWriteFile
HttpSendRequestA

The Trojan installs the following user-mode hooks in WS2_32.dll:

send

The Trojan installs the following user-mode hooks in kernel32.dll:

MoveFileA
CopyFileW
CopyFileA
MoveFileW
CreateFileW
CreateFileA

The Trojan installs the following user-mode hooks in ntdll.dll:

LdrLoadDll
NtResumeThread
NtQueryDirectoryFile
NtEnumerateValueKey

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.A program can register a device notification with the help of RegisterDeviceNotification. So it is notified when a USB device is plugged and then the worm copies itself to the USB device plugged into the affected computer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):
Lskmkx.exe:1528
%original file name%.exe:120
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Application Data\Lskmkx.exe (673 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Lskmkx" = "%Documents and Settings%\%current user%\Application Data\Lskmkx.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Lskmkx" = "%Documents and Settings%\%current user%\Application Data\Lskmkx.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Lskmkx" = "%Documents and Settings%\%current user%\Application Data\Lskmkx.exe"
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: ZvTLHTk
Product Name: ZvTLHTk
Product Version: 3, 2, 7, 1
Legal Copyright: ZvTLHTk
Legal Trademarks:
Original Filename: ZvTLHTk.EXE
Internal Name: ZvTLHTk
File Version: 3, 2, 7, 1
File Description: ZvTLHTk
Comments: ZvTLHTk
Language: Language Neutral

Company Name: ZvTLHTkProduct Name: ZvTLHTkProduct Version: 3, 2, 7, 1Legal Copyright: ZvTLHTkLegal Trademarks: Original Filename: ZvTLHTk.EXEInternal Name: ZvTLHTkFile Version: 3, 2, 7, 1File Description: ZvTLHTkComments: ZvTLHTkLanguage: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	63072	63488	4.49428	fd080fdbe7fe8541e1c828f20a21058d
.bss	69632	3488	0	0	d41d8cd98f00b204e9800998ecf8427e
.data	73728	51200	51200	5.45892	7f73bdc8acab31dc38137608bf8820cc
.rsrc	126976	73368	73728	5.4995	2c61a11dc7ff5e2a8872ba2310ab8b87
.reloc	200704	2208	2560	4.03753	86ae92f00570983808a0597582bad772

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

csrss.exe_696_rwx_00C40000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

\??\%System%\csrss.exe

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\csrss.exe

winlogon.exe_720_rwx_01270000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

\??\%System%\winlogon.exe

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\winlogon.exe

services.exe_764_rwx_00050000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\services.exe

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\services.exe

wmiprvse.exe_768_rwx_00DE0000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\wbem\wmiprvse.exe

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\wbem\wmiprvse.exe

lsass.exe_776_rwx_00BD0000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\lsass.exe

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\lsass.exe

svchost.exe_960_rwx_00D00000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\svchost.exe

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe

svchost.exe_1028_rwx_009C0000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\svchost.exe

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe

svchost.exe_1116_rwx_00A00000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%WinDir%\System32\svchost.exe

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe

svchost.exe_1160_rwx_00840000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\svchost.exe

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe

svchost.exe_1268_rwx_00B80000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\svchost.exe

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe

spoolsv.exe_1448_rwx_00B70000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\spoolsv.exe

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\spoolsv.exe

Explorer.EXE_1684_rwx_02060000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%WinDir%\Explorer.EXE

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

Lskmkx.exe

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\explorer.exe

jqs.exe_1972_rwx_010C0000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.PTF://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

hXXp://VVV.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s
';

%s
%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Ã%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%Program Files%\Java\jre6\bin\jqs.exe

%Documents and Settings%\%current user%\Application Data\Lskmkx.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\Program Files\Java\jre6\bin\jqs.exe

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps