Worm.Win32.AutoIt.FD, mzpefinder_pcap_file.YR, WormAutoItGen.YR (Lavasoft MAS)Behaviour: Worm
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 89ec1e4e02775cec038e4f033f37ba03
SHA1: 2bc02d3066b0f7c555352f23e62c4efede1f4dc1
SHA256: ceda5d1cff63da2f6556f6ba8c888966db442dafdff1fb0670f5c9e227a0e3be
SSDeep: 12288:a6Wq4aaE6KwyF5L0Y2D1PqLh8np1BN6QJEeRBoL:4thEVaPqLc1BNz5PoL
Size: 445232 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: no certificate found
Created at: 2012-01-29 23:32:28
Analyzed on: WindowsXP SP3 32-bit
Summary: Worm. A program that is primarily replicating on networks or removable drives.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Worm creates the following process(es):
searchMessenger_upgrade.exe:1940
%original file name%.exe:776
The Worm injects its code into the following process(es):
searchMessenger.exe:1568
File activity
The process searchMessenger_upgrade.exe:1940 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\searchMessenger_upgrade[2].exe (362697 bytes)
C:\sMessenger\update\searchMessenger.ico (196 bytes)
C:\sMessenger\update\searchMessenger.exe (56564 bytes)
C:\sMessenger\searchMessenger_update.ini (424 bytes)
%Documents and Settings%\%current user%\Favorites\Links\ìâ€Â½Ã¬존 - ì§€ì‹ÂÂ거래.url (156 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\yesformoffice_auto_update.exe (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\yesformoffice_auto_update[1].exe (189961 bytes)
C:\sMessenger\update\searchMessenger_update.ini (491 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\예스ü 문서ë©â€Âì‹ ì €\예스ü 문서ë©â€Âì‹ ì €.lnk (707 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\searchMessenger_ulist[1].dta (255 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\favicon[2].ico (337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\searchMessenger_uninstall[1].exe (358745 bytes)
C:\sMessenger\update\searchMessenger_ulist.dta (255 bytes)
C:\sMessenger\searchMessenger_upchk.txt (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\favicon[1].ico (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\searchMessenger[1].ico (337 bytes)
C:\sMessenger\update\searchMessenger_uninstall.exe (95004 bytes)
C:\sMessenger\예스ü 문서ë©â€Âì‹ ì €.lnk (555 bytes)
C:\sMessenger\update\searchMessenger_tray.ico (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\searchMessenger_update[1].ini (491 bytes)
%Documents and Settings%\%current user%\Favorites\예스ü - 문서서ì‹ÂÂ.url (153 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\searchMessenger_tray[1].ico (337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\searchMessenger_update[2].ini (491 bytes)
C:\sMessenger\update\searchMessenger_upgrade.exe (95844 bytes)
%Documents and Settings%\%current user%\Application Data\Thinkzon\Thinkzon.ico (196 bytes)
%Documents and Settings%\%current user%\Favorites\ìâ€Â½Ã¬존 - ì§€ì‹ÂÂ거래.url (156 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\예스ü 문서ë©â€Âì‹ ì €\예스ü 문서ë©â€Âì‹ ì € ì‚ÂÂì œ.lnk (763 bytes)
%Documents and Settings%\%current user%\Application Data\Yesform\Yesform.ico (388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\searchMessenger[1].exe (213985 bytes)
%Documents and Settings%\%current user%\Favorites\Links\예스ü - 문서서ì‹ÂÂ.url (153 bytes)
C:\sMessenger\update\yesformoffice_auto_update.exe (50052 bytes)
The Worm deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\searchMessenger_ulist[1].dta (0 bytes)
C:\sMessenger\searchMessenger_ulist.dta (0 bytes)
C:\sMessenger\update\searchMessenger_update.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\searchMessenger_upgrade[1].exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\searchMessenger_update[1].ini (0 bytes)
C:\sMessenger\update\yesformoffice_auto_update.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\searchMessenger_update[2].ini (0 bytes)
The process %original file name%.exe:776 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\searchMessenger_ulist[1].dta (255 bytes)
C:\sMessenger\searchMessenger_ulist.dta (255 bytes)
C:\searchMessenger.pid (3 bytes)
C:\sMessenger\searchMessenger_upgrade.exe (95844 bytes)
C:\sMessenger\update\searchMessenger_update.ini (491 bytes)
C:\searchMessenger.ini (127 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\searchMessenger_upgrade[1].exe (362697 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\searchMessenger_update[1].ini (491 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\update_check[1].htm (491 bytes)
The Worm deletes the following file(s):
The process searchMessenger.exe:1568 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
C:\sMessenger\searchMessenger.pid (4 bytes)
C:\sMessenger\update\searchMessenger_update.ini (491 bytes)
C:\sMessenger\searchMessenger_update.ini (140 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\update_check[1].htm (491 bytes)
C:\sMessenger\searchMessenger.ini (127 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\searchMessenger_update[1].ini (491 bytes)
The Worm deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\update_check[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\searchMessenger_update[1].ini (0 bytes)
C:\sMessenger\update\searchMessenger_update.ini (0 bytes)
C:\sMessenger\searchMessenger_upgrade.exe (0 bytes)
Registry activity
The process searchMessenger_upgrade.exe:1940 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1FE67845-4ED4-47B9-CB29-2E3363D9B8E6}]
"URL" = "http://www.yesform.com/z_n/forms/search.php?ie=SearchScopes&q={searchTerms}"
[HKCU\Software\Yesform\searchMessenger]
"yoNum" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\searchMessenger]
"DisplayVersion" = "1.4.3.22"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B1A7197F-ACC3-54BA-2661-43FEEB408097}]
"FaviconURL" = "http://www.thinkzon.com/favicon.ico"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\searchMessenger]
"UninstallString" = "C:\sMessenger\searchMessenger_uninstall.exe c"
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1FE67845-4ED4-47B9-CB29-2E3363D9B8E6}]
"Codepage" = "949"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\searchMessenger]
"DisplayIcon" = "C:\sMessenger\searchMessenger_tray.ico"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1FE67845-4ED4-47B9-CB29-2E3363D9B8E6}]
"DisplayName" = "예스ü"
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B1A7197F-ACC3-54BA-2661-43FEEB408097}]
"Codepage" = "949"
"DisplayName" = "ìâ€Â½Ã¬존"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\searchMessenger]
"DisplayName" = "예스ü 문서ë©â€Âì‹ ì €"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "09 94 F3 2D 62 48 8C E0 41 1A A6 E6 0A 67 11 E9"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1FE67845-4ED4-47B9-CB29-2E3363D9B8E6}]
"FaviconURL" = "http://www.yesform.com/favicon.ico"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\searchMessenger]
"Publisher" = "예스ü"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B1A7197F-ACC3-54BA-2661-43FEEB408097}]
"URL" = "http://www.thinkzon.com/search/?ie=SearchScopes&q={searchTerms}"
The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"searchMessenger" = "C:\sMessenger\searchMessenger.exe"
The Worm deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process %original file name%.exe:776 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A3 7B 2C 59 D8 55 D0 F6 4C 47 81 80 73 5C A4 A4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Worm deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process searchMessenger.exe:1568 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 27 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E9 79 48 1B 83 55 EF BE CA 03 8C 41 53 F2 A8 11"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Worm deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
MD5 | File path |
---|---|
5918fc4e1b120cc35f82214209372857 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\searchMessenger[1].exe |
63b8733b94d1c9f0676f5fbe9342411c | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\yesformoffice_auto_update[1].exe |
e2d3e41a20666865264ad2e8914c0c46 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\searchMessenger_uninstall[1].exe |
9c488ae2492abbc8b7f4949825637148 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\searchMessenger_upgrade[2].exe |
63b8733b94d1c9f0676f5fbe9342411c | c:\Documents and Settings\"%CurrentUserName%"\Start Menu\Programs\Startup\yesformoffice_auto_update.exe |
5918fc4e1b120cc35f82214209372857 | c:\sMessenger\searchMessenger.exe |
e2d3e41a20666865264ad2e8914c0c46 | c:\sMessenger\searchMessenger_uninstall.exe |
9c488ae2492abbc8b7f4949825637148 | c:\sMessenger\searchMessenger_upgrade.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
searchMessenger_upgrade.exe:1940
%original file name%.exe:776 - Delete the original Worm file.
- Delete or disinfect the following files created/modified by the Worm:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\searchMessenger_upgrade[2].exe (362697 bytes)
C:\sMessenger\update\searchMessenger.ico (196 bytes)
C:\sMessenger\update\searchMessenger.exe (56564 bytes)
C:\sMessenger\searchMessenger_update.ini (424 bytes)
%Documents and Settings%\%current user%\Favorites\Links\ìâ€Â½Ã¬존 - ì§€ì‹ÂÂ거래.url (156 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\yesformoffice_auto_update.exe (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\yesformoffice_auto_update[1].exe (189961 bytes)
C:\sMessenger\update\searchMessenger_update.ini (491 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\예스ü 문서ë©â€Âì‹ ì €\예스ü 문서ë©â€Âì‹ ì €.lnk (707 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\searchMessenger_ulist[1].dta (255 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\favicon[2].ico (337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\searchMessenger_uninstall[1].exe (358745 bytes)
C:\sMessenger\update\searchMessenger_ulist.dta (255 bytes)
C:\sMessenger\searchMessenger_upchk.txt (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\favicon[1].ico (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\searchMessenger[1].ico (337 bytes)
C:\sMessenger\update\searchMessenger_uninstall.exe (95004 bytes)
C:\sMessenger\예스ü 문서ë©â€Âì‹ ì €.lnk (555 bytes)
C:\sMessenger\update\searchMessenger_tray.ico (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\searchMessenger_update[1].ini (491 bytes)
%Documents and Settings%\%current user%\Favorites\예스ü - 문서서ì‹ÂÂ.url (153 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\searchMessenger_tray[1].ico (337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\searchMessenger_update[2].ini (491 bytes)
C:\sMessenger\update\searchMessenger_upgrade.exe (95844 bytes)
%Documents and Settings%\%current user%\Application Data\Thinkzon\Thinkzon.ico (196 bytes)
%Documents and Settings%\%current user%\Favorites\ìâ€Â½Ã¬존 - ì§€ì‹ÂÂ거래.url (156 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\예스ü 문서ë©â€Âì‹ ì €\예스ü 문서ë©â€Âì‹ ì € ì‚ÂÂì œ.lnk (763 bytes)
%Documents and Settings%\%current user%\Application Data\Yesform\Yesform.ico (388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\searchMessenger[1].exe (213985 bytes)
%Documents and Settings%\%current user%\Favorites\Links\예스ü - 문서서ì‹ÂÂ.url (153 bytes)
C:\sMessenger\update\yesformoffice_auto_update.exe (50052 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\searchMessenger_ulist[1].dta (255 bytes)
C:\sMessenger\searchMessenger_ulist.dta (255 bytes)
C:\searchMessenger.pid (3 bytes)
C:\sMessenger\searchMessenger_upgrade.exe (95844 bytes)
C:\searchMessenger.ini (127 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\searchMessenger_upgrade[1].exe (362697 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\update_check[1].htm (491 bytes)
C:\sMessenger\searchMessenger.pid (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\update_check[1].htm (491 bytes)
C:\sMessenger\searchMessenger.ini (127 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\searchMessenger_update[1].ini (491 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"searchMessenger" = "C:\sMessenger\searchMessenger.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name:
Product Version:
Legal Copyright: (?)???
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.1307.1401
File Description: ??? ?????
Comments: ??? ?????
Language: Korean (Korea)
Company Name: Product Name: Product Version: Legal Copyright: (?)???Legal Trademarks: Original Filename: Internal Name: File Version: 1.1307.1401File Description: ??? ?????Comments: ??? ?????Language: Korean (Korea)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
UPX0 | 4096 | 458752 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
UPX1 | 462848 | 274432 | 270848 | 5.49597 | 427929c2876ad452785e27c720c62cf1 |
.rsrc | 737280 | 12288 | 8704 | 3.03176 | 48b6912f62eb496b6241317a88b71a8d |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://222.122.6.226/active/searchMessenger/update2/searchMessenger_update.ini | |
hxxp://222.122.6.226/active/searchMessenger/update2/searchMessenger.ico | |
hxxp://222.122.6.226/active/searchMessenger/update2/searchMessenger_tray.ico | |
hxxp://222.122.6.226/active/searchMessenger/update2/searchMessenger.exe | |
hxxp://222.122.6.226/active/searchMessenger/update2/searchMessenger_upgrade.exe | |
hxxp://222.122.6.226/active/searchMessenger/update2/searchMessenger_uninstall.exe | |
hxxp://222.122.6.226/active/searchMessenger/update2/searchMessenger_ulist.dta | |
hxxp://www.yesform.com/favicon.ico | 222.122.6.226 |
hxxp://filevip.yesform.com/yesform_office/upgrade/yesformoffice_auto_update.exe | |
winapp.yesform.com | 222.122.6.229 |
www.thinkzon.com | 222.122.6.226 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /active/searchMessenger/update2/searchMessenger.exe HTTP/1.1
User-Agent: AutoIt
Host: wupgrade.yesform.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 13 Apr 2014 04:18:55 GMT
Server: Apache
Last-Modified: Wed, 24 Jul 2013 04:08:56 GMT
ETag: "6cae8-4e23a11798600"
Accept-Ranges: bytes
Content-Length: 445160
P3P: CP='ALL DSP COR MON LAW OUR LEG'
Connection: close
Content-Type: application/x-msdownload
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................1b.......P.).....Q.......y.......i..........}....N.......d.......`.......m.......g.....Rich............PE..L.....%O..........#......0...0......`........@....@..........................p................@.......@......................\.......@..................X...........................................................................................UPX0....................................UPX1.....0......."..................@....rsrc....0...@..."...&..............@......................................................................................................................................................................................................................................................................................................................................................................................3.07.UPX!.....I......?...W.......&.......U..3.......8..tI.tNh..P..\.......R.'....$....<..u..........X<Qj.......c.`$.7;\....$H...]..A....F$S3.;....O...,.^$..i..^0.48.^.[o.~...=.l:)Lj........t..&......N..H....F.....o..6...E..MXU.W.....}.PQR.6._]...?...S.....].V;..uf...|s)...r;...6=..J....ZU..6.~E.RPWS..&^[...f....`.t8.vL...........l..,..}.<...u............<.~.h.....4.L....?o~..G.....q..$.,w.A..@.....o.7..i.m0j.".{j.h...?3W.h(NHH..=o..m....u.&.^.....|.......}..?`.Z....... ..B.............HSWx...X...1..SP`T.x..Q.....|.=...J{.<..\...
<<
<<< skipped >>>
GET /active/searchMessenger/update2/searchMessenger_ulist.dta HTTP/1.1
User-Agent: AutoIt
Host: wupgrade.yesform.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 13 Apr 2014 04:19:07 GMT
Server: Apache
Last-Modified: Wed, 15 Jan 2014 06:23:48 GMT
ETag: "ff-4effc5a064500"
Accept-Ranges: bytes
Content-Length: 255
P3P: CP='ALL DSP COR MON LAW OUR LEG'
Connection: close
203A20EB84A4EC9DB4EPQ28420ED86B5ED95A9EAB280EC83890A202D20476F6F..676C6520EAB280EC83890A203A3A20EAB280EC83897A756D0A204461756D20ED..86B5ED95A920EAB280EC83890A20EB84A4EC9DB4ED8AB820ED86B5ED95A920EA..B280EC83890A202D2042696E6720ED86B5ED95A9EAB280EC83890A=....
GET /active/searchMessenger/update2/searchMessenger_update.ini HTTP/1.1
User-Agent: AutoIt
Host: wupgrade.yesform.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 13 Apr 2014 04:18:53 GMT
Server: Apache
Last-Modified: Wed, 15 Jan 2014 06:26:06 GMT
ETag: "1eb-4effc62404835"
Accept-Ranges: bytes
Content-Length: 491
P3P: CP='ALL DSP COR MON LAW OUR LEG'
Connection: close
[readme].help=upgrade: 1)version history 2)update file..[version].history=2014-01-15 01..[install].searchMessenger.ico=Y.searchMessenger_tray.ico=N.searchMessenger.exe=Y.searchMessenger_upgrade.exe=Y.searchMessenger_uninstall.exe=Y.searchMessenger_update.ini=Y..[update].searchMessenger.ico=1.2009.12.22.searchMessenger_tray.ico=1.2009.12.22.searchMessenger.exe=1.1307.2401.searchMessenger_upgrade.exe=1.2.06.searchMessenger_uninstall.exe=913.13.111.5.searchMessenger_ulist.dta=15.1401.1005...
GET /active/searchMessenger/update2/searchMessenger_tray.ico HTTP/1.1
User-Agent: AutoIt
Host: wupgrade.yesform.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 13 Apr 2014 04:18:54 GMT
Server: Apache
Last-Modified: Thu, 05 Jun 2008 04:56:38 GMT
ETag: "10be-44ee42b9c0d80"
Accept-Ranges: bytes
Content-Length: 4286
P3P: CP='ALL DSP COR MON LAW OUR LEG'
Connection: close
Content-Type: image/x-icon
...... .... .........(... ...@..... ......................................................................................}.Y...............................................................................................................^.......sZO..vm..i_..wn.....$.......,...,...,...,...,.......................................................................5.... ..............3....................................................................................................!...!...........................................................................................................................!..t!... ..............................E.................................................................................... ..'................RL..........'..........................................................................................."...!...............@6..................XT.................R...................................................................."..e ...........................................&...........................................................................#... ...............|{.............._]..................^\.................`.................................................... ..."...........<4..........................dc.................. $.................&........................................!..T .......*...OH..!...............................)!..................fc.................o................................!...#... .......................B:.............
<<
<<< skipped >>>
GET /active/searchMessenger/update2/searchMessenger_upgrade.exe HTTP/1.1
User-Agent: AutoIt
Host: wupgrade.yesform.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 13 Apr 2014 04:18:58 GMT
Server: Apache
Last-Modified: Wed, 18 Dec 2013 08:21:09 GMT
ETag: "b5ff0-4edcaba24e740"
Accept-Ranges: bytes
Content-Length: 745456
P3P: CP='ALL DSP COR MON LAW OUR LEG'
Connection: close
Content-Type: application/x-msdownload
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................1b.......P.).....Q.......y.......i..........}....N.......d.......`.......m.......g.....Rich............PE..L.....%O..........#..................e....... ....@...........................................@.......@.........................T........?...........E..h............................................................ ..D............................text............................... ..`.rdata....... ......................@..@.data...X........h..................@....rsrc....?.......@...T..............@..@................................................................................................................................................................................................................................................................................................................................................................................U..3.......8..tI.tNh....P..\...R..tI..............uI......X...Qj...X.........\.....`..........$H...].............F$S3.;....O...F,.^$;....O...^,.^0.^4.^8.^.[.....~....)L..j..&........t......N..H....F...N.3..H....F............U...E..M..U.W.}.PQR....._]......U.....S.].V;..uI.uf......s)...r$;=..J........U..E.RPWS...&H.^[..].........t8...vL.......................}.........u..Q.....uI...t....E.h..J........3.^[..]..........G......q....$.,.@.j.S...&H....J..7...j....&H.3.^[..]...j.h....j.S...&H.h(NH....&H..=..J.....
<<
<<< skipped >>>
GET /favicon.ico HTTP/1.1
User-Agent: AutoIt
Host: VVV.thinkzon.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 13 Apr 2014 04:19:06 GMT
Server: Apache
Last-Modified: Tue, 26 Nov 2013 06:53:09 GMT
ETag: "10be-4ec0eeefb2aa4"
Accept-Ranges: bytes
Content-Length: 4286
Connection: close
Content-Type: image/x-icon
...... .... .........(... ...@..... ......................................................................qJ..qJ/.kA........@...............................................................V.........................................qJ..qJ..qJ..nG..|X:.......H...^...j...o...y...z...z...z...z...z...z...r...j...a...S.../.........................................qJ..qJ..qJ..qK..nF..uO}.zV..................................................................................................qJB.qJ..qJ..qJ..qJ..qJ..pH..oG..j@I.........................................................................................qJ..qJ..qJ..qJ..qJ..kB..kB..pI..qJ..qJ..qI..lB..................................................................................qJ..qJ..qJ..qI..mE...o...m..lD..mE..qJ..qJ..qJ..qJZ.........................................................................qJ9.qJ..qJ..qJ..jA..................zU..jA..pI..qJ..qJ..qJ..qJ(.............................................................qJ..qJ..qJ..qJ..lD...\..........................lD..lD..qJ..qJ..qJ..qJn.qJ......................................................qJu.qJ..qJ..pH..qJ..................................}Z..jA..pH..qJ..qJ..qJ..qJ6.............................................qJ-.qJ..qJ..qJ..i@..vO..............f=..._......................nF..lC..qJ..qJ..qJ..qJ..qJ..................................qJ..qJ..qJ..qI..pH.......d..vQ......._..nF..mE..mE.......................d..h?..oG..qJ..qJ..qJ..qJG.............................qJs.qJ..qJ..kC..................jA..i@..qJ..qJ..p
<<
<<< skipped >>>
GET /active/searchMessenger/update2/searchMessenger_update.ini HTTP/1.1
User-Agent: AutoIt
Host: wupgrade.yesform.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 13 Apr 2014 04:18:53 GMT
Server: Apache
Last-Modified: Wed, 15 Jan 2014 06:26:06 GMT
ETag: "1eb-4effc62404835"
Accept-Ranges: bytes
Content-Length: 491
P3P: CP='ALL DSP COR MON LAW OUR LEG'
Connection: close
[readme].help=upgrade: 1)version history 2)update file..[version].history=2014-01-15 01..[install].searchMessenger.ico=Y.searchMessenger_tray.ico=N.searchMessenger.exe=Y.searchMessenger_upgrade.exe=Y.searchMessenger_uninstall.exe=Y.searchMessenger_update.ini=Y..[update].searchMessenger.ico=1.2009.12.22.searchMessenger_tray.ico=1.2009.12.22.searchMessenger.exe=1.1307.2401.searchMessenger_upgrade.exe=1.2.06.searchMessenger_uninstall.exe=913.13.111.5.searchMessenger_ulist.dta=15.1401.1005...
GET /favicon.ico HTTP/1.1
User-Agent: AutoIt
Host: VVV.yesform.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 13 Apr 2014 04:19:09 GMT
Server: Apache
Last-Modified: Mon, 06 Jan 2014 02:55:57 GMT
ETag: "25be-4ef44661f8940"
Accept-Ranges: bytes
Content-Length: 9662
P3P: CP='ALL DSP COR MON LAW OUR LEG'
Connection: close
Content-Type: image/x-icon
......00.... ..%......(...0...`..... ......%.................................................................................................................P.......................................................................................@................................................................................,...,..0...............@...................................................................................p...@............................................................................,..p,...,...,...,..@........................................................................................................................................................................,..@,...,...,...,...,...,...,...............................................................................................................................................................,...,...,...,...,...,...,...,...,...,..`........................................................................................................................................................,...,...,...,...,...,...,...,...,...,...,...,.. ............................................................................................................................................,..@,...,...,...,...,...,...,...,...,...,...,...,...,...........................................................................................................................................,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,..@..........
<<
<<< skipped >>>
GET /active/searchMessenger/update2/searchMessenger.ico HTTP/1.1
User-Agent: AutoIt
Host: wupgrade.yesform.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 13 Apr 2014 04:18:49 GMT
Server: Apache
Last-Modified: Mon, 16 Nov 2009 07:07:08 GMT
ETag: "10be-47877a85dbf00"
Accept-Ranges: bytes
Content-Length: 4286
P3P: CP='ALL DSP COR MON LAW OUR LEG'
Connection: close
Content-Type: image/x-icon
...... .... .........(... ...@..... ...............................4...4...4...4...4...4...4...4...4...4...4...4...4...4...4...4...4...4...4...4...4...4...4...4...4...4...4...4...4...4.......4...8...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...8...4...4...>...................................................................................................................>...4...4...>..."..."..."..."..."..."..."..."..."..."..."..."..."..."..."..."..."..."..."..."..."..........................."...>...4...4...>...%...%...%...%...%...%...%...%...%...%...%...%...%...%...%...%...%...%...%...%.............zzz.JJJ...........%...>...4...4...>...(...(.\\\.............................................................................zzz.JJJ.k.............(...>...4...4...>...-...-.\\\..................|...|.......|...|...|..(.}.(.}.(.}...E...E.............zzz.JJJ.k.................-...>...4...4...>...1...1.\\\.....................................................................zzz.>>>.H.................1...1...>...4...4...>...5...5.\\\.................................................%%%.............bbb.>>>.%...>>>...........5...5...5...>...4...4...>...9...9.\\\.....................................%Kp.W...4...6...n...|pR.....&&&.%...>>>...............9...9...9...>...4...4...>...<...<.\
<<
<<< skipped >>>
GET /yesform_office/upgrade/yesformoffice_auto_update.exe HTTP/1.1
User-Agent: AutoIt
Host: winapp.yesform.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 13 Apr 2014 04:19:11 GMT
Server: Apache
Last-Modified: Thu, 19 Dec 2013 05:04:25 GMT
ETag: "1a41136-5f810-4eddc18698840"
Accept-Ranges: bytes
Content-Length: 391184
Content-Type: application/x-msdownload
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................1b.......P.).....Q.......y.......i..........}....N.......d.......`.......m.......g.....Rich............PE..L.....%O..........#......0...`...@..`n...P........@.................................t.........@.......@..................................N..............p...........................................................................................UPX0.....@..............................UPX1.....0...P..."..................@....rsrc....`.......T...&..............@......................................................................................................................................................................................................................................................................................................................................................................................3.07.UPX!.... G(. ...?A..^....)..&..Z....U..3.......8..tI.tNh..P..\.......R.'....$....<..u..........X<Qj.......c.`$.7;\....$H...]..A....F$S3.;....O...,.^$..i..^0.48.^.[o.~...=.l:)Lj........t..&......N..H....F.....o..6...E..MXU.W.....}.PQR.6._]...?...S.....].V;..uf...|s)...r;...6=..J....ZU..6.~E.RPWS..&^[...f....`.t8.vL...........l..,..}.<...u............<.~.h.....4.L....?o~..G.....q..$.,w.A..@.....o.7..i.m0j.".{j.h...?3W.h(NHH..=o..m....u.&.^.....|.......}..?`.Z....... ..B.............HSWx...X...1..SP`T.x..Q.....|.=...J{.<..\...
<<
<<< skipped >>>
GET /active/searchMessenger/update2/searchMessenger_uninstall.exe HTTP/1.1
User-Agent: AutoIt
Host: wupgrade.yesform.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 13 Apr 2014 04:19:02 GMT
Server: Apache
Last-Modified: Wed, 04 Dec 2013 08:53:32 GMT
ETag: "b2ab0-4ecb18c2d7b00"
Accept-Ranges: bytes
Content-Length: 731824
P3P: CP='ALL DSP COR MON LAW OUR LEG'
Connection: close
Content-Type: application/x-msdownload
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................1b.......P.).....Q.......y.......i..........}....N.......d.......`.......m.......g.....Rich............PE..L.....%O..........#..................e....... ....@...........................................@.......@.........................T........?..........P...`............................................................ ..D............................text............................... ..`.rdata....... ......................@..@.data...X........h..................@....rsrc....?.......@...T..............@..@................................................................................................................................................................................................................................................................................................................................................................................U..3.......8..tI.tNh....P..\...R..tI..............uI......X...Qj...X.........\.....`..........$H...].............F$S3.;....O...F,.^$;....O...^,.^0.^4.^8.^.[.....~....)L..j..&........t......N..H....F...N.3..H....F............U...E..M..U.W.}.PQR....._]......U.....S.].V;..uI.uf......s)...r$;=..J........U..E.RPWS...&H.^[..].........t8...vL.......................}.........u..Q.....uI...t....E.h..J........3.^[..]..........G......q....$.,.@.j.S...&H....J..7...j....&H.3.^[..]...j.h....j.S...&H.h(NH....&H..=..J.....
<<
<<< skipped >>>
Map
Strings from Dumps
searchMessenger.exe_1568:
`.rsrc
`.rsrc
s%j.Zf
s%j.Zf
8crtsu
8crtsu
:crts
:crts
crts
crts
GetProcessWindowStation
GetProcessWindowStation
operator
operator
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.
uxtheme.dll
uxtheme.dll
kernel32.dll
kernel32.dll
operand of unlimited repeat could match the empty string
operand of unlimited repeat could match the empty string
POSIX named classes are supported only within a class
POSIX named classes are supported only within a class
erroffset passed as NULL
erroffset passed as NULL
POSIX collating elements are not supported
POSIX collating elements are not supported
this version of PCRE is not compiled with PCRE_UTF8 support
this version of PCRE is not compiled with PCRE_UTF8 support
PCRE does not support \L, \l, \N{name}, \U, or \u
PCRE does not support \L, \l, \N{name}, \U, or \u
support for \P, \p, and \X has not been compiled
support for \P, \p, and \X has not been compiled
this version of PCRE is not compiled with PCRE_UCP support
this version of PCRE is not compiled with PCRE_UCP support
ICMP.DLL
ICMP.DLL
advapi32.dll
advapi32.dll
RegDeleteKeyExW
RegDeleteKeyExW
Error text not found (please report)
Error text not found (please report)
zcÁ
zcÁ
0.KP{
0.KP{
GetProcessHeap
GetProcessHeap
CreatePipe
CreatePipe
GetWindowsDirectoryW
GetWindowsDirectoryW
GetCPInfo
GetCPInfo
RegDeleteKeyW
RegDeleteKeyW
RegEnumKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegOpenKeyExW
RegCloseKey
RegCloseKey
SetViewportOrgEx
SetViewportOrgEx
ShellExecuteExW
ShellExecuteExW
SHFileOperationW
SHFileOperationW
ShellExecuteW
ShellExecuteW
RegisterHotKey
RegisterHotKey
GetKeyboardLayoutNameW
GetKeyboardLayoutNameW
ExitWindowsEx
ExitWindowsEx
EnumThreadWindows
EnumThreadWindows
GetAsyncKeyState
GetAsyncKeyState
SetKeyboardState
SetKeyboardState
GetKeyboardState
GetKeyboardState
GetKeyState
GetKeyState
VkKeyScanW
VkKeyScanW
EnumWindows
EnumWindows
EnumChildWindows
EnumChildWindows
MapVirtualKeyW
MapVirtualKeyW
CloseWindowStation
CloseWindowStation
SetProcessWindowStation
SetProcessWindowStation
OpenWindowStationW
OpenWindowStationW
UnregisterHotKey
UnregisterHotKey
keybd_event
keybd_event
InternetCrackUrlW
InternetCrackUrlW
HttpQueryInfoW
HttpQueryInfoW
HttpOpenRequestW
HttpOpenRequestW
HttpSendRequestW
HttpSendRequestW
FtpOpenFileW
FtpOpenFileW
FtpGetFileSize
FtpGetFileSize
InternetOpenUrlW
InternetOpenUrlW
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
23$--%"!'
23$--%"!'
's.ak[
's.ak[
Sub%U
Sub%U
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" language="*" processorArchitecture="*" publicKeyToken="6595b64144ccf1df"></assemblyIdentity>
<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" language="*" processorArchitecture="*" publicKeyToken="6595b64144ccf1df"></assemblyIdentity>
KERNEL32.DLL
KERNEL32.DLL
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
COMDLG32.dll
COMDLG32.dll
GDI32.dll
GDI32.dll
MPR.dll
MPR.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
PSAPI.DLL
PSAPI.DLL
SHELL32.dll
SHELL32.dll
USER32.dll
USER32.dll
USERENV.dll
USERENV.dll
VERSION.dll
VERSION.dll
WININET.dll
WININET.dll
WINMM.dll
WINMM.dll
WSOCK32.dll
WSOCK32.dll
mscoree.dll
mscoree.dll
nKERNEL32.DLL
nKERNEL32.DLL
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
WUSER32.DLL
WUSER32.DLL
>>>AUTOIT NO CMDEXECUTE<<<</pre><pre>CMDLINERAW</pre><pre>CMDLINE</pre><pre>/AutoIt3ExecuteLine</pre><pre>/AutoIt3ExecuteScript</pre><pre>%s (%d) : ==> %s.:</pre><pre>Line %d:</pre><pre>Line %d (File "%s"):</pre><pre>%s (%d) : ==> %s:</pre><pre>AutoIt script files (*.au3, *.a3x)</pre><pre>*.au3;*.a3x</pre><pre>All files (*.*)</pre><pre>#NoAutoIt3Execute</pre><pre>APPSKEY</pre><pre>04090000</pre><pre>%u.%u.%u.%u</pre><pre>0.0.0.0</pre><pre>Mddddd</pre><pre>%s (%d) : ==> %s:</pre><pre>UDPSTARTUP</pre><pre>UDPSHUTDOWN</pre><pre>UDPSEND</pre><pre>UDPRECV</pre><pre>UDPOPEN</pre><pre>UDPCLOSESOCKET</pre><pre>UDPBIND</pre><pre>TRAYGETMSG</pre><pre>TCPSTARTUP</pre><pre>TCPSHUTDOWN</pre><pre>TCPSEND</pre><pre>TCPRECV</pre><pre>TCPNAMETOIP</pre><pre>TCPLISTEN</pre><pre>TCPCONNECT</pre><pre>TCPCLOSESOCKET</pre><pre>TCPACCEPT</pre><pre>SHELLEXECUTEWAIT</pre><pre>SHELLEXECUTE</pre><pre>REGENUMKEY</pre><pre>MSGBOX</pre><pre>ISKEYWORD</pre><pre>HTTPSETUSERAGENT</pre><pre>HTTPSETPROXY</pre><pre>HOTKEYSET</pre><pre>GUIREGISTERMSG</pre><pre>GUIGETMSG</pre><pre>GUICTRLSENDMSG</pre><pre>GUICTRLRECVMSG</pre><pre>FTPSETPROXY</pre><pre>\??\%s</pre><pre>GUI_RUNDEFMSG</pre><pre>SendKeyDelay</pre><pre>SendKeyDownDelay</pre><pre>TCPTimeout</pre><pre>AUTOITCALLVARIABLE%d</pre><pre>255.255.255.255</pre><pre>Keyword</pre><pre>AutoIt.Error</pre><pre>Null Object assignment in FOR..IN loop</pre><pre>Incorrect Object type in FOR..IN loop</pre><pre>HOTKEYPRESSED</pre><pre>AUTOITEXE</pre><pre>WINDOWSDIR</pre><pre>3, 3, 8, 1</pre><pre>HKEY_LOCAL_MACHINE</pre><pre>HKEY_CLASSES_ROOT</pre><pre>HKEY_CURRENT_CONFIG</pre><pre>HKEY_CURRENT_USER</pre><pre>HKEY_USERS</pre><pre>%d/d/d</pre><pre>C:\sMessenger\searchMessenger.exe</pre><pre>:C:\sMessenger\searchMessenger.exe</pre><pre>AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.</pre><pre>Missing operator in expression."Unbalanced brackets in expression.</pre><pre>Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.</pre><pre>Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.</pre><pre>Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.</pre><pre>3This keyword cannot be used after a "Then" keyword.>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.</pre><pre>Can not redeclare a constant.5Can not redeclare a parameter inside a user function.HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.</pre><pre>String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.</pre><pre>1.1307.2401</pre><b>searchMessenger.exe_1568_rwx_00401000_000B1000:</b><pre>s%j.Zf</pre><pre>8crtsu</pre><pre>:crts</pre><pre>crts</pre><pre>GetProcessWindowStation</pre><pre>operator</pre><pre>This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.</pre><pre>uxtheme.dll</pre><pre>kernel32.dll</pre><pre>operand of unlimited repeat could match the empty string</pre><pre>POSIX named classes are supported only within a class</pre><pre>erroffset passed as NULL</pre><pre>POSIX collating elements are not supported</pre><pre>this version of PCRE is not compiled with PCRE_UTF8 support</pre><pre>PCRE does not support \L, \l, \N{name}, \U, or \u</pre><pre>support for \P, \p, and \X has not been compiled</pre><pre>this version of PCRE is not compiled with PCRE_UCP support</pre><pre>ICMP.DLL</pre><pre>advapi32.dll</pre><pre>RegDeleteKeyExW</pre><pre>Error text not found (please report)</pre><pre>zcÁ</pre><pre>0.KP{</pre><pre>GetProcessHeap</pre><pre>CreatePipe</pre><pre>GetWindowsDirectoryW</pre><pre>GetCPInfo</pre><pre>RegDeleteKeyW</pre><pre>RegEnumKeyExW</pre><pre>RegCreateKeyExW</pre><pre>RegOpenKeyExW</pre><pre>RegCloseKey</pre><pre>SetViewportOrgEx</pre><pre>ShellExecuteExW</pre><pre>SHFileOperationW</pre><pre>ShellExecuteW</pre><pre>RegisterHotKey</pre><pre>GetKeyboardLayoutNameW</pre><pre>ExitWindowsEx</pre><pre>EnumThreadWindows</pre><pre>GetAsyncKeyState</pre><pre>SetKeyboardState</pre><pre>GetKeyboardState</pre><pre>GetKeyState</pre><pre>VkKeyScanW</pre><pre>EnumWindows</pre><pre>EnumChildWindows</pre><pre>MapVirtualKeyW</pre><pre>CloseWindowStation</pre><pre>SetProcessWindowStation</pre><pre>OpenWindowStationW</pre><pre>UnregisterHotKey</pre><pre>keybd_event</pre><pre>InternetCrackUrlW</pre><pre>HttpQueryInfoW</pre><pre>HttpOpenRequestW</pre><pre>HttpSendRequestW</pre><pre>FtpOpenFileW</pre><pre>FtpGetFileSize</pre><pre>InternetOpenUrlW</pre><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.rsrc</pre><pre>23$--%"!'</pre><pre>'s.ak[</pre><pre>mscoree.dll</pre><pre>nKERNEL32.DLL</pre><pre>- Attempt to initialize the CRT more than once.</pre><pre>- CRT not initialized</pre><pre>- floating point support not loaded</pre><pre>WUSER32.DLL</pre><pre>>>>AUTOIT NO CMDEXECUTE<<<</pre><pre>CMDLINERAW</pre><pre>CMDLINE</pre><pre>/AutoIt3ExecuteLine</pre><pre>/AutoIt3ExecuteScript</pre><pre>%s (%d) : ==> %s.:</pre><pre>Line %d:</pre><pre>Line %d (File "%s"):</pre><pre>%s (%d) : ==> %s:</pre><pre>AutoIt script files (*.au3, *.a3x)</pre><pre>*.au3;*.a3x</pre><pre>All files (*.*)</pre><pre>#NoAutoIt3Execute</pre><pre>APPSKEY</pre><pre>04090000</pre><pre>%u.%u.%u.%u</pre><pre>0.0.0.0</pre><pre>Mddddd</pre><pre>%s (%d) : ==> %s:</pre><pre>UDPSTARTUP</pre><pre>UDPSHUTDOWN</pre><pre>UDPSEND</pre><pre>UDPRECV</pre><pre>UDPOPEN</pre><pre>UDPCLOSESOCKET</pre><pre>UDPBIND</pre><pre>TRAYGETMSG</pre><pre>TCPSTARTUP</pre><pre>TCPSHUTDOWN</pre><pre>TCPSEND</pre><pre>TCPRECV</pre><pre>TCPNAMETOIP</pre><pre>TCPLISTEN</pre><pre>TCPCONNECT</pre><pre>TCPCLOSESOCKET</pre><pre>TCPACCEPT</pre><pre>SHELLEXECUTEWAIT</pre><pre>SHELLEXECUTE</pre><pre>REGENUMKEY</pre><pre>MSGBOX</pre><pre>ISKEYWORD</pre><pre>HTTPSETUSERAGENT</pre><pre>HTTPSETPROXY</pre><pre>HOTKEYSET</pre><pre>GUIREGISTERMSG</pre><pre>GUIGETMSG</pre><pre>GUICTRLSENDMSG</pre><pre>GUICTRLRECVMSG</pre><pre>FTPSETPROXY</pre><pre>\??\%s</pre><pre>GUI_RUNDEFMSG</pre><pre>SendKeyDelay</pre><pre>SendKeyDownDelay</pre><pre>TCPTimeout</pre><pre>AUTOITCALLVARIABLE%d</pre><pre>255.255.255.255</pre><pre>Keyword</pre><pre>AutoIt.Error</pre><pre>Null Object assignment in FOR..IN loop</pre><pre>Incorrect Object type in FOR..IN loop</pre><pre>HOTKEYPRESSED</pre><pre>AUTOITEXE</pre><pre>WINDOWSDIR</pre><pre>3, 3, 8, 1</pre><pre>HKEY_LOCAL_MACHINE</pre><pre>HKEY_CLASSES_ROOT</pre><pre>HKEY_CURRENT_CONFIG</pre><pre>HKEY_CURRENT_USER</pre><pre>HKEY_USERS</pre><pre>%d/d/d</pre><pre>C:\sMessenger\searchMessenger.exe</pre><pre>:C:\sMessenger\searchMessenger.exe</pre><pre>AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.</pre><pre>Missing operator in expression."Unbalanced brackets in expression.</pre><pre>Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.</pre><pre>Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.</pre><pre>Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.</pre><pre>3This keyword cannot be used after a "Then" keyword.>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.</pre><pre>Can not redeclare a constant.5Can not redeclare a parameter inside a user function.HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.</pre><pre>String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.</pre></pre>