MD5: 71d80646a52febb51aca8d0ed6e6f0c6
SHA1: f0344e297c7a10de9649c5fbcf9ff46f2d9a2214
SHA256: 1a847bc50e7698fec53026d3b4f837de75ccfd4e36fbbd099ca622849fa649e8
SSDeep: 3072:gNzzzX rOOacccN22jffffkF0rayvyPvf3YY VncgBLEDC4xZlvvJE/0DdofYRa:mzzzwOOacccN22jffffDra3/pzu8YDCV
Size: 187392 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: BorlandDelphi30, MicrosoftVisualCv60SPx, UPolyXv05_v6
Company: no certificate found
Created at: 2011-07-08 19:48:33
Analyzed on: WindowsXPESX SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):

Gpwiwo.exe:2812
%original file name%.exe:2764

The Trojan injects its code into the following process(es):

mscorsvw.exe:424
svchost.exe:340
jqs.exe:480
csrss.exe:692
winlogon.exe:716
services.exe:760
svchost.exe:928
svchost.exe:1012
svchost.exe:1096
svchost.exe:1144
svchost.exe:1188
spoolsv.exe:1432
Explorer.EXE:1948
wmiprvse.exe:3704

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:2764 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Gpwiwo.exe (673 bytes)

Registry activity

The process Gpwiwo.exe:2812 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "34 34 81 FA 16 B9 E2 91 02 19 E3 9C EE 20 B9 7C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process %original file name%.exe:2764 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3C 24 41 5A 6E 09 5C 88 FD D9 67 7D 52 BF A2 10"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Gpwiwo" = "%Documents and Settings%\%current user%\Application Data\Gpwiwo.exe"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Trojan installs the following user-mode hooks in urlmon.dll:

URLDownloadToFileA
URLDownloadToFileW

The Trojan installs the following user-mode hooks in WININET.dll:

InternetWriteFile
HttpSendRequestA
HttpSendRequestW

The Trojan installs the following user-mode hooks in ADVAPI32.dll:

RegCreateKeyExA
RegCreateKeyExW

The Trojan installs the following user-mode hooks in WS2_32.dll:

send
getaddrinfo

The Trojan installs the following user-mode hooks in kernel32.dll:

MoveFileA
CopyFileW
CopyFileA
MoveFileW
CreateFileW
CreateFileA

The Trojan installs the following user-mode hooks in ntdll.dll:

LdrLoadDll
NtResumeThread
ZwQueryDirectoryFile
ZwEnumerateValueKey

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.
A program can register a device notification with the help of RegisterDeviceNotification. So it is notified when a USB device is plugged and then the worm copies itself to the USB device plugged into the affected computer.
A worm can spread its copies through the MSN Messanger.

VersionInfo

Company Name: GFhPgSWwWibur
Product Name: UBHbjYEzAyDov
Product Version: 6.0
Legal Copyright: elQdcswzqPeXH
Legal Trademarks: prMotHDmAZZAJ
Original Filename: WyRxVnMnysKtQ.exe
Internal Name: CElFKSInwxvAX
File Version: 6.0.10511.0
File Description: OjIAwIZoJxGeZ
Comments:
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSSh

ShellExecuteA

SHELL32.dll

HttpQueryInfoA

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetWindowsDirectoryW

GetProcessHeap

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s-%s-%s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.%s%s

%S%s%s

%s.%S%S

%S%S%S

%s.p10-> Message hijacked!

%s.p10-> Message to %s hijacked!

%s.p21-> Message hijacked!

msnmsg

CAL %d %6s

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.

PRIVMSG #

%s:%d

%s.PTF://%s:%s@%s:%d (p='%S')

%s:%s@%s:%d

PASS %s

USER %s

ftpgrab

%s.Blocked possible browser exploit pack call on URL '%s'

hXXp://

%s.Blocked possible browser exploit pack call on URL '%S'

update.jebac.net

gov.ba

1.0.3

msn.set

msn.int

http.set

http.int

http.inj

logins

webroot.

virusbuster.nprotect.

heck.tc

onecare.live.

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d

[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d

[Slowloris]: Starting flood on "%s" for %d minute(s)

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s:%d" for %d second(s)

[UDP]: Finished flood on "%s:%d"

[SYN]: Starting flood on "%s:%d" for %d second(s)

[SYN]: Finished flood on "%s:%d"

[USB]: Infected %s

[MSN]: Updated MSN spread message to "%s"

[MSN]: Updated MSN spread interval to "%s"

[HTTP]: Updated HTTP spread message to "%s"

[HTTP]: Injected value is now %s.

[HTTP]: Updated HTTP spread interval to "%s"

[Visit]: Visited "%s"

[DNS]: Blocked "%s"

[usb="%d" msn="%d" http="%d" total="%d"]

[ftp="%d" http="%d" total="%d"]

[RSOCK4]: Started rsock4 on "%s:%d"

[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Detected File: "%s"

[Ruskill]: Detected DNS: "%s"

[Ruskill]: Detected Reg: "%s"

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

[HTTP]: %s

ftplog

ftpinfect

httplogin

httptraff

httpspread

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

*officebanking.cl/*login.asp*

*secure.logmein.*/*logincheck*

*megaupload.*/*login

loginUserPassword

loginUserName

*loginUserPassword=*

*fileserve.*/login*

session[password]

*password]=*

*twitter.com/sessions

*:2086/login*

*:2083/login*

Password

*&Password=*

*.alertpay.*/*login.aspx

txtPassword

*&txtPassword=*

*.moneybookers.*/*login.pl

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

-\\.\PHYSICALDRIVE0

state_%s

shell32.dll

httpi

dnsapi.dll

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s%s}%s

n{%s|%s%s}%s

%s|%s|%s

[DNS]: Redirecting "%s" to "%s"

%s|%s

[Logins]: Cleared %d logins

explorer.exe

[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)

[Logins]: %s

[DNS]: Blocked %d domain(s) - Redirected %d domain(s)

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

&&%%windir%%\explorer.exe %Í%%%s

/c "start %Í%%RECYCLER\%s

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

0x%0X.exe

*bebo.*/c/profile/comment_post.json

*bebo.*/mail/MailCompose.jsp*

*friendster.*/sendmessage.php*

*friendster.*/rpc.php

*vkontakte.ru/mail.php

*vkontakte.ru/wall.php

*vkontakte.ru/api.php

*facebook.*/ajax/*MessageComposerEndpoint.php*

msg_text

*facebook.*/ajax/chat/send.php*

-_.!~*'()

%s.%s hijacked!

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s_0xX

RegCreateKeyExA

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\svchost.exe

%Documents and Settings%\%current user%\Application Data\Gpwiwo.exe

%WinDir%

:*:/:[:`:

\\.\pipe

nwlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

xchat.exe

mirc.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

cipconfig.exe

verclsid.exe

regedit.exe

rundll32.exe

cmd.exe

regsvr32.exe

l"%s" %S

Internet Explorer\iexplore.exe

lol.exe

%s:Zone.Identifier

winlogon.exe

Aadvapi32.dll

urlmon.dll

nspr4.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

skype.exe

lsass.exe

\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe

mscorsvw.exe_424_rwx_008D0000_0002A000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSSh

ShellExecuteA

SHELL32.dll

HttpQueryInfoA

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetWindowsDirectoryW

GetProcessHeap

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s-%s-%s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.%s%s

%S%s%s

%s.%S%S

%S%S%S

%s.p10-> Message hijacked!

%s.p10-> Message to %s hijacked!

%s.p21-> Message hijacked!

msnmsg

CAL %d %6s

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.

PRIVMSG #

%s:%d

%s.PTF://%s:%s@%s:%d (p='%S')

%s:%s@%s:%d

PASS %s

USER %s

ftpgrab

%s.Blocked possible browser exploit pack call on URL '%s'

hXXp://

%s.Blocked possible browser exploit pack call on URL '%S'

update.jebac.net

gov.ba

1.0.3

msn.set

msn.int

http.set

http.int

http.inj

logins

webroot.

virusbuster.nprotect.

heck.tc

onecare.live.

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d

[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d

[Slowloris]: Starting flood on "%s" for %d minute(s)

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s:%d" for %d second(s)

[UDP]: Finished flood on "%s:%d"

[SYN]: Starting flood on "%s:%d" for %d second(s)

[SYN]: Finished flood on "%s:%d"

[USB]: Infected %s

[MSN]: Updated MSN spread message to "%s"

[MSN]: Updated MSN spread interval to "%s"

[HTTP]: Updated HTTP spread message to "%s"

[HTTP]: Injected value is now %s.

[HTTP]: Updated HTTP spread interval to "%s"

[Visit]: Visited "%s"

[DNS]: Blocked "%s"

[usb="%d" msn="%d" http="%d" total="%d"]

[ftp="%d" http="%d" total="%d"]

[RSOCK4]: Started rsock4 on "%s:%d"

[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Detected File: "%s"

[Ruskill]: Detected DNS: "%s"

[Ruskill]: Detected Reg: "%s"

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

[HTTP]: %s

ftplog

ftpinfect

httplogin

httptraff

httpspread

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

*officebanking.cl/*login.asp*

*secure.logmein.*/*logincheck*

*megaupload.*/*login

loginUserPassword

loginUserName

*loginUserPassword=*

*fileserve.*/login*

session[password]

*password]=*

*twitter.com/sessions

*:2086/login*

*:2083/login*

Password

*&Password=*

*.alertpay.*/*login.aspx

txtPassword

*&txtPassword=*

*.moneybookers.*/*login.pl

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

-\\.\PHYSICALDRIVE0

state_%s

shell32.dll

httpi

dnsapi.dll

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s%s}%s

n{%s|%s%s}%s

%s|%s|%s

[DNS]: Redirecting "%s" to "%s"

%s|%s

[Logins]: Cleared %d logins

explorer.exe

[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)

[Logins]: %s

[DNS]: Blocked %d domain(s) - Redirected %d domain(s)

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

&&%%windir%%\explorer.exe %Í%%%s

/c "start %Í%%RECYCLER\%s

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

0x%0X.exe

*bebo.*/c/profile/comment_post.json

*bebo.*/mail/MailCompose.jsp*

*friendster.*/sendmessage.php*

*friendster.*/rpc.php

*vkontakte.ru/mail.php

*vkontakte.ru/wall.php

*vkontakte.ru/api.php

*facebook.*/ajax/*MessageComposerEndpoint.php*

msg_text

*facebook.*/ajax/chat/send.php*

-_.!~*'()

%s.%s hijacked!

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s_0xX

RegCreateKeyExA

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%WinDir%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

%Documents and Settings%\%current user%\Application Data\Gpwiwo.exe

%WinDir%

:*:/:[:`:

\\.\pipe

nwlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

xchat.exe

mirc.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

cipconfig.exe

verclsid.exe

regedit.exe

rundll32.exe

cmd.exe

regsvr32.exe

l"%s" %S

Internet Explorer\iexplore.exe

lol.exe

%s:Zone.Identifier

winlogon.exe

Aadvapi32.dll

urlmon.dll

nspr4.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

skype.exe

lsass.exe

\Device\HarddiskVolume1\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

jqs.exe_480_rwx_010C0000_0002A000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSSh

ShellExecuteA

SHELL32.dll

HttpQueryInfoA

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetWindowsDirectoryW

GetProcessHeap

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s-%s-%s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.%s%s

%S%s%s

%s.%S%S

%S%S%S

%s.p10-> Message hijacked!

%s.p10-> Message to %s hijacked!

%s.p21-> Message hijacked!

msnmsg

CAL %d %6s

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.

PRIVMSG #

%s:%d

%s.PTF://%s:%s@%s:%d (p='%S')

%s:%s@%s:%d

PASS %s

USER %s

ftpgrab

%s.Blocked possible browser exploit pack call on URL '%s'

hXXp://

%s.Blocked possible browser exploit pack call on URL '%S'

update.jebac.net

gov.ba

1.0.3

msn.set

msn.int

http.set

http.int

http.inj

logins

webroot.

virusbuster.nprotect.

heck.tc

onecare.live.

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d

[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d

[Slowloris]: Starting flood on "%s" for %d minute(s)

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s:%d" for %d second(s)

[UDP]: Finished flood on "%s:%d"

[SYN]: Starting flood on "%s:%d" for %d second(s)

[SYN]: Finished flood on "%s:%d"

[USB]: Infected %s

[MSN]: Updated MSN spread message to "%s"

[MSN]: Updated MSN spread interval to "%s"

[HTTP]: Updated HTTP spread message to "%s"

[HTTP]: Injected value is now %s.

[HTTP]: Updated HTTP spread interval to "%s"

[Visit]: Visited "%s"

[DNS]: Blocked "%s"

[usb="%d" msn="%d" http="%d" total="%d"]

[ftp="%d" http="%d" total="%d"]

[RSOCK4]: Started rsock4 on "%s:%d"

[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Detected File: "%s"

[Ruskill]: Detected DNS: "%s"

[Ruskill]: Detected Reg: "%s"

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

[HTTP]: %s

ftplog

ftpinfect

httplogin

httptraff

httpspread

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

*officebanking.cl/*login.asp*

*secure.logmein.*/*logincheck*

*megaupload.*/*login

loginUserPassword

loginUserName

*loginUserPassword=*

*fileserve.*/login*

session[password]

*password]=*

*twitter.com/sessions

*:2086/login*

*:2083/login*

Password

*&Password=*

*.alertpay.*/*login.aspx

txtPassword

*&txtPassword=*

*.moneybookers.*/*login.pl

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

-\\.\PHYSICALDRIVE0

state_%s

shell32.dll

httpi

dnsapi.dll

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s%s}%s

n{%s|%s%s}%s

%s|%s|%s

[DNS]: Redirecting "%s" to "%s"

%s|%s

[Logins]: Cleared %d logins

explorer.exe

[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)

[Logins]: %s

[DNS]: Blocked %d domain(s) - Redirected %d domain(s)

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

&&%%windir%%\explorer.exe %Í%%%s

/c "start %Í%%RECYCLER\%s

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

0x%0X.exe

*bebo.*/c/profile/comment_post.json

*bebo.*/mail/MailCompose.jsp*

*friendster.*/sendmessage.php*

*friendster.*/rpc.php

*vkontakte.ru/mail.php

*vkontakte.ru/wall.php

*vkontakte.ru/api.php

*facebook.*/ajax/*MessageComposerEndpoint.php*

msg_text

*facebook.*/ajax/chat/send.php*

-_.!~*'()

%s.%s hijacked!

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s_0xX

RegCreateKeyExA

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%Program Files%\Java\jre6\bin\jqs.exe

%Documents and Settings%\%current user%\Application Data\Gpwiwo.exe

%WinDir%

:*:/:[:`:

\\.\pipe

nwlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

xchat.exe

mirc.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

cipconfig.exe

verclsid.exe

regedit.exe

rundll32.exe

cmd.exe

regsvr32.exe

l"%s" %S

Internet Explorer\iexplore.exe

lol.exe

%s:Zone.Identifier

winlogon.exe

Aadvapi32.dll

urlmon.dll

nspr4.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

skype.exe

lsass.exe

\Device\HarddiskVolume1\Program Files\Java\jre6\bin\jqs.exe

csrss.exe_692_rwx_01290000_0002A000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSSh

ShellExecuteA

SHELL32.dll

HttpQueryInfoA

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetWindowsDirectoryW

GetProcessHeap

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s-%s-%s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.%s%s

%S%s%s

%s.%S%S

%S%S%S

%s.p10-> Message hijacked!

%s.p10-> Message to %s hijacked!

%s.p21-> Message hijacked!

msnmsg

CAL %d %6s

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.

PRIVMSG #

%s:%d

%s.PTF://%s:%s@%s:%d (p='%S')

%s:%s@%s:%d

PASS %s

USER %s

ftpgrab

%s.Blocked possible browser exploit pack call on URL '%s'

hXXp://

%s.Blocked possible browser exploit pack call on URL '%S'

update.jebac.net

gov.ba

1.0.3

msn.set

msn.int

http.set

http.int

http.inj

logins

webroot.

virusbuster.nprotect.

heck.tc

onecare.live.

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d

[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d

[Slowloris]: Starting flood on "%s" for %d minute(s)

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s:%d" for %d second(s)

[UDP]: Finished flood on "%s:%d"

[SYN]: Starting flood on "%s:%d" for %d second(s)

[SYN]: Finished flood on "%s:%d"

[USB]: Infected %s

[MSN]: Updated MSN spread message to "%s"

[MSN]: Updated MSN spread interval to "%s"

[HTTP]: Updated HTTP spread message to "%s"

[HTTP]: Injected value is now %s.

[HTTP]: Updated HTTP spread interval to "%s"

[Visit]: Visited "%s"

[DNS]: Blocked "%s"

[usb="%d" msn="%d" http="%d" total="%d"]

[ftp="%d" http="%d" total="%d"]

[RSOCK4]: Started rsock4 on "%s:%d"

[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Detected File: "%s"

[Ruskill]: Detected DNS: "%s"

[Ruskill]: Detected Reg: "%s"

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

[HTTP]: %s

ftplog

ftpinfect

httplogin

httptraff

httpspread

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

*officebanking.cl/*login.asp*

*secure.logmein.*/*logincheck*

*megaupload.*/*login

loginUserPassword

loginUserName

*loginUserPassword=*

*fileserve.*/login*

session[password]

*password]=*

*twitter.com/sessions

*:2086/login*

*:2083/login*

Password

*&Password=*

*.alertpay.*/*login.aspx

txtPassword

*&txtPassword=*

*.moneybookers.*/*login.pl

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

-\\.\PHYSICALDRIVE0

state_%s

shell32.dll

httpi

dnsapi.dll

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s%s}%s

n{%s|%s%s}%s

%s|%s|%s

[DNS]: Redirecting "%s" to "%s"

%s|%s

[Logins]: Cleared %d logins

explorer.exe

[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)

[Logins]: %s

[DNS]: Blocked %d domain(s) - Redirected %d domain(s)

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

&&%%windir%%\explorer.exe %Í%%%s

/c "start %Í%%RECYCLER\%s

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

0x%0X.exe

*bebo.*/c/profile/comment_post.json

*bebo.*/mail/MailCompose.jsp*

*friendster.*/sendmessage.php*

*friendster.*/rpc.php

*vkontakte.ru/mail.php

*vkontakte.ru/wall.php

*vkontakte.ru/api.php

*facebook.*/ajax/*MessageComposerEndpoint.php*

msg_text

*facebook.*/ajax/chat/send.php*

-_.!~*'()

%s.%s hijacked!

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s_0xX

RegCreateKeyExA

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

\??\%System%\csrss.exe

%Documents and Settings%\%current user%\Application Data\Gpwiwo.exe

%WinDir%

:*:/:[:`:

\\.\pipe

nwlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

xchat.exe

mirc.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

cipconfig.exe

verclsid.exe

regedit.exe

rundll32.exe

cmd.exe

regsvr32.exe

l"%s" %S

Internet Explorer\iexplore.exe

lol.exe

%s:Zone.Identifier

winlogon.exe

Aadvapi32.dll

urlmon.dll

nspr4.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

skype.exe

lsass.exe

\Device\HarddiskVolume1\WINDOWS\system32\csrss.exe

winlogon.exe_716_rwx_00AC0000_0002A000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSSh

ShellExecuteA

SHELL32.dll

HttpQueryInfoA

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetWindowsDirectoryW

GetProcessHeap

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s-%s-%s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.%s%s

%S%s%s

%s.%S%S

%S%S%S

%s.p10-> Message hijacked!

%s.p10-> Message to %s hijacked!

%s.p21-> Message hijacked!

msnmsg

CAL %d %6s

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.

PRIVMSG #

%s:%d

%s.PTF://%s:%s@%s:%d (p='%S')

%s:%s@%s:%d

PASS %s

USER %s

ftpgrab

%s.Blocked possible browser exploit pack call on URL '%s'

hXXp://

%s.Blocked possible browser exploit pack call on URL '%S'

update.jebac.net

gov.ba

1.0.3

msn.set

msn.int

http.set

http.int

http.inj

logins

webroot.

virusbuster.nprotect.

heck.tc

onecare.live.

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d

[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d

[Slowloris]: Starting flood on "%s" for %d minute(s)

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s:%d" for %d second(s)

[UDP]: Finished flood on "%s:%d"

[SYN]: Starting flood on "%s:%d" for %d second(s)

[SYN]: Finished flood on "%s:%d"

[USB]: Infected %s

[MSN]: Updated MSN spread message to "%s"

[MSN]: Updated MSN spread interval to "%s"

[HTTP]: Updated HTTP spread message to "%s"

[HTTP]: Injected value is now %s.

[HTTP]: Updated HTTP spread interval to "%s"

[Visit]: Visited "%s"

[DNS]: Blocked "%s"

[usb="%d" msn="%d" http="%d" total="%d"]

[ftp="%d" http="%d" total="%d"]

[RSOCK4]: Started rsock4 on "%s:%d"

[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Detected File: "%s"

[Ruskill]: Detected DNS: "%s"

[Ruskill]: Detected Reg: "%s"

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

[HTTP]: %s

ftplog

ftpinfect

httplogin

httptraff

httpspread

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

*officebanking.cl/*login.asp*

*secure.logmein.*/*logincheck*

*megaupload.*/*login

loginUserPassword

loginUserName

*loginUserPassword=*

*fileserve.*/login*

session[password]

*password]=*

*twitter.com/sessions

*:2086/login*

*:2083/login*

Password

*&Password=*

*.alertpay.*/*login.aspx

txtPassword

*&txtPassword=*

*.moneybookers.*/*login.pl

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

-\\.\PHYSICALDRIVE0

state_%s

shell32.dll

httpi

dnsapi.dll

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s%s}%s

n{%s|%s%s}%s

%s|%s|%s

[DNS]: Redirecting "%s" to "%s"

%s|%s

[Logins]: Cleared %d logins

explorer.exe

[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)

[Logins]: %s

[DNS]: Blocked %d domain(s) - Redirected %d domain(s)

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

&&%%windir%%\explorer.exe %Í%%%s

/c "start %Í%%RECYCLER\%s

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

0x%0X.exe

*bebo.*/c/profile/comment_post.json

*bebo.*/mail/MailCompose.jsp*

*friendster.*/sendmessage.php*

*friendster.*/rpc.php

*vkontakte.ru/mail.php

*vkontakte.ru/wall.php

*vkontakte.ru/api.php

*facebook.*/ajax/*MessageComposerEndpoint.php*

msg_text

*facebook.*/ajax/chat/send.php*

-_.!~*'()

%s.%s hijacked!

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s_0xX

RegCreateKeyExA

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

\??\%System%\winlogon.exe

%Documents and Settings%\%current user%\Application Data\Gpwiwo.exe

%WinDir%

:*:/:[:`:

\\.\pipe

nwlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

xchat.exe

mirc.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

cipconfig.exe

verclsid.exe

regedit.exe

rundll32.exe

cmd.exe

regsvr32.exe

l"%s" %S

Internet Explorer\iexplore.exe

lol.exe

%s:Zone.Identifier

winlogon.exe

Aadvapi32.dll

urlmon.dll

nspr4.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

skype.exe

lsass.exe

\Device\HarddiskVolume1\WINDOWS\system32\winlogon.exe

services.exe_760_rwx_006C0000_0002A000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSSh

ShellExecuteA

SHELL32.dll

HttpQueryInfoA

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetWindowsDirectoryW

GetProcessHeap

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s-%s-%s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.%s%s

%S%s%s

%s.%S%S

%S%S%S

%s.p10-> Message hijacked!

%s.p10-> Message to %s hijacked!

%s.p21-> Message hijacked!

msnmsg

CAL %d %6s

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.

PRIVMSG #

%s:%d

%s.PTF://%s:%s@%s:%d (p='%S')

%s:%s@%s:%d

PASS %s

USER %s

ftpgrab

%s.Blocked possible browser exploit pack call on URL '%s'

hXXp://

%s.Blocked possible browser exploit pack call on URL '%S'

update.jebac.net

gov.ba

1.0.3

msn.set

msn.int

http.set

http.int

http.inj

logins

webroot.

virusbuster.nprotect.

heck.tc

onecare.live.

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d

[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d

[Slowloris]: Starting flood on "%s" for %d minute(s)

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s:%d" for %d second(s)

[UDP]: Finished flood on "%s:%d"

[SYN]: Starting flood on "%s:%d" for %d second(s)

[SYN]: Finished flood on "%s:%d"

[USB]: Infected %s

[MSN]: Updated MSN spread message to "%s"

[MSN]: Updated MSN spread interval to "%s"

[HTTP]: Updated HTTP spread message to "%s"

[HTTP]: Injected value is now %s.

[HTTP]: Updated HTTP spread interval to "%s"

[Visit]: Visited "%s"

[DNS]: Blocked "%s"

[usb="%d" msn="%d" http="%d" total="%d"]

[ftp="%d" http="%d" total="%d"]

[RSOCK4]: Started rsock4 on "%s:%d"

[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Detected File: "%s"

[Ruskill]: Detected DNS: "%s"

[Ruskill]: Detected Reg: "%s"

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

[HTTP]: %s

ftplog

ftpinfect

httplogin

httptraff

httpspread

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

*officebanking.cl/*login.asp*

*secure.logmein.*/*logincheck*

*megaupload.*/*login

loginUserPassword

loginUserName

*loginUserPassword=*

*fileserve.*/login*

session[password]

*password]=*

*twitter.com/sessions

*:2086/login*

*:2083/login*

Password

*&Password=*

*.alertpay.*/*login.aspx

txtPassword

*&txtPassword=*

*.moneybookers.*/*login.pl

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

-\\.\PHYSICALDRIVE0

state_%s

shell32.dll

httpi

dnsapi.dll

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s%s}%s

n{%s|%s%s}%s

%s|%s|%s

[DNS]: Redirecting "%s" to "%s"

%s|%s

[Logins]: Cleared %d logins

explorer.exe

[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)

[Logins]: %s

[DNS]: Blocked %d domain(s) - Redirected %d domain(s)

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

&&%%windir%%\explorer.exe %Í%%%s

/c "start %Í%%RECYCLER\%s

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

0x%0X.exe

*bebo.*/c/profile/comment_post.json

*bebo.*/mail/MailCompose.jsp*

*friendster.*/sendmessage.php*

*friendster.*/rpc.php

*vkontakte.ru/mail.php

*vkontakte.ru/wall.php

*vkontakte.ru/api.php

*facebook.*/ajax/*MessageComposerEndpoint.php*

msg_text

*facebook.*/ajax/chat/send.php*

-_.!~*'()

%s.%s hijacked!

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s_0xX

RegCreateKeyExA

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\services.exe

%Documents and Settings%\%current user%\Application Data\Gpwiwo.exe

%WinDir%

:*:/:[:`:

\\.\pipe

nwlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

xchat.exe

mirc.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

cipconfig.exe

verclsid.exe

regedit.exe

rundll32.exe

cmd.exe

regsvr32.exe

l"%s" %S

Internet Explorer\iexplore.exe

lol.exe

%s:Zone.Identifier

winlogon.exe

Aadvapi32.dll

urlmon.dll

nspr4.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

skype.exe

lsass.exe

m\Device\HarddiskVolume1\WINDOWS\system32\services.exe

svchost.exe_928_rwx_005C0000_0002A000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSSh

ShellExecuteA

SHELL32.dll

HttpQueryInfoA

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetWindowsDirectoryW

GetProcessHeap

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s-%s-%s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.%s%s

%S%s%s

%s.%S%S

%S%S%S

%s.p10-> Message hijacked!

%s.p10-> Message to %s hijacked!

%s.p21-> Message hijacked!

msnmsg

CAL %d %6s

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.

PRIVMSG #

%s:%d

%s.PTF://%s:%s@%s:%d (p='%S')

%s:%s@%s:%d

PASS %s

USER %s

ftpgrab

%s.Blocked possible browser exploit pack call on URL '%s'

hXXp://

%s.Blocked possible browser exploit pack call on URL '%S'

update.jebac.net

gov.ba

1.0.3

msn.set

msn.int

http.set

http.int

http.inj

logins

webroot.

virusbuster.nprotect.

heck.tc

onecare.live.

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d

[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d

[Slowloris]: Starting flood on "%s" for %d minute(s)

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s:%d" for %d second(s)

[UDP]: Finished flood on "%s:%d"

[SYN]: Starting flood on "%s:%d" for %d second(s)

[SYN]: Finished flood on "%s:%d"

[USB]: Infected %s

[MSN]: Updated MSN spread message to "%s"

[MSN]: Updated MSN spread interval to "%s"

[HTTP]: Updated HTTP spread message to "%s"

[HTTP]: Injected value is now %s.

[HTTP]: Updated HTTP spread interval to "%s"

[Visit]: Visited "%s"

[DNS]: Blocked "%s"

[usb="%d" msn="%d" http="%d" total="%d"]

[ftp="%d" http="%d" total="%d"]

[RSOCK4]: Started rsock4 on "%s:%d"

[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Detected File: "%s"

[Ruskill]: Detected DNS: "%s"

[Ruskill]: Detected Reg: "%s"

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

[HTTP]: %s

ftplog

ftpinfect

httplogin

httptraff

httpspread

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

*officebanking.cl/*login.asp*

*secure.logmein.*/*logincheck*

*megaupload.*/*login

loginUserPassword

loginUserName

*loginUserPassword=*

*fileserve.*/login*

session[password]

*password]=*

*twitter.com/sessions

*:2086/login*

*:2083/login*

Password

*&Password=*

*.alertpay.*/*login.aspx

txtPassword

*&txtPassword=*

*.moneybookers.*/*login.pl

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

-\\.\PHYSICALDRIVE0

state_%s

shell32.dll

httpi

dnsapi.dll

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s%s}%s

n{%s|%s%s}%s

%s|%s|%s

[DNS]: Redirecting "%s" to "%s"

%s|%s

[Logins]: Cleared %d logins

explorer.exe

[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)

[Logins]: %s

[DNS]: Blocked %d domain(s) - Redirected %d domain(s)

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

&&%%windir%%\explorer.exe %Í%%%s

/c "start %Í%%RECYCLER\%s

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

0x%0X.exe

*bebo.*/c/profile/comment_post.json

*bebo.*/mail/MailCompose.jsp*

*friendster.*/sendmessage.php*

*friendster.*/rpc.php

*vkontakte.ru/mail.php

*vkontakte.ru/wall.php

*vkontakte.ru/api.php

*facebook.*/ajax/*MessageComposerEndpoint.php*

msg_text

*facebook.*/ajax/chat/send.php*

-_.!~*'()

%s.%s hijacked!

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s_0xX

RegCreateKeyExA

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\svchost.exe

%Documents and Settings%\%current user%\Application Data\Gpwiwo.exe

%WinDir%

:*:/:[:`:

\\.\pipe

nwlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

xchat.exe

mirc.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

cipconfig.exe

verclsid.exe

regedit.exe

rundll32.exe

cmd.exe

regsvr32.exe

l"%s" %S

Internet Explorer\iexplore.exe

lol.exe

%s:Zone.Identifier

winlogon.exe

Aadvapi32.dll

urlmon.dll

nspr4.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

skype.exe

lsass.exe

]\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe

svchost.exe_1012_rwx_00B40000_0002A000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSSh

ShellExecuteA

SHELL32.dll

HttpQueryInfoA

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetWindowsDirectoryW

GetProcessHeap

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s-%s-%s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.%s%s

%S%s%s

%s.%S%S

%S%S%S

%s.p10-> Message hijacked!

%s.p10-> Message to %s hijacked!

%s.p21-> Message hijacked!

msnmsg

CAL %d %6s

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.

PRIVMSG #

%s:%d

%s.PTF://%s:%s@%s:%d (p='%S')

%s:%s@%s:%d

PASS %s

USER %s

ftpgrab

%s.Blocked possible browser exploit pack call on URL '%s'

hXXp://

%s.Blocked possible browser exploit pack call on URL '%S'

update.jebac.net

gov.ba

1.0.3

msn.set

msn.int

http.set

http.int

http.inj

logins

webroot.

virusbuster.nprotect.

heck.tc

onecare.live.

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d

[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d

[Slowloris]: Starting flood on "%s" for %d minute(s)

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s:%d" for %d second(s)

[UDP]: Finished flood on "%s:%d"

[SYN]: Starting flood on "%s:%d" for %d second(s)

[SYN]: Finished flood on "%s:%d"

[USB]: Infected %s

[MSN]: Updated MSN spread message to "%s"

[MSN]: Updated MSN spread interval to "%s"

[HTTP]: Updated HTTP spread message to "%s"

[HTTP]: Injected value is now %s.

[HTTP]: Updated HTTP spread interval to "%s"

[Visit]: Visited "%s"

[DNS]: Blocked "%s"

[usb="%d" msn="%d" http="%d" total="%d"]

[ftp="%d" http="%d" total="%d"]

[RSOCK4]: Started rsock4 on "%s:%d"

[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Detected File: "%s"

[Ruskill]: Detected DNS: "%s"

[Ruskill]: Detected Reg: "%s"

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

[HTTP]: %s

ftplog

ftpinfect

httplogin

httptraff

httpspread

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

*officebanking.cl/*login.asp*

*secure.logmein.*/*logincheck*

*megaupload.*/*login

loginUserPassword

loginUserName

*loginUserPassword=*

*fileserve.*/login*

session[password]

*password]=*

*twitter.com/sessions

*:2086/login*

*:2083/login*

Password

*&Password=*

*.alertpay.*/*login.aspx

txtPassword

*&txtPassword=*

*.moneybookers.*/*login.pl

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

-\\.\PHYSICALDRIVE0

state_%s

shell32.dll

httpi

dnsapi.dll

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s%s}%s

n{%s|%s%s}%s

%s|%s|%s

[DNS]: Redirecting "%s" to "%s"

%s|%s

[Logins]: Cleared %d logins

explorer.exe

[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)

[Logins]: %s

[DNS]: Blocked %d domain(s) - Redirected %d domain(s)

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

&&%%windir%%\explorer.exe %Í%%%s

/c "start %Í%%RECYCLER\%s

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

0x%0X.exe

*bebo.*/c/profile/comment_post.json

*bebo.*/mail/MailCompose.jsp*

*friendster.*/sendmessage.php*

*friendster.*/rpc.php

*vkontakte.ru/mail.php

*vkontakte.ru/wall.php

*vkontakte.ru/api.php

*facebook.*/ajax/*MessageComposerEndpoint.php*

msg_text

*facebook.*/ajax/chat/send.php*

-_.!~*'()

%s.%s hijacked!

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s_0xX

RegCreateKeyExA

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\svchost.exe

%Documents and Settings%\%current user%\Application Data\Gpwiwo.exe

%WinDir%

:*:/:[:`:

\\.\pipe

nwlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

xchat.exe

mirc.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

cipconfig.exe

verclsid.exe

regedit.exe

rundll32.exe

cmd.exe

regsvr32.exe

l"%s" %S

Internet Explorer\iexplore.exe

lol.exe

%s:Zone.Identifier

winlogon.exe

Aadvapi32.dll

urlmon.dll

nspr4.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

skype.exe

lsass.exe

\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe

svchost.exe_1096_rwx_02960000_0002A000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSSh

ShellExecuteA

SHELL32.dll

HttpQueryInfoA

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetWindowsDirectoryW

GetProcessHeap

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s-%s-%s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.%s%s

%S%s%s

%s.%S%S

%S%S%S

%s.p10-> Message hijacked!

%s.p10-> Message to %s hijacked!

%s.p21-> Message hijacked!

msnmsg

CAL %d %6s

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.

PRIVMSG #

%s:%d

%s.PTF://%s:%s@%s:%d (p='%S')

%s:%s@%s:%d

PASS %s

USER %s

ftpgrab

%s.Blocked possible browser exploit pack call on URL '%s'

hXXp://

%s.Blocked possible browser exploit pack call on URL '%S'

update.jebac.net

gov.ba

1.0.3

msn.set

msn.int

http.set

http.int

http.inj

logins

webroot.

virusbuster.nprotect.

heck.tc

onecare.live.

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d

[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d

[Slowloris]: Starting flood on "%s" for %d minute(s)

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s:%d" for %d second(s)

[UDP]: Finished flood on "%s:%d"

[SYN]: Starting flood on "%s:%d" for %d second(s)

[SYN]: Finished flood on "%s:%d"

[USB]: Infected %s

[MSN]: Updated MSN spread message to "%s"

[MSN]: Updated MSN spread interval to "%s"

[HTTP]: Updated HTTP spread message to "%s"

[HTTP]: Injected value is now %s.

[HTTP]: Updated HTTP spread interval to "%s"

[Visit]: Visited "%s"

[DNS]: Blocked "%s"

[usb="%d" msn="%d" http="%d" total="%d"]

[ftp="%d" http="%d" total="%d"]

[RSOCK4]: Started rsock4 on "%s:%d"

[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Detected File: "%s"

[Ruskill]: Detected DNS: "%s"

[Ruskill]: Detected Reg: "%s"

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

[HTTP]: %s

ftplog

ftpinfect

httplogin

httptraff

httpspread

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

*officebanking.cl/*login.asp*

*secure.logmein.*/*logincheck*

*megaupload.*/*login

loginUserPassword

loginUserName

*loginUserPassword=*

*fileserve.*/login*

session[password]

*password]=*

*twitter.com/sessions

*:2086/login*

*:2083/login*

Password

*&Password=*

*.alertpay.*/*login.aspx

txtPassword

*&txtPassword=*

*.moneybookers.*/*login.pl

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

-\\.\PHYSICALDRIVE0

state_%s

shell32.dll

httpi

dnsapi.dll

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s%s}%s

n{%s|%s%s}%s

%s|%s|%s

[DNS]: Redirecting "%s" to "%s"

%s|%s

[Logins]: Cleared %d logins

explorer.exe

[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)

[Logins]: %s

[DNS]: Blocked %d domain(s) - Redirected %d domain(s)

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

&&%%windir%%\explorer.exe %Í%%%s

/c "start %Í%%RECYCLER\%s

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

0x%0X.exe

*bebo.*/c/profile/comment_post.json

*bebo.*/mail/MailCompose.jsp*

*friendster.*/sendmessage.php*

*friendster.*/rpc.php

*vkontakte.ru/mail.php

*vkontakte.ru/wall.php

*vkontakte.ru/api.php

*facebook.*/ajax/*MessageComposerEndpoint.php*

msg_text

*facebook.*/ajax/chat/send.php*

-_.!~*'()

%s.%s hijacked!

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s_0xX

RegCreateKeyExA

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%WinDir%\System32\svchost.exe

%Documents and Settings%\%current user%\Application Data\Gpwiwo.exe

%WinDir%

:*:/:[:`:

\\.\pipe

nwlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

xchat.exe

mirc.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

cipconfig.exe

verclsid.exe

regedit.exe

rundll32.exe

cmd.exe

regsvr32.exe

l"%s" %S

Internet Explorer\iexplore.exe

lol.exe

%s:Zone.Identifier

winlogon.exe

Aadvapi32.dll

urlmon.dll

nspr4.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

skype.exe

lsass.exe

\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe

svchost.exe_1144_rwx_00820000_0002A000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSSh

ShellExecuteA

SHELL32.dll

HttpQueryInfoA

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetWindowsDirectoryW

GetProcessHeap

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s-%s-%s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.%s%s

%S%s%s

%s.%S%S

%S%S%S

%s.p10-> Message hijacked!

%s.p10-> Message to %s hijacked!

%s.p21-> Message hijacked!

msnmsg

CAL %d %6s

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.

PRIVMSG #

%s:%d

%s.PTF://%s:%s@%s:%d (p='%S')

%s:%s@%s:%d

PASS %s

USER %s

ftpgrab

%s.Blocked possible browser exploit pack call on URL '%s'

hXXp://

%s.Blocked possible browser exploit pack call on URL '%S'

update.jebac.net

gov.ba

1.0.3

msn.set

msn.int

http.set

http.int

http.inj

logins

webroot.

virusbuster.nprotect.

heck.tc

onecare.live.

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d

[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d

[Slowloris]: Starting flood on "%s" for %d minute(s)

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s:%d" for %d second(s)

[UDP]: Finished flood on "%s:%d"

[SYN]: Starting flood on "%s:%d" for %d second(s)

[SYN]: Finished flood on "%s:%d"

[USB]: Infected %s

[MSN]: Updated MSN spread message to "%s"

[MSN]: Updated MSN spread interval to "%s"

[HTTP]: Updated HTTP spread message to "%s"

[HTTP]: Injected value is now %s.

[HTTP]: Updated HTTP spread interval to "%s"

[Visit]: Visited "%s"

[DNS]: Blocked "%s"

[usb="%d" msn="%d" http="%d" total="%d"]

[ftp="%d" http="%d" total="%d"]

[RSOCK4]: Started rsock4 on "%s:%d"

[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Detected File: "%s"

[Ruskill]: Detected DNS: "%s"

[Ruskill]: Detected Reg: "%s"

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

[HTTP]: %s

ftplog

ftpinfect

httplogin

httptraff

httpspread

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

*officebanking.cl/*login.asp*

*secure.logmein.*/*logincheck*

*megaupload.*/*login

loginUserPassword

loginUserName

*loginUserPassword=*

*fileserve.*/login*

session[password]

*password]=*

*twitter.com/sessions

*:2086/login*

*:2083/login*

Password

*&Password=*

*.alertpay.*/*login.aspx

txtPassword

*&txtPassword=*

*.moneybookers.*/*login.pl

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

-\\.\PHYSICALDRIVE0

state_%s

shell32.dll

httpi

dnsapi.dll

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s%s}%s

n{%s|%s%s}%s

%s|%s|%s

[DNS]: Redirecting "%s" to "%s"

%s|%s

[Logins]: Cleared %d logins

explorer.exe

[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)

[Logins]: %s

[DNS]: Blocked %d domain(s) - Redirected %d domain(s)

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

&&%%windir%%\explorer.exe %Í%%%s

/c "start %Í%%RECYCLER\%s

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

0x%0X.exe

*bebo.*/c/profile/comment_post.json

*bebo.*/mail/MailCompose.jsp*

*friendster.*/sendmessage.php*

*friendster.*/rpc.php

*vkontakte.ru/mail.php

*vkontakte.ru/wall.php

*vkontakte.ru/api.php

*facebook.*/ajax/*MessageComposerEndpoint.php*

msg_text

*facebook.*/ajax/chat/send.php*

-_.!~*'()

%s.%s hijacked!

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s_0xX

RegCreateKeyExA

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\svchost.exe

%Documents and Settings%\%current user%\Application Data\Gpwiwo.exe

%WinDir%

:*:/:[:`:

\\.\pipe

nwlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

xchat.exe

mirc.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

cipconfig.exe

verclsid.exe

regedit.exe

rundll32.exe

cmd.exe

regsvr32.exe

l"%s" %S

Internet Explorer\iexplore.exe

lol.exe

%s:Zone.Identifier

winlogon.exe

Aadvapi32.dll

urlmon.dll

nspr4.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

skype.exe

lsass.exe

\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe

svchost.exe_1188_rwx_00AB0000_0002A000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSSh

ShellExecuteA

SHELL32.dll

HttpQueryInfoA

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetWindowsDirectoryW

GetProcessHeap

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s-%s-%s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.%s%s

%S%s%s

%s.%S%S

%S%S%S

%s.p10-> Message hijacked!

%s.p10-> Message to %s hijacked!

%s.p21-> Message hijacked!

msnmsg

CAL %d %6s

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.

PRIVMSG #

%s:%d

%s.PTF://%s:%s@%s:%d (p='%S')

%s:%s@%s:%d

PASS %s

USER %s

ftpgrab

%s.Blocked possible browser exploit pack call on URL '%s'

hXXp://

%s.Blocked possible browser exploit pack call on URL '%S'

update.jebac.net

gov.ba

1.0.3

msn.set

msn.int

http.set

http.int

http.inj

logins

webroot.

virusbuster.nprotect.

heck.tc

onecare.live.

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d

[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d

[Slowloris]: Starting flood on "%s" for %d minute(s)

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s:%d" for %d second(s)

[UDP]: Finished flood on "%s:%d"

[SYN]: Starting flood on "%s:%d" for %d second(s)

[SYN]: Finished flood on "%s:%d"

[USB]: Infected %s

[MSN]: Updated MSN spread message to "%s"

[MSN]: Updated MSN spread interval to "%s"

[HTTP]: Updated HTTP spread message to "%s"

[HTTP]: Injected value is now %s.

[HTTP]: Updated HTTP spread interval to "%s"

[Visit]: Visited "%s"

[DNS]: Blocked "%s"

[usb="%d" msn="%d" http="%d" total="%d"]

[ftp="%d" http="%d" total="%d"]

[RSOCK4]: Started rsock4 on "%s:%d"

[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Detected File: "%s"

[Ruskill]: Detected DNS: "%s"

[Ruskill]: Detected Reg: "%s"

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

[HTTP]: %s

ftplog

ftpinfect

httplogin

httptraff

httpspread

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

*officebanking.cl/*login.asp*

*secure.logmein.*/*logincheck*

*megaupload.*/*login

loginUserPassword

loginUserName

*loginUserPassword=*

*fileserve.*/login*

session[password]

*password]=*

*twitter.com/sessions

*:2086/login*

*:2083/login*

Password

*&Password=*

*.alertpay.*/*login.aspx

txtPassword

*&txtPassword=*

*.moneybookers.*/*login.pl

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

-\\.\PHYSICALDRIVE0

state_%s

shell32.dll

httpi

dnsapi.dll

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s%s}%s

n{%s|%s%s}%s

%s|%s|%s

[DNS]: Redirecting "%s" to "%s"

%s|%s

[Logins]: Cleared %d logins

explorer.exe

[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)

[Logins]: %s

[DNS]: Blocked %d domain(s) - Redirected %d domain(s)

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

&&%%windir%%\explorer.exe %Í%%%s

/c "start %Í%%RECYCLER\%s

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

0x%0X.exe

*bebo.*/c/profile/comment_post.json

*bebo.*/mail/MailCompose.jsp*

*friendster.*/sendmessage.php*

*friendster.*/rpc.php

*vkontakte.ru/mail.php

*vkontakte.ru/wall.php

*vkontakte.ru/api.php

*facebook.*/ajax/*MessageComposerEndpoint.php*

msg_text

*facebook.*/ajax/chat/send.php*

-_.!~*'()

%s.%s hijacked!

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s_0xX

RegCreateKeyExA

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\svchost.exe

%Documents and Settings%\%current user%\Application Data\Gpwiwo.exe

%WinDir%

:*:/:[:`:

\\.\pipe

nwlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

xchat.exe

mirc.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

cipconfig.exe

verclsid.exe

regedit.exe

rundll32.exe

cmd.exe

regsvr32.exe

l"%s" %S

Internet Explorer\iexplore.exe

lol.exe

%s:Zone.Identifier

winlogon.exe

Aadvapi32.dll

urlmon.dll

nspr4.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

skype.exe

lsass.exe

\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe

spoolsv.exe_1432_rwx_00980000_0002A000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSSh

ShellExecuteA

SHELL32.dll

HttpQueryInfoA

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetWindowsDirectoryW

GetProcessHeap

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s-%s-%s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.%s%s

%S%s%s

%s.%S%S

%S%S%S

%s.p10-> Message hijacked!

%s.p10-> Message to %s hijacked!

%s.p21-> Message hijacked!

msnmsg

CAL %d %6s

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.

PRIVMSG #

%s:%d

%s.PTF://%s:%s@%s:%d (p='%S')

%s:%s@%s:%d

PASS %s

USER %s

ftpgrab

%s.Blocked possible browser exploit pack call on URL '%s'

hXXp://

%s.Blocked possible browser exploit pack call on URL '%S'

update.jebac.net

gov.ba

1.0.3

msn.set

msn.int

http.set

http.int

http.inj

logins

webroot.

virusbuster.nprotect.

heck.tc

onecare.live.

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d

[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d

[Slowloris]: Starting flood on "%s" for %d minute(s)

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s:%d" for %d second(s)

[UDP]: Finished flood on "%s:%d"

[SYN]: Starting flood on "%s:%d" for %d second(s)

[SYN]: Finished flood on "%s:%d"

[USB]: Infected %s

[MSN]: Updated MSN spread message to "%s"

[MSN]: Updated MSN spread interval to "%s"

[HTTP]: Updated HTTP spread message to "%s"

[HTTP]: Injected value is now %s.

[HTTP]: Updated HTTP spread interval to "%s"

[Visit]: Visited "%s"

[DNS]: Blocked "%s"

[usb="%d" msn="%d" http="%d" total="%d"]

[ftp="%d" http="%d" total="%d"]

[RSOCK4]: Started rsock4 on "%s:%d"

[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Detected File: "%s"

[Ruskill]: Detected DNS: "%s"

[Ruskill]: Detected Reg: "%s"

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

[HTTP]: %s

ftplog

ftpinfect

httplogin

httptraff

httpspread

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

*officebanking.cl/*login.asp*

*secure.logmein.*/*logincheck*

*megaupload.*/*login

loginUserPassword

loginUserName

*loginUserPassword=*

*fileserve.*/login*

session[password]

*password]=*

*twitter.com/sessions

*:2086/login*

*:2083/login*

Password

*&Password=*

*.alertpay.*/*login.aspx

txtPassword

*&txtPassword=*

*.moneybookers.*/*login.pl

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

-\\.\PHYSICALDRIVE0

state_%s

shell32.dll

httpi

dnsapi.dll

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s%s}%s

n{%s|%s%s}%s

%s|%s|%s

[DNS]: Redirecting "%s" to "%s"

%s|%s

[Logins]: Cleared %d logins

explorer.exe

[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)

[Logins]: %s

[DNS]: Blocked %d domain(s) - Redirected %d domain(s)

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

&&%%windir%%\explorer.exe %Í%%%s

/c "start %Í%%RECYCLER\%s

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

0x%0X.exe

*bebo.*/c/profile/comment_post.json

*bebo.*/mail/MailCompose.jsp*

*friendster.*/sendmessage.php*

*friendster.*/rpc.php

*vkontakte.ru/mail.php

*vkontakte.ru/wall.php

*vkontakte.ru/api.php

*facebook.*/ajax/*MessageComposerEndpoint.php*

msg_text

*facebook.*/ajax/chat/send.php*

-_.!~*'()

%s.%s hijacked!

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s_0xX

RegCreateKeyExA

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\spoolsv.exe

%Documents and Settings%\%current user%\Application Data\Gpwiwo.exe

%WinDir%

:*:/:[:`:

\\.\pipe

nwlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

xchat.exe

mirc.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

cipconfig.exe

verclsid.exe

regedit.exe

rundll32.exe

cmd.exe

regsvr32.exe

l"%s" %S

Internet Explorer\iexplore.exe

lol.exe

%s:Zone.Identifier

winlogon.exe

Aadvapi32.dll

urlmon.dll

nspr4.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

skype.exe

lsass.exe

\Device\HarddiskVolume1\WINDOWS\system32\spoolsv.exe

Explorer.EXE_1948_rwx_01100000_0002A000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSSh

ShellExecuteA

SHELL32.dll

HttpQueryInfoA

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetWindowsDirectoryW

GetProcessHeap

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s-%s-%s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.%s%s

%S%s%s

%s.%S%S

%S%S%S

%s.p10-> Message hijacked!

%s.p10-> Message to %s hijacked!

%s.p21-> Message hijacked!

msnmsg

CAL %d %6s

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.

PRIVMSG #

%s:%d

%s.PTF://%s:%s@%s:%d (p='%S')

%s:%s@%s:%d

PASS %s

USER %s

ftpgrab

%s.Blocked possible browser exploit pack call on URL '%s'

hXXp://

%s.Blocked possible browser exploit pack call on URL '%S'

update.jebac.net

gov.ba

1.0.3

msn.set

msn.int

http.set

http.int

http.inj

logins

webroot.

virusbuster.nprotect.

heck.tc

onecare.live.

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d

[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d

[Slowloris]: Starting flood on "%s" for %d minute(s)

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s:%d" for %d second(s)

[UDP]: Finished flood on "%s:%d"

[SYN]: Starting flood on "%s:%d" for %d second(s)

[SYN]: Finished flood on "%s:%d"

[USB]: Infected %s

[MSN]: Updated MSN spread message to "%s"

[MSN]: Updated MSN spread interval to "%s"

[HTTP]: Updated HTTP spread message to "%s"

[HTTP]: Injected value is now %s.

[HTTP]: Updated HTTP spread interval to "%s"

[Visit]: Visited "%s"

[DNS]: Blocked "%s"

[usb="%d" msn="%d" http="%d" total="%d"]

[ftp="%d" http="%d" total="%d"]

[RSOCK4]: Started rsock4 on "%s:%d"

[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Detected File: "%s"

[Ruskill]: Detected DNS: "%s"

[Ruskill]: Detected Reg: "%s"

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

[HTTP]: %s

ftplog

ftpinfect

httplogin

httptraff

httpspread

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

*officebanking.cl/*login.asp*

*secure.logmein.*/*logincheck*

*megaupload.*/*login

loginUserPassword

loginUserName

*loginUserPassword=*

*fileserve.*/login*

session[password]

*password]=*

*twitter.com/sessions

*:2086/login*

*:2083/login*

Password

*&Password=*

*.alertpay.*/*login.aspx

txtPassword

*&txtPassword=*

*.moneybookers.*/*login.pl

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

-\\.\PHYSICALDRIVE0

state_%s

shell32.dll

httpi

dnsapi.dll

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s%s}%s

n{%s|%s%s}%s

%s|%s|%s

[DNS]: Redirecting "%s" to "%s"

%s|%s

[Logins]: Cleared %d logins

explorer.exe

[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)

[Logins]: %s

[DNS]: Blocked %d domain(s) - Redirected %d domain(s)

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

&&%%windir%%\explorer.exe %Í%%%s

/c "start %Í%%RECYCLER\%s

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

0x%0X.exe

*bebo.*/c/profile/comment_post.json

*bebo.*/mail/MailCompose.jsp*

*friendster.*/sendmessage.php*

*friendster.*/rpc.php

*vkontakte.ru/mail.php

*vkontakte.ru/wall.php

*vkontakte.ru/api.php

*facebook.*/ajax/*MessageComposerEndpoint.php*

msg_text

*facebook.*/ajax/chat/send.php*

-_.!~*'()

%s.%s hijacked!

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s_0xX

RegCreateKeyExA

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

c:\%original file name%.exe

:*:/:[:`:

\\.\pipe

nwlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

xchat.exe

mirc.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

cipconfig.exe

verclsid.exe

regedit.exe

rundll32.exe

cmd.exe

regsvr32.exe

l"%s" %S

Internet Explorer\iexplore.exe

lol.exe

%s:Zone.Identifier

winlogon.exe

Aadvapi32.dll

urlmon.dll

nspr4.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

skype.exe

lsass.exe

%Documents and Settings%\%current user%\Application Data\Gpwiwo.exe

Explorer.EXE_1948_rwx_01B90000_0002A000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSSh

ShellExecuteA

SHELL32.dll

HttpQueryInfoA

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetWindowsDirectoryW

GetProcessHeap

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s-%s-%s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.%s%s

%S%s%s

%s.%S%S

%S%S%S

%s.p10-> Message hijacked!

%s.p10-> Message to %s hijacked!

%s.p21-> Message hijacked!

msnmsg

CAL %d %6s

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.

PRIVMSG #

%s:%d

%s.PTF://%s:%s@%s:%d (p='%S')

%s:%s@%s:%d

PASS %s

USER %s

ftpgrab

%s.Blocked possible browser exploit pack call on URL '%s'

hXXp://

%s.Blocked possible browser exploit pack call on URL '%S'

update.jebac.net

gov.ba

1.0.3

msn.set

msn.int

http.set

http.int

http.inj

logins

webroot.

virusbuster.nprotect.

heck.tc

onecare.live.

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d

[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d

[Slowloris]: Starting flood on "%s" for %d minute(s)

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s:%d" for %d second(s)

[UDP]: Finished flood on "%s:%d"

[SYN]: Starting flood on "%s:%d" for %d second(s)

[SYN]: Finished flood on "%s:%d"

[USB]: Infected %s

[MSN]: Updated MSN spread message to "%s"

[MSN]: Updated MSN spread interval to "%s"

[HTTP]: Updated HTTP spread message to "%s"

[HTTP]: Injected value is now %s.

[HTTP]: Updated HTTP spread interval to "%s"

[Visit]: Visited "%s"

[DNS]: Blocked "%s"

[usb="%d" msn="%d" http="%d" total="%d"]

[ftp="%d" http="%d" total="%d"]

[RSOCK4]: Started rsock4 on "%s:%d"

[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Detected File: "%s"

[Ruskill]: Detected DNS: "%s"

[Ruskill]: Detected Reg: "%s"

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

[HTTP]: %s

ftplog

ftpinfect

httplogin

httptraff

httpspread

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

*officebanking.cl/*login.asp*

*secure.logmein.*/*logincheck*

*megaupload.*/*login

loginUserPassword

loginUserName

*loginUserPassword=*

*fileserve.*/login*

session[password]

*password]=*

*twitter.com/sessions

*:2086/login*

*:2083/login*

Password

*&Password=*

*.alertpay.*/*login.aspx

txtPassword

*&txtPassword=*

*.moneybookers.*/*login.pl

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

-\\.\PHYSICALDRIVE0

state_%s

shell32.dll

httpi

dnsapi.dll

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s%s}%s

n{%s|%s%s}%s

%s|%s|%s

[DNS]: Redirecting "%s" to "%s"

%s|%s

[Logins]: Cleared %d logins

explorer.exe

[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)

[Logins]: %s

[DNS]: Blocked %d domain(s) - Redirected %d domain(s)

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

&&%%windir%%\explorer.exe %Í%%%s

/c "start %Í%%RECYCLER\%s

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

0x%0X.exe

*bebo.*/c/profile/comment_post.json

*bebo.*/mail/MailCompose.jsp*

*friendster.*/sendmessage.php*

*friendster.*/rpc.php

*vkontakte.ru/mail.php

*vkontakte.ru/wall.php

*vkontakte.ru/api.php

*facebook.*/ajax/*MessageComposerEndpoint.php*

msg_text

*facebook.*/ajax/chat/send.php*

-_.!~*'()

%s.%s hijacked!

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s_0xX

RegCreateKeyExA

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%WinDir%\Explorer.EXE

%Documents and Settings%\%current user%\Application Data\Gpwiwo.exe

%WinDir%

0xFFD12566.exe

:*:/:[:`:

\\.\pipe

nwlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

xchat.exe

mirc.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

cipconfig.exe

verclsid.exe

regedit.exe

rundll32.exe

cmd.exe

regsvr32.exe

l"%s" %S

Internet Explorer\iexplore.exe

lol.exe

%s:Zone.Identifier

winlogon.exe

Aadvapi32.dll

urlmon.dll

nspr4.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

skype.exe

lsass.exe

\Device\HarddiskVolume1\WINDOWS\explorer.exe

wmiprvse.exe_3704_rwx_00D90000_0002A000:

.text

`.rdata

@.data

.reloc

:.datt

tB<%u4

toSSSSSSSSSSh

ShellExecuteA

SHELL32.dll

HttpQueryInfoA

InternetOpenUrlA

HttpQueryInfoW

WININET.dll

SHLWAPI.dll

ntdll.dll

WS2_32.dll

MSVCRT.dll

GetWindowsDirectoryW

GetProcessHeap

ConnectNamedPipe

CreateNamedPipeA

DisconnectNamedPipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

ole32.dll

%s.%s

%s.%S

%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!

autorun.inf

%s.Blocked "%S" from creating "%S"

%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!

%s.Blocked "%s" from removing our bot file!

%s.Blocked "%S" from removing our bot file!

%s.%s ->> %s : %s

%s-%s-%s

%s.Blocked "%s" from moving our bot file

%s.Blocked "%S" from moving our bot file

%s.%s%s

%S%s%s

%s.%S%S

%S%S%S

%s.p10-> Message hijacked!

%s.p10-> Message to %s hijacked!

%s.p21-> Message hijacked!

msnmsg

CAL %d %6s

JOIN #

%s.Detected process "%S" sending an IRC packet to server %s:%d.

PRIVMSG #

%s:%d

%s.PTF://%s:%s@%s:%d (p='%S')

%s:%s@%s:%d

PASS %s

USER %s

ftpgrab

%s.Blocked possible browser exploit pack call on URL '%s'

hXXp://

%s.Blocked possible browser exploit pack call on URL '%S'

update.jebac.net

gov.ba

1.0.3

msn.set

msn.int

http.set

http.int

http.inj

logins

webroot.

virusbuster.nprotect.

heck.tc

onecare.live.

USER %s 0 0 :%s

NICK %s

JOIN %s %s

PART %s

PRIVMSG %s :%s

QUIT :%s

PONG %s

PRIVMSG

[v="%s" c="%s" h="%s" p="%S"]

[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d

[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d

[Slowloris]: Starting flood on "%s" for %d minute(s)

[Slowloris]: Finished flood on "%s"

[UDP]: Starting flood on "%s:%d" for %d second(s)

[UDP]: Finished flood on "%s:%d"

[SYN]: Starting flood on "%s:%d" for %d second(s)

[SYN]: Finished flood on "%s:%d"

[USB]: Infected %s

[MSN]: Updated MSN spread message to "%s"

[MSN]: Updated MSN spread interval to "%s"

[HTTP]: Updated HTTP spread message to "%s"

[HTTP]: Injected value is now %s.

[HTTP]: Updated HTTP spread interval to "%s"

[Visit]: Visited "%s"

[DNS]: Blocked "%s"

[usb="%d" msn="%d" http="%d" total="%d"]

[ftp="%d" http="%d" total="%d"]

[RSOCK4]: Started rsock4 on "%s:%d"

[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)

[d="%s"] Error downloading file [e="%d"]

[d="%s"] Error writing download to "%S" [e="%d"]

[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]

[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]

[d="%s"] Error getting temporary filename. [e="%d"]

[d='%s"] Error getting application data path [e="%d"]

[Visit]: Error visitng "%s"

[FTP Login]: %s

[FTP Infect]: %s was iframed

[HTTP Login]: %s

[HTTP Traffic]: %s

[Ruskill]: Detected File: "%s"

[Ruskill]: Detected DNS: "%s"

[Ruskill]: Detected Reg: "%s"

[PDef ]: %s

[DNS]: Blocked DNS "%s"

[MSN]: %s

[HTTP]: %s

ftplog

ftpinfect

httplogin

httptraff

httpspread

hXXp://api.wipmania.com/

\\.\pipe\%s_ipc

*officebanking.cl/*login.asp*

*secure.logmein.*/*logincheck*

*megaupload.*/*login

loginUserPassword

loginUserName

*loginUserPassword=*

*fileserve.*/login*

session[password]

*password]=*

*twitter.com/sessions

*:2086/login*

*:2083/login*

Password

*&Password=*

*.alertpay.*/*login.aspx

txtPassword

*&txtPassword=*

*.moneybookers.*/*login.pl

*runescape*/*weblogin*

*&password=*

*no-ip*/login*

*steampowered*/login*

quick_password

*hackforums.*/member.php

*facebook.*/login.php*

*login.yahoo.*/*login*

passwd

login

*passwd=*

*login.live.*/*post.srf*

TextfieldPassword

*TextfieldPassword=*

*gmx.*/*FormLogin*

*Passwd=*

FLN-Password

*FLN-Password=*

*pass=*

*bigstring.*/*index.php*

*screenname.aol.*/login.psp*

password

loginId

*password=*

*aol.*/*login.psp*

Passwd

*google.*/*ServiceLoginAuth*

login_password

login_email

*login_password=*

*paypal.*/webscr?cmd=_login-submit*

%s / ?%d HTTP/1.1

Host: %s

User-Agent: %s

Mozilla/4.0

-\\.\PHYSICALDRIVE0

state_%s

shell32.dll

httpi

dnsapi.dll

hXXp://%s/%s

hXXp://%s/

POST /23s

{%s|%s%s}%s

n{%s|%s%s}%s

%s|%s|%s

[DNS]: Redirecting "%s" to "%s"

%s|%s

[Logins]: Cleared %d logins

explorer.exe

[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)

[Logins]: %s

[DNS]: Blocked %d domain(s) - Redirected %d domain(s)

icon=shell32.dll,7

shellexecute=

%windir%\system32\cmd.exe

&&%%windir%%\explorer.exe %Í%%%s

/c "start %Í%%RECYCLER\%s

\\.\%c:

%s\%s

%sautorun.tmp

%sautorun.inf

0x%0X.exe

*bebo.*/c/profile/comment_post.json

*bebo.*/mail/MailCompose.jsp*

*friendster.*/sendmessage.php*

*friendster.*/rpc.php

*vkontakte.ru/mail.php

*vkontakte.ru/wall.php

*vkontakte.ru/api.php

*facebook.*/ajax/*MessageComposerEndpoint.php*

msg_text

*facebook.*/ajax/chat/send.php*

-_.!~*'()

%s.%s hijacked!

MSG %d %s %d

MSG %d %1s

SDG %d %d

Content-Length: %d

SDG %d

%s_0xX

RegCreateKeyExA

URLDownloadToFileW

URLDownloadToFileA

HttpSendRequestW

HttpSendRequestA

NtEnumerateValueKey

%s-Mutex

%s_%d

%s_%lu

kernel32.dll

%System%\wbem\wmiprvse.exe

%Documents and Settings%\%current user%\Application Data\Gpwiwo.exe

%WinDir%

:*:/:[:`:

\\.\pipe

nwlcomm.exe

msmsgs.exe

msnmsgr.exe

pidgin.exe

xchat.exe

mirc.exe

iexplore.exe

firefox.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\System

.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

cipconfig.exe

verclsid.exe

regedit.exe

rundll32.exe

cmd.exe

regsvr32.exe

l"%s" %S

Internet Explorer\iexplore.exe

lol.exe

%s:Zone.Identifier

winlogon.exe

Aadvapi32.dll

urlmon.dll

nspr4.dll

wininet.dll

ws2_32.dll

Akernel23.dll

yntdll.dll

skype.exe

lsass.exe

\Device\HarddiskVolume1\WINDOWS\system32\wbem\wmiprvse.exe

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   Gpwiwo.exe:2812
   %original file name%.exe:2764
   

3. Delete the original Trojan file.
   
4. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Application Data\Gpwiwo.exe (673 bytes)

5. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Gpwiwo" = "%Documents and Settings%\%current user%\Application Data\Gpwiwo.exe"

6. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.