Trojan.Generic.5843933_098096ec91
Trojan.Win32.Jorik.IRCbot.xw (Kaspersky), Trojan.Generic.5843933 (B) (Emsisoft), Trojan.Generic.5843933 (AdAware), Worm.Win32.Dorkbot.FD, WormDorkbot.YR, GenericUDPFlooder.YR, GenericIRCBot.YR, GenericMSNWorm.YR, GenericUSBInfector.YR, GenericDNSBlocker.YR, GenericAutorunWorm.YR, GenericSYNFlooder.YR, GenericInjector.YR, BankerGeneric.YR, GenericProxy.YR, GenericPhysicalDrive0.YR (Lavasoft MAS)
Behaviour: Banker, Trojan, Flooder, Worm, WormAutorun, IRCBot, MSNWorm, DNSBlocker, UDPFlooder, SYNFlooder, Trojan-Proxy, USBInfector
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
| Requires JavaScript enabled! |
|---|
MD5: 098096ec911948fe00452bdfac2aec3e
SHA1: 6189c00ca7dd8fc192db12ceaccd5beaf101edbb
SHA256: a6f59a52cd7486aefbc74c7fc56f15a8b203b0fcab91bda0e87c144a79eca585
SSDeep: 6144:sp0LAsio8lxLHzVZVhRquXYFn0nccccccccc0i/FMCbfavpjRehF:s6ssioQ5HzbRlM0xCs
Size: 294912 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: StunningSoftware
Created at: 2008-10-16 23:46:30
Analyzed on: WindowsXPESX SP3 32-bit
Summary:
Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Payload
| Behaviour | Description |
|---|---|
| WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer. |
| IRCBot | A bot can communicate with command and control servers via IRC channel. |
| MSNWorm | A worm can spread its copies through the MSN Messanger. |
| DNSBlocker | A program can block designated DNS servers for making it difficult for users to locate specific domains or web sites on the Internet. |
| UDPFlooder | This program can make a UDP flood. A UDP flood attack is a denial-of-service attack using the User Datagram Protocol (UDP). It can be initiated by sending a large number of UDP packets to random ports on a remote host. |
| SYNFlooder | This program can make a SYN flood. It is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic. |
| Trojan-Proxy | This program can launch a proxy server (SOCKS4) on a designated TCP port. |
| USBInfector | A program can register a device notification with the help of RegisterDeviceNotification. So it is notified when a USB device is plugged and then the worm copies itself to the USB device plugged into the affected computer. |
Process activity
The Trojan creates the following process(es):
%original file name%.exe:1472
%original file name%.exe:1616
Gukmks.exe:636
Gukmks.exe:1800
The Trojan injects its code into the following process(es):
mscorsvw.exe:172
jqs.exe:288
wmiprvse.exe:552
csrss.exe:696
winlogon.exe:720
services.exe:764
svchost.exe:932
svchost.exe:1000
svchost.exe:1088
svchost.exe:1132
svchost.exe:1184
spoolsv.exe:1432
Explorer.EXE:2032
Mutexes
The following mutexes were created/opened:
No objects were found.
File activity
The process %original file name%.exe:1616 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\Gukmks.exe (1425 bytes)
Registry activity
The process %original file name%.exe:1472 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9F A2 38 45 36 B5 35 1D 2C 4C 60 EE 0C BA 5A DA"
The process %original file name%.exe:1616 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "16 DF A8 F6 5C 25 D2 E0 ED D7 4C BD E3 C3 15 EE"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Gukmks" = "%Documents and Settings%\%current user%\Application Data\Gukmks.exe"
The process Gukmks.exe:636 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B7 85 D3 41 5D 29 98 E6 B3 CD B8 B7 83 EF 05 15"
The process Gukmks.exe:1800 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1C 26 AA 2E C6 21 25 AE 48 1A C1 4F 7C 4A D3 8C"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
The process mscorsvw.exe:172 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\State]
"AccumulatedWaitIdleTime" = "1260000"
Dropped PE files
There are no dropped PE files.
HOSTS file anomalies
No changes have been detected.
Rootkit activity
The Trojan installs the following user-mode hooks in WININET.dll:
HttpSendRequestW
InternetWriteFile
HttpSendRequestA
The Trojan installs the following user-mode hooks in ADVAPI32.dll:
RegCreateKeyExA
RegCreateKeyExW
The Trojan installs the following user-mode hooks in WS2_32.dll:
send
GetAddrInfoW
The Trojan installs the following user-mode hooks in kernel32.dll:
MoveFileA
CopyFileW
CopyFileA
MoveFileW
CreateFileW
CreateFileA
The Trojan installs the following user-mode hooks in ntdll.dll:
LdrLoadDll
NtResumeThread
NtQueryDirectoryFile
NtEnumerateValueKey
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.
A program can register a device notification with the help of RegisterDeviceNotification. So it is notified when a USB device is plugged and then the worm copies itself to the USB device plugged into the affected computer.
A worm can spread its copies through the MSN Messanger.
VersionInfo
Company Name: FCYtTYVg
Product Name: skKm
Product Version: 0.04.0001
Legal Copyright: cyPidSwHI
Legal Trademarks: DHJBaphSA
Original Filename: CEeKtMQUK.exe
Internal Name: CEeKtMQUK
File Version: 0.04.0001
File Description:
Comments:
Language: English (United States)
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| UPX0 | 4096 | 475136 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| UPX1 | 479232 | 114688 | 112128 | 5.48539 | b2cb3ddf18bbf66c933fd074c358d92e |
| .rsrc | 593920 | 28672 | 27136 | 4.20922 | 38aa798c3764aead7befbf40383427e3 |
| . | 622592 | 155648 | 154624 | 4.50333 | 6841f0e9e413686dd985661931c125cb |
| dxgfuwa | 778240 | 4096 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
URLs
No activity has been detected.
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Web Traffic was not found.
The Trojan connects to the servers at the folowing location(s):
mscorsvw.exe_172_rwx_008E0000_0002A000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSShp7
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.PTF://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
hXXp://
%s.Blocked possible browser exploit pack call on URL '%S'
keshmoney.biz
usakesh.biz
heytherebitch.com
smellypussy.info
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
USER %s 0 0 :%s
NICK %s
JOIN %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
hXXp://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
hXXp://%s/%s
hXXp://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
*bebo.*/c/profile/comment_post.json
*bebo.*/mail/MailCompose.jsp*
*friendster.*/sendmessage.php*
*friendster.*/rpc.php
*vkontakte.ru/mail.php
*vkontakte.ru/wall.php
*vkontakte.ru/api.php
*facebook.*/ajax/*MessageComposerEndpoint.php*
msg_text
*facebook.*/ajax/chat/send.php*
-_.!~*'()
%s.%s hijacked!
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
%WinDir%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
%Documents and Settings%\%current user%\Application Data\Gukmks.exe
%WinDir%
="='=7=<=
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
\Device\HarddiskVolume1\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
jqs.exe_288_rwx_010C0000_0002A000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSShp7
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.PTF://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
hXXp://
%s.Blocked possible browser exploit pack call on URL '%S'
keshmoney.biz
usakesh.biz
heytherebitch.com
smellypussy.info
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
USER %s 0 0 :%s
NICK %s
JOIN %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
hXXp://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
hXXp://%s/%s
hXXp://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
*bebo.*/c/profile/comment_post.json
*bebo.*/mail/MailCompose.jsp*
*friendster.*/sendmessage.php*
*friendster.*/rpc.php
*vkontakte.ru/mail.php
*vkontakte.ru/wall.php
*vkontakte.ru/api.php
*facebook.*/ajax/*MessageComposerEndpoint.php*
msg_text
*facebook.*/ajax/chat/send.php*
-_.!~*'()
%s.%s hijacked!
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
%Program Files%\Java\jre6\bin\jqs.exe
%Documents and Settings%\%current user%\Application Data\Gukmks.exe
%WinDir%
="='=7=<=
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
\Device\HarddiskVolume1\Program Files\Java\jre6\bin\jqs.exe
wmiprvse.exe_552_rwx_00DE0000_0002A000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSShp7
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.PTF://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
hXXp://
%s.Blocked possible browser exploit pack call on URL '%S'
keshmoney.biz
usakesh.biz
heytherebitch.com
smellypussy.info
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
USER %s 0 0 :%s
NICK %s
JOIN %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
hXXp://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
hXXp://%s/%s
hXXp://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
*bebo.*/c/profile/comment_post.json
*bebo.*/mail/MailCompose.jsp*
*friendster.*/sendmessage.php*
*friendster.*/rpc.php
*vkontakte.ru/mail.php
*vkontakte.ru/wall.php
*vkontakte.ru/api.php
*facebook.*/ajax/*MessageComposerEndpoint.php*
msg_text
*facebook.*/ajax/chat/send.php*
-_.!~*'()
%s.%s hijacked!
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
%System%\wbem\wmiprvse.exe
%Documents and Settings%\%current user%\Application Data\Gukmks.exe
%WinDir%
="='=7=<=
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
\Device\HarddiskVolume1\WINDOWS\system32\wbem\wmiprvse.exe
csrss.exe_696_rwx_00AF0000_0002A000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSShp7
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.PTF://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
hXXp://
%s.Blocked possible browser exploit pack call on URL '%S'
keshmoney.biz
usakesh.biz
heytherebitch.com
smellypussy.info
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
USER %s 0 0 :%s
NICK %s
JOIN %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
hXXp://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
hXXp://%s/%s
hXXp://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
*bebo.*/c/profile/comment_post.json
*bebo.*/mail/MailCompose.jsp*
*friendster.*/sendmessage.php*
*friendster.*/rpc.php
*vkontakte.ru/mail.php
*vkontakte.ru/wall.php
*vkontakte.ru/api.php
*facebook.*/ajax/*MessageComposerEndpoint.php*
msg_text
*facebook.*/ajax/chat/send.php*
-_.!~*'()
%s.%s hijacked!
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
\??\%System%\csrss.exe
%Documents and Settings%\%current user%\Application Data\Gukmks.exe
%WinDir%
="='=7=<=
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
\Device\HarddiskVolume1\WINDOWS\system32\csrss.exe
winlogon.exe_720_rwx_00AD0000_0002A000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSShp7
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.PTF://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
hXXp://
%s.Blocked possible browser exploit pack call on URL '%S'
keshmoney.biz
usakesh.biz
heytherebitch.com
smellypussy.info
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
USER %s 0 0 :%s
NICK %s
JOIN %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
hXXp://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
hXXp://%s/%s
hXXp://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
*bebo.*/c/profile/comment_post.json
*bebo.*/mail/MailCompose.jsp*
*friendster.*/sendmessage.php*
*friendster.*/rpc.php
*vkontakte.ru/mail.php
*vkontakte.ru/wall.php
*vkontakte.ru/api.php
*facebook.*/ajax/*MessageComposerEndpoint.php*
msg_text
*facebook.*/ajax/chat/send.php*
-_.!~*'()
%s.%s hijacked!
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
\??\%System%\winlogon.exe
%Documents and Settings%\%current user%\Application Data\Gukmks.exe
%WinDir%
="='=7=<=
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
\Device\HarddiskVolume1\WINDOWS\system32\winlogon.exe
services.exe_764_rwx_006F0000_0002A000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSShp7p
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.PTF://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
hXXp://
%s.Blocked possible browser exploit pack call on URL '%S'
keshmoney.biz
usakesh.biz
heytherebitch.com
smellypussy.info
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
USER %s 0 0 :%s
NICK %s
JOIN %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
hXXp://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
hXXp://%s/%s
hXXp://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
*bebo.*/c/profile/comment_post.json
*bebo.*/mail/MailCompose.jsp*
*friendster.*/sendmessage.php*
*friendster.*/rpc.php
*vkontakte.ru/mail.php
*vkontakte.ru/wall.php
*vkontakte.ru/api.php
*facebook.*/ajax/*MessageComposerEndpoint.php*
msg_text
*facebook.*/ajax/chat/send.php*
-_.!~*'()
%s.%s hijacked!
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
%System%\services.exe
%Documents and Settings%\%current user%\Application Data\Gukmks.exe
%WinDir%
="='=7=<=
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
p\Device\HarddiskVolume1\WINDOWS\system32\services.exe
svchost.exe_932_rwx_00940000_0002A000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSShp7
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.PTF://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
hXXp://
%s.Blocked possible browser exploit pack call on URL '%S'
keshmoney.biz
usakesh.biz
heytherebitch.com
smellypussy.info
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
USER %s 0 0 :%s
NICK %s
JOIN %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
hXXp://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
hXXp://%s/%s
hXXp://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
*bebo.*/c/profile/comment_post.json
*bebo.*/mail/MailCompose.jsp*
*friendster.*/sendmessage.php*
*friendster.*/rpc.php
*vkontakte.ru/mail.php
*vkontakte.ru/wall.php
*vkontakte.ru/api.php
*facebook.*/ajax/*MessageComposerEndpoint.php*
msg_text
*facebook.*/ajax/chat/send.php*
-_.!~*'()
%s.%s hijacked!
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
%System%\svchost.exe
%Documents and Settings%\%current user%\Application Data\Gukmks.exe
%WinDir%
="='=7=<=
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe
svchost.exe_1000_rwx_00B10000_0002A000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSShp7
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.PTF://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
hXXp://
%s.Blocked possible browser exploit pack call on URL '%S'
keshmoney.biz
usakesh.biz
heytherebitch.com
smellypussy.info
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
USER %s 0 0 :%s
NICK %s
JOIN %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
hXXp://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
hXXp://%s/%s
hXXp://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
*bebo.*/c/profile/comment_post.json
*bebo.*/mail/MailCompose.jsp*
*friendster.*/sendmessage.php*
*friendster.*/rpc.php
*vkontakte.ru/mail.php
*vkontakte.ru/wall.php
*vkontakte.ru/api.php
*facebook.*/ajax/*MessageComposerEndpoint.php*
msg_text
*facebook.*/ajax/chat/send.php*
-_.!~*'()
%s.%s hijacked!
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
%System%\svchost.exe
%Documents and Settings%\%current user%\Application Data\Gukmks.exe
%WinDir%
="='=7=<=
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe
svchost.exe_1088_rwx_02C80000_0002A000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSShp7
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.PTF://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
hXXp://
%s.Blocked possible browser exploit pack call on URL '%S'
keshmoney.biz
usakesh.biz
heytherebitch.com
smellypussy.info
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
USER %s 0 0 :%s
NICK %s
JOIN %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
hXXp://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
hXXp://%s/%s
hXXp://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
*bebo.*/c/profile/comment_post.json
*bebo.*/mail/MailCompose.jsp*
*friendster.*/sendmessage.php*
*friendster.*/rpc.php
*vkontakte.ru/mail.php
*vkontakte.ru/wall.php
*vkontakte.ru/api.php
*facebook.*/ajax/*MessageComposerEndpoint.php*
msg_text
*facebook.*/ajax/chat/send.php*
-_.!~*'()
%s.%s hijacked!
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
%WinDir%\System32\svchost.exe
%Documents and Settings%\%current user%\Application Data\Gukmks.exe
%WinDir%
="='=7=<=
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe
svchost.exe_1132_rwx_007F0000_0002A000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSShp7
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.PTF://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
hXXp://
%s.Blocked possible browser exploit pack call on URL '%S'
keshmoney.biz
usakesh.biz
heytherebitch.com
smellypussy.info
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
USER %s 0 0 :%s
NICK %s
JOIN %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
hXXp://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
hXXp://%s/%s
hXXp://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
*bebo.*/c/profile/comment_post.json
*bebo.*/mail/MailCompose.jsp*
*friendster.*/sendmessage.php*
*friendster.*/rpc.php
*vkontakte.ru/mail.php
*vkontakte.ru/wall.php
*vkontakte.ru/api.php
*facebook.*/ajax/*MessageComposerEndpoint.php*
msg_text
*facebook.*/ajax/chat/send.php*
-_.!~*'()
%s.%s hijacked!
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
%System%\svchost.exe
%Documents and Settings%\%current user%\Application Data\Gukmks.exe
%WinDir%
="='=7=<=
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe
svchost.exe_1184_rwx_00B80000_0002A000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSShp7
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.PTF://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
hXXp://
%s.Blocked possible browser exploit pack call on URL '%S'
keshmoney.biz
usakesh.biz
heytherebitch.com
smellypussy.info
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
USER %s 0 0 :%s
NICK %s
JOIN %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
hXXp://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
hXXp://%s/%s
hXXp://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
*bebo.*/c/profile/comment_post.json
*bebo.*/mail/MailCompose.jsp*
*friendster.*/sendmessage.php*
*friendster.*/rpc.php
*vkontakte.ru/mail.php
*vkontakte.ru/wall.php
*vkontakte.ru/api.php
*facebook.*/ajax/*MessageComposerEndpoint.php*
msg_text
*facebook.*/ajax/chat/send.php*
-_.!~*'()
%s.%s hijacked!
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
%System%\svchost.exe
%Documents and Settings%\%current user%\Application Data\Gukmks.exe
%WinDir%
="='=7=<=
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe
spoolsv.exe_1432_rwx_009F0000_0002A000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSShp7
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.PTF://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
hXXp://
%s.Blocked possible browser exploit pack call on URL '%S'
keshmoney.biz
usakesh.biz
heytherebitch.com
smellypussy.info
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
USER %s 0 0 :%s
NICK %s
JOIN %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
hXXp://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
hXXp://%s/%s
hXXp://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
*bebo.*/c/profile/comment_post.json
*bebo.*/mail/MailCompose.jsp*
*friendster.*/sendmessage.php*
*friendster.*/rpc.php
*vkontakte.ru/mail.php
*vkontakte.ru/wall.php
*vkontakte.ru/api.php
*facebook.*/ajax/*MessageComposerEndpoint.php*
msg_text
*facebook.*/ajax/chat/send.php*
-_.!~*'()
%s.%s hijacked!
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
%System%\spoolsv.exe
%Documents and Settings%\%current user%\Application Data\Gukmks.exe
%WinDir%
="='=7=<=
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
\Device\HarddiskVolume1\WINDOWS\system32\spoolsv.exe
Explorer.EXE_2032_rwx_00E70000_0002A000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSShp7
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.PTF://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
hXXp://
%s.Blocked possible browser exploit pack call on URL '%S'
keshmoney.biz
usakesh.biz
heytherebitch.com
smellypussy.info
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
USER %s 0 0 :%s
NICK %s
JOIN %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
hXXp://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
hXXp://%s/%s
hXXp://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
*bebo.*/c/profile/comment_post.json
*bebo.*/mail/MailCompose.jsp*
*friendster.*/sendmessage.php*
*friendster.*/rpc.php
*vkontakte.ru/mail.php
*vkontakte.ru/wall.php
*vkontakte.ru/api.php
*facebook.*/ajax/*MessageComposerEndpoint.php*
msg_text
*facebook.*/ajax/chat/send.php*
-_.!~*'()
%s.%s hijacked!
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
c:\%original file name%.exe
="='=7=<=
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
%Documents and Settings%\%current user%\Application Data\Gukmks.exe
Explorer.EXE_2032_rwx_01C50000_0002A000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSShp7
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.PTF://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
hXXp://
%s.Blocked possible browser exploit pack call on URL '%S'
keshmoney.biz
usakesh.biz
heytherebitch.com
smellypussy.info
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
USER %s 0 0 :%s
NICK %s
JOIN %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
hXXp://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
hXXp://%s/%s
hXXp://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
*bebo.*/c/profile/comment_post.json
*bebo.*/mail/MailCompose.jsp*
*friendster.*/sendmessage.php*
*friendster.*/rpc.php
*vkontakte.ru/mail.php
*vkontakte.ru/wall.php
*vkontakte.ru/api.php
*facebook.*/ajax/*MessageComposerEndpoint.php*
msg_text
*facebook.*/ajax/chat/send.php*
-_.!~*'()
%s.%s hijacked!
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
%WinDir%\Explorer.EXE
%Documents and Settings%\%current user%\Application Data\Gukmks.exe
%WinDir%
30e41aa1.exe
="='=7=<=
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
\Device\HarddiskVolume1\WINDOWS\explorer.exe
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1472
%original file name%.exe:1616
Gukmks.exe:636
Gukmks.exe:1800 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Application Data\Gukmks.exe (1425 bytes)
- Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Gukmks" = "%Documents and Settings%\%current user%\Application Data\Gukmks.exe" - Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
