Worm.Win32.AutoItGen_ef176263c0

by malwarelabrobot on February 28th, 2015 in Malware Descriptions.

Trojan.Win32.Vimditator.gsm (Kaspersky), Trojan-Dropper.RAR.Agent (A) (Emsisoft), (AdAware), WormAutoItGen.YR, GenericAutorunWorm.YR (Lavasoft MAS)
Behaviour: Trojan-Dropper, Trojan, Worm, WormAutorun


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: ef176263c02a5722c86ff835bdcacc0a
SHA1: 67005ec7b3f8b997f8ba41d056152476163db0e2
SHA256: 02966c24b821f8db75d34fed92f504377ef5afa9def151e64d57da8acfaeae90
SSDeep: 49152:/tJgzMngbFbqn9TxHZ/i2Ggr5kFm53Sya5T:/ibqn995/55kFm5W5T
Size: 1836556 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2012-06-09 16:19:49
Analyzed on: WindowsXP SP3 32-bit


Summary:

Worm. A program that is primarily replicating on networks or removable drives.

Payload

Behaviour Description
WormAutorun A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.


Process activity

The Worm creates the following process(es):

vbc.exe:344
vbc.exe:1144
%original file name%.exe:636

The Worm injects its code into the following process(es):

xaaoclphoyys.exe:852
RegSvcs.exe:528

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process vbc.exe:344 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (400 bytes)

The process vbc.exe:1144 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (399 bytes)

The process xaaoclphoyys.exe:852 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\1f5pn1963m431\amtryglqrhnpf.vbs (131 bytes)
%Documents and Settings%\%current user%\1f5pn1963m431\run.vbs (94 bytes)
%Documents and Settings%\%current user%\1f5pn1963m431\odsuxp.cmd (73 bytes)

The process RegSvcs.exe:528 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\pid.txt (3 bytes)
%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (656 bytes)
%System%\wbem\Logs\wbemprox.log (152 bytes)
%Documents and Settings%\%current user%\Application Data\pidloc.txt (57 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (0 bytes)

The process %original file name%.exe:636 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\1f5pn1963m431\wqysku.ZAJ (90 bytes)
%Documents and Settings%\%current user%\1f5pn1963m431\zvvuayagm.EMS (7547 bytes)
%Documents and Settings%\%current user%\1f5pn1963m431\yxsjjocyy (2409088 bytes)
%Documents and Settings%\%current user%\1f5pn1963m431\xaaoclphoyys.exe (15361 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\1f5pn1963m431\__tmp_rar_sfx_access_check_1114718 (0 bytes)

Registry activity

The process vbc.exe:344 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "92 C2 30 77 A7 57 01 42 60 EC 40 0D D3 EF 59 1B"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process vbc.exe:1144 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA 38 52 70 37 29 BA D1 75 39 8C 0D 21 1F 0F D0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process xaaoclphoyys.exe:852 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D6 94 72 A2 81 21 01 8B 3C 11 66 54 51 96 A6 7F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\C:\DOCUME~1\adm]
"1F5PN1~1" = "C:\DOCUME~1\"%CurrentUserName%"\1F5PN1~1\amtryglqrhnpf.vbs"

The process RegSvcs.exe:528 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\RegSvcs\DEBUG]
"Trace Level" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "42 AB 72 5B D9 43 09 A8 78 F9 DB 2F 26 05 82 C5"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Update" = "%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe"

The Worm deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\RegSvcs\DEBUG]
"Trace Level"

The process %original file name%.exe:636 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "47 90 F9 77 28 EF 02 09 D2 50 D7 6B 8E 3B 3F 61"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\1f5pn1963m431]
"xaaoclphoyys.exe" = "AutoIt v3 Script"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Dropped PE files

MD5 File path
71d8f6d5dc35517275bc38ebcc815f9f c:\Documents and Settings\"%CurrentUserName%"\1f5pn1963m431\xaaoclphoyys.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 74526 74752 4.54396 a8692f5ba740240ef0f9a827376f76f9
.rdata 81920 7445 7680 3.46159 d4f36accffde0bf520f52486679ccf0d
.data 90112 96036 512 2.46008 b6c7edb5b7fec47a37a622cc5d71f3f4
.CRT 188416 32 512 0.273198 439411041ee0b8261668525c5c132cd9
.rsrc 192512 28736 29184 3.52491 9309ec256e1c20dc19301e6f40a4b09e

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://whatismyipaddress.com/ 66.171.248.172
smtp.ybeoffice123.com 208.91.199.225


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1
Host: whatismyipaddress.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Fri, 27 Feb 2015 17:30:04 GMT
Server: Apache/2.2.26 (Unix) DAV/2 PHP/5.4.30 mod_ssl/2.2.26 OpenSSL/0.9.8zc
Set-Cookie: pt=8651c37cbeec0dad198626c770a8acfe; expires=Sat, 28-Feb-2015 17:30:04 GMT
Cache-Control: max-age=15
MS-Author-Via: DAV
Vary: Accept-Encoding
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
218c..<!doctype html>.<html lang="en">.<head>..<m
eta charset="windows-1252">..<meta name="robots" content="noarch
ive">..<title>What Is My IP Address? IP Address Tools and Mor
e</title>..<meta name="description" content="IP address looku
p, location, proxy detection, email tracing, IP hiding tips, blacklist
 check, speed test, and forums.  Find, get, and show my IP address."&g
t;..<meta name="keywords" content="my ip ,ip, address, adress, my, 
what, is, find, get, show, locate, change, location, how, do, i, ip ad
dress, proxy, server, anonymous, hide, conceal, stealth, surf, web, an
onymizer, anonymize, changer, privacy, geolocation, geolocate, lookup,
 look up, locate, trace, track, email, source, headers">..<meta 
property="fb:admins" content="607824267" />..<link rel="shortcut
 icon" href="hXXp://cdn.whatismyipaddress.com/favicon.ico">..<li
nk rel="stylesheet" type="text/css" href="hXXp://cdn.whatismyipaddress
.com/css/myip_v4_3.css">..<link rel="publisher" href="hXXps://pl
us.google.com/ whatismyipaddress">..<link rel="canonical" href="
hXXp://whatismyipaddress.com">..<link rel="alternate" hreflang="
fr" href="hXXp://whatismyipaddress.com/fr/mon-ip">..<link rel="a
lternate" hreflang="de" href="hXXp://whatismyipaddress.com/de/meine-ip
">..<link rel="alternate" hreflang="es" href="hXXp://whatismyipa
ddress.com/es/mi-ip">..<link rel="alternate" hreflang="tr" href=
"hXXp://whatismyipaddress.com/tr/ip-im">..<link rel="alterna
<<< skipped >>>

