Trojan.Generic.5567254_bbef4c5a3c – Adaware

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.
IRCBot	A bot can communicate with command and control servers via IRC channel.
UDPFlooder	This program can make a UDP flood. A UDP flood attack is a denial-of-service attack using the User Datagram Protocol (UDP). It can be initiated by sending a large number of UDP packets to random ports on a remote host.
USBInfector	A program can register a device notification with the help of RegisterDeviceNotification. So it is notified when a USB device is plugged and then the worm copies itself to the USB device plugged into the affected computer.

Process activity

The Trojan creates the following process(es):

Lnwiwt.exe:3232
Lnwiwt.exe:2904
%original file name%.exe:2868
%original file name%.exe:2704

The Trojan injects its code into the following process(es):

spoolsv.exe:1432
mscorsvw.exe:424
svchost.exe:340
jqs.exe:480
csrss.exe:692
winlogon.exe:716
services.exe:760
lsass.exe:772
svchost.exe:928
svchost.exe:1012
svchost.exe:1096
svchost.exe:1144
svchost.exe:1188
Explorer.EXE:1948

File activity

The process %original file name%.exe:2868 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Lnwiwt.exe (24284 bytes)

Registry activity

The process Lnwiwt.exe:3232 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E5 71 C3 8A 44 A2 CF 1C D7 7D C4 0B 4C F5 E5 D1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process Lnwiwt.exe:2904 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "98 D7 88 31 86 F8 F8 0D 6E 5F 89 90 8C E3 B8 44"

The process %original file name%.exe:2868 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A7 D4 F3 81 2D E0 7D 1B ED 5A FF F6 A6 58 CD 38"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"Shell" = "explorer.exe,%Documents and Settings%\%current user%\Application Data\Lnwiwt.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"Shell" = "explorer.exe,%Documents and Settings%\%current user%\Application Data\Lnwiwt.exe"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Lnwiwt" = "%Documents and Settings%\%current user%\Application Data\Lnwiwt.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Lnwiwt" = "%Documents and Settings%\%current user%\Application Data\Lnwiwt.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Lnwiwt" = "%Documents and Settings%\%current user%\Application Data\Lnwiwt.exe"

The process %original file name%.exe:2704 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "59 DA B2 C5 19 79 5A 94 1B 40 33 4D 8F 33 A8 8F"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Trojan installs the following user-mode hooks in urlmon.dll:

URLDownloadToFileA
URLDownloadToFileW

The Trojan installs the following user-mode hooks in WININET.dll:

InternetWriteFile
HttpSendRequestA
HttpSendRequestW

The Trojan installs the following user-mode hooks in WS2_32.dll:

send

The Trojan installs the following user-mode hooks in kernel32.dll:

MoveFileA
CopyFileW
CopyFileA
MoveFileW
CreateFileW
CreateFileA

The Trojan installs the following user-mode hooks in ntdll.dll:

LdrLoadDll
NtResumeThread
ZwQueryDirectoryFile
ZwEnumerateValueKey

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.A program can register a device notification with the help of RegisterDeviceNotification. So it is notified when a USB device is plugged and then the worm copies itself to the USB device plugged into the affected computer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):
Lnwiwt.exe:3232
Lnwiwt.exe:2904
%original file name%.exe:2868
%original file name%.exe:2704
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Application Data\Lnwiwt.exe (24284 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Lnwiwt" = "%Documents and Settings%\%current user%\Application Data\Lnwiwt.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Lnwiwt" = "%Documents and Settings%\%current user%\Application Data\Lnwiwt.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Lnwiwt" = "%Documents and Settings%\%current user%\Application Data\Lnwiwt.exe"
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Beepa Pty Ltd
Product Name: FRAPS
Product Version:
Legal Copyright: Copyright (c) Beepa Pty Ltd 2010
Legal Trademarks: Fraps is a trademark of Beepa Pty Ltd
Original Filename:
Internal Name:
File Version: 3.2.6.12176
File Description: Fraps Installer
Comments:
Language: Language Neutral

Company Name: Beepa Pty LtdProduct Name: FRAPSProduct Version: Legal Copyright: Copyright (c) Beepa Pty Ltd 2010Legal Trademarks: Fraps is a trademark of Beepa Pty LtdOriginal Filename: Internal Name: File Version: 3.2.6.12176File Description: Fraps InstallerComments: Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	1233076	1236992	3.21003	6535d0da06d6351630dc372b74bafbec
.data	1241088	14712	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	1257472	4584	8192	1.72692	5f4b194abe7b573cedb3078973e7e4d1

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 3
1465d048a3b53ff00b3ecc2915c03d0b
67ceddffb7cb629154277dc4de9a698a
ebda8c1a9bb0da11a2f92a9262282317

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

Strings from Dumps

svchost.exe_340_rwx_00890000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.ftp://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

http://www.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

http://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s<br />';

%s<br />%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

http://%s/%s

http://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Í%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\svchost.exe

%Documents and Settings%\%current user%\Application Data\Lnwiwt.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe

mscorsvw.exe_424_rwx_008D0000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.ftp://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

http://www.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

http://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s<br />';

%s<br />%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

http://%s/%s

http://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Í%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%WinDir%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

%Documents and Settings%\%current user%\Application Data\Lnwiwt.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

jqs.exe_480_rwx_010C0000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.ftp://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

http://www.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

http://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s<br />';

%s<br />%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

http://%s/%s

http://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Í%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%Program Files%\Java\jre6\bin\jqs.exe

