Trojan.Win32.Sasfis_f592659e2b

by malwarelabrobot on March 24th, 2016 in Malware Descriptions.

Trojan.Win32.Scar.hfot (Kaspersky), Gen:Variant.Symmi.2729 (B) (Emsisoft), Trojan.Win32.Sasfis.FD, VirTool.Win32.DelfInject.FD, GenericInjector.YR (Lavasoft MAS)
Behaviour: Trojan, VirTool


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: f592659e2b0c0c428d2f78e716bb8024
SHA1: f91229559603931f391350c0eb6d0e4b5537963d
SHA256: 979e8b610268c843958e36534b8195e4448bbab11e2ca54deb1a0b36d9f23655
SSDeep: 6144:mCETCo8xh5516v 2UUA/HH6s7ejUxVPw/8kfvpIW06Br:qeoMLl2UUmLlxtw/82Iat
Size: 294912 bytes
File type: PE32
Platform: WIN32
Entropy: Packed
PEID: UPXv0896v102v105v122Delphistub, UPolyXv05_v6
Company:
Created at: 1992-06-20 01:22:17
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

Server.exe:1528
%original file name%.exe:1004

The Trojan injects its code into the following process(es):

svchost.exe:160

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1004 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Win\MSstart.exe (1425 bytes)
%WinDir%\SpyNet\Server.exe (1425 bytes)

Registry activity

The process Server.exe:1528 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "17 7B D3 1F 0E 92 E2 20 E9 74 12 D5 43 8D 75 64"

[HKCU\Software\Microsoft\--((SpyNet))--]
"InstalledServer" = "%WinDir%\SpyNet\Server.exe"

The process %original file name%.exe:1004 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{2J58XP0K-ERQO-J3F4-1E5X-JB44DFP82S24}]
"StubPath" = "%WinDir%\SpyNet\Server.exe restart"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%WinDir%\SpyNet]
"server.exe" = "Server"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"Server" = "%WinDir%\SpyNet\Server.exe"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F7 C5 F1 F7 BA 3F A0 83 D3 09 27 F8 A5 76 C7 D4"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"load" = "C:\Win\MSstart.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Server" = "%WinDir%\SpyNet\Server.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"load" = "C:\Win\MSstart.exe"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan adds the reference to itself to be executed when a user logs on:

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell" = "explorer.exe %WinDir%\SpyNet\Server.exe"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Server" = "%WinDir%\SpyNet\Server.exe"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan adds the reference to itself to be executed when a user logs on:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell" = "explorer.exe %WinDir%\SpyNet\Server.exe"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Server" = "%WinDir%\SpyNet\Server.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Server" = "%WinDir%\SpyNet\Server.exe"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
UPX0 4096 684032 0 0 d41d8cd98f00b204e9800998ecf8427e
UPX1 688128 282624 281600 5.49252 fa16b4e4fb164adb4f726b7208ba99d6
.rsrc 970752 12288 12288 3.08291 2644ae80a2df640cda4403ea2716416d

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

svchost.exe_160:

`.rsrc
kernel32.dll
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
EInvalidOperation
u%CNu
%s[%d]
EIdCanNotBindPortInRange
EIdInvalidPortRange(,
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStreamVCL.pas
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdGlobal.pas
WS2_32.DLL
MSWSOCK.DLL
getservbyport
WSAAsyncGetServByPort
WSAJoinLeaf
WSARecvMsg
WSASendMsg
Wship6.dll
Fwpuclnt.dll
TIdSocketListWindows
TIdStackWindowsU
Kernel32.dll
EIdIPVersionUnsupportedT
127.0.0.1
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStack.pas
EIdPortRequiredp
EIdTCPConnectionError
EIdObjectTypeNotSupported
ftpTransfer
ftpReady
ftpAborted
PortT
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandler.pas
ClientPortMin
ClientPortMax
Port
"EIdTransparentProxyUDPNotSupported
TIdTCPConnection
IdTCPConnection
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandlerStack.pas
TIdTCPClientCustom
TIdTCPClientCustomDh
IdTCPClient
TIdTCPClient
BoundPortT
%EIdSocksUDPNotSupportedBySOCKSVersion
saUsernamePassword
Password
0.0.0.1
0.0.0.0
BoundPort
DefaultPort
ole32.dll
sqlite3_bind_blob
sqlite3_bind_text
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_index
sqlite3_open
sqlite3_close
sqlite3_errmsg
sqlite3_errcode
sqlite3_free
sqlite3_prepare_v2
sqlite3_column_count
sqlite3_column_name
sqlite3_column_decltype
sqlite3_step
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_double
sqlite3_column_text
sqlite3_column_type
sqlite3_column_int64
sqlite3_finalize
sqlite3_reset
SQL error or missing database
An internal logic error in SQLite
Operation terminated by sqlite3_interrupt()
Uses OS features not supported on host
2nd parameter to sqlite3_bind out of range
sqlite3_step() has another row ready
sqlite3_step() has finished executing
Unknown SQLite Error Code "
ESQLiteException
TSQLiteDatabase
TSQLiteTable
Failed to open database "%s" : %s
Failed to open database "%s" : unknown error
Error [%d]: %s.
"%s": %s
Error executing SQL
Could not prepare SQL statement
Error executing SQL statement
SQLite is Busy
SOFTWARE\Mozilla\Mozilla Firefox
SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox
SOFTWARE\Mozilla\Mozilla Firefox\
SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\
1234567890.
mozsqlite3.dll
sqlite3.dll
MSVCR100.dll
mozglue.dll
mozcrt19.dll
mozutils.dll
nspr4.dll
plc4.dll
plds4.dll
nssutil3.dll
nss3.dll
PK11_GetInternalKeySlot
\Mozilla\Firefox\profiles.ini
\Mozilla\Firefox\
signons.sqlite
SELECT * FROM moz_logins
encryptedPassword
SOFTWARE\Microsoft\Windows\CurrentVersion
Microsoft\Network\Connections\pbk\rasphone.pbk
rasapi32.dll
rnaph.dll
RAS Passwords
advapi32.dll
crypt32.dll
uURLHistory
abe2869f-9b47-4cd9-a358-c22904dba7f7
UnitPasswords
WindowsLive:name=*
\Mozilla Firefox\
softokn3.dll
userenv.dll
profiles.ini
\signons3.txt
\signons2.txt
\signons1.txt
\signons.txt
\\.\pipe\wzcsvc_wep_keys
winlogon.exe
SafariPasswordRecovery
AVURLProtocol_Classic
\Apple Computer\Preferences\keychain.plist
\Apple\Apple Application Support\CFNetwork.dll
hXXp://
PTF://
*PTF://
hXXps://
gdiplus.dll
GdiplusShutdown
EInvalidGraphicOperation
WbemScripting.SWbemLocator
%s\%s
SELECT * FROM %s
pathToSignedProductExe
pathToSignedReportingExe
WbemScripting.SWbemDateTime
HExecQuery
TargetOperatingSystem
NumberOfMediaSupported
PowerManagementSupported
SCSIPort
Select * from Win32_Keyboard
NumberOfFunctionKeys
MaxMemorySupported
Monochrome
ProtocolSupported
AdminPasswordStatus
BootROMSupported
InfraredSupported
KeyboardPasswordStatus
PowerOnPasswordStatus
SupportContactDescription
Select * from Win32_OperatingSystem
WindowsDirectory
Select Caption,BuildNumber,CSDVersion from Win32_OperatingSystem
TKeylogger
TIdTCPClientNew
Please, send a email to SpyNetCoder ---> [email protected]
TWebcam
ISO_646.irv:1991
ISO_646.basic:1983
ISO_646.irv:1983
csISO16Portuguese
csISO84Portuguese2
windows-936
csShiftJIS
windows-874
ISO-8859-1-Windows-3.0-Latin-1
csWindows30Latin1
ISO-8859-1-Windows-3.1-Latin-1
csWindows31Latin1
ISO-8859-2-Windows-Latin-2
csWindows31Latin2
ISO-8859-9-Windows-Latin-5
csWindows31Latin5
csMicrosoftPublishing
Windows-31J
csWindows31J
PTCP154
csPTCP154
windows-1250
windows-1251
windows-1252
windows-1253
windows-1254
windows-1255
windows-1256
windows-1257
windows-1258
HTTP-EQUIV
()<>@,;:\"./
()<>@,;:\"/[]?=
()<>@,;:\"/[]?={}
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdThread.pas
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdScheduler.pas
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdServerIOHandlerSocket.pas
IdCustomTCPServer
TIdCustomTCPServer
TIdCustomTCPServerX
DefaultPortt
EIdTCPServerError
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCustomTCPServer.pas
EIdTCPNoOnExecute
TIdTCPServer
IdTCPServer
OnExecute
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdSchedulerOfThread.pas
%s User
CmdDelimiter
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCommandHandlers.pas
'TIdCmdTCPServerAfterCommandHandlerEvent
TIdCmdTCPServer
(TIdCmdTCPServerBeforeCommandHandlerEvent
IdCmdTCPServer
Displays commands that the servers supports.
TIdTCPStream
IdRead() method of TIdTCPStream class does not support seeking
TIdHTTPProxyTransferMode
TIdHTTPProxyServerContext
TIdHTTPProxyServerContextlS
TOnHTTPContextEvent
TOnHTTPDocument
TIdHTTPProxyServer
OnHTTPBeforeCommand
OnHTTPResponse8T
OnHTTPDocument
HTTP/1.0
HTTP/1.0 200 Connection established
HNetCfg.NATUPnP
StaticPortMappingCollection
PSAPI.dll
shlwapi.dll
TSendKey
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SetupApi.dll
SetupDiOpenClassRegKey
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKeyExW
SetupDiCreateDeviceInterfaceRegKeyA
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiOpenDeviceInterfaceRegKey
SetupDiDeleteDeviceInterfaceRegKey
SetupDiCreateDevRegKeyA
SetupDiCreateDevRegKeyW
SetupDiOpenDevRegKey
SetupDiDeleteDevRegKey
CM_DEVCAP_LOCKSUPPORTED
CM_DEVCAP_EJECTSUPPORTED
PDCAP_D0_SUPPORTED
PDCAP_D1_SUPPORTED
PDCAP_D2_SUPPORTED
PDCAP_D3_SUPPORTED
PDCAP_WAKE_FROM_D0_SUPPORTED
PDCAP_WAKE_FROM_D1_SUPPORTED
PDCAP_WAKE_FROM_D2_SUPPORTED
PDCAP_WAKE_FROM_D3_SUPPORTED
PDCAP_WARM_EJECT_SUPPORTED
iphlpapi.dll
AllocateAndGetTcpExTableFromStack
AllocateAndGetUdpExTableFromStack
AllocateAndGetTcpTableFromStack
AllocateAndGetUdpTableFromStack
SetTcpEntry
GetExtendedTcpTable
GetExtendedUdpTable
TWebcamThread
Shell.Application
SHFileOperationW
\Opera\Opera\wand.dat
\Google\Chrome\User Data\Default\Web Data
\Google\Chrome\User Data\Default\Login Data
TNewFTPThreadU
CDO.Message
CDO.Configuration
hXXp://schemas.microsoft.com/cdo/configuration/smtpusessl
hXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticate
hXXp://schemas.microsoft.com/cdo/configuration/sendusername
hXXp://schemas.microsoft.com/cdo/configuration/sendpassword
hXXp://schemas.microsoft.com/cdo/configuration/smtpserver
hXXp://schemas.microsoft.com/cdo/configuration/sendusing
hXXp://schemas.microsoft.com/cdo/configuration/smtpserverport
VBoxService.exe
SbieDll.dll
dbghelp.dll
Software\Microsoft\Windows\CurrentVersion
55274-640-2673064-23950
76487-644-3177037-23510
76487-337-8429955-22614
\\.\SICE
\\.\NTICE
drivers\sice.sys
drivers\ntice.sys
drivers\syser.sys
drivers\winice.sys
drivers\sice.vxd
drivers\winice.vxd
winice.vxd
vmm32\winice.vxd
sice.vxd
vmm32\sice.vxd
\\.\SIWVID
\\.\TRW
\\.\TWX
\\.\ICEEXT
1.2.3
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
?456789:;<=
!"#$%&'()* ,-./0123
com.apple.Safari
com.apple.Safari0123456789ABCDEF
KWindows
.ScktComp
WebcamAPI
IdStackWindows
UnitKeylogger
UnitServerPass
UnitExecutarComandos
UnitSendFTPFiles
UnitListarPortasAtivas
Usndkey32
sUnitWindows
IdTCPStream
 IdTCPServer
4UnitStartWebcam
OperaPasswords
ZPasswordRecovery
KuURLHistory
IEpasswords
UnitChrome
SQLite3
SQLiteTable3
UnitFireFox3_5
SetNamedPipeHandleState
GetWindowsDirectoryW
GetProcessHeap
GetCPInfo
DisconnectNamedPipe
CreatePipe
CreateNamedPipeA
RegOpenKeyExW
RegOpenKeyExA
RegOpenKeyW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyW
RegCloseKey
RegEnumKeyExA
RegQueryInfoKeyA
CryptImportKey
CryptSetKeyParam
CryptDestroyKey
ShellExecuteW
FindExecutableW
SHDeleteKeyW
URLDownloadToFileW
keybd_event
VkKeyScanW
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowsHookExA
SetKeyboardState
MsgWaitForMultipleObjects
MapVirtualKeyW
MapVirtualKeyA
GetKeyboardState
GetKeyboardLayout
GetKeyState
ExitWindowsEx
EnumWindows
GetKeyboardType
FtpPutFileW
FtpSetCurrentDirectoryW
.idata
.rdata
P.reloc
P.rsrc
KERNEL32.DLL
AVICAP32.DLL
gdi32.dll
mpr.dll
msacm32.dll
ntdll.dll
powrprof.dll
pstorec.dll
shell32.dll
URLMON.DLL
user32.dll
wininet.dll
winmm.dll
wsock32.dll
x.html
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\RunOnce
Win\MSstart.exe
Software\Microsoft\Windows NT\CurrentVersion\Windows
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
explorer.exe "
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
explorer.exe
hXXp://VVV.uol.com.br/
hXXp://mail.terra.com.br/
hXXps://VVV.google.com/accounts/servicelogin
hXXps://my.screenname.aol.com/_cqr/login/login.psp
hXXp://VVV.lycos.com
hXXp://VVV.myspace.com
Portugal
Turkey
TargetOperatingSystem:
NumberOfMediaSupported:
PowerManagementSupported:
SCSIPort:
NumberOfFunctionKeys:
Password:
MaxMemorySupported:
Monochrome:
ProtocolSupported:
AdminPasswordStatus:
BootROMSupported:
InfraredSupported:
KeyboardPasswordStatus:
PowerOnPasswordStatus:
SupportContactDescription:
WindowsDirectory:
[Execute]
SpyNetKeylogger
keylogger
WEBCAM
uploadandexecute
uploadandexecuteyes|
uploadandexecuteno|
*<>#%"{}|\^[]`
:LocalSubNet:Enabled:@xpsperes.dll,-22006
SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_CURRENT_CONFIG
Invalid Key Name
Invalid KeyName
software\microsoft\windows\currentversion\uninstall\
webcamstream2|
webcam|webcamstream|
webcamstop2|
webcam|webcamstop|
webcamstart
webcamstart2
*.jpg
keyloggernew
c:\users\rafael\desktop\TESTE\
keylogger|mouseloggerbuffer|
OPERA|
CHROME|
keylogger|mouseloggerstart|
keylogger|mouseloggerstop|
keylogger|keyloggerativar|F|
keylogger|keyloggerativar|T|
keylogger|keyloggeronlinekey|
webcamlist|
getpasswords|
webcam
FirstExecution
SelfDelete.bat
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
rar.exe
rarreg.key
filemanager|fmsendftpyes|
filemanager|fmsendftpno|
webcamlist
downexec
openweb
getpasswords
getpasswords|START
chromepass
chromepass|
sendkeyswindow
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
listarportas
listarportas|listadeportasativas|
listarportasdns
listarportas|finalizarconexao|
finalizarprocessoportas
listarportas|finalizarprocessoportas|Y|
listarportas|finalizarprocessoportas|N|
tecaladoexecutar
webcam2
webcamconfig
keylogger|keyloggeronlinestart|
keylogger|keyloggeronlinestop|
logs_*.txt
keylogger|keylogger|
keyloggerativar
keyloggerdesativar
keyloggerbaixar
keylogger|keyloggerbaixar|
keylogger|keyloggerbaixar|NOLOGS
keyloggerexcluir
keylogger|keyloggerexcluir|
keyloggeronlinestart
keyloggeronlinestop
MouseLoggerWindows
fmexecnormal
filemanager|fmexecnormal|
fmexechide
filemanager|fmexechide|
fmexecparam
filemanager|fmexecparam|F|
filemanager|fmexecparam|T|
fmsendftp
filemanager|fmsendftp|
keysearch
Logs_*.txt
keysearch|YES
keysearch|NO
keyboardinfo
getcompinfo|getcompinfo|keyboardinfo|
ÞFAULTBROWSER%
Unsupported clipboard format
Canvas does not allow drawing Clipboard does not support Icons
Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.
Reply Code is not valid: %s
Reply Code already exists: %s Thread must be specified for the scheduler.!You must have an OnExecute event.7Cannot change the scheduler while the server is Active.
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
File "%s" not found
Object type not supported.
5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
Command not supported.
Address type not supported."%d: Circular links are not allowed"Not enough data in buffer. (%d/%d)
Stack already created.1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.
Invalid Port Range (%d - %d)
%s is not a valid service.
%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.
Set Size Exceeded.)UDP is not support in this SOCKS version.
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Operation already in progress.
Socket operation on non-socket.
Protocol not supported.
Socket type not supported."Operation not supported on socket.
Protocol family not supported.0Address family not supported by protocol family.
&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Connecting to %s.
Socket Error # %d
Operation would block.
Operation now in progress.
%s.Seek not implemented$Operation not allowed on sorted list
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)
Invalid destination array"Character index out of bounds (%d)
Start index out of bounds (%d)
Invalid count (%d)
Invalid destination index (%d)
Invalid codepage (%d)-Error on call to Winsock2 library function %s
ECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s$''%s'' is not a valid component name
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Ancestor for '%s' not found
Cannot assign a %s to a %s
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Operation aborted(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value('%s' is not a valid floating point value
I/O error %d
Integer overflow Invalid floating point operation