The Worm connects to the servers at the folowing location(s):

xaaoclphoyys.exe_852:

.text
`.rdata
@.data
.rsrc
@.reloc
s%j.Zf
8crtsu
:crts
crts
GetProcessWindowStation
operator
uxtheme.dll
kernel32.dll
operand of unlimited repeat could match the empty string
POSIX named classes are supported only within a class
erroffset passed as NULL
POSIX collating elements are not supported
this version of PCRE is not compiled with PCRE_UTF8 support
PCRE does not support \L, \l, \N{name}, \U, or \u
support for \P, \p, and \X has not been compiled
this version of PCRE is not compiled with PCRE_UCP support
ICMP.DLL
advapi32.dll
RegDeleteKeyExW
Error text not found (please report)
WSOCK32.dll
VERSION.dll
WINMM.dll
COMCTL32.dll
MPR.dll
InternetCrackUrlW
HttpQueryInfoW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
WININET.dll
PSAPI.DLL
USERENV.dll
GetProcessHeap
CreatePipe
GetWindowsDirectoryW
KERNEL32.dll
OpenWindowStationW
SetProcessWindowStation
CloseWindowStation
MapVirtualKeyW
EnumChildWindows
EnumWindows
VkKeyScanW
GetKeyState
GetKeyboardState
SetKeyboardState
GetAsyncKeyState
keybd_event
EnumThreadWindows
ExitWindowsEx
UnregisterHotKey
RegisterHotKey
GetKeyboardLayoutNameW
USER32.dll
SetViewportOrgEx
GDI32.dll
COMDLG32.dll
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
RegDeleteKeyW
ADVAPI32.dll
ShellExecuteW
SHFileOperationW
ShellExecuteExW
SHELL32.dll
ole32.dll
OLEAUT32.dll
GetCPInfo
zcÁ
L.aVFY)
.ijjrc
g%D`-
sssh6
uW.MW
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" language="*" processorArchitecture="*" publicKeyToken="6595b64144ccf1df"></assemblyIdentity>
3.3/464(5,5054585
8 8$8(8,808
= =$=(=,=0=4=8=<=@=
0 0$0(0,0004080<0
:*;3;?;|;
11
2 323[3.5
? ?<?@?`?
= =$=(=,=0=4=
5 5$5(5,5054585
CADjD%D<D
mscoree.dll
nKERNEL32.DLL
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
WUSER32.DLL
CMDLINERAW
CMDLINE
/AutoIt3ExecuteLine
/AutoIt3ExecuteScript
%s (%d) : ==> %s.:
Line %d:
Line %d (File "%s"):
%s (%d) : ==> %s:
AutoIt script files (*.au3, *.a3x)
*.au3;*.a3x
All files (*.*)
#NoAutoIt3Execute
APPSKEY
Line %d:
04090000
%u.%u.%u.%u
0.0.0.0
Mddddd
%s (%d) : ==> %s:
UDPSTARTUP
UDPSHUTDOWN
UDPSEND
UDPRECV
UDPOPEN
UDPCLOSESOCKET
UDPBIND
TRAYGETMSG
TCPSTARTUP
TCPSHUTDOWN
TCPSEND
TCPRECV
TCPNAMETOIP
TCPLISTEN
TCPCONNECT
TCPCLOSESOCKET
TCPACCEPT
SHELLEXECUTEWAIT
SHELLEXECUTE
REGENUMKEY
MSGBOX
ISKEYWORD
HTTPSETUSERAGENT
HTTPSETPROXY
HOTKEYSET
GUIREGISTERMSG
GUIGETMSG
GUICTRLSENDMSG
GUICTRLRECVMSG
FTPSETPROXY
\??\%s
GUI_RUNDEFMSG
SendKeyDelay
SendKeyDownDelay
TCPTimeout
AUTOITCALLVARIABLE%d
255.255.255.255
Keyword
AutoIt.Error
Null Object assignment in FOR..IN loop
Incorrect Object type in FOR..IN loop
HOTKEYPRESSED
AUTOITEXE
WINDOWSDIR
3, 3, 8, 1
HKEY_LOCAL_MACHINE
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_USERS
%d/d/d
%Documents and Settings%\%current user%\1f5pn1963m431\xaaoclphoyys.exe
AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.
Missing operator in expression."Unbalanced brackets in expression.
Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.
Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.
Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.
3This keyword cannot be used after a "Then" keyword.>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.
Can not redeclare a constant.5Can not redeclare a parameter inside a user function.HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.
String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.
hXXp://VVV.autoitscