MD5: 2afe308ae90cadea9837ee0cc9fca523
SHA1: c096e778016248cfb1e0876b4faac5ff9831fe73
SHA256: 5d7c7dc87b9a118a6946174fd9542841b49c2859d6dff62e172ca4a74bbb6f4f
SSDeep: 24576:ba2I/qJu6sNRr9R7RwLS0ZM5k7hMCWqbqY5:b/I/2HsNRBRVkv3 8
Size: 1453568 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MoleBoxV2X, UPolyXv05_v6
Company: no certificate found
Created at: 2015-04-26 03:51:53
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:1332

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1332 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ip138[1].htm (3745 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ic[1].htm (224 bytes)

Registry activity

The process %original file name%.exe:1332 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E9 0F 6E 0D C6 42 86 8A 05 3A B7 5B 3E 6D 53 1D"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: Baidu.com, Inc.
Product Name: ting???
Product Version: 1.0.3.0
Legal Copyright: Copyright(C) Baidu.com, Inc. All rights reserved.
Legal Trademarks:
Original Filename: ting_Setup.exe
Internal Name: ting_Setup
File Version: 1.0.3.0
File Description: ting??? ????
Comments: ting Setup Package
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://www.ip138.com/	203.130.61.92
1111.ip138.com	183.238.101.232

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1

Accept: */*

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: VVV.ip138.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Fri, 05 Jun 2015 08:23:27 GMT

Content-Length: 16659

Content-Type: text/html

Content-Location: hXXp://VVV.ip138.com/index.htm

Last-Modified: Tue, 02 Jun 2015 12:45:55 GMT

Accept-Ranges: bytes

ETag: "3c77811329dd01:bcc0"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Age: 75025

X-Via: 1.1 kf48:10 (Cdn Cache Server V2.0)

Connection: keep-alive
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">..
<html>..<head>..<meta http-equiv="Content-Type" content
="text/html; charset=gb2312">..<meta name="mobile-agent"content=
"format=html5; url=hXXp://m.ip138.com/">..<title>IP........--
.................. | ............ | ............ | ...................
.....</title>..<meta name="Keywords" content="ip,IP....,IP...
.....,ip138">..<meta name="Description" content="ip,IP....,IP...
.....,ip138">..<script language="javascript">..<!--..if(wi
ndow.top!=window.self)window.top.location.href='hXXp://VVV.ip138.com/'
;..function checkIP()..{...var ipArray,ip,j;...ip = document.ipform.ip
.value;...if (ip.indexOf(" ")>=0){....ip = ip.replace(/ /g,"");....
document.ipform.ip.value = ip;...}...if (ip.toLowerCase().indexOf("htt
p://")==0){....ip = ip.slice(7);....document.ipform.ip.value = ip;...}
...if (ip.toLowerCase().indexOf("hXXps://")==0){....ip = ip.slice(8);.
...document.ipform.ip.value = ip;...}...if (ip.slice(ip.length-1)=="/"
){....ip = ip.slice(0,ip.length-1);....document.ipform.ip.value = ip;.
..}...if(/[A-Za-z_-]/.test(ip)){....if(!/^([\w-] \.) ((top)|(com)|(net
)|(org)|(gov\.cn)|(info)|(cc)|(com\.cn)|(net\.cn)|(org\.cn)|(name)|(bi
z)|(tv)|(cn)|(mobi)|(name)|(sh)|(ac)|(io)|(tw)|(com\.tw)|(hk)|(com\.hk
)|(ws)|(travel)|(us)|(tm)|(la)|(me\.uk)|(org\.uk)|(ltd\.uk)|(plc\.uk)|
(in)|(eu)|(it)|(jp)|(co)|(me)|(mx)|(ca)|(ag)|(com\.co)|(net\.co)|(nom\
.co)|(com\.ag)|(net\.ag)|(fr)|(org\.ag)|(am)|(asia)|(at)|(be)|(bz)
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

t$(SSh

~%UVW

u$SShe

user32.dll

Kernel32.dll

kernel32.dll

wininet.dll

advapi32.dll

shlwapi.dll

EnumWindows

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

1.2.9

bbs.125.la

?hXXp://VVV.ip138.com

https

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

http=

HTTP/1.1

Content-Type: application/x-www-form-urlencoded

hXXps://

hXXp://

0@C:\Windir\wind.dat

C:\Windir\

QQ.exe

99999999

%Documents and Settings%\

D:\My Documents\Tencent Files\

C:\Users\

%Documents and Settings%\Administrator\Application Data\Tencent\Users\

scripting.FileSystemObject

&QQPassWord=

360tray.exe

360tray.exe|

360sd.exe

360sd.exe|

kxetray.exe

kxetray.exe|

QQPCTray.exe

QQPCTray.exe|

RavMonD.exe

RavMonD.exe|

avp.exe

avp.exe|

egui.exe

egui.exe|

knsdtray.exe

knsdtray.exe|

KvMonXP.exe

KvMonXP.exe|

Mcshield.exe

Mcshield.exe|

TMBMSRV.exe

TMBMSRV.exe|

hXXp://im.qq.com/pcqq/

'77/7&*\

(7),01444

'9=82<.342

~%xkW

F%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

ole32.dll

__MSVCRT_HEAP_SELECT

iphlpapi.dll

SHLWAPI.dll

MPR.dll

VERSION.dll

WSOCK32.dll

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

(%d-%d):

%ld%c

%s <%s>

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

HELO %s

SMTP

AUTH LOGIN

LOGIN

AUTH=LOGIN

EHLO %s

Content-Type: application/octet-stream; name=%s

Content-Disposition: attachment; filename=%s

MAIL FROM:<%s>

RCPT TO:<%s>

%d%d%d

rundll32.exe shell32.dll,

(*.htm;*.html)|*.htm;*.html

VVV.dywt.com.cn

.PAVCOleException@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

zcÁ

cmon.exe

adea9837ee0cc9fca523.exe

X-Powered-By: ASP.NET

c:\%original file name%.exe

`D.tR7

bE.tR7

`D~_C|]By[@vY?sW=pT;mR:kQ9jP8iO8hN7hN7hN7hN7hN7hN7hN7hN7hN7hN7hN7hN7hN7hN7hN7hN7`H3`G2`G2`G2`G2`G2`G2`G2`G2`G2`G2`F1`G2`G2`G2`G2`G2`F2`G2`G2`F1`G2`G2aH2aH2aH3ZA,Y@,\C-^D.aF0cH1fJ2gK3iL3iL4jM4jM4jM4jM3jM4jM4jM4jM4jM3jM3jM4jM4jM4jM4jM4jM3jM3z[?

`D~_C{]Ax[@tX>pU<mR:iO8fM6dK5bJ4aI4aI4`I3`I3`I3`I3`I3`I3`I3`I3`I3`I3`I3`I3`I3`I3`I3ZC/ZB.YB.YA.YA.YB.YB.YB.YB.YB.YB.YB.YB.YA-YB.YB.YB.YB.YB.YA.YB.YB.YB.ZB/ZC/\D0V?,S<(W?*YA ]D-`F/dI0eJ2gK3iL3iL3jM4jM4jM4jM4jM4jM3jM3jM4jM4jM4jM4jM4jM4jM4jM3jM4z[?

`D|^By[@tX>oS;jP8dL5`I3]F1ZD0XC/XB/WA.WA.VA.VA.VA.VA.VA.VA.VA.VA.VA.VA.VA.VA.VA.VA.VA.P<*P;*P:*P;*P;*P;*P;*P;*P;*P;*P:)P;*P;*P:*P:)P;*P;*P;*P;*P;*P;*P;*P;*P;*P;*R<*Q<)J6$L7&O:&S<)W? [B,`F/cH1fJ2hK3iL4jM4jM3kN4jM4jM4jM4jM4jM4jM3jM4jM4jM4jM3jM4jM3

`D|^Bx[@rV=lQ9fM6`H3[E1XB/U@-S?,R>,R>,Q= Q= Q= Q= Q= Q= Q= Q= Q= Q= Q= Q= Q= Q= Q= Q= Q= L8(K7&K8&K8'L8'K8'K8'K8'K8'K8'L8'K8'K8'K8'K8'K8'K8'K8'L8'K8'K8'K7&K8'K8'K8'L8(K8'D1"F2"H5#K6%P:'T=)ZA,_E.cH0fJ2hL2iL3jM3jM4jM4jM4jM4jM4jM4jM4jM4jM4jM4jM4jM4iL3

Cl#Be-?T56:B2ò"H4#L7&Q;(W? \C-aF/eI1gK2iL2kN4jM3jM3jM4jM4jM4jM4jM4jM4jM4jM4jM3jM4iL3

Al27AG3#J6%O9&T=)ZB,_E.dH0gK2iL3jM3kN4jM4jM3jM4jM4jM4jM4jM4jM4jM4jM4jM3iL3

$=ZG6'M8%R<)X@,^D.bG0gK2hL3iL4jM4jM4jM4jM4jM4jM4jM4jM4jM3jM3jM3jM3iL3

)?XO9'T=*ZA,^D.bG0dI1fJ2hL3hK3hL3iL3iL3jM3jM4jM4jM4jM3jM4jM3jM3

<<?R;(W? [B-^D.aF/cH1dI0eJ1fJ2gK3hL3iL3jL4jM4jM4jM4kM4jM4iL3

"ChN:(S<)W?*ZA ]C-_E/`F.bG/cH1eI1fJ2hK3iL3iL4jM4jM4jM3jM4iL3

(B`B0 C0!C0 C0!C1!D2!F3#H4$K7%O:'T=)YA,_E.cH0fJ1hK3iL4iL3

2T}GHKV<#R<'S<'S<'M8ó"D1!F2"H4#L7&Q;'V?*\C-bF0eI1gK2iL3jM4

yj`z[=uS/rP rO qO qO qO qO qN qN qN pN qO qN qO qO qO qO qN qN qO qN pN pN pN*pN oN oN*qO*rO tP uQ,uR,wR,vR,wS,wS,wR,wS,wS-wS-wS.xS/wS/rT4rR3pR2nP1lO0fJ-Y@)K6$G3#J6$O9'U=)ZA,_E/cH1gK2iL3iL4

];~]:}\:|[:yY8vW6rU5pR3lO0gJ.U>'H4$L7&R;(X@ ]D.bG0fJ2hL3iL4

`<vV6pR3[B,ZB,`F.dI1gK3hK3

_=tU7ZB,`F.dI1gK3hK2

eBxZ:[B-aF.dI1gK2hK3

iEyZ;[B-`F.dI0gK2hK3

iEsW<]E0aG1cI3eK4gK5gL5gL5gL5gL5gL5gL5gL5gL5gL5fL5eK4cI3aF2]E0YB.UD9Q

jFz[=[B-`F.dI1gK3hK3

iEqU;T>,[email protected]?,U> S= Q<*M>10t

kF{\=[B,`F.eJ1gK3hK3

nI}^>[B-`F.eJ1gK3hK3

oJ}_?[B,`F.dI0hL3hK3

oJ~_?[B-`F.dI1gK3hK3

`@]D.bG0eJ1hK3iM3

GetCPInfo

WinExec

GetProcessHeap

RegCloseKey

RegCreateKeyExA

RegOpenKeyExA

GetViewportOrgEx

GetViewportExtEx

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

ShellExecuteA

UnregisterHotKey

RegisterHotKey

SetWindowsHookExA

GetKeyState

CreateDialogIndirectParamA

UnhookWindowsHookEx

.text

`.rdata

@.data

.rsrc

H]

@^p.WN

c~k-V}

*CSC %Fj;

.LHD/

*6Âk

81Þ

nEb.cRw&Dz

$Ï'

:.MjQ

B:Í

.Mx&[

`]T-O}S{E

1%XJVt

@.euee

0%c<pf?

.ZHh^

.Pq k

m.pz_

V5.rN

92>>4:::444

4$1$%dh`Vp/8

%D_RE

]].eX6t0

co.KKV-C^

.cEvO:8

-EZzj}

...Fyy9

.KZb.

;u.oE

VVV"VVV&VVV*VVV,VVV-VVV.VVV-TTT/TTT-VVV*VVV(VVV%VVV$VVV!VVV

!!!|&&&o   e222[999S>>>LCCCFGGGBLLL<QQQ7QQQ4SSS2TTT.VVV*VVV'VVV$VVV VVV

!!!u(((i///_444X<<<N@@@HFFFBKKK=NNN9QQQ4SSS2TTT.VVV*VVV'VVV$VVV!VVV

VVV VVV$VVV*VVV.TTT4NNN:CCCF333W"""s

!!!t(((j---a222Y999Q???IDDDDHHH>MMM:QQQ4SSS1TTT.TTT VVV'VVV$VVV!VVV

VVV$VVV)VVV.VVV4PPP9EEED888Q&&&j

x&&&l   b222Y777R<<<KBBBDGGG?KKK:PPP5QQQ1RRR.VVV*VVV&VVV$VVV!VVV

VVV$VVV)VVV.VVV3QQQ8KKK@;;;N***d

!!!u&&&k,,,b333X888Q>>>IBBBDHHH>MMM9QQQ3QQQ1RRR.TTT)VVV&VVV#VVV VVV

!!!t%%%k,,,a111Y777P===HCCCAJJJ:NNN6QQQ1RRR.TTT TTT(VVV#VVV!VVV

u%%%k,,,a444V888O???FDDD@JJJ:NNN5QQQ1RRR.TTT)VVV&VVV#VVV VVV

VVV$VVV(VVV.VVV3SSS8NNN?@@@K000]!!!w

y$$$n***c000Z777P;;;KBBBBGGG<LLL7OOO2PPP.RRR,TTT(VVV$VVV"VVV

u%%%k   `222W777P>>>HBBBBHHH:LLL7OOO2RRR.TTT*VVV&VVV#VVV VVV

!!!t'''i,,,^333U777O<<<GCCCAJJJ9MMM4QQQ0RRR.TTT*TTT'VVV#VVV!VVV

VVV"VVV(VVV.VVV3TTT7OOO>EEEH444X$$$q

!!!r(((h---^444S999L>>>FDDD>JJJ9MMM4QQQ/RRR.TTT)VVV&VVV"VVV

y$$$n)))c000[555R;;;J@@@CFFF=JJJ8OOO2PPP.RRR,TTT(VVV$VVV!VVV

x$$$n)))c///X555P;;;JAAACFFF<KKK7OOO2PPP.RRR TTT'VVV#VVV VVV

~!!!s'''g,,,^333T888M===FCCC?HHH8LLL5PPP.RRR,TTT)VVV$VVV"VVV

{"""q'''f---]444S888K===FDDD=III6LLL3PPP.RRR TTT'VVV$VVV!VVV

z"""n)))d---Z444S999J>>>CDDD=III6OOO1PPP.RRR*TTT'VVV#VVV VVV

VVV"VVV(VVV.VVV2VVV6RRR<LLLC>>>O---b z!!!

z$$$q)))e///^555U;;;N???FDDD>III6LLL,OOO%SSS

VVV"VVV(VVV.VVV3VVV7RRR=LLLD@@@N///b y

$$$y(((n,,,`444N;;;>EEE.NNN!RRR

VVV!VVV(VVV.VVV2VVV7SSS<MMMBCCCM333]$$$r

VVV"VVV(VVV.VVV3VVV7SSS>LLLDAAAN222^"""w

VVV"VVV(VVV.VVV3VVV8RRR>LLLD???P...c z

VVV"VVV)VVV.VVV4VVV8RRR>KKKE<<<S   f

VVV!VVV(VVV.VVV4UUU:RRR>GGGG999U***h

VVV"VVV(VVV.SSS6KKK>>>>L111^!!!w

VVV&RRR.JJJ9888M%%%j

VVV&VVV2SSSABBBV555g999e@@@ZGGGNQQQ?TTT7VVV.VVV'VVV VVV

VVV$VVV.SSS8777R&&&

VVV#VVV.VVV6@@@K"""tXYZ

{)))f666QCCCCLLL7TTT.VVV(VVV"VVV

~&&&h222U???DIII7PPP.VVV'VVV!VVV

VVV$VVV.VVV8LLLD---d>?@

MR*G.Hd@

.fA@0

%X#Q;*

3cmDU*

VVV.CCCIHIJ

...PIII"VVV

%F?WJAikC

version="1.0.0.0"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel

KERNEL32.DLL

ADVAPI32.dll

COMCTL32.dll

comdlg32.dll

GDI32.dll

OLEAUT32.dll

oledlg.dll

RASAPI32.dll

SHELL32.dll

USER32.dll

WININET.dll

WINMM.dll

WINSPOOL.DRV

WS2_32.dll

.rdata

.data

20050518

346457458.exe.BOX

gdi32.dll

oleaut32.dll

KERNEL32.dll

1.1.4

WindowsNT(unknown)

Windows.NET

WindowsXP

Windows2000

WindowsNT(4.0)

WindowsNT(3.51)

Windows9x(unknown)

WindowsMe

Windows98

Windows95

:BOX:ReadCompressedSection: decompresion failed with code %d

D:\Projects\My.SRC\Teggo\MoleBox\molebox2\bootup\boxmanager.cpp

The dynamic link library '%s' could not be found

oleaout32.dll

oleoaut32.dll

imm32.dll

D:\Projects\My.SRC\Teggo\MoleBox\molebox2\bootup\mbx_DLL.cpp

MBX@%X@*.###

Error at %s:%d

-up1.txt

-up.txt

windows error %s

at %s(%d)

MBX@%X@%X.###

MBX@%X@%X@%X.###

HAS NO ACCESS TO EXECUTABLE

ESI:0xX EDI:0xX

ESP:0xX EBP:0xX EIP:0xX

EAX:0xX EDX:0xX ECX:0xX

ES :0xX FS :0xX GS :0xX

CS :0xX SS :0xX DS :0xX

__SEH__ 0x%x at 0x%x

{CC7574E4-5E39-4700-B286-269A82DD8E95}

_splashscreen.bmp

!broken!0xx:

0xx:[%s]:(x:x)

0xx:[unknown]:unknown

0xx: 0xx 0xx 0xx 0xx

ADVAPI32.DLL

CLSID\{x-x-x-xx-xxxxxx}\InprocServer32

Impor&t or Export...

Import &Windows XP Mode VM

%s Enter

C&apture Screen%s

%s PrtScn

%s Right

%s Left

&Windows

&Guest Operating System Install Guide

VMware on the &Web

O&nline Support

Request &Support

Check for &Updates on the Web

Collect &Support Data...

cmdBar

Collect Support Data

Select the virtual machines you want to collect support data for. When this process finishes (which may take several minutes) you can send the collected data to VMware for troubleshooting.

Password:

To access virtual machines on the local computer you are using, select Local host. To access virtual machines on a networked host, select Remote host and enter the host name and a valid user name and password.

&Password:

VMware Web Check

View a list of virtual machines available on this server and to select one to display in this panel. Interact with the guest operating system within this display as you would a standard PC.

Display the GSX Server configuration window. From this window you can set all of the server configuration options that affect the operation and performance characteristics of the server.

Create a new virtual machine. Install and run a variety of standard operating systems in the virtual machine.

Browse for virtual machines or teams and select one to display in this panel. Interact with the guest operating system within this display as you would a standard PC.

Select the VMware host that you want to connect to and enter a valid user name and password.

If you have forgotten your password, click this button to ask your administrator to reset the password.

&Show AutoProtect snapshots (%u hidden)

Preparing clone operation

Recovery key

You can reset the password for this ACE instance and send the hot fix back to the user.

Specify the private portion of the recovery key and the password to access this key.

&Private recovery key:

&Recovery key password:

Reset password

Choose a new password for this ACE instance.

&New password:

New password &confirm:

This new password is not displayed to the user in the hot fix. You must let the user know the new password.

You must enter its password to continue.

Enter Password

Login

%1OThe application encountered an error while running this operation

Error ID = You do not have permissions to perform this operation

VMware Workstation allows multiple standard operating systems and their applications to run with high performance in secure and transportable virtual machines. Each virtual machine is equivalent to a PC with a unique network address and full complement of hardware choices.

The VMware Virtual Machine Console lets you connect to virtual machines that run on VMware GSX Server or VMware ESX Server systems. Each virtual machine is equivalent to a physical server with storage, networking, memory and devices. The VMware Virtual Machine Console gives you full control over virtual machines, including keyboard, video and mouse interactivity.

Remove from &Favorites Legacy virtual machine for %1 %2!Current virtual machine for %1 &Unable to create a new virtual machine "%1!s!":

úiled to enter serial number:

&About %s

About %s

Product: %s

Version: %s

Suspended screenshot for %s

>VMware Configuration Files (*.vmx)|*.vmx|All files (*.*)|*.*||

please register on our Web site at "%2".

- Opportunity to receive 30 days of complimentary Web-based support

choosing "VMware on the Web" > "Register Now!"

or by visiting our Web site at: "%4"

- Activation of support and subscription services you have purchased

choosing the "VMware on the web" > "Register Now!" option,

or by visiting our Web site at: "%4"VSorry! Another client is currently submitting changes.

Remove "%s" from the Favorites?

(Port %1!d!)

DA snapshot operation is already in progress.

Please try again later.;BMP Windows Bitmap Format (*.bmp)|*.bmp|PNG (*.PNG)|*.PNG||

(%s).

9Sorry! Another client has already started this operation.

%1 has detected that your host uses a Japanese locale. However, the Japanese language is not supported with the English-only version you are running. %1 will exit now. The next time you run %1, the English language will be used.

%1 has detected that you just enabled Japanese language support. %1 will exit now. The next time you run %1, the Japanese language will be used.

Please request support and include the contents of the log file: "%2".$%s

DThis virtual machine is locked and has not been assigned a password.AThis virtual machine is locked and requires a password to use it.8Assign a password to this virtual machine and unlock it.4Enter your password and unlock this virtual machine.

Invalid UserOYour administrator has not given you permission to access this virtual machine.GThis virtual machine cannot be opened because it is a member of a team.

AVI Video Format (*.avi)|*.avi||&High (best quality for short captures) Medium (higher quality for longer captures)

1A movie capture operation cannot occur right now.

Error resetting password.

Approved on %s.

Denied on %s.

All files (*.*)|*.*||

8When this dialog box closes, &email hot fix to user (%s)

Hot fix sent on %s.

Password reset

Using custom policies2Could not find %s. Please browse for this project.[This project does not match the project we need to open this hot fix. Please browse for %s.

Guest Operating System

Please check that you have shut down your guest operating system first before powering off.

Do you want to revert to "%s"?

IP AddressRThe virtual machine %1 (%2) cannot be unregistered because it is still powered on.MThe virtual machine %1 (%2) cannot be deleted because it is still powered on.

2Please wait while %s checks for available updates.#No new %1!s! updates are available.

Check your Web browser configuration settings and your connection hardware.

The virtual machine is configured to run only within your current Windows session. When you log off of the Windows session, the virtual machine will be powered off.

If you click OK, the virtual machine will be powered off when you log off of the session.jOther connected users may be affected by this operation.

Proceed with this operation?

*Are you sure you want to close project %s?lYou can have only one project open at a time.

Are you sure you want to close '%s' and create a new project?[You can have only one project open at a time.

Are you sure you want to close project '%s'?

The password you entered is not correct. Please re-enter your password.

\There have been %1!d! invalid attempts to enter the password to unlock this virtual machine.

VMware Workstation ACE Edition lets you create, configure, distribute and support managed virtual machines that users in your organization can run at work or at home.

Unable to run %s

.The file "%1!s!" is not a valid %2!s! project.6The file "%1!s!" is not a valid %2!s! virtual machine.

VMware Workstation ACE EditionLVMware ACE Hot Fix Files (*.vmhr,*.vmhf)|*.vmhr;*.vmhf|All files (*.*)|*.*||.The file "%1!s!" is not a valid %2!s! hot fix. Unable to open hot fix file "%1!s!":

private recovery key file

Created on%new password for this virtual machine

password confirmationAThe password and confirmation are not the same. Please try again.KTo apply the hot fix, double-click the hot fix file attached to this email.wTo send the hot fix to the end user, click Send hot fix on the hot fix summary or manually send the hot fix file %1!s!.

Browse for Recovery Key

Send Hot Fix7Private Key Files (*.priv)|*.priv|All files (*.*)|*.*||

Clone Type.How do you want to clone this virtual machine?

Clone Source/Which state do you want to create a clone from?9This virtual machine has no existing cloneable snapshots.eThis virtual machine is a template. To clone it, you must create a snapshot or disable template mode.

Please specify the team name.!Please specify the team location.LThe specified team path already exists. Please specify a different location.

VMware Workstation Files (*.vmx,*.vmtm)|*.vmx;*.vmtm|VMware Configuration Files (*.vmx)|*.vmx|VMware Team Files (*.vmtm)|*.vmtm|VMware ACE Master Files (*.vmxa)|*.vmxa|VMware ACE Hot Fix Files (*.vmhr,*.vmhf)|*.vmhr;*.vmhf|Microsoft Virtual PC/Virtual Server Files (*.vmc)|*.vmc|Symantec Backup Exec Files (*.sv2i)|*.sv2i|StorageCraft ShadowProtect Files (*.spf)|*.spf|Acronis True Image Files (*.tib)|*.tib|Open Virtual Machine Format Images (*.ovf, *.ova)|*.ovf;*.ova|All image files (*.vmx,*.vmtm,*.vmc,*.sv2i,*.spf,*.tib,*.ovf,*.ova)|*.vmx;*.vmtm;*.vmc;*.sv2i;*.spf;*.tib;*.ovf;*.ova|All files (*.*)|*.*||

Add Existing Virtual Machine Add New Clone of Virtual Machine>VMware Configuration Files (*.vmx)|*.vmx|All files (*.*)|*.*||

SummaryTThe team "%1!s!" is still powered on. You must power off all teams before quitting.jThe virtual machine "%1!s!" is still powered on. You must power off all virtual machines before quitting.%The team "%1!s!" is still powered on.0The virtual machine "%1!s!" is still powered on.

key combination

HTTP Proxy=%3

Port=%4

Create New Package<Create Pocket ACE Package for Deployment to Portable Devices

Baidu.com, Inc.

1.0.3.0

Copyright(C) Baidu.com, Inc. All rights reserved.

ting_Setup.exe

%original file name%.exe_1332_rwx_00401000_002C8000:

t$(SSh

~%UVW

u$SShe

user32.dll

Kernel32.dll

kernel32.dll

wininet.dll

advapi32.dll

shlwapi.dll

EnumWindows

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

1.2.9

bbs.125.la

?hXXp://VVV.ip138.com

https

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

http=

HTTP/1.1

Content-Type: application/x-www-form-urlencoded

hXXps://

hXXp://

0@C:\Windir\wind.dat

C:\Windir\

QQ.exe

99999999

%Documents and Settings%\

D:\My Documents\Tencent Files\

C:\Users\

%Documents and Settings%\Administrator\Application Data\Tencent\Users\

scripting.FileSystemObject

&QQPassWord=

360tray.exe

360tray.exe|

360sd.exe

360sd.exe|

kxetray.exe

kxetray.exe|

QQPCTray.exe

QQPCTray.exe|

RavMonD.exe

RavMonD.exe|

avp.exe

avp.exe|

egui.exe

egui.exe|

knsdtray.exe

knsdtray.exe|

KvMonXP.exe

KvMonXP.exe|

Mcshield.exe

Mcshield.exe|

TMBMSRV.exe

TMBMSRV.exe|

hXXp://im.qq.com/pcqq/

'77/7&*\

(7),01444

'9=82<.342

~%xkW

F%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

ole32.dll

__MSVCRT_HEAP_SELECT

iphlpapi.dll

SHLWAPI.dll

MPR.dll

VERSION.dll

WSOCK32.dll

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

(%d-%d):

%ld%c

%s <%s>

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

HELO %s

SMTP

AUTH LOGIN

LOGIN

AUTH=LOGIN

EHLO %s

Content-Type: application/octet-stream; name=%s

Content-Disposition: attachment; filename=%s

MAIL FROM:<%s>

RCPT TO:<%s>

%d%d%d

rundll32.exe shell32.dll,

(*.htm;*.html)|*.htm;*.html

VVV.dywt.com.cn

.PAVCOleException@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

zcÁ

cmon.exe

adea9837ee0cc9fca523.exe

X-Powered-By: ASP.NET

c:\%original file name%.exe

`D.tR7

bE.tR7

`D~_C|]By[@vY?sW=pT;mR:kQ9jP8iO8hN7hN7hN7hN7hN7hN7hN7hN7hN7hN7hN7hN7hN7hN7hN7hN7`H3`G2`G2`G2`G2`G2`G2`G2`G2`G2`G2`F1`G2`G2`G2`G2`G2`F2`G2`G2`F1`G2`G2aH2aH2aH3ZA,Y@,\C-^D.aF0cH1fJ2gK3iL3iL4jM4jM4jM4jM3jM4jM4jM4jM4jM3jM3jM4jM4jM4jM4jM4jM3jM3z[?

`D~_C{]Ax[@tX>pU<mR:iO8fM6dK5bJ4aI4aI4`I3`I3`I3`I3`I3`I3`I3`I3`I3`I3`I3`I3`I3`I3`I3ZC/ZB.YB.YA.YA.YB.YB.YB.YB.YB.YB.YB.YB.YA-YB.YB.YB.YB.YB.YA.YB.YB.YB.ZB/ZC/\D0V?,S<(W?*YA ]D-`F/dI0eJ2gK3iL3iL3jM4jM4jM4jM4jM4jM3jM3jM4jM4jM4jM4jM4jM4jM4jM3jM4z[?

`D|^By[@tX>oS;jP8dL5`I3]F1ZD0XC/XB/WA.WA.VA.VA.VA.VA.VA.VA.VA.VA.VA.VA.VA.VA.VA.VA.VA.P<*P;*P:*P;*P;*P;*P;*P;*P;*P;*P:)P;*P;*P:*P:)P;*P;*P;*P;*P;*P;*P;*P;*P;*P;*R<*Q<)J6$L7&O:&S<)W? [B,`F/cH1fJ2hK3iL4jM4jM3kN4jM4jM4jM4jM4jM4jM3jM4jM4jM4jM3jM4jM3

`D|^Bx[@rV=lQ9fM6`H3[E1XB/U@-S?,R>,R>,Q= Q= Q= Q= Q= Q= Q= Q= Q= Q= Q= Q= Q= Q= Q= Q= Q= L8(K7&K8&K8'L8'K8'K8'K8'K8'K8'L8'K8'K8'K8'K8'K8'K8'K8'L8'K8'K8'K7&K8'K8'K8'L8(K8'D1"F2"H5#K6%P:'T=)ZA,_E.cH0fJ2hL2iL3jM3jM4jM4jM4jM4jM4jM4jM4jM4jM4jM4jM4jM4iL3

Cl#Be-?T56:B2ò"H4#L7&Q;(W? \C-aF/eI1gK2iL2kN4jM3jM3jM4jM4jM4jM4jM4jM4jM4jM4jM3jM4iL3

Al27AG3#J6%O9&T=)ZB,_E.dH0gK2iL3jM3kN4jM4jM3jM4jM4jM4jM4jM4jM4jM4jM4jM3iL3

$=ZG6'M8%R<)X@,^D.bG0gK2hL3iL4jM4jM4jM4jM4jM4jM4jM4jM4jM3jM3jM3jM3iL3

)?XO9'T=*ZA,^D.bG0dI1fJ2hL3hK3hL3iL3iL3jM3jM4jM4jM4jM3jM4jM3jM3

<<?R;(W? [B-^D.aF/cH1dI0eJ1fJ2gK3hL3iL3jL4jM4jM4jM4kM4jM4iL3

"ChN:(S<)W?*ZA ]C-_E/`F.bG/cH1eI1fJ2hK3iL3iL4jM4jM4jM3jM4iL3

(B`B0 C0!C0 C0!C1!D2!F3#H4$K7%O:'T=)YA,_E.cH0fJ1hK3iL4iL3

2T}GHKV<#R<'S<'S<'M8ó"D1!F2"H4#L7&Q;'V?*\C-bF0eI1gK2iL3jM4

yj`z[=uS/rP rO qO qO qO qO qN qN qN pN qO qN qO qO qO qO qN qN qO qN pN pN pN*pN oN oN*qO*rO tP uQ,uR,wR,vR,wS,wS,wR,wS,wS-wS-wS.xS/wS/rT4rR3pR2nP1lO0fJ-Y@)K6$G3#J6$O9'U=)ZA,_E/cH1gK2iL3iL4

];~]:}\:|[:yY8vW6rU5pR3lO0gJ.U>'H4$L7&R;(X@ ]D.bG0fJ2hL3iL4

`<vV6pR3[B,ZB,`F.dI1gK3hK3

_=tU7ZB,`F.dI1gK3hK2

eBxZ:[B-aF.dI1gK2hK3

iEyZ;[B-`F.dI0gK2hK3

iEsW<]E0aG1cI3eK4gK5gL5gL5gL5gL5gL5gL5gL5gL5gL5fL5eK4cI3aF2]E0YB.UD9Q

jFz[=[B-`F.dI1gK3hK3

iEqU;T>,[email protected]?,U> S= Q<*M>10t

kF{\=[B,`F.eJ1gK3hK3

nI}^>[B-`F.eJ1gK3hK3

oJ}_?[B,`F.dI0hL3hK3

oJ~_?[B-`F.dI1gK3hK3

`@]D.bG0eJ1hK3iM3

GetCPInfo

WinExec

GetProcessHeap

RegCloseKey

RegCreateKeyExA

RegOpenKeyExA

GetViewportOrgEx

GetViewportExtEx

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

ShellExecuteA

UnregisterHotKey

RegisterHotKey

SetWindowsHookExA

GetKeyState

CreateDialogIndirectParamA

UnhookWindowsHookEx

.text

`.rdata

@.data

.rsrc

H]

Impor&t or Export...

Import &Windows XP Mode VM

%s Enter

C&apture Screen%s

%s PrtScn

%s Right

%s Left

&Windows

&Guest Operating System Install Guide

VMware on the &Web

O&nline Support

Request &Support

Check for &Updates on the Web

Collect &Support Data...

cmdBar

Collect Support Data

Select the virtual machines you want to collect support data for. When this process finishes (which may take several minutes) you can send the collected data to VMware for troubleshooting.

Password:

To access virtual machines on the local computer you are using, select Local host. To access virtual machines on a networked host, select Remote host and enter the host name and a valid user name and password.

&Password:

VMware Web Check

View a list of virtual machines available on this server and to select one to display in this panel. Interact with the guest operating system within this display as you would a standard PC.

Display the GSX Server configuration window. From this window you can set all of the server configuration options that affect the operation and performance characteristics of the server.

Create a new virtual machine. Install and run a variety of standard operating systems in the virtual machine.

Browse for virtual machines or teams and select one to display in this panel. Interact with the guest operating system within this display as you would a standard PC.

Select the VMware host that you want to connect to and enter a valid user name and password.

If you have forgotten your password, click this button to ask your administrator to reset the password.

&Show AutoProtect snapshots (%u hidden)

Preparing clone operation

Recovery key

You can reset the password for this ACE instance and send the hot fix back to the user.

Specify the private portion of the recovery key and the password to access this key.

&Private recovery key:

&Recovery key password:

Reset password

Choose a new password for this ACE instance.

&New password:

New password &confirm:

This new password is not displayed to the user in the hot fix. You must let the user know the new password.

You must enter its password to continue.

Enter Password

Login

%1OThe application encountered an error while running this operation

Error ID = You do not have permissions to perform this operation

VMware Workstation allows multiple standard operating systems and their applications to run with high performance in secure and transportable virtual machines. Each virtual machine is equivalent to a PC with a unique network address and full complement of hardware choices.

The VMware Virtual Machine Console lets you connect to virtual machines that run on VMware GSX Server or VMware ESX Server systems. Each virtual machine is equivalent to a physical server with storage, networking, memory and devices. The VMware Virtual Machine Console gives you full control over virtual machines, including keyboard, video and mouse interactivity.

Remove from &Favorites Legacy virtual machine for %1 %2!Current virtual machine for %1 &Unable to create a new virtual machine "%1!s!":

úiled to enter serial number:

&About %s

About %s

Product: %s

Version: %s

Suspended screenshot for %s

>VMware Configuration Files (*.vmx)|*.vmx|All files (*.*)|*.*||

please register on our Web site at "%2".

- Opportunity to receive 30 days of complimentary Web-based support

choosing "VMware on the Web" > "Register Now!"

or by visiting our Web site at: "%4"

- Activation of support and subscription services you have purchased

choosing the "VMware on the web" > "Register Now!" option,

or by visiting our Web site at: "%4"VSorry! Another client is currently submitting changes.

Remove "%s" from the Favorites?

(Port %1!d!)

DA snapshot operation is already in progress.

Please try again later.;BMP Windows Bitmap Format (*.bmp)|*.bmp|PNG (*.PNG)|*.PNG||

(%s).

9Sorry! Another client has already started this operation.

%1 has detected that your host uses a Japanese locale. However, the Japanese language is not supported with the English-only version you are running. %1 will exit now. The next time you run %1, the English language will be used.

%1 has detected that you just enabled Japanese language support. %1 will exit now. The next time you run %1, the Japanese language will be used.

Please request support and include the contents of the log file: "%2".$%s

DThis virtual machine is locked and has not been assigned a password.AThis virtual machine is locked and requires a password to use it.8Assign a password to this virtual machine and unlock it.4Enter your password and unlock this virtual machine.

Invalid UserOYour administrator has not given you permission to access this virtual machine.GThis virtual machine cannot be opened because it is a member of a team.

AVI Video Format (*.avi)|*.avi||&High (best quality for short captures) Medium (higher quality for longer captures)

1A movie capture operation cannot occur right now.

Error resetting password.

Approved on %s.

Denied on %s.

All files (*.*)|*.*||

8When this dialog box closes, &email hot fix to user (%s)

Hot fix sent on %s.

Password reset

Using custom policies2Could not find %s. Please browse for this project.[This project does not match the project we need to open this hot fix. Please browse for %s.

Guest Operating System

Please check that you have shut down your guest operating system first before powering off.

Do you want to revert to "%s"?

IP AddressRThe virtual machine %1 (%2) cannot be unregistered because it is still powered on.MThe virtual machine %1 (%2) cannot be deleted because it is still powered on.

2Please wait while %s checks for available updates.#No new %1!s! updates are available.

Check your Web browser configuration settings and your connection hardware.

The virtual machine is configured to run only within your current Windows session. When you log off of the Windows session, the virtual machine will be powered off.

If you click OK, the virtual machine will be powered off when you log off of the session.jOther connected users may be affected by this operation.

Proceed with this operation?

*Are you sure you want to close project %s?lYou can have only one project open at a time.

Are you sure you want to close '%s' and create a new project?[You can have only one project open at a time.

Are you sure you want to close project '%s'?

The password you entered is not correct. Please re-enter your password.

\There have been %1!d! invalid attempts to enter the password to unlock this virtual machine.

VMware Workstation ACE Edition lets you create, configure, distribute and support managed virtual machines that users in your organization can run at work or at home.

Unable to run %s

.The file "%1!s!" is not a valid %2!s! project.6The file "%1!s!" is not a valid %2!s! virtual machine.

VMware Workstation ACE EditionLVMware ACE Hot Fix Files (*.vmhr,*.vmhf)|*.vmhr;*.vmhf|All files (*.*)|*.*||.The file "%1!s!" is not a valid %2!s! hot fix. Unable to open hot fix file "%1!s!":

private recovery key file

Created on%new password for this virtual machine

password confirmationAThe password and confirmation are not the same. Please try again.KTo apply the hot fix, double-click the hot fix file attached to this email.wTo send the hot fix to the end user, click Send hot fix on the hot fix summary or manually send the hot fix file %1!s!.

Browse for Recovery Key

Send Hot Fix7Private Key Files (*.priv)|*.priv|All files (*.*)|*.*||

Clone Type.How do you want to clone this virtual machine?

Clone Source/Which state do you want to create a clone from?9This virtual machine has no existing cloneable snapshots.eThis virtual machine is a template. To clone it, you must create a snapshot or disable template mode.

Please specify the team name.!Please specify the team location.LThe specified team path already exists. Please specify a different location.

VMware Workstation Files (*.vmx,*.vmtm)|*.vmx;*.vmtm|VMware Configuration Files (*.vmx)|*.vmx|VMware Team Files (*.vmtm)|*.vmtm|VMware ACE Master Files (*.vmxa)|*.vmxa|VMware ACE Hot Fix Files (*.vmhr,*.vmhf)|*.vmhr;*.vmhf|Microsoft Virtual PC/Virtual Server Files (*.vmc)|*.vmc|Symantec Backup Exec Files (*.sv2i)|*.sv2i|StorageCraft ShadowProtect Files (*.spf)|*.spf|Acronis True Image Files (*.tib)|*.tib|Open Virtual Machine Format Images (*.ovf, *.ova)|*.ovf;*.ova|All image files (*.vmx,*.vmtm,*.vmc,*.sv2i,*.spf,*.tib,*.ovf,*.ova)|*.vmx;*.vmtm;*.vmc;*.sv2i;*.spf;*.tib;*.ovf;*.ova|All files (*.*)|*.*||

Add Existing Virtual Machine Add New Clone of Virtual Machine>VMware Configuration Files (*.vmx)|*.vmx|All files (*.*)|*.*||

SummaryTThe team "%1!s!" is still powered on. You must power off all teams before quitting.jThe virtual machine "%1!s!" is still powered on. You must power off all virtual machines before quitting.%The team "%1!s!" is still powered on.0The virtual machine "%1!s!" is still powered on.

key combination

HTTP Proxy=%3

Port=%4

Create New Package<Create Pocket ACE Package for Deployment to Portable Devices

%original file name%.exe_1332_rwx_007B0000_00002000:

version="1.0.0.0"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel

KERNEL32.DLL

ADVAPI32.dll

COMCTL32.dll

comdlg32.dll

GDI32.dll

ole32.dll

OLEAUT32.dll

oledlg.dll

RASAPI32.dll

SHELL32.dll

USER32.dll

WININET.dll

WINMM.dll

WINSPOOL.DRV

WS2_32.dll

RegCloseKey

Baidu.com, Inc.

1.0.3.0

Copyright(C) Baidu.com, Inc. All rights reserved.

ting_Setup.exe

%original file name%.exe_1332_rwx_007B3000_0001A000:

.rsrc

.text

.rdata

.data

20050518

346457458.exe.BOX

kernel32.dll

gdi32.dll

user32.dll

ole32.dll

advapi32.dll

oleaut32.dll

KERNEL32.dll

USER32.dll

1.1.4

WindowsNT(unknown)

Windows.NET

WindowsXP

Windows2000

WindowsNT(4.0)

WindowsNT(3.51)

Windows9x(unknown)

WindowsMe

Windows98

Windows95

EnumWindows

:BOX:ReadCompressedSection: decompresion failed with code %d

D:\Projects\My.SRC\Teggo\MoleBox\molebox2\bootup\boxmanager.cpp

The dynamic link library '%s' could not be found

oleaout32.dll

oleoaut32.dll

imm32.dll

D:\Projects\My.SRC\Teggo\MoleBox\molebox2\bootup\mbx_DLL.cpp

MBX@%X@*.###

Error at %s:%d

-up1.txt

-up.txt

windows error %s

at %s(%d)

MBX@%X@%X.###

MBX@%X@%X@%X.###

HAS NO ACCESS TO EXECUTABLE

ESI:0xX EDI:0xX

ESP:0xX EBP:0xX EIP:0xX

EAX:0xX EDX:0xX ECX:0xX

ES :0xX FS :0xX GS :0xX

CS :0xX SS :0xX DS :0xX

__SEH__ 0x%x at 0x%x

{CC7574E4-5E39-4700-B286-269A82DD8E95}

_splashscreen.bmp

!broken!0xx:

0xx:[%s]:(x:x)

0xx:[unknown]:unknown

0xx: 0xx 0xx 0xx 0xx

ADVAPI32.DLL

CLSID\{x-x-x-xx-xxxxxx}\InprocServer32

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ip138[1].htm (3745 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ic[1].htm (224 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.