MD5: b1482a893304d9cff0a8c846369a2299
SHA1: 7d780678bc02d175a05d9127e1162dfe2587bc35
SHA256: d3b9a45a973856b52f59827f452619660d31fe87cbe392bf202e33eb9c53fcdc
SSDeep: 49152:Xm5KDLL9rfQ2Ayo4WTr1onSvHa u9r7EqwIR51OKT6HBgwYEbSHr9Vt/0y3Cnpe6:OuL59oboSvHqhiG0bWJVtLynpVhY9oP
Size: 4448256 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC50, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, Armadillov171, UPolyXv05_v6
Company: Popeler.-.Installer
Created at: 2014-07-24 09:56:26
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

TSsafe.exe:164
%original file name%.exe:784

Mutexes

The following mutexes were created/opened:

ini_read_write
ShimCacheMutex

File activity

The process TSsafe.exe:164 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)

The process %original file name%.exe:784 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\TSsafe.exe (23407 bytes)

Registry activity

The process TSsafe.exe:164 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKU\.DEFAULT\Software\Super-EC\½ûÖ¹Öظ´ÔËÐÐ]
"tsloginsafe" = "35000378"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%System%\config\systemprofile\Application Data"

"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "www.2345.com/?k744606640"

[HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"HomePage" = "0"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "46 56 A6 4B 3D E6 13 8E 9B CA 1D 8E 55 65 5E C2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\InternetExplorer\Main]
"Start Page" = "www.2345.com/?k744606640"

[HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ParseAutoexec" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process %original file name%.exe:784 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9C 97 A7 B5 F2 38 95 E5 C2 7E 7C 94 05 EF BA 74"

[HKLM\SOFTWARE\Microsoft\InternetExplorer\Main]
"Start Page" = "www.2345.com/?k744606640I"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "www.2345.com/?k744606640"

[HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"HomePage" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: TSsafe??
Product Name: TSsafe??
Product Version: 1.0.0.0
Legal Copyright: TSsafe
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: TSsafe??
Comments: TSsafe??
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://aladdin.a.shifen.com/special/time/
hxxp://open.baidu.com/special/time/	123.125.114.102

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Unsupported/Fake Windows NT Version 5.0

Traffic

<font color="red">GET /special/time/ HTTP/1.0<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)<br>

Accept: */*<br>

Host: open.baidu.com<br>

Pragma: no-cache<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Date: Thu, 14 Aug 2014 23:44:42 GMT<br>

Server: Apache<br>

X-Powered-By: PHP/5.2.9<br>

Vary: User-Agent<br>

Connection: Close<br>

Content-Type: text/html<br><pre><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".."ht<br>tp://VVV.w3.org/TR/html4/loose.dtd">..<html>..    <head><br>;..        <meta http-equiv="Content-Type" content="text/html; char<br>set=gbk">..        <title>........_........</title>...&<br>lt;style type="text/css">..p,dl,dd,div,h1,h2,table,td,th,ul,ol,li,i<br>mg,form{margin:0;padding:0;}div,ul{zoom:1;}a:link{color:#261cdc;}img{b<br>order:none;}body{margin:6px 0 0 0;background-color:#fff;color:#000;fon<br>t-family:arial;}#head{margin-left:0px;width:670px;height:54px;}#head{p<br>adding-left:20px;font-size:12px}.fm{clear:both;position:relative;z-ind<br>ex:297}.nv a,.nv b,.btn,#page,#more{font-size:14px}.s_nav{height:45px}<br>.s_nav .s_logo{margin-right:20px;float:left}.s_nav .s_logo img{border:<br>0;display:block}.s_nav .s_tab{line-height:18px;padding:20px 0 0;float:<br>left}.s_nav a{color:#0000cc;font-size:14px}.s_nav b{font-size:14px}.s_<br>ipt_wr{width:533px;height:30px;display:inline-block;margin-right:5px;b<br>ackground:url(hXXp://s1.bdstatic.com/r/www/img/i-1.0.0.png) no-repeat <br>-304px 0;border:1px solid #b6b6b6;border-color:#7b7b7b #b6b6b6 #b6b6b6<br> #7b7b7b;vertical-align:top}.s_ipt{width:520px;height:22px;font:16px/2<br>2px arial;margin:5px 0 0 7px;padding:0;background:#fff;border:0;outlin<br>e:none;-webkit-appearance:none}.s_btn{width:95px;height:32px;padding-t<br>op:2px\9;font-size:14px;padding:0;background:#ddd url(hXXp://s1.bdstat<br>ic.com/r/www/img/i-1.0.0.png);border:0;cursor:pointer}.s_btn_h{backgro<br>und-position:-100px 0}.s_btn_wr{width:97px;height:34px;display:inl</pre><<< skipped >>></font><br><br

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

t$(SSh

~%UVW

u$SShe

kernel32.dll

advapi32.dll

ADVAPI32.DLL

KERNEL32.DLL

shell32.dll

ntdll.dll

winmm.dll

shlwapi.dll

RegOpenKeyA

RegEnumKeyA

RegCloseKey

RegOpenKeyExA

GetAsyncKeyState

GetProcessHeap

RegCreateKeyA

1970-1-1 00:00:01

001A2B3C4D5Ec:\kss.ini

SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\

ServiceName\\.\

\.pL.

Windows

0,8999($

.SCK_LINES/9

.jJ^\

.ERZDLL$

%fLH^A

n.ef"

g%s_%d

=.Xh"

.Hjsp"

ANSI_CHARSE.Dc

O7E(AL("%s

KeywnF

.cu%t

\-ú

.NDFR8P

 Ix.Lv?h]#

keysK<

A.DHq*-

8X%Fx

L.@%u

.QunW

.da]o

.PP` 

.pas8

6.Pob

oOV?.DD@

.ChS-v

#yfP.re

comctl32.dll

gdi32.dll

oleaut32.dll

user32.dll

version.dll

wsock32.dll

rsadll.dll

@\TSsafe.exe

t%SVh

ole32.dll

CrackCaptchaAPI.dll

MsgWaitForMultipleObjects

GetKeyState

MapVirtualKeyA

EnumWindows

tsloginsafe

c:\tssafe.ini

!regsvr32 C:\yunzhongjun.dll -s

ts.haq

!!"#$%&'(0

%U!il

_%.EhO^

{u%UWS

KÜn$

\.gh<

\.rvicy

\.\%s

.rBvi

iy..MzSL<oa

u0r$.bu

wn.%c

D.EUi

.lkmene

ZI%9UCo$

-mqM}i

%s*RB

w6N6.MMN

.MulF

V.RZk

4M$%s

RV5.qQ

4M%d]

%d,Ý

s^%s$%d

f~.su

[email protected]

v%u5bT

\%x%-

K.Wvt|

[%C!y

%s,%.

)/.yp

47R.uv

.At5B

4W key

J%D%C

.Hxc!2es

i,

P1udPfE

u.vwxMS%

x%

.DP4V=

@%D=HL

.Ae~D_$

QU.FAS

%uM441"h<

nj

U^.lo

=}'@"` /

].Nd8

.ac2T6'

C.SM0

ut8.dt

.za|c

\.gxo

5.zu 0X$

.sm^8

hc.QI

F7a%sW

6e.fgtC2

p(.vpd

.hl(p

.nn5P

NNN.qrstNNNNuvwxNNNNyz{|NNNN}~

1.2.3 Copyright

H.yW 7

cesrs when executednWin9

MSG.N

%d\_:

r`t%C

=%d<?

x=%f,Ty

?keyw

.%fW'

Y:z%u

%4uZ)

f.rZz

OeXE

HF=%U

.PxJ<

p?B%f

.JV~9

%FVMcc|&t

Zv%.S

^.Vk[

X6.Vf

.CN=~

(bP.ojZ

]zjH%c

O .KC

d.uE~

<]%DXF

-a}HU0uH

A%xFh

 h.IB

N-9}qF[

M t%D

Q%Ch>

.PrLp

U$:%CrV

"%x\Pu

A<Li.gr

8.Wv] HA

.NO$H\ P

%s5uh

7?.Un

yMask.SQueryDo

tod.bene

i:|%f`p

CMsg#

'Omci%XV

E!.nWSPu-

7.qPn

281 60-")

>j.PHG

{5894428C-A025-5FAF-402F-21DEF9E3A748} = s 'ts'

'ts.EXE'

val AppID = s {5894428C-A025-5FAF-402F-21DEF9E3A748}

ts.haq = s 'ts.haq'

CLSID = s '{20D12E19-8A53-F356-B3BE-8E9C6165C2FF}'

CurVer = s 'ts.haq'

ForceRemove {20D12E19-8A53-F356-B3BE-8E9C6165C2FF} = s 'ts.haq'

ProgID = s 'ts.haq'

stdole2.tlbWWW

%fNZxPR_uBVaLk_jSireHW

AzVMTAs_zxkeYdNWWW

YfSkqgs_nuRLfyWWd

^.aLbCbB40d

jNYqqs_nexeapp

nudPIAI_qNXISf_94d

XeCv_UDPgtWW

.VtirWQ_Cvrgk_nbCTDbW

^kshFi_keyOLFt

ROciw_TCPWmjo_14d

6.YHlt_rLAjNWW

sXnw_VZqHTyD_cRtiSQW

%xBRe39WWd

.bdHkY_ilBMfPy_EAQRMtNWWW

IEGkF_ObtC_kkcmdvWWW

.jzRQB_SjVOR_29WWd

.azUkMDUPPqcwLfzLW

kudPoPR_rivhU_ZvebErWd

ADVAPI32.dll

GDI32.dll

IMM32.dll

MFC42.DLL

MSVCP60.dll

MSVCRT.dll

OLEAUT32.dll

SHELL32.dll

USER32.dll

VERSION.dll

WINMM.dll

WS2_32.dll

x2H%U

-%d$<C,-

D.HJH

Bp.Tu

? %Uf

f-%SG

Anm%dQ

cL.CI

p%x]Ks

xPG)o%Sc

..asz

.EuD\

A[.Sh

f;Je%6U

s<m

ddN-%s/

8*c.Jd

6}A8ZX.Dq

~%Dr6

.hn.C<

.wV0WA.r(

!F|.eA

8M.kt

(OrZli:`%d

-nFqa}$

yËo

U.AJ~

z.PX;z

V%dim

{.kkK

%dzWx

[email protected]}|cli

N.nRT

T%D#8U'S=7O

.yHd]

%f#.)oc

AT.UQ

*]1%U

M}.mu

SH%D<]A

'6%Cq?

{]9Cz'FtP

WI.Nx

.MWNJ

s,%DV

xQ%SY

y-D4o}J

Gi,2.qQ

-ul

*.cl*

]V#%U

-> >&>->/

ePL%F

%uKX>

Q)aþ!

(9%SR&

.Xgb>[@

aMÿ

.Eo3}>

{.dT6

.yD=L

%s{g0 ?

#.wG7

4.qq 

Hr.Chg

.hE*xe

%XAyv

o%uC{

%xu^0

8g%x[d

=aÌo

%6x\6

.ef*`&-

B.Gr9

X:.Mc

]R8.Yz

.LYuV

.cUIv

':-/:'=&,

-:%!&)<-

C:\yunzhongjun.dll

C:\lj.ini

hXXp://open.baidu.com/special/time/

window.baidu_time(

\update.exe

MSXML2.XMLHTTP.6.0

MSXML2.XMLHTTP.5.0

MSXML2.XMLHTTP.4.0

MSXML2.XMLHTTP.3.0

MSXML2.XMLHTTP

Microsoft.XMLHTTP.1.0

Can't create XMLHTTP connection object

Mozilla/4.0 (compatible; MSiE 6.0; Windows NT 5.1;)

application/x-www-form-urlencoded

errmsg_s

x.yvr

x.yvkd

:|:czkey:|:

\1sprite_interface2_reward_ver2.0.NPK

\1sprite_common_activestatus.NPK

\1sprite_common_etc.NPK

\1sprite_interface2_minimap_dungeon.NPK

\1sprite_interface.NPK

\1sprite_map_act2_sepa.NPK

\1sprite_map_minimap.NPK

DNF.exe

ws2_32.dll

WinINet.dll

GLU32.DLL

aclui.dll

acsmib.dll

activeds.dll

AcXtrnal.dll

adimage.dll

adptif.dll

advpack.dll

atl.dll

authz.dll

avicap32.dll

avifil32.dll

browseui.dll

CABINET.DLL

clusapi.dll

comdlg32.dll

comsvcs.dll

crtdll.dll

crypt32.dll

cryptnet.dll

D3DRM.DLL

dbghelp.dll

ddraw.dll

DHCPCSVC.DLL

digest.dll

DINPUT.DLL

dplay.dll

dplayx.dll

dsound.dll

dsprop.dll

dsuiext.dll

ftsrch.dll

gpedit.dll

hhctrl.ocx

hlink.dll

iasperf.dll

icm32.dll

ICMP.DLL

icmui.dll

idq.dll

iedkcs32.dll

iissuba.dll

IMAGEHLP.DLL

imm32.dll

inetcpl.cpl

IPHLPAPI.DLL

iprop.dll

KSUSER.DLL

loadperf.dll

lz32.dll

mapi32.dll

mgmtapi.dll

MOBSYNC.DLL

mpg4dmod.dll

mpr.dll

mprapi.dll

mqrt.dll

msacm32.dll

msafd.dll

mscms.dll

mscpxl32.dLL

msgina.dll

MSHTML.DLL

MSI.DLL

msimg32.dll

msorcl32.dll

MSPATCHA.DLL

msrating.dll

mstlsapi.dll

msvbvm50.dll

msvfw32.dll

MSWSOCK.DLL

MTXDM.DLL

MTXOCI.DLL

NDDEAPI.DLL

ndisnpp.dll

netapi32.dll

npptools.dll

ntdsapi.dll

ntdsbcli.dll

ntmsapi.dll

nwprovau.dll

odbc32.dll

ODBCBCP.DLL

odbccp32.dll

ODBCTRAC.DLL

OLEACC.DLL

olecli32.dll

oledlg.dll

olesvr32.dll

opengl32.dll

password.cpl

pdh.dll

Powrprof.dll

psapi.dll

qosname.dll

query.dll

rasapi32.dll

raschap.dll

rasdlg.dll

rasman.dll

rassapi.dll

rastls.dll

resutils.dll

RICHED20.DLL

rpcns4.dll

rpcrt4.dll

RSRC32.dll

rtm.dll

rtutils.dll

scarddlg.dll

secur32.dll

SENSAPI.DLL

setupapi.dll

SFC.DLL

shdocvw.dll

snmpapi.dll

softpub.dll

spoolss.dll

SVRAPI.DLL

tapi32.dll

TLBINF32.dll

traffic.dll

url.dll

URLMON.DLL

userenv.dll

USP10.DLL

uxtheme.dll

VB5STKIT.DLL

vba6.dll

VDMDBG.DLL

winfax.dll

wininet.dll

winscard.dll

winspool.dll

winspool.drv

wintrust.dll

wldap32.dll

WOW32.DLL

wsnmp32.dll

wtsapi32.dll

xolehlp.dll

\TCLS\Client.exe

\TCLS\config\LoginQ.dat

LastLogin

NoLoginUserRecord

C:\gj.ini

C:\yzm.bmp

Function Getcpuid()

Set cpuSet = GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_Processor")

getcpuid=cpu.ProcessorId

Getcpuid

\\.\PhysicalDrive

ch.bmp

QQLogin.exe

Tencentdl.exe

TXPlatform.exe

TenSafe.exe

TenSafe_1.exe

TenSafe_2.exe

\rzxx.ini

2.bmp

BOSS.bmp

%WinDir%\ggg.ini

1.bmp

@.reloc

f9z.vk

KERNEL32.dll

ts.dll

hXXp://116.255.195.191/tsjqm.htm

hXXp://116.255.195.191/tsverb.htm

hXXp://blog.sina.com.cn/s/blog_ec98d81a0101ud6i.html

dnf.exe

c:\windows\ggg.ini

0000000

Super-EChXXp://VVV.super-ec.cnhXXp://VVV.eyybc.com/forum-17-1.html/forum-12-1.html/memcp.php/ip.asp/time.asp/gonggao.txt/ec-user6.php/ec-bd.php/ec-jh.php

hXXp://VVV.super-ec.cn

<input type="text" name="field_2new" size="25" value="" disabled class="txt" />" class="txt" />Function Getcpuid()

User-Agent: Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.0; MyIE2; .NET CLR 1.1.4322)

InternetOpenUrlA

HttpQueryInfoA

eyybc.com

super-ec.cn

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Content-Type: application/x-www-form-urlencoded

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

http=

HTTP/1.1

HttpOpenRequestA

HttpSendRequestA

hXXp://

HttpAddRequestHeadersA

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies

\*.txt

scripting.FileSystemObject

%Documents and Settings%\IBM\Cookies\*.txt

Content.IE5\

program internal error number is %d.

:"%s"

:"%s".

;';0;<;\;|;

454>4-5;5

Software\Policies\Microsoft\Internet Explorer\control Panel\HomePage.tmp

google chrome

Google Chrome

VVV.2345.com/?k744606640

VVV.2345.com/?keyybc

VVV.duba.com/?un_4_447411

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\InternetExplorer\MainHKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

Kernel32.dll

cmd.exe /c del

0123456789

0123456789* 

)!@#$%^&*(

gdiplus.dll

{557CF400-1A04-11D3-9A73-0000F81EF32E}

{557CF401-1A04-11D3-9A73-0000F81EF32E}

{557CF402-1A04-11D3-9A73-0000F81EF32E}

{557CF405-1A04-11D3-9A73-0000F81EF32E}

{557CF406-1A04-11D3-9A73-0000F81EF32E}

BUG! hXXp://VVV.super-ec.cn/

F%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

__MSVCRT_HEAP_SELECT

RASAPI32.dll

iphlpapi.dll

SHLWAPI.dll

MPR.dll

WinExec

GetWindowsDirectoryA

GetViewportOrgEx

WINSPOOL.DRV

RegDeleteKeyA

RegCreateKeyExA

ShellExecuteA

COMCTL32.dll

WSOCK32.dll

InternetCrackUrlA

InternetCanonicalizeUrlA

WININET.dll

GetCPInfo

CreateDialogIndirectParamA

UnhookWindowsHookEx

SetWindowsHookExA

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

(%d-%d):

%ld%c

HTTP/1.0

%s <%s>

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

1.1.3

;3 #>6.&

'2, / 0&7!4-)1#

%s,%d

%s.lnk

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

zcÁ

#include "l.chs\afxres.rc" // Standard components

.AWINLOGON.EXE

c:\%original file name%.exe

1.0.0.0

(hXXp://VVV.eyuyan.com)

(*.*)

%original file name%.exe_784_rwx_00EB0000_00072000:

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

USER32.DLL

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

u%CNu

%s_%d

EInvalidGraphicOperation

comctl32.dll

uxtheme.dll

MAPI32.DLL

!"#$%xi

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

OnKeyDown

OnKeyPressl

OnKeyUp

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

AutoHotkeys

TMainMenuDp

TKeyEvent

TKeyPressEvent

HelpKeyword,

crSQLWait

%s (%s)

imm32.dll

readnowid.mtx

D:\ksreg_delphi\V9\_rsa_delphi_dll\UnitSock.pas

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

3333333

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

KWindows

UrlMon

GetCPInfo

RegOpenKeyExA

RegCloseKey

SetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

EnumWindows

EnumThreadWindows

ActivateKeyboardLayout

GetKeyboardType

38000=344

.idata

.edata

P.reloc

P.rsrc

#yfP.re

KERNEL32.DLL

advapi32.dll

gdi32.dll

user32.dll

version.dll

wsock32.dll

rsadll.dll

No help keyword specified.

No help found for %s#No context-sensitive help installed$No topic-based help system installed

Alt  Clipboard does not support Icons/Menu '%s' is already being used by another form

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Unsupported clipboard format

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Invalid stream format$''%s'' is not a valid component name

Invalid property value List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Interface not supported

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value

I/O error %d

Integer overflow Invalid floating point operation

TSsafe.exe_164:

.text

`.rdata

@.data

.rsrc

t%SVh

t$(SSh

~%UVW

u$SShe

kernel32.dll

advapi32.dll

ntdll.dll

ole32.dll

KERNEL32.DLL

user32.dll

CrackCaptchaAPI.dll

winmm.dll

shlwapi.dll

GetAsyncKeyState

MsgWaitForMultipleObjects

GetProcessHeap

GetKeyState

MapVirtualKeyA

EnumWindows

RegOpenKeyA

RegEnumKeyA

RegCloseKey

RegOpenKeyExA

RegCreateKeyA

tsloginsafe

c:\tssafe.ini

!regsvr32 C:\yunzhongjun.dll -s

ts.haq

!!"#$%&'(0

%U!il

_%.EhO^

{u%UWS

KÜn$

\.gh<

\.rvicy

\.\%s

.rBvi

iy..MzSL<oa

u0r$.bu

wn.%c

D.EUi

.lkmene

ZI%9UCo$

-mqM}i

%s*RB

w6N6.MMN

.MulF

V.RZk

4M$%s

RV5.qQ

4M%d]

%d,Ý

s^%s$%d

f~.su

[email protected]

v%u5bT

\%x%-

K.Wvt|

[%C!y

%s,%.

)/.yp

47R.uv

.At5B

4W key

J%D%C

.Hxc!2es

i,

P1udPfE

u.vwxMS%

x%

.DP4V=

@%D=HL

.Ae~D_$

QU.FAS

%uM441"h<

nj

U^.lo

=}'@"` /

].Nd8

.ac2T6'

C.SM0

ut8.dt

.za|c

\.gxo

5.zu 0X$

.sm^8

hc.QI

F7a%sW

6e.fgtC2

p(.vpd

.hl(p

.nn5P

NNN.qrstNNNNuvwxNNNNyz{|NNNN}~

1.2.3 Copyright

H.yW 7

cesrs when executednWin9

MSG.N

%d\_:

r`t%C

=%d<?

x=%f,Ty

?keyw

.%fW'

Y:z%u

%4uZ)

f.rZz

OeXE

HF=%U

.PxJ<

p?B%f

.JV~9

%FVMcc|&t

Zv%.S

^.Vk[

X6.Vf

.CN=~

(bP.ojZ

]zjH%c

O .KC

d.uE~

<]%DXF

-a}HU0uH

A%xFh

 h.IB

N-9}qF[

M t%D

Q%Ch>

.PrLp

U$:%CrV

"%x\Pu

A<Li.gr

8.Wv] HA

.NO$H\ P

%s5uh

7?.Un

yMask.SQueryDo

tod.bene

i:|%f`p

CMsg#

'Omci%XV

E!.nWSPu-

7.qPn

281 60-")

>j.PHG

{5894428C-A025-5FAF-402F-21DEF9E3A748} = s 'ts'

'ts.EXE'

val AppID = s {5894428C-A025-5FAF-402F-21DEF9E3A748}

ts.haq = s 'ts.haq'

CLSID = s '{20D12E19-8A53-F356-B3BE-8E9C6165C2FF}'

CurVer = s 'ts.haq'

ForceRemove {20D12E19-8A53-F356-B3BE-8E9C6165C2FF} = s 'ts.haq'

ProgID = s 'ts.haq'

stdole2.tlbWWW

%fNZxPR_uBVaLk_jSireHW

AzVMTAs_zxkeYdNWWW

YfSkqgs_nuRLfyWWd

^.aLbCbB40d

jNYqqs_nexeapp

nudPIAI_qNXISf_94d

XeCv_UDPgtWW

.VtirWQ_Cvrgk_nbCTDbW

^kshFi_keyOLFt

ROciw_TCPWmjo_14d

6.YHlt_rLAjNWW

sXnw_VZqHTyD_cRtiSQW

%xBRe39WWd

.bdHkY_ilBMfPy_EAQRMtNWWW

IEGkF_ObtC_kkcmdvWWW

.jzRQB_SjVOR_29WWd

.azUkMDUPPqcwLfzLW

kudPoPR_rivhU_ZvebErWd

ADVAPI32.dll

GDI32.dll

IMM32.dll

MFC42.DLL

MSVCP60.dll

MSVCRT.dll

OLEAUT32.dll

SHELL32.dll

USER32.dll

VERSION.dll

WINMM.dll

WS2_32.dll

x2H%U

-%d$<C,-

D.HJH

Bp.Tu

? %Uf

f-%SG

Anm%dQ

cL.CI

p%x]Ks

xPG)o%Sc

..asz

.EuD\

A[.Sh

f;Je%6U

s<m

ddN-%s/

8*c.Jd

6}A8ZX.Dq

~%Dr6

.hn.C<

.wV0WA.r(

!F|.eA

8M.kt

(OrZli:`%d

-nFqa}$

yËo

U.AJ~

z.PX;z

V%dim

{.kkK

%dzWx

[email protected]}|cli

N.nRT

T%D#8U'S=7O

.yHd]

%f#.)oc

AT.UQ

*]1%U

M}.mu

SH%D<]A

'6%Cq?

{]9Cz'FtP

WI.Nx

.MWNJ

s,%DV

xQ%SY

y-D4o}J

Gi,2.qQ

-ul

*.cl*

]V#%U

-> >&>->/

ePL%F

%uKX>

Q)aþ!

(9%SR&

.Xgb>[@

aMÿ

.Eo3}>

{.dT6

.yD=L

%s{g0 ?

#.wG7

4.qq 

Hr.Chg

.hE*xe

%XAyv

o%uC{

%xu^0

8g%x[d

=aÌo

%6x\6

.ef*`&-

B.Gr9

X:.Mc

]R8.Yz

.LYuV

.cUIv

':-/:'=&,

-:%!&)<-

C:\yunzhongjun.dll

C:\lj.ini

hXXp://open.baidu.com/special/time/

window.baidu_time(

1970-1-1 00:00:01

\update.exe

MSXML2.XMLHTTP.6.0

MSXML2.XMLHTTP.5.0

MSXML2.XMLHTTP.4.0

MSXML2.XMLHTTP.3.0

MSXML2.XMLHTTP

Microsoft.XMLHTTP.1.0

Can't create XMLHTTP connection object

Mozilla/4.0 (compatible; MSiE 6.0; Windows NT 5.1;)

application/x-www-form-urlencoded

errmsg_s

x.yvr

x.yvkd

:|:czkey:|:

\1sprite_interface2_reward_ver2.0.NPK

\1sprite_common_activestatus.NPK

\1sprite_common_etc.NPK

\1sprite_interface2_minimap_dungeon.NPK

\1sprite_interface.NPK

\1sprite_map_act2_sepa.NPK

\1sprite_map_minimap.NPK

DNF.exe

ws2_32.dll

WinINet.dll

gdi32.dll

GLU32.DLL

aclui.dll

acsmib.dll

activeds.dll

AcXtrnal.dll

adimage.dll

adptif.dll

ADVAPI32.DLL

advpack.dll

atl.dll

authz.dll

avicap32.dll

avifil32.dll

browseui.dll

CABINET.DLL

clusapi.dll

comctl32.dll

comdlg32.dll

comsvcs.dll

crtdll.dll

crypt32.dll

cryptnet.dll

D3DRM.DLL

dbghelp.dll

ddraw.dll

DHCPCSVC.DLL

digest.dll

DINPUT.DLL

dplay.dll

dplayx.dll

dsound.dll

dsprop.dll

dsuiext.dll

ftsrch.dll

gpedit.dll

hhctrl.ocx

hlink.dll

iasperf.dll

icm32.dll

ICMP.DLL

icmui.dll

idq.dll

iedkcs32.dll

iissuba.dll

IMAGEHLP.DLL

imm32.dll

inetcpl.cpl

IPHLPAPI.DLL

iprop.dll

KSUSER.DLL

loadperf.dll

lz32.dll

mapi32.dll

mgmtapi.dll

MOBSYNC.DLL

mpg4dmod.dll

mpr.dll

mprapi.dll

mqrt.dll

msacm32.dll

msafd.dll

mscms.dll

mscpxl32.dLL

msgina.dll

MSHTML.DLL

MSI.DLL

msimg32.dll

msorcl32.dll

MSPATCHA.DLL

msrating.dll

mstlsapi.dll

msvbvm50.dll

msvfw32.dll

MSWSOCK.DLL

MTXDM.DLL

MTXOCI.DLL

NDDEAPI.DLL

ndisnpp.dll

netapi32.dll

npptools.dll

ntdsapi.dll

ntdsbcli.dll

ntmsapi.dll

nwprovau.dll

odbc32.dll

ODBCBCP.DLL

odbccp32.dll

ODBCTRAC.DLL

OLEACC.DLL

oleaut32.dll

olecli32.dll

oledlg.dll

olesvr32.dll

opengl32.dll

password.cpl

pdh.dll

Powrprof.dll

psapi.dll

qosname.dll

query.dll

rasapi32.dll

raschap.dll

rasdlg.dll

rasman.dll

rassapi.dll

rastls.dll

resutils.dll

RICHED20.DLL

rpcns4.dll

rpcrt4.dll

RSRC32.dll

rtm.dll

rtutils.dll

scarddlg.dll

secur32.dll

SENSAPI.DLL

setupapi.dll

SFC.DLL

shdocvw.dll

shell32.dll

snmpapi.dll

softpub.dll

spoolss.dll

SVRAPI.DLL

tapi32.dll

TLBINF32.dll

traffic.dll

url.dll

URLMON.DLL

userenv.dll

USP10.DLL

uxtheme.dll

VB5STKIT.DLL

vba6.dll

VDMDBG.DLL

version.dll

winfax.dll

wininet.dll

winscard.dll

winspool.dll

winspool.drv

wintrust.dll

wldap32.dll

WOW32.DLL

wsnmp32.dll

wtsapi32.dll

xolehlp.dll

\TCLS\Client.exe

\TCLS\config\LoginQ.dat

LastLogin

NoLoginUserRecord

C:\gj.ini

C:\yzm.bmp

Function Getcpuid()

Set cpuSet = GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_Processor")

getcpuid=cpu.ProcessorId

Getcpuid

\\.\PhysicalDrive

ch.bmp

QQLogin.exe

Tencentdl.exe

TXPlatform.exe

TenSafe.exe

TenSafe_1.exe

TenSafe_2.exe

\rzxx.ini

2.bmp

BOSS.bmp

%WinDir%\ggg.ini

1.bmp

@.reloc

f9z.vk

KERNEL32.dll

ts.dll

hXXp://116.255.195.191/tsjqm.htm

hXXp://116.255.195.191/tsverb.htm

hXXp://blog.sina.com.cn/s/blog_ec98d81a0101ud6i.html

dnf.exe

c:\windows\ggg.ini

0000000

Super-EChXXp://VVV.super-ec.cnhXXp://VVV.eyybc.com/forum-17-1.html/forum-12-1.html/memcp.php/ip.asp/time.asp/gonggao.txt/ec-user6.php/ec-bd.php/ec-jh.php

hXXp://VVV.super-ec.cn

<input type="text" name="field_2new" size="25" value="" disabled class="txt" />" class="txt" />Function Getcpuid()

User-Agent: Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.0; MyIE2; .NET CLR 1.1.4322)

InternetOpenUrlA

HttpQueryInfoA

eyybc.com

super-ec.cn

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Content-Type: application/x-www-form-urlencoded

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

http=

HTTP/1.1

HttpOpenRequestA

HttpSendRequestA

hXXp://

HttpAddRequestHeadersA

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies

\*.txt

scripting.FileSystemObject

%Documents and Settings%\IBM\Cookies\*.txt

Content.IE5\

program internal error number is %d.

:"%s"

:"%s".

;';0;<;\;|;

454>4-5;5

001A2B3C4D5Ec:\kss.ini

SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\

ServiceName\\.\

\.pL.

Windows

0,8999($

.SCK_LINES/9

.jJ^\

.ERZDLL$

%fLH^A

n.ef"

g%s_%d

=.Xh"

.Hjsp"

ANSI_CHARSE.Dc

O7E(AL("%s

KeywnF

.cu%t

\-ú

.NDFR8P

 Ix.Lv?h]#

keysK<

A.DHq*-

8X%Fx

L.@%u

.QunW

.da]o

.PP` 

.pas8

6.Pob

oOV?.DD@

.ChS-v

#yfP.re

wsock32.dll

rsadll.dll

Software\Policies\Microsoft\Internet Explorer\control Panel\HomePage.tmp

google chrome

Google Chrome

VVV.2345.com/?k744606640

VVV.2345.com/?keyybc

VVV.duba.com/?un_4_447411

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\InternetExplorer\MainHKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

Kernel32.dll

cmd.exe /c del

0123456789

0123456789* 

)!@#$%^&*(

gdiplus.dll

{557CF400-1A04-11D3-9A73-0000F81EF32E}

{557CF401-1A04-11D3-9A73-0000F81EF32E}

{557CF402-1A04-11D3-9A73-0000F81EF32E}

{557CF405-1A04-11D3-9A73-0000F81EF32E}

{557CF406-1A04-11D3-9A73-0000F81EF32E}

BUG! hXXp://VVV.super-ec.cn/

F%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

__MSVCRT_HEAP_SELECT

RASAPI32.dll

iphlpapi.dll

SHLWAPI.dll

MPR.dll

WinExec

GetWindowsDirectoryA

GetViewportOrgEx

WINSPOOL.DRV

RegDeleteKeyA

RegCreateKeyExA

ShellExecuteA

COMCTL32.dll

WSOCK32.dll

InternetCrackUrlA

InternetCanonicalizeUrlA

WININET.dll

GetCPInfo

CreateDialogIndirectParamA

UnhookWindowsHookEx

SetWindowsHookExA

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

(%d-%d):

%ld%c

HTTP/1.0

%s <%s>

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

1.1.3

;3 #>6.&

'2, / 0&7!4-)1#

%s,%d

%s.lnk

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

zcÁ

408059882016

c:\TSsafe.exe

#include "l.chs\afxres.rc" // Standard components

1.0.0.0

(hXXp://VVV.eyuyan.com)

(*.*)

TSsafe.exe_164_rwx_01110000_00072000:

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

USER32.DLL

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

u%CNu

%s_%d

EInvalidGraphicOperation

comctl32.dll

uxtheme.dll

MAPI32.DLL

!"#$%xi

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

OnKeyDown

OnKeyPressl

OnKeyUp

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

AutoHotkeys

TMainMenuDp

TKeyEvent

TKeyPressEvent

HelpKeyword,

crSQLWait

%s (%s)

imm32.dll

readnowid.mtx

D:\ksreg_delphi\V9\_rsa_delphi_dll\UnitSock.pas

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

3333333

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

KWindows

UrlMon

GetCPInfo

RegOpenKeyExA

RegCloseKey

SetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

EnumWindows

EnumThreadWindows

ActivateKeyboardLayout

GetKeyboardType

38000=344

.idata

.edata

P.reloc

P.rsrc

#yfP.re

KERNEL32.DLL

advapi32.dll

gdi32.dll

user32.dll

version.dll

wsock32.dll

rsadll.dll

No help keyword specified.

No help found for %s#No context-sensitive help installed$No topic-based help system installed

Alt  Clipboard does not support Icons/Menu '%s' is already being used by another form

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Unsupported clipboard format

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Invalid stream format$''%s'' is not a valid component name

Invalid property value List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Interface not supported

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value

I/O error %d

Integer overflow Invalid floating point operation

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
   C:\TSsafe.exe (23407 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.