svchost.exe_160_rwx_00C80000_000F0000:

`.rsrc
kernel32.dll
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
EInvalidOperation
u%CNu
%s[%d]
EIdCanNotBindPortInRange
EIdInvalidPortRange(,
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStreamVCL.pas
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdGlobal.pas
WS2_32.DLL
MSWSOCK.DLL
getservbyport
WSAAsyncGetServByPort
WSAJoinLeaf
WSARecvMsg
WSASendMsg
Wship6.dll
Fwpuclnt.dll
TIdSocketListWindows
TIdStackWindowsU
Kernel32.dll
EIdIPVersionUnsupportedT
127.0.0.1
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\System\IdStack.pas
EIdPortRequiredp
EIdTCPConnectionError
EIdObjectTypeNotSupported
ftpTransfer
ftpReady
ftpAborted
PortT
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandler.pas
ClientPortMin
ClientPortMax
Port
"EIdTransparentProxyUDPNotSupported
TIdTCPConnection
IdTCPConnection
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdIOHandlerStack.pas
TIdTCPClientCustom
TIdTCPClientCustomDh
IdTCPClient
TIdTCPClient
BoundPortT
%EIdSocksUDPNotSupportedBySOCKSVersion
saUsernamePassword
Password
0.0.0.1
0.0.0.0
BoundPort
DefaultPort
ole32.dll
sqlite3_bind_blob
sqlite3_bind_text
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_index
sqlite3_open
sqlite3_close
sqlite3_errmsg
sqlite3_errcode
sqlite3_free
sqlite3_prepare_v2
sqlite3_column_count
sqlite3_column_name
sqlite3_column_decltype
sqlite3_step
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_double
sqlite3_column_text
sqlite3_column_type
sqlite3_column_int64
sqlite3_finalize
sqlite3_reset
SQL error or missing database
An internal logic error in SQLite
Operation terminated by sqlite3_interrupt()
Uses OS features not supported on host
2nd parameter to sqlite3_bind out of range
sqlite3_step() has another row ready
sqlite3_step() has finished executing
Unknown SQLite Error Code "
ESQLiteException
TSQLiteDatabase
TSQLiteTable
Failed to open database "%s" : %s
Failed to open database "%s" : unknown error
Error [%d]: %s.
"%s": %s
Error executing SQL
Could not prepare SQL statement
Error executing SQL statement
SQLite is Busy
SOFTWARE\Mozilla\Mozilla Firefox
SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox
SOFTWARE\Mozilla\Mozilla Firefox\
SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\
1234567890.
mozsqlite3.dll
sqlite3.dll
MSVCR100.dll
mozglue.dll
mozcrt19.dll
mozutils.dll
nspr4.dll
plc4.dll
plds4.dll
nssutil3.dll
nss3.dll
PK11_GetInternalKeySlot
\Mozilla\Firefox\profiles.ini
\Mozilla\Firefox\
signons.sqlite
SELECT * FROM moz_logins
encryptedPassword
SOFTWARE\Microsoft\Windows\CurrentVersion
Microsoft\Network\Connections\pbk\rasphone.pbk
rasapi32.dll
rnaph.dll
RAS Passwords
advapi32.dll
crypt32.dll
uURLHistory
abe2869f-9b47-4cd9-a358-c22904dba7f7
UnitPasswords
WindowsLive:name=*
\Mozilla Firefox\
softokn3.dll
userenv.dll
profiles.ini
\signons3.txt
\signons2.txt
\signons1.txt
\signons.txt
\\.\pipe\wzcsvc_wep_keys
winlogon.exe
SafariPasswordRecovery
AVURLProtocol_Classic
\Apple Computer\Preferences\keychain.plist
\Apple\Apple Application Support\CFNetwork.dll
hXXp://
PTF://
*PTF://
hXXps://
gdiplus.dll
GdiplusShutdown
EInvalidGraphicOperation
WbemScripting.SWbemLocator
%s\%s
SELECT * FROM %s
pathToSignedProductExe
pathToSignedReportingExe
WbemScripting.SWbemDateTime
HExecQuery
TargetOperatingSystem
NumberOfMediaSupported
PowerManagementSupported
SCSIPort
Select * from Win32_Keyboard
NumberOfFunctionKeys
MaxMemorySupported
Monochrome
ProtocolSupported
AdminPasswordStatus
BootROMSupported
InfraredSupported
KeyboardPasswordStatus
PowerOnPasswordStatus
SupportContactDescription
Select * from Win32_OperatingSystem
WindowsDirectory
Select Caption,BuildNumber,CSDVersion from Win32_OperatingSystem
TKeylogger
TIdTCPClientNew
Please, send a email to SpyNetCoder ---> [email protected]
TWebcam
ISO_646.irv:1991
ISO_646.basic:1983
ISO_646.irv:1983
csISO16Portuguese
csISO84Portuguese2
windows-936
csShiftJIS
windows-874
ISO-8859-1-Windows-3.0-Latin-1
csWindows30Latin1
ISO-8859-1-Windows-3.1-Latin-1
csWindows31Latin1
ISO-8859-2-Windows-Latin-2
csWindows31Latin2
ISO-8859-9-Windows-Latin-5
csWindows31Latin5
csMicrosoftPublishing
Windows-31J
csWindows31J
PTCP154
csPTCP154
windows-1250
windows-1251
windows-1252
windows-1253
windows-1254
windows-1255
windows-1256
windows-1257
windows-1258
HTTP-EQUIV
()<>@,;:\"./
()<>@,;:\"/[]?=
()<>@,;:\"/[]?={}
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdThread.pas
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdScheduler.pas
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdServerIOHandlerSocket.pas
IdCustomTCPServer
TIdCustomTCPServer
TIdCustomTCPServerX
DefaultPortt
EIdTCPServerError
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCustomTCPServer.pas
EIdTCPNoOnExecute
TIdTCPServer
IdTCPServer
OnExecute
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdSchedulerOfThread.pas
%s User
CmdDelimiter
C:\Users\Rafael\Desktop\Spy-Net XE2\Servidor\Indy10\Core\IdCommandHandlers.pas
'TIdCmdTCPServerAfterCommandHandlerEvent
TIdCmdTCPServer
(TIdCmdTCPServerBeforeCommandHandlerEvent
IdCmdTCPServer
Displays commands that the servers supports.
TIdTCPStream
IdRead() method of TIdTCPStream class does not support seeking
TIdHTTPProxyTransferMode
TIdHTTPProxyServerContext
TIdHTTPProxyServerContextlS
TOnHTTPContextEvent
TOnHTTPDocument
TIdHTTPProxyServer
OnHTTPBeforeCommand
OnHTTPResponse8T
OnHTTPDocument
HTTP/1.0
HTTP/1.0 200 Connection established
HNetCfg.NATUPnP
StaticPortMappingCollection
PSAPI.dll
shlwapi.dll
TSendKey
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SetupApi.dll
SetupDiOpenClassRegKey
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKeyExW
SetupDiCreateDeviceInterfaceRegKeyA
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiOpenDeviceInterfaceRegKey
SetupDiDeleteDeviceInterfaceRegKey
SetupDiCreateDevRegKeyA
SetupDiCreateDevRegKeyW
SetupDiOpenDevRegKey
SetupDiDeleteDevRegKey
CM_DEVCAP_LOCKSUPPORTED
CM_DEVCAP_EJECTSUPPORTED
PDCAP_D0_SUPPORTED
PDCAP_D1_SUPPORTED
PDCAP_D2_SUPPORTED
PDCAP_D3_SUPPORTED
PDCAP_WAKE_FROM_D0_SUPPORTED
PDCAP_WAKE_FROM_D1_SUPPORTED
PDCAP_WAKE_FROM_D2_SUPPORTED
PDCAP_WAKE_FROM_D3_SUPPORTED
PDCAP_WARM_EJECT_SUPPORTED
iphlpapi.dll
AllocateAndGetTcpExTableFromStack
AllocateAndGetUdpExTableFromStack
AllocateAndGetTcpTableFromStack
AllocateAndGetUdpTableFromStack
SetTcpEntry
GetExtendedTcpTable
GetExtendedUdpTable
TWebcamThread
Shell.Application
SHFileOperationW
\Opera\Opera\wand.dat
\Google\Chrome\User Data\Default\Web Data
\Google\Chrome\User Data\Default\Login Data
TNewFTPThreadU
CDO.Message
CDO.Configuration
hXXp://schemas.microsoft.com/cdo/configuration/smtpusessl
hXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticate
hXXp://schemas.microsoft.com/cdo/configuration/sendusername
hXXp://schemas.microsoft.com/cdo/configuration/sendpassword
hXXp://schemas.microsoft.com/cdo/configuration/smtpserver
hXXp://schemas.microsoft.com/cdo/configuration/sendusing
hXXp://schemas.microsoft.com/cdo/configuration/smtpserverport
VBoxService.exe
SbieDll.dll
dbghelp.dll
Software\Microsoft\Windows\CurrentVersion
55274-640-2673064-23950
76487-644-3177037-23510
76487-337-8429955-22614
\\.\SICE
\\.\NTICE
drivers\sice.sys
drivers\ntice.sys
drivers\syser.sys
drivers\winice.sys
drivers\sice.vxd
drivers\winice.vxd
winice.vxd
vmm32\winice.vxd
sice.vxd
vmm32\sice.vxd
\\.\SIWVID
\\.\TRW
\\.\TWX
\\.\ICEEXT
1.2.3
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
?456789:;<=
!"#$%&'()* ,-./0123
com.apple.Safari
com.apple.Safari0123456789ABCDEF
KWindows
.ScktComp
WebcamAPI
IdStackWindows
UnitKeylogger
UnitServerPass
UnitExecutarComandos
UnitSendFTPFiles
UnitListarPortasAtivas
Usndkey32
sUnitWindows
IdTCPStream
 IdTCPServer
4UnitStartWebcam
OperaPasswords
ZPasswordRecovery
KuURLHistory
IEpasswords
UnitChrome
SQLite3
SQLiteTable3
UnitFireFox3_5
SetNamedPipeHandleState
GetWindowsDirectoryW
GetProcessHeap
GetCPInfo
DisconnectNamedPipe
CreatePipe
CreateNamedPipeA
RegOpenKeyExW
RegOpenKeyExA
RegOpenKeyW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyW
RegCloseKey
RegEnumKeyExA
RegQueryInfoKeyA
CryptImportKey
CryptSetKeyParam
CryptDestroyKey
ShellExecuteW
FindExecutableW
SHDeleteKeyW
URLDownloadToFileW
keybd_event
VkKeyScanW
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowsHookExA
SetKeyboardState
MsgWaitForMultipleObjects
MapVirtualKeyW
MapVirtualKeyA
GetKeyboardState
GetKeyboardLayout
GetKeyState
ExitWindowsEx
EnumWindows
GetKeyboardType
FtpPutFileW
FtpSetCurrentDirectoryW
.idata
.rdata
P.reloc
P.rsrc
KERNEL32.DLL
AVICAP32.DLL
gdi32.dll
mpr.dll
msacm32.dll
ntdll.dll
powrprof.dll
pstorec.dll
shell32.dll
URLMON.DLL
user32.dll
wininet.dll
winmm.dll
wsock32.dll
x.html
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\RunOnce
Win\MSstart.exe
Software\Microsoft\Windows NT\CurrentVersion\Windows
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
explorer.exe "
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
explorer.exe
hXXp://VVV.uol.com.br/
hXXp://mail.terra.com.br/
hXXps://VVV.google.com/accounts/servicelogin
hXXps://my.screenname.aol.com/_cqr/login/login.psp
hXXp://VVV.lycos.com
hXXp://VVV.myspace.com
Portugal
Turkey
TargetOperatingSystem:
NumberOfMediaSupported:
PowerManagementSupported:
SCSIPort:
NumberOfFunctionKeys:
Password:
MaxMemorySupported:
Monochrome:
ProtocolSupported:
AdminPasswordStatus:
BootROMSupported:
InfraredSupported:
KeyboardPasswordStatus:
PowerOnPasswordStatus:
SupportContactDescription:
WindowsDirectory:
[Execute]
SpyNetKeylogger
keylogger
WEBCAM
uploadandexecute
uploadandexecuteyes|
uploadandexecuteno|
*<>#%"{}|\^[]`
:LocalSubNet:Enabled:@xpsperes.dll,-22006
SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_CURRENT_CONFIG
Invalid Key Name
Invalid KeyName
software\microsoft\windows\currentversion\uninstall\
webcamstream2|
webcam|webcamstream|
webcamstop2|
webcam|webcamstop|
webcamstart
webcamstart2
*.jpg
keyloggernew
c:\users\rafael\desktop\TESTE\
keylogger|mouseloggerbuffer|
OPERA|
CHROME|
keylogger|mouseloggerstart|
keylogger|mouseloggerstop|
keylogger|keyloggerativar|F|
keylogger|keyloggerativar|T|
keylogger|keyloggeronlinekey|
webcamlist|
getpasswords|
webcam
FirstExecution
SelfDelete.bat
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
rar.exe
rarreg.key
filemanager|fmsendftpyes|
filemanager|fmsendftpno|
webcamlist
downexec
openweb
getpasswords
getpasswords|START
chromepass
chromepass|
sendkeyswindow
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
listarportas
listarportas|listadeportasativas|
listarportasdns
listarportas|finalizarconexao|
finalizarprocessoportas
listarportas|finalizarprocessoportas|Y|
listarportas|finalizarprocessoportas|N|
tecaladoexecutar
webcam2
webcamconfig
keylogger|keyloggeronlinestart|
keylogger|keyloggeronlinestop|
logs_*.txt
keylogger|keylogger|
keyloggerativar
keyloggerdesativar
keyloggerbaixar
keylogger|keyloggerbaixar|
keylogger|keyloggerbaixar|NOLOGS
keyloggerexcluir
keylogger|keyloggerexcluir|
keyloggeronlinestart
keyloggeronlinestop
MouseLoggerWindows
fmexecnormal
filemanager|fmexecnormal|
fmexechide
filemanager|fmexechide|
fmexecparam
filemanager|fmexecparam|F|
filemanager|fmexecparam|T|
fmsendftp
filemanager|fmsendftp|
keysearch
Logs_*.txt
keysearch|YES
keysearch|NO
keyboardinfo
getcompinfo|getcompinfo|keyboardinfo|
ÞFAULTBROWSER%
Unsupported clipboard format
Canvas does not allow drawing Clipboard does not support Icons
Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.
Reply Code is not valid: %s
Reply Code already exists: %s Thread must be specified for the scheduler.!You must have an OnExecute event.7Cannot change the scheduler while the server is Active.
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
File "%s" not found
Object type not supported.
5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
Command not supported.
Address type not supported."%d: Circular links are not allowed"Not enough data in buffer. (%d/%d)
Stack already created.1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.
Invalid Port Range (%d - %d)
%s is not a valid service.
%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.
Set Size Exceeded.)UDP is not support in this SOCKS version.
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Operation already in progress.
Socket operation on non-socket.
Protocol not supported.
Socket type not supported."Operation not supported on socket.
Protocol family not supported.0Address family not supported by protocol family.
&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Connecting to %s.
Socket Error # %d
Operation would block.
Operation now in progress.
%s.Seek not implemented$Operation not allowed on sorted list
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)
Invalid destination array"Character index out of bounds (%d)
Start index out of bounds (%d)
Invalid count (%d)
Invalid destination index (%d)
Invalid codepage (%d)-Error on call to Winsock2 library function %s
ECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s$''%s'' is not a valid component name
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Ancestor for '%s' not found
Cannot assign a %s to a %s
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Operation aborted(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value('%s' is not a valid floating point value
I/O error %d
Integer overflow Invalid floating point operation


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    Server.exe:1528
    %original file name%.exe:1004

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    C:\Win\MSstart.exe (1425 bytes)
    %WinDir%\SpyNet\Server.exe (1425 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "Server" = "%WinDir%\SpyNet\Server.exe"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "Server" = "%WinDir%\SpyNet\Server.exe"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Server" = "%WinDir%\SpyNet\Server.exe"

  5. Remove the references to the Trojan by modifying the following registry value(s) (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "Shell" = "explorer.exe %WinDir%\SpyNet\Server.exe"

    [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "Shell" = "explorer.exe %WinDir%\SpyNet\Server.exe"

  6. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now