Virus.Win32.Sality_de709ea239
Trojan.Win32.Tibs.i (Kaspersky), Win32.Sality.OG (B) (Emsisoft), Win32.Sality.OG (AdAware), Virus.Win32.Sality.FD, Virus.Win32.Sality.2.FD, Worm.Win32.Dorkbot.FD, VirusSality.YR, WormDorkbot.YR, GenericUDPFlooder.YR, GenericIRCBot.YR, GenericMSNWorm.YR, GenericUSBInfector.YR, GenericDNSBlocker.YR, GenericAutorunWorm.YR, GenericSYNFlooder.YR, GenericInjector.YR, BankerGeneric.YR, GenericProxy.YR, GenericPhysicalDrive0.YR (Lavasoft MAS)
Behaviour: Banker, Trojan, Flooder, Worm, Virus, WormAutorun, IRCBot, MSNWorm, DNSBlocker, UDPFlooder, SYNFlooder, Trojan-Proxy, USBInfector
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
| Requires JavaScript enabled! |
|---|
MD5: de709ea23926b2d0056afe0f719068db
SHA1: 5bd43431e8d94f80937834e2bfde339c06eee666
SHA256: bf152435694c4859480e11a25cb3feb84823c5cb52db39ec933eb2542b22143d
SSDeep: 6144:u8uHfp/9ArDXaPNsizC6TG83Vsq8RjQJOnLGX2N:unR0mPad6TG83VsZi4LGmN
Size: 204800 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Sysinnals - www.sysinternals.com
Created at: 2011-07-07 21:31:44
Analyzed on: WindowsXP SP3 32-bit
Summary:
Virus. A program that recursively replicates a possibly evolved copy of itself.
Payload
| Behaviour | Description |
|---|---|
| WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer. |
| IRCBot | A bot can communicate with command and control servers via IRC channel. |
| MSNWorm | A worm can spread its copies through the MSN Messanger. |
| DNSBlocker | A program can block designated DNS servers for making it difficult for users to locate specific domains or web sites on the Internet. |
| UDPFlooder | This program can make a UDP flood. A UDP flood attack is a denial-of-service attack using the User Datagram Protocol (UDP). It can be initiated by sending a large number of UDP packets to random ports on a remote host. |
| SYNFlooder | This program can make a SYN flood. It is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic. |
| Trojan-Proxy | This program can launch a proxy server (SOCKS4) on a designated TCP port. |
| USBInfector | A program can register a device notification with the help of RegisterDeviceNotification. So it is notified when a USB device is plugged and then the worm copies itself to the USB device plugged into the affected computer. |
Process activity
The Virus creates the following process(es):
WINMINE.EXE:2896
WINMINE.EXE:2608
WINMINE.EXE:2728
NOTEPAD.EXE:2864
NOTEPAD.EXE:2848
NOTEPAD.EXE:2640
NOTEPAD.EXE:2760
NOTEPAD.EXE:3136
NOTEPAD.EXE:2684
NOTEPAD.EXE:3108
netsh.exe:332
%original file name%.exe:584
%original file name%.exe:528
Xtkmkj.exe:604
Xtkmkj.exe:1968
The Virus injects its code into the following process(es):
imapi.exe:1320
spoolsv.exe:1460
netsh.exe:1600
vmacthlp.exe:896
netsh.exe:2680
csrss.exe:652
winlogon.exe:676
services.exe:720
svchost.exe:920
Explorer.EXE:932
svchost.exe:992
svchost.exe:1120
svchost.exe:1204
svchost.exe:1252
jqs.exe:1628
File activity
The process %original file name%.exe:584 makes changes in the file system.
The Virus creates and/or writes to the following file(s):
%WinDir%\system.ini (72 bytes)
The process %original file name%.exe:528 makes changes in the file system.
The Virus creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\Xtkmkj.exe (1281 bytes)
Registry activity
The process WINMINE.EXE:2896 makes changes in the system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "32 82 45 32 1E 3C F4 DA 7E CE 45 47 94 D6 5D D0"
The process WINMINE.EXE:2608 makes changes in the system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 9E DC 28 00 32 49 DA D0 58 C3 68 CD AB 5C 03"
The process WINMINE.EXE:2728 makes changes in the system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B6 E1 54 B3 41 6D 18 EC AA D5 F6 1F F1 1D 0E 9F"
The process NOTEPAD.EXE:2864 makes changes in the system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B6 AD 12 D4 20 EA 5F F3 58 42 AA 33 21 20 2E B9"
The process NOTEPAD.EXE:2848 makes changes in the system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "68 07 2F B3 EB 4A C4 87 9B AB 35 D9 CA 11 8C 0B"
The process NOTEPAD.EXE:2640 makes changes in the system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EA BA 48 69 F7 B8 D5 56 F7 67 22 04 25 61 DB 2D"
The process NOTEPAD.EXE:2760 makes changes in the system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "90 4A 4D 3E 52 42 12 A6 A5 14 F4 D9 F6 91 EA 65"
The process NOTEPAD.EXE:3136 makes changes in the system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7E 56 9C F0 53 EA 0D A1 1D 66 A7 1E E2 AB C7 30"
The process NOTEPAD.EXE:2684 makes changes in the system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F0 29 DE 75 F3 AE F5 F7 B8 47 C5 0C 8B C7 DA 45"
The process NOTEPAD.EXE:3108 makes changes in the system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E3 09 4E 00 71 B1 FF 07 FD DB D1 51 87 98 D2 9D"
The process netsh.exe:1600 makes changes in the system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "10 FE 18 ED 3D 40 8E AA 49 B5 C7 F1 E0 6B 34 DE"
The process netsh.exe:332 makes changes in the system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"MaxFileSize" = "1048576"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"ControlFlags" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"ControlFlags" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"ConsoleTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"BitNames" = " NAP_TRACE_BASE NAP_TRACE_NETSH"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableFileTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"Guid" = "710adbf0-ce88-40b4-a50d-231ada6593f0"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"Guid" = "b0278a28-76f1-4e15-b1df-14b209a12613"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"
[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableConsoleTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DD 74 90 E9 51 00 F0 DE D5 F5 39 9E 23 AA 31 B3"
[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileDirectory" = "%windir%\tracing"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"LogSessionName" = "stdout"
[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"LogSessionName" = "stdout"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"
A firewall is disabled:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"
The process %original file name%.exe:584 makes changes in the system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"
[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools" = "1"
[HKCU\Software\adm914\695404737]
"43014726" = "0500687474703A2F2F6D617474666F6C6C2E65752E696E74657269612E706C2F6C6F676F732E67696600687474703A2F2F7374312E646973742E73752E6C742F6C6F676F682E67696600687474703A2F2F6C70626D782E72752F6C6F676F732E67696600687474703A2F2F626A65726D2E6D6173732E68632E72752F6C6F676F682E67696600687474703A2F2F534F536954455F41564552495F534F5369544545452E6861686168"
"14338242" = "0"
[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"
[HKCU\Software\adm914\695404737]
"7169121" = "36"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"
[HKCU\Software\adm914\695404737]
"35845605" = "169"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "26 64 23 E7 F0 E5 FE 53 74 FB 80 F5 27 2A 5C F0"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"
[HKCU\Software\adm914\695404737]
"28676484" = "35"
[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"
[HKCU\Software\adm914\695404737]
"50183847" = "AB5E0738695C8F8323226F12B1D03D7D79E71A90760ACADED2B04A211637CD4145F6749BEE9023AA532184F995577060D6510DE74D26646EFEDFC32366D2CC8E7771C37E919020908A4DB60C10921A99946050DEA9E148F0FFAB69F3A9524762D4085A5E517FCB0C38FF00DB7E5CB8BFF62F51C41C88B0B67DC3FC07CB089EF3"
"21507363" = "0"
[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"
Antivirus notifications are disabled:
[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"
Adds a rule to the firewall Windows which allows any network activity:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"%original file name%.exe" = "c:\%original file name%.exe:*:Enabled:ipsec"
Antivirus notifications are disabled:
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"
Task Manager is disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr" = "1"
The process %original file name%.exe:528 makes changes in the system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C0 BD 9F FD E1 D9 3D 30 27 66 B7 9E 1E CD 9B AD"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
To automatically run itself each time Windows is booted, the Virus adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Xtkmkj" = "%Documents and Settings%\%current user%\Application Data\Xtkmkj.exe"
The process Xtkmkj.exe:604 makes changes in the system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EF 01 0B 8D 78 6F 48 0A 6E C6 E9 7B DC 92 11 9A"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
The process Xtkmkj.exe:1968 makes changes in the system registry.
The Virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"
"AntiVirusOverride" = "1"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "83 D5 96 3E EC 32 2F 51 AF 35 58 A3 63 79 0B 74"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools" = "1"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"
[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"
[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"
"FirewallDisableNotify" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"
"UacDisableNotify" = "1"
"FirewallDisableNotify" = "1"
Antivirus notifications are disabled:
[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"
Adds a rule to the firewall Windows which allows any network activity:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Application Data]
"Xtkmkj.exe" = "%Documents and Settings%\%current user%\Application Data\Xtkmkj.exe:*:Enabled:ipsec"
Antivirus notifications are disabled:
[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"
Task Manager is disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr" = "1"
Dropped PE files
There are no dropped PE files.
HOSTS file anomalies
No changes have been detected.
Rootkit activity
The Virus installs the following user-mode hooks in WININET.dll:
HttpSendRequestW
InternetWriteFile
HttpSendRequestA
The Virus installs the following user-mode hooks in ADVAPI32.dll:
RegCreateKeyExA
RegCreateKeyExW
The Virus installs the following user-mode hooks in WS2_32.dll:
send
GetAddrInfoW
The Virus installs the following user-mode hooks in kernel32.dll:
MoveFileA
CopyFileW
CopyFileA
MoveFileW
CreateFileW
CreateFileA
The Virus installs the following user-mode hooks in ntdll.dll:
LdrLoadDll
NtResumeThread
NtQueryDirectoryFile
NtEnumerateValueKey
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.
A program can register a device notification with the help of RegisterDeviceNotification. So it is notified when a USB device is plugged and then the worm copies itself to the USB device plugged into the affected computer.
A worm can spread its copies through the MSN Messanger.
VersionInfo
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 13900 | 16384 | 4.04938 | 618dda539c845db0c55de0765e78f683 |
| .rdata | 20480 | 952 | 4096 | 1.05402 | c49d7f4a943a873be44964522a33c28e |
| .data | 24576 | 6152 | 4096 | 3.98279 | db785dbf9e0d2c708e2395c0fa267d83 |
| .rsrc | 32768 | 90264 | 94208 | 5.52027 | ca084a433eccbbd73320c8e5c6ff901c |
| .nrdata | 126976 | 81920 | 81920 | 5.54194 | e1a17f7d042b4cfa6859b81fc1f74654 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
URLs
No activity has been detected.
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Web Traffic was not found.
The Virus connects to the servers at the folowing location(s):
netsh.exe_1600:
.text
`.data
.rsrc
msvcrt.dll
ADVAPI32.dll
KERNEL32.dll
NTDLL.DLL
MPRAPI.dll
ole32.dll
OLEAUT32.dll
RASAPI32.dll
USER32.dll
iphlpapi.dll
[%S] %S
netsh.pdb
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
GetProcessHeap
GetConsoleOutputCP
ntdll.dll
NETSH.EXE
MatchCmdLine
MatchTagsInCmdLine
{X-X-X-XX-XXXXXX}netsh.exe
Error %d in FormatMessageW()
select * from Win32_OperatingSystem
\\%s\root\cimv2
5.1.2600.5512 (xpsp.080413-0852)
Windows
Operating System
5.1.2600.5512
LFirst, add the protocol to the transport, and then add it to the interface.
*The requested transport is not available.
%1!s! ipmontr.dll
The above command installs ipmontr.dll in netsh.
is removed, it is no longer supported by netsh.
The command cannot be executed.
*Windows cannot open the file named %1!s!.
.The commit call to %1!s! cannot be completed.
.Sets the current machine on which to operate.
name - Name of the machine on which to operate
Sets the current machine on which to operate. If a machine name
%1!s! open c:\logfiles\logfile.txt
.Error creating key for %1!s! in the registry.
.Error deleting key for %1!s! in the registry.
netsh.exe_1600_rwx_00150000_00002000:
SHELL32.DLL
ShellExecuteA
KERNEL32.DLL
.text
netsh.exe_1600_rwx_00260000_00001000:
|netsh.exeM_1600_
netsh.exe_1600_rwx_00B60000_00029000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSSh
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.ftp://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
http://
%s.Blocked possible browser exploit pack call on URL '%S'
ng.marketallone.com
ng.themarketbaby.com
ng.grasshopperz11.com
ng.lighthousez11.com
ng.coachloan.com
fbi.gov
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
RSSR %s 0 0 :%s
KCIK %s
SEND %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
http://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
http://%s/%s
http://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
%System%\netsh.exe
%Documents and Settings%\%current user%\Application Data\Xtkmkj.exe
%WinDir%
0 0F0K0Q0e0r0x0~0
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
\Device\HarddiskVolume1\WINDOWS\system32\netsh.exe
netsh.exe_2680:
.text
`.data
.rsrc
msvcrt.dll
ADVAPI32.dll
KERNEL32.dll
NTDLL.DLL
MPRAPI.dll
ole32.dll
OLEAUT32.dll
RASAPI32.dll
USER32.dll
iphlpapi.dll
[%S] %S
netsh.pdb
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
GetProcessHeap
GetConsoleOutputCP
ntdll.dll
NETSH.EXE
MatchCmdLine
MatchTagsInCmdLine
{X-X-X-XX-XXXXXX}netsh.exe
Error %d in FormatMessageW()
select * from Win32_OperatingSystem
\\%s\root\cimv2
5.1.2600
5.1.2600.5512 (xpsp.080413-0852)
Windows
Operating System
5.1.2600.5512
LFirst, add the protocol to the transport, and then add it to the interface.
*The requested transport is not available.
%1!s! ipmontr.dll
The above command installs ipmontr.dll in netsh.
is removed, it is no longer supported by netsh.
The command cannot be executed.
*Windows cannot open the file named %1!s!.
.The commit call to %1!s! cannot be completed.
.Sets the current machine on which to operate.
name - Name of the machine on which to operate
Sets the current machine on which to operate. If a machine name
%1!s! open c:\logfiles\logfile.txt
.Error creating key for %1!s! in the registry.
.Error deleting key for %1!s! in the registry.
netsh.exe_2680_rwx_00160000_00029000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSSh
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.ftp://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
http://
%s.Blocked possible browser exploit pack call on URL '%S'
ng.marketallone.com
ng.themarketbaby.com
ng.grasshopperz11.com
ng.lighthousez11.com
ng.coachloan.com
fbi.gov
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
RSSR %s 0 0 :%s
KCIK %s
SEND %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
http://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
http://%s/%s
http://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
%System%\netsh.exe
%Documents and Settings%\%current user%\Application Data\Xtkmkj.exe
%WinDir%
0 0F0K0Q0e0r0x0~0
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
\Device\HarddiskVolume1\WINDOWS\system32\netsh.exe
csrss.exe_652_rwx_00A50000_00029000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSSh
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.ftp://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
http://
%s.Blocked possible browser exploit pack call on URL '%S'
ng.marketallone.com
ng.themarketbaby.com
ng.grasshopperz11.com
ng.lighthousez11.com
ng.coachloan.com
fbi.gov
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
RSSR %s 0 0 :%s
KCIK %s
SEND %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
http://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
http://%s/%s
http://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
\??\%System%\csrss.exe
%Documents and Settings%\%current user%\Application Data\Xtkmkj.exe
%WinDir%
0 0F0K0Q0e0r0x0~0
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
\Device\HarddiskVolume1\WINDOWS\system32\csrss.exe
winlogon.exe_676_rwx_00AD0000_00029000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSSh
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.ftp://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
http://
%s.Blocked possible browser exploit pack call on URL '%S'
ng.marketallone.com
ng.themarketbaby.com
ng.grasshopperz11.com
ng.lighthousez11.com
ng.coachloan.com
fbi.gov
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
RSSR %s 0 0 :%s
KCIK %s
SEND %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
http://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
http://%s/%s
http://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
\??\%System%\winlogon.exe
%Documents and Settings%\%current user%\Application Data\Xtkmkj.exe
%WinDir%
0 0F0K0Q0e0r0x0~0
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
\Device\HarddiskVolume1\WINDOWS\system32\winlogon.exe
services.exe_720_rwx_007F0000_00029000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSSh
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.ftp://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
http://
%s.Blocked possible browser exploit pack call on URL '%S'
ng.marketallone.com
ng.themarketbaby.com
ng.grasshopperz11.com
ng.lighthousez11.com
ng.coachloan.com
fbi.gov
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
RSSR %s 0 0 :%s
KCIK %s
SEND %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
http://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
http://%s/%s
http://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
%System%\services.exe
%Documents and Settings%\%current user%\Application Data\Xtkmkj.exe
%WinDir%
0 0F0K0Q0e0r0x0~0
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
\Device\HarddiskVolume1\WINDOWS\system32\services.exe
svchost.exe_920_rwx_00940000_00029000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSSh
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.ftp://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
http://
%s.Blocked possible browser exploit pack call on URL '%S'
ng.marketallone.com
ng.themarketbaby.com
ng.grasshopperz11.com
ng.lighthousez11.com
ng.coachloan.com
fbi.gov
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
RSSR %s 0 0 :%s
KCIK %s
SEND %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
http://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
http://%s/%s
http://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
%System%\svchost.exe
%Documents and Settings%\%current user%\Application Data\Xtkmkj.exe
%WinDir%
0 0F0K0Q0e0r0x0~0
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe
Explorer.EXE_932_rwx_00FF0000_00002000:
SHELL32.DLL
ShellExecuteA
KERNEL32.DLL
.text
Explorer.EXE_932_rwx_01DE0000_00001000:
|explorer.exeM_932_
Explorer.EXE_932_rwx_02310000_00029000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSSh
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.ftp://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
http://
%s.Blocked possible browser exploit pack call on URL '%S'
ng.marketallone.com
ng.themarketbaby.com
ng.grasshopperz11.com
ng.lighthousez11.com
ng.coachloan.com
fbi.gov
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
RSSR %s 0 0 :%s
KCIK %s
SEND %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
http://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
http://%s/%s
http://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
c:\%original file name%.exe
0 0F0K0Q0e0r0x0~0
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
%Documents and Settings%\%current user%\Application Data\Xtkmkj.exe
Explorer.EXE_932_rwx_02890000_00029000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSSh
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.ftp://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
http://
%s.Blocked possible browser exploit pack call on URL '%S'
ng.marketallone.com
ng.themarketbaby.com
ng.grasshopperz11.com
ng.lighthousez11.com
ng.coachloan.com
fbi.gov
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
RSSR %s 0 0 :%s
KCIK %s
SEND %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
http://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
http://%s/%s
http://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
%WinDir%\Explorer.EXE
%Documents and Settings%\%current user%\Application Data\Xtkmkj.exe
%WinDir%
e5188982.exe
0 0F0K0Q0e0r0x0~0
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
\Device\HarddiskVolume1\WINDOWS\explorer.exe
Explorer.EXE_932_rwx_03840000_01033000:
c:\windows
http://mattfoll.eu.interia.pl/logos.gif
http://st1.dist.su.lt/logoh.gif
http://lpbmx.ru/logos.gif
http://bjerm.mass.hc.ru/logoh.gif
http://SOSiTE_AVERI_SOSiTEEE.hahah
%System%\drivers\lhhnqn.sys
71403137851
SHELL32.DLL
ShellExecuteA
KERNEL32.DLL
.text
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
h.rdata
H.data
.reloc
ntoskrnl.exe
Opera/8.81 (Windows NT 6.0; U; en)
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Software\Microsoft\Windows\CurrentVersion\policies\system
Software\Microsoft\Windows\ShellNoRoam\MUICache
%s:*:Enabled:ipsec
NOTEPAD.EXE
WINMINE.EXE
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
GdiPlus.dll
http://
http://klkjwre77638dfqwieuoi888.info/
www.microsoft.com
?%x=%d
&%x=%d
SYSTEM.INI
USER32.DLL
.%c%s
\\.\abp470n5
WINDOWS
NTDLL.DLL
autorun.inf
ADVAPI32.DLL
win%s.exe
%s.exe
WININET.DLL
InternetOpenUrlA
avast! Web Scanner
Avira AntiVir Premium WebGuard
BackWeb Plug-in - 4476822
Eset HTTP Server
ProtoPort Firewall service
SpIDer FS Monitor for Windows NT
Symantec Password Validation
tcpsr
WebrootDesktopFirewallDataService
WebrootFirewall
%d%d.tmp
SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
%s\%s
%s\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
Software\Microsoft\Windows\CurrentVersion\Ext\Stats
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
Explorer.exe
ASHWEBSV.
DRWEB32W.
DRWEBSCD.
DRWEBUPW.
DWEBLLIO
DWEBIO
FSGUIEXE.
MCVSSHLD.
NPFMSG.
SYMSPORT.
WEBPROXY.
WEBSCANX.
WEBTRAP.
sfc_os.dll
M_%d_
%c%d_%d
?456789:;<=
!"#$%&'()* ,-./0123
GetWindowsDirectoryA
GetProcessHeap
WinExec
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegCreateKeyA
RegCloseKey
SHFileOperationA
.rdata
.data
.xdata
@.CRT
/KPCKwWEBWUP
.SEdAUD
MM.PFW.
?.cmd
>>?456789:;<=
!"#$%&'()* ,-./012
ADVAPI32.dll
MSVCRT.dll
SHELL32.dll
USER32.dll
WS2_32.dll
svchost.exe_992_rwx_00B50000_00029000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSSh
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.ftp://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
http://
%s.Blocked possible browser exploit pack call on URL '%S'
ng.marketallone.com
ng.themarketbaby.com
ng.grasshopperz11.com
ng.lighthousez11.com
ng.coachloan.com
fbi.gov
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
RSSR %s 0 0 :%s
KCIK %s
SEND %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
http://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
http://%s/%s
http://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
%System%\svchost.exe
%Documents and Settings%\%current user%\Application Data\Xtkmkj.exe
%WinDir%
0 0F0K0Q0e0r0x0~0
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe
svchost.exe_1120_rwx_025F0000_00029000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSSh
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.ftp://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
http://
%s.Blocked possible browser exploit pack call on URL '%S'
ng.marketallone.com
ng.themarketbaby.com
ng.grasshopperz11.com
ng.lighthousez11.com
ng.coachloan.com
fbi.gov
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
RSSR %s 0 0 :%s
KCIK %s
SEND %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
http://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
http://%s/%s
http://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
%WinDir%\System32\svchost.exe
%Documents and Settings%\%current user%\Application Data\Xtkmkj.exe
%WinDir%
0 0F0K0Q0e0r0x0~0
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe
svchost.exe_1204_rwx_007E0000_00029000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSSh
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.ftp://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
http://
%s.Blocked possible browser exploit pack call on URL '%S'
ng.marketallone.com
ng.themarketbaby.com
ng.grasshopperz11.com
ng.lighthousez11.com
ng.coachloan.com
fbi.gov
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
RSSR %s 0 0 :%s
KCIK %s
SEND %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
http://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
http://%s/%s
http://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
%System%\svchost.exe
%Documents and Settings%\%current user%\Application Data\Xtkmkj.exe
%WinDir%
0 0F0K0Q0e0r0x0~0
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe
svchost.exe_1252_rwx_00B40000_00029000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSSh
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.ftp://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
http://
%s.Blocked possible browser exploit pack call on URL '%S'
ng.marketallone.com
ng.themarketbaby.com
ng.grasshopperz11.com
ng.lighthousez11.com
ng.coachloan.com
fbi.gov
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
RSSR %s 0 0 :%s
KCIK %s
SEND %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
http://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
http://%s/%s
http://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
%System%\svchost.exe
%Documents and Settings%\%current user%\Application Data\Xtkmkj.exe
%WinDir%
0 0F0K0Q0e0r0x0~0
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
\Device\HarddiskVolume1\WINDOWS\system32\svchost.exe
imapi.exe_1320_rwx_005D0000_00029000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSSh
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.ftp://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
http://
%s.Blocked possible browser exploit pack call on URL '%S'
ng.marketallone.com
ng.themarketbaby.com
ng.grasshopperz11.com
ng.lighthousez11.com
ng.coachloan.com
fbi.gov
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
RSSR %s 0 0 :%s
KCIK %s
SEND %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
http://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
http://%s/%s
http://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
%System%\imapi.exe
%Documents and Settings%\%current user%\Application Data\Xtkmkj.exe
%WinDir%
0 0F0K0Q0e0r0x0~0
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
^\Device\HarddiskVolume1\WINDOWS\system32\imapi.exe
spoolsv.exe_1460_rwx_00F00000_00029000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSSh
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.ftp://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
http://
%s.Blocked possible browser exploit pack call on URL '%S'
ng.marketallone.com
ng.themarketbaby.com
ng.grasshopperz11.com
ng.lighthousez11.com
ng.coachloan.com
fbi.gov
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
RSSR %s 0 0 :%s
KCIK %s
SEND %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
http://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
http://%s/%s
http://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
%System%\spoolsv.exe
%Documents and Settings%\%current user%\Application Data\Xtkmkj.exe
%WinDir%
0 0F0K0Q0e0r0x0~0
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
\Device\HarddiskVolume1\WINDOWS\system32\spoolsv.exe
jqs.exe_1628_rwx_010C0000_00029000:
.text
`.rdata
@.data
.reloc
:.datt
tB<%u4
toSSSSSSSSSSh
ShellExecuteA
SHELL32.dll
HttpQueryInfoA
InternetOpenUrlA
HttpQueryInfoW
WININET.dll
SHLWAPI.dll
ntdll.dll
WS2_32.dll
MSVCRT.dll
GetWindowsDirectoryW
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeA
DisconnectNamedPipe
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExW
ADVAPI32.dll
ole32.dll
%s.%s
%s.%S
%s.Blocked "%S" from creating "%s" - "%s" will be removed at reboot!
autorun.inf
%s.Blocked "%S" from creating "%S"
%s.Blocked "%S" from creating "%S" - "%s" will be removed at reboot!
%s.Blocked "%s" from removing our bot file!
%s.Blocked "%S" from removing our bot file!
%s.%s ->> %s : %s
%s-%s-%s
%s.Blocked "%s" from moving our bot file
%s.Blocked "%S" from moving our bot file
%s.%s%s
%S%s%s
%s.%S%S
%S%S%S
%s.p10-> Message hijacked!
%s.p10-> Message to %s hijacked!
%s.p21-> Message hijacked!
msnmsg
CAL %d %6s
JOIN #
%s.Detected process "%S" sending an IRC packet to server %s:%d.
PRIVMSG #
%s:%d
%s.ftp://%s:%s@%s:%d (p='%S')
%s:%s@%s:%d
PASS %s
USER %s
ftpgrab
%s.Blocked possible browser exploit pack call on URL '%s'
http://
%s.Blocked possible browser exploit pack call on URL '%S'
ng.marketallone.com
ng.themarketbaby.com
ng.grasshopperz11.com
ng.lighthousez11.com
ng.coachloan.com
fbi.gov
1.0.3
msn.set
msn.int
http.set
http.int
http.inj
logins
webroot.
virusbuster.nprotect.
heck.tc
onecare.live.
RSSR %s 0 0 :%s
KCIK %s
SEND %s %s
PART %s
PRIVMSG %s :%s
QUIT :%s
PONG %s
PRIVMSG
[v="%s" c="%s" h="%s" p="%S"]
[d="%s" s="%d bytes"] Updated bot file "%S" - Download retries: %d
[d="%s" s="%d bytes"] Executed file "%S" - Download retries: %d
[Slowloris]: Starting flood on "%s" for %d minute(s)
[Slowloris]: Finished flood on "%s"
[UDP]: Starting flood on "%s:%d" for %d second(s)
[UDP]: Finished flood on "%s:%d"
[SYN]: Starting flood on "%s:%d" for %d second(s)
[SYN]: Finished flood on "%s:%d"
[USB]: Infected %s
[MSN]: Updated MSN spread message to "%s"
[MSN]: Updated MSN spread interval to "%s"
[HTTP]: Updated HTTP spread message to "%s"
[HTTP]: Injected value is now %s.
[HTTP]: Updated HTTP spread interval to "%s"
[Visit]: Visited "%s"
[DNS]: Blocked "%s"
[usb="%d" msn="%d" http="%d" total="%d"]
[ftp="%d" http="%d" total="%d"]
[RSOCK4]: Started rsock4 on "%s:%d"
[d="%s" s="%d bytes"] Update error: MD5 mismatch (%s != %s)
[d="%s"] Error downloading file [e="%d"]
[d="%s"] Error writing download to "%S" [e="%d"]
[d="%s" s="%d bytes"] Error creating process "%S" [e="%d"]
[d="%s" s="%d bytes"] File "%S" has an invalid binary type. [type="%d"]
[d="%s"] Error getting temporary filename. [e="%d"]
[d='%s"] Error getting application data path [e="%d"]
[Visit]: Error visitng "%s"
[FTP Login]: %s
[FTP Infect]: %s was iframed
[HTTP Login]: %s
[HTTP Traffic]: %s
[Ruskill]: Detected File: "%s"
[Ruskill]: Detected DNS: "%s"
[Ruskill]: Detected Reg: "%s"
[PDef ]: %s
[DNS]: Blocked DNS "%s"
[MSN]: %s
[HTTP]: %s
ftplog
ftpinfect
httplogin
httptraff
httpspread
http://api.wipmania.com/
\\.\pipe\%s_ipc
*officebanking.cl/*login.asp*
*secure.logmein.*/*logincheck*
*megaupload.*/*login
loginUserPassword
loginUserName
*loginUserPassword=*
*fileserve.*/login*
session[password]
*password]=*
*twitter.com/sessions
*:2086/login*
*:2083/login*
Password
*&Password=*
*.alertpay.*/*login.aspx
txtPassword
*&txtPassword=*
*.moneybookers.*/*login.pl
*runescape*/*weblogin*
*&password=*
*no-ip*/login*
*steampowered*/login*
quick_password
*hackforums.*/member.php
*facebook.*/login.php*
*login.yahoo.*/*login*
passwd
login
*passwd=*
*login.live.*/*post.srf*
TextfieldPassword
*TextfieldPassword=*
*gmx.*/*FormLogin*
*Passwd=*
FLN-Password
*FLN-Password=*
*pass=*
*bigstring.*/*index.php*
*screenname.aol.*/login.psp*
password
loginId
*password=*
*aol.*/*login.psp*
Passwd
*google.*/*ServiceLoginAuth*
login_password
login_email
*login_password=*
*paypal.*/webscr?cmd=_login-submit*
%s / ?%d HTTP/1.1
Host: %s
User-Agent: %s
Mozilla/4.0
-\\.\PHYSICALDRIVE0
state_%s
shell32.dll
httpi
dnsapi.dll
http://%s/%s
http://%s/
POST /23s
{%s|%s%s}%sn{%s|%s%s}%s%s|%s|%s
[DNS]: Redirecting "%s" to "%s"
%s|%s
[Logins]: Cleared %d logins
explorer.exe
[d="%s" s="%d bytes"] Download error: MD5 mismatch (%s != %s)
[Logins]: %s
[DNS]: Blocked %d domain(s) - Redirected %d domain(s)
icon=shell32.dll,7
shellexecute=
%windir%\system32\cmd.exe
&&%%windir%%\explorer.exe %Í%%%s
/c "start %Í%%RECYCLER\%s
\\.\%c:
%s\%s
%sautorun.tmp
%sautorun.inf
%0x.exe
MSG %d %s %d
MSG %d %1s
SDG %d %d
Content-Length: %d
SDG %d
%s_0xX
RegCreateKeyExA
URLDownloadToFileW
URLDownloadToFileA
HttpSendRequestW
HttpSendRequestA
NtEnumerateValueKey
%s-Mutex
%s_%d
%s_%lu
kernel32.dll
%Program Files%\Java\jre6\bin\jqs.exe
%Documents and Settings%\%current user%\Application Data\Xtkmkj.exe
%WinDir%
0 0F0K0Q0e0r0x0~0
\\.\pipe
nwlcomm.exe
msmsgs.exe
msnmsgr.exe
pidgin.exe
xchat.exe
mirc.exe
iexplore.exe
firefox.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\System
.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
cipconfig.exe
verclsid.exe
regedit.exe
rundll32.exe
cmd.exe
regsvr32.exe
l"%s" %S
Internet Explorer\iexplore.exe
lol.exe
%s:Zone.Identifier
winlogon.exe
Aadvapi32.dll
urlmon.dll
nspr4.dll
wininet.dll
ws2_32.dll
Akernel23.dll
yntdll.dll
skype.exe
lsass.exe
\Device\HarddiskVolume1\Program Files\Java\jre6\bin\jqs.exe
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
WINMINE.EXE:2896
WINMINE.EXE:2608
WINMINE.EXE:2728
NOTEPAD.EXE:2864
NOTEPAD.EXE:2848
NOTEPAD.EXE:2640
NOTEPAD.EXE:2760
NOTEPAD.EXE:3136
NOTEPAD.EXE:2684
NOTEPAD.EXE:3108
netsh.exe:332
%original file name%.exe:584
%original file name%.exe:528
Xtkmkj.exe:604
Xtkmkj.exe:1968 - Delete the original Virus file.
- Delete or disinfect the following files created/modified by the Virus:
%WinDir%\system.ini (72 bytes)
%Documents and Settings%\%current user%\Application Data\Xtkmkj.exe (1281 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Xtkmkj" = "%Documents and Settings%\%current user%\Application Data\Xtkmkj.exe" - Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