%Documents and Settings%\%current user%\Application Data\Lnwiwt.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\Program Files\Java\jre6\bin\jqs.exe

csrss.exe_692_rwx_01280000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.ftp://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

http://www.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

http://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s<br />';

%s<br />%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

http://%s/%s

http://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Í%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

\??\%System%\csrss.exe

%Documents and Settings%\%current user%\Application Data\Lnwiwt.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\csrss.exe

winlogon.exe_716_rwx_00EA0000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.ftp://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

http://www.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

http://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s<br />';

%s<br />%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

http://%s/%s

http://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Í%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

\??\%System%\winlogon.exe

%Documents and Settings%\%current user%\Application Data\Lnwiwt.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\winlogon.exe

services.exe_760_rwx_00050000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.ftp://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

http://www.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

http://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s<br />';

%s<br />%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

http://%s/%s

http://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Í%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\services.exe

%Documents and Settings%\%current user%\Application Data\Lnwiwt.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\services.exe

lsass.exe_772_rwx_00E20000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.ftp://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

http://www.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

http://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s<br />';

%s<br />%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

http://%s/%s

http://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Í%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\lsass.exe

%Documents and Settings%\%current user%\Application Data\Lnwiwt.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\lsass.exe

svchost.exe_928_rwx_009F0000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.ftp://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

http://www.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

http://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s<br />';

%s<br />%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

http://%s/%s

http://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Í%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\svchost.exe

%Documents and Settings%\%current user%\Application Data\Lnwiwt.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe

svchost.exe_1012_rwx_00A80000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.ftp://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

http://www.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

http://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s<br />';

%s<br />%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

http://%s/%s

http://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Í%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\svchost.exe

%Documents and Settings%\%current user%\Application Data\Lnwiwt.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe

svchost.exe_1096_rwx_02080000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.ftp://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

http://www.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

http://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s<br />';

%s<br />%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

http://%s/%s

http://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Í%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%WinDir%\System32\svchost.exe

%Documents and Settings%\%current user%\Application Data\Lnwiwt.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe

svchost.exe_1144_rwx_00860000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.ftp://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

http://www.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

http://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s<br />';

%s<br />%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

http://%s/%s

http://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Í%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\svchost.exe

%Documents and Settings%\%current user%\Application Data\Lnwiwt.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe

svchost.exe_1188_rwx_00AB0000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.ftp://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

http://www.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

http://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s<br />';

%s<br />%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

http://%s/%s

http://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Í%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\svchost.exe

%Documents and Settings%\%current user%\Application Data\Lnwiwt.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe

spoolsv.exe_1432_rwx_00D10000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.ftp://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

http://www.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

http://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s<br />';

%s<br />%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

http://%s/%s

http://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Í%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\spoolsv.exe

%Documents and Settings%\%current user%\Application Data\Lnwiwt.exe

%WinDir%

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\system32\spoolsv.exe

Explorer.EXE_1948_rwx_01110000_00024000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSShl

ShellExecuteA

SHELL32.dll

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetProcessHeap

GetWindowsDirectoryW

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s"

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.p10-> Link sent!

%s.p21-> Link sent!

msnmsg

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.. Removing at reboot

PRIVMSG #

%s.ftp://%s:%s@%s:%d (p='%S')

PASS %s

USER %s

%s.Blocked possible browser exploit pack call on URL '%s'

%s.Blocked possible browser exploit pack call on URL '%S'

1.0.0

http://www.nobrain.dk

msn.set

msn.int

w00t.edu

dns.photomarket.me

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v ="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S"

[d="%s" s="%d bytes"] Executed file "%S"

[Slowloris]: Starting flood on "%s" for %d minutes

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s" for %d seconds

[UDP]: Finished flood on "%s"

[SSYN]: Starting flood on "%s" for %d seconds

[SSYN]: Finished flood on "%s"

[USB]: Infected %s

[MSN]: Updated MSN spread link to "%s"

[MSN]: Updated MSN spread interval to "%s"

[Visit]: Visited "%s"

[d="%s" s="%d bytes"] Error update md5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type.. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Removing "%s" at reboot

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

ftplog

ftpinfect

httplogin

httptraff

http://api.wipmania.com/

\\.\pipe\%s_ipc

print '%s<br />';

%s<br />%s

.webroot.

.fortinet.

.virusbuster..nprotect.

.gdatasoftware.

.virus.

.precisesecurity.

.lavasoft.

check.tc

.emsisoft.

.onlinemalwarescanner.

onecare.live.

.bullguard.

.clamav.

.pandasecurity.

.sophos.

.malwarebytes.

.sunbeltsoftware.

.norton.

.norman.

.mcafee.

.symantec

.comodo.

.avast.

.avira.

.avg.

.bitdefender.

.eset.

.kaspersky.

.trendmicro.

.iseclab.

.virscan.

.garyshood.

.viruschief.

.jotti.

.threatexpert.

.novirusthanks.

.virustotal.

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s:%d

http://%s/%s

http://%s/

POST /23s

{%s|%s}%s

n{%s|%s}%s

%s|%s

%s|%s|%s

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

/c "start Í%

&&%windir%\explorer.exe

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

%s.exe

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s.disable

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%WinDir%\Explorer.EXE

%Documents and Settings%\%current user%\Application Data\Lnwiwt.exe

%WinDir%

Lnwiwt.exe

wlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

"%s" %S

Internet Explorer\iexplore.exe

lol.exe

explorer.exe

urlmon.dll

nspr4.dll

dnsapi.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

\Device\HarddiskVolume1\WINDOWS\explorer.exe

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps