MD5: f675eddb95e0e1eb43e6ba8654865c13
SHA1: 07fe25cd898375d3de89f14422ab94935b101022
SHA256: e7ed9943c2b602babd8250b8a7250a54b895b9bbf460afd668cc2b1c7cfa35ec
SSDeep: 12288:OK2mhAMJ/cPlYjPVtjeTc6X7vIGCvC8hA7DlXExd85Os2GueeZo:f2O/GlYjrjb6XTtP8y7hX0baueD
Size: 619239 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2012-06-09 16:19:49
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Generic creates the following process(es):

lssas.exe:432
lssas.exe:396
%original file name%.exe:652

The Generic injects its code into the following process(es):

Explorer.EXE:532

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process lssas.exe:432 makes changes in the file system.
The Generic deletes the following file(s):

%Program Files%\Common Files\win0\000cbffa.txt (0 bytes)

The process lssas.exe:396 makes changes in the file system.
The Generic creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (1473 bytes)
%Documents and Settings%\%current user%\W71E93.TY4 (673 bytes)

The Generic deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (0 bytes)
%Documents and Settings%\%current user%\W71E93.TY4 (0 bytes)

The process %original file name%.exe:652 makes changes in the file system.
The Generic creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\B76B\lssas.exe (11745 bytes)

The Generic deletes the following file(s):

%Documents and Settings%\%current user%\B76B\__tmp_rar_sfx_access_check_831828 (0 bytes)

Registry activity

The process lssas.exe:432 makes changes in the system registry.
The Generic creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "99 CE ED 24 7F D7 2C 16 73 01 52 21 A3 04 60 33"

[HKCU\Software\Classes\CLSID\{7EB1EE07-4731-E144-B670-83942C90D1CE}\184E042E\CG1]
"BID" = "20 00 08 00 15 00 05 00 DF 07 00 00 14 00 88 FF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"

[HKCU\Software\Win7zip]
"uuid" = "7E B1 EE 07 47 31 E1 44 B6 70 83 94 2C 90 D1 CE"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Classes\CLSID\{7EB1EE07-4731-E144-B670-83942C90D1CE}\184E042E\CG1]
"HAL" = "05 EE 00 00"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rqmynangs.exe]
"DisableExceptionChainValidation" = ""

The process lssas.exe:396 makes changes in the system registry.
The Generic creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E 8C E1 3F CD 54 7A DC 87 6C 07 18 05 D8 F0 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process %original file name%.exe:652 makes changes in the system registry.
The Generic creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7D 02 E1 CE 73 95 62 9A FA A1 CD CC 4F 5C 2E 63"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\B76B]
"lssas.exe" = "lssas"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Generic modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Generic modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Generic modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Generic installs the following user-mode hooks in DNSAPI.dll:

DnsQuery_W

The Generic installs the following user-mode hooks in WS2_32.dll:

gethostbyname
getaddrinfo
GetAddrInfoW

The Generic installs the following user-mode hooks in ntdll.dll:

KiFastSystemCall

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://javatube.net/videos/player.php	173.254.28.70
update.microsoft.com	134.170.58.221

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

The Generic connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

@.reloc

PSSSSSSh

SSSSh

u@SSShHC(

RPVSSh

PSSh(

PSSh#

9p.uS

Opera/9.00 (Windows NT 5.1; U; en)

Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Mozilla/4.0 (compatible; MSIE 6.01; Windows NT 6.0)

Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2)

Opera 9.4 (Windows NT 6.1; U; en)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; NeosBrowser; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; WOW64; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506; Media Center PC 5.0; .NET CLR 1.1.4322; Windows-Media-Player/10.00.00.3990; InfoPath.2

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.13) Gecko/20060410 Firefox/1.0.8

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)

Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 5.2; WOW64; .NET CLR 2.0.50726)

SbieDll.dll

Software\Classes\CLSID\%s\X

Software\Classes\CLSID\%s\X\%s

0xX

SB:0xX

G:%s_0xX_%c:%s_v1$

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u

IEXPLORE.EXE

IE.HTTP

SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

IE.HTTPS

SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice

IE.AssocFile.HTM

HTTP\shell\open\command

Software\Microsoft\Windows\CurrentVersion\Ext\Settings\%s

Psapi.dll

%s\%s

Software\Adobe\Acrobat Reader\%s\Privileged

mscoree.dll

HARDWARE\DESCRIPTION\System\CentralProcessor\%u

SOFTWARE\Microsoft\Windows NT\CurrentVersion

.vcproj

Software\%s

nspr4.dll

nss3.dll

Urlmon.dll

URLDownloadToFileW

Netapi32.dll

76487-640-1457236-23837

76487-337-8429955-22614

76487-644-3177037-23510

76497-640-6308873-23835

55274-640-2673064-23950

76487-640-8834005-23195

76487-640-0716662-23535

76487-644-8648466-23106

00426-293-8170032-85146

76487-341-5883812-22420

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer

SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsBackup

{8E5E2654-AD2D-48BF-AC2D-D17F00898D06}

snxhk.dll

comctl32.dll

ZwSetValueKey

ZwDeleteValueKey

SOFTWARE\%s

update.microsoft.com

microsoft.com

windowsupdate.microsoft.com

JOIN

PRIVMSG

.rdata

cmd_option.%s

msvcrt.dll

Port

--x-x-x-xx

Content-Type: multipart/form-data; boundary=x-x-x-xx

Content-Disposition: multipart/form-data; name="newfile"; filename="%d.jpeg"

%s?action=up&g=%s

<Port>

<Pass>

<Password>

Software\FTPWare\CoreFTP\Sites

PortNumber

Password

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

%s\FTP Commander

%s\FTP Commander Deluxe

Port=

Password=

Content-Type: application/x-www-form-urlencoded

HTTP/1.1

ps0=%s&ps1=%s

&slc=%d

%d|%s|%s|%s

&sl_%d=

.info

httpget

GET /%s HTTP/1.1

Host: %s

Content-Length: %d

Accept: %s

Accept-Language: %s

Accept-Charset: %s

Accept-Encoding: %s

User-Agent: %s

Referer: %s

Connection: %s

hXXp://

iexplore.exe

firefox.exe

%s:%hu

windowsupdate

SSH2_MSG_KEXINIT

SSH2_MSG_DISCONNECT

SSH2_MSG_USERAUTH_SUCCESS

hXXp://%s%s/image.php?id=%s

TaskDialogIndirect

hXXp://answers.microsoft.com/en-us/windows/forum/windows_vista-windows_programs/corrupted-documents-folder/e2a7660f-8eea-4f27-b2e6-e77a0f0c1535

ÐxX

vBetaLib.exe

ntdll.dll

kernel32.dll

secur32.dll

crypt32.dll

user32.dll

advapi32.dll

wininet.dll

shell32.dll

shlwapi.dll

ole32.dll

version.dll

sfc.dll

dnsapi.dll

ws2_32.dll

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>

3!4-4\4}4

2$2 22292

>*>1>=>}>

? ?4?\?~?

4 4)434<4

51696?6\6

s%j.Zf

8crtsu

:crts

crts

GetProcessWindowStation

operator

This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.

uxtheme.dll

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N{name}, \U, or \u

support for \P, \p, and \X has not been compiled

this version of PCRE is not compiled with PCRE_UCP support

ICMP.DLL

RegDeleteKeyExW

Error text not found (please report)

WSOCK32.dll

VERSION.dll

WINMM.dll

COMCTL32.dll

MPR.dll

InternetCrackUrlW

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

FtpOpenFileW

FtpGetFileSize

InternetOpenUrlW

WININET.dll

PSAPI.DLL

USERENV.dll

GetProcessHeap

CreatePipe

GetWindowsDirectoryW

KERNEL32.dll

OpenWindowStationW

SetProcessWindowStation

CloseWindowStation

MapVirtualKeyW

EnumChildWindows

EnumWindows

VkKeyScanW

GetKeyState

GetKeyboardState

SetKeyboardState

GetAsyncKeyState

keybd_event

EnumThreadWindows

ExitWindowsEx

UnregisterHotKey

RegisterHotKey

GetKeyboardLayoutNameW

USER32.dll

SetViewportOrgEx

GDI32.dll

COMDLG32.dll

RegOpenKeyExW

RegCloseKey

RegCreateKeyExW

RegEnumKeyExW

RegDeleteKeyW

ADVAPI32.dll

ShellExecuteW

SHFileOperationW

ShellExecuteExW

SHELL32.dll

OLEAUT32.dll

GetCPInfo

zcÁ

#%.c#%.'#%.

0187028

23:-23:724:

239:139[139

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" language="*" processorArchitecture="*" publicKeyToken="6595b64144ccf1df"></assemblyIdentity>

%cKfI

.Sdt{

s.Ai<SA

.nP_Kl

%uEqOZw

%uQ$@"

,W.cG@H

r%d*\uVZ.f

C.zc/

%sXc{

lv%FpT

^a'%sP.3nVc

-b.st

%-ix}h

URlM

b%DOtGtYr

a{%D%

B,.Sb

ml.Bf

z%CIC

G]9%C

.CN-e

y.tn;

$>f.OK

De%sQ

Software\Classes\CLSID\%S

G:%S_0xX

chrome.exe

opera.exe

safari.exe

maxthon.exe

:Mozilla\Firefox\Profiles

cookies.sqlite

%s\winsxs\x86_microsoft.windows.common-controls_*6.0.*_*

%s\winsxs\%s\comctl32.dll

cmd.exe

SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\%s

%s:*:Enabled

avcuf32.dll

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

prstrui.exe

Windows Defender

MpClient.dll

Windows Defender\MSASCui.exe

MpSvc.dll

msseces.exe

MsMpEng.exe

MSASCui.exe

MpAsDesc.dll

MsMpLics.dll

avgui.exe

avgidsagent.exe

avgwdsvc.exe

avgdiagex.exe

avgmfapx.exe

avgupd.exe

avgcfgex.exe

avgnt.exe

avguard.exe

avshadow.exe

avcenter.exe

update.dll

updaterc.dll

usrreq.exe

updater_pdk.esm

filecategorizer.dll

starter_avp.exe

ccsvchst.exe

symerr.exe

NIS.exe

navw32.exe

avastui.exe

avastsvc.exe

AvastEmUpdate.exe

WRSA.exe

zatray.exe

ForceField.exe

updating.dll

fshoster32.exe

fsaua.dll

PSUNMain.exe

PSUAService.exe

PSANHost.exe

PSUNScan.dll

epavjobs.exe

AVENGINE.exe

Upgrader.exe

adaware.exe

BullGuard.exe.manifest

BullGuardUpdate.exe

BullGuard.exe

BullGuardScanner.exe

BullGuardBhvScanner.exe

BullGuardUpdate2.exe

BgScan.exe

BgScanEngine.dll

.manifest

updater.exe

Backup\RSD\RSSetup\updater.exe

RsTray.exe

RavMonD.exe

RsMgrSvc.exe

rsmain.exe

RsScan.dll

RsTray.dll

mbamgui.exe

mbam.exe

pctsGui.exe

pctsAuxs.exe

pctsSvc.exe

Update.exe

UpdateHlpr.dll

Definitions\vcore.dll

sbamui.exe

SBAMTray.exe

updater_client_mod.dll

FProtTray.exe

FPWin.exe

scf.dat

ALUpdate.exe

update_tmp.exe

arcaclean.exe

rcfp.exe

CLPSLA.exe

op_mon.exe

niu.exe

K7TSUpdT.exe

sguardxup.exe

ccupdate.exe

caupdate.dll

a2guard.exe

a2start.exe

a2service.exe

AVKTray.exe

GDSC.exe

AVK.exe

GDFirewallTray.exe

Bka.exe

BLuPro.exe

BkavSystemServer.exe

BkavService.exe

LiveUpdate.dll

LiveConnect.dll

BaseFile\Bkav\LiveUpdate.dll

V3Lite.exe

ASDSvc.exe

autoup.exe

downloader.exe

seccenter.exe

updatesrv.exe

odscanui.exe

bdapupck.dll

updatemgr.dll

egui.exe

ekrn.exe

%s.config

x86\ekrn.exe

uWinMgr.exe

coreServiceShell.exe

uiSeAgnt.exe

uiWatchDog.exe

plugins\plugUpdater.dll

UiFrmwrk\uiUpdateTray.exe

coreFrameworkHost.exe

mcagent.exe

McSvHost.exe

McUICnt.exe

McPvTray.exe

mcui_exe

mcpltui_exe

mcshell.exe

mcupdmgr.exe

mcupdate.exe

mcshield.exe

.config

Image File Execution Options\%s

SYSTEM\CurrentControlSet\services\%s

%c:\ntusbdriver.sys

%c:\*p.exe

%c:\%s

p.exe

%WinDir%\explorer.exe

/C start /d. %s&"%s"

%COMSPEC%

%WinDir%\system32\shell32.dll

%c:\%s.lnk

AvastUI.exe

VisthAux.exe

explorer.exe

t.minecraft

Works! PID: %d, Name: %s

cmdvirth

%s%s\X

tcp://

svchost.exe

csrss.exe

lsass.exe

smss.exe

wscript.exe

cscript.exe

vbc.exe

rundll32.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

winlogon.exe

services.exe

%s\x.lnk

_.exe

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%s

desktop.ini

SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

wintrust.dll

Software\Microsoft\Windows\CurrentVersion\RunOnce

chrome.dll

Applications\iexplore.exe\shell\open\command

%s_xx

x.zip

Navw32.exe

SysInspector.exe

avscan.exe

mfefire.exe

wuauclt.exe

WerFault.exe

FileZilla\sitemanager.xml

SmartFTP\Client 2.0\Favorites

SmartFTP

port

Sites.dat

Quick.dat

%s\3\%s

%s\4\%s

eFtplist.txt

spoolsv.exe

steam.exe

skype.exe

origin.exe

dwm.exe

tapi3.dll

x.txt

/C copy "%s" "%s"

SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run

Windows Update Service

"%s" /%s

/CREATE /SC ONLOGON /TN "Windows Update Check - 0xX" /TR "%s" /RL HIGHEST

schtasks.exe

/DELETE /TN "Windows Update Check - 0xX" /F

\Windows\Explorer.exe

Low_X

%s.manifest

PendingFileRenameOperations

%s\X

Windows\CurrentVersion\Run

CurrentVersion\Windows

Windows NT\CurrentVersion\Image File Execution Options\%s

Windows has encountered a corrupted folder on your hard drive

Multiple corrupted files have been found in the folder 'My Documents'. To prevent serious loss of data, please allow Windows to restore these files.

Corrupted folder: %s

Corrupted file count: %d

<a href=".ms">%s</a>

/c start "" "%s" /%s "%s"

shell32,ShellExec_RunDLL "%s" /%s "%s"

You denied the proper privileges to the Windows file restoration utility. Please select YES on the following UAC prompt to allow Windows to restore the corrupted files.

Windows NT Update Service

%s:Zone.Identifier

%s\X.pif

nKERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

>>>AUTOIT NO CMDEXECUTE<<<

CMDLINERAW

CMDLINE

/AutoIt3ExecuteLine

/AutoIt3ExecuteScript

%s (%d) : ==> %s.:

Line %d:

Line %d (File "%s"):

%s (%d) : ==> %s:

AutoIt script files (*.au3, *.a3x)

*.au3;*.a3x

All files (*.*)

#NoAutoIt3Execute

APPSKEY

04090000

%u.%u.%u.%u

0.0.0.0

Mddddd

%s (%d) : ==> %s:

UDPSTARTUP

UDPSHUTDOWN

UDPSEND

UDPRECV

UDPOPEN

UDPCLOSESOCKET

UDPBIND

TRAYGETMSG

TCPSTARTUP

TCPSHUTDOWN

TCPSEND

TCPRECV

TCPNAMETOIP

TCPLISTEN

TCPCONNECT

TCPCLOSESOCKET

TCPACCEPT

SHELLEXECUTEWAIT

SHELLEXECUTE

REGENUMKEY

MSGBOX

ISKEYWORD

HTTPSETUSERAGENT

HTTPSETPROXY

HOTKEYSET

GUIREGISTERMSG

GUIGETMSG

GUICTRLSENDMSG

GUICTRLRECVMSG

FTPSETPROXY

\??\%s

GUI_RUNDEFMSG

SendKeyDelay

SendKeyDownDelay

TCPTimeout

AUTOITCALLVARIABLE%d

255.255.255.255

Keyword

AutoIt.Error

Null Object assignment in FOR..IN loop

Incorrect Object type in FOR..IN loop

HOTKEYPRESSED

AUTOITEXE

WINDOWSDIR

3, 3, 8, 1

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_USERS

%d/d/d

AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.

Missing operator in expression."Unbalanced brackets in expression.

Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.

Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.

Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.

3This keyword cannot be used after a "Then" keyword.

>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.

HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.

String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   lssas.exe:432
   lssas.exe:396
   %original file name%.exe:652
   

3. Delete the original Generic file.
   
4. Delete or disinfect the following files created/modified by the Generic:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (1473 bytes)
   %Documents and Settings%\%current user%\W71E93.TY4 (673 bytes)
   %Documents and Settings%\%current user%\B76B\lssas.exe (11745 bytes)

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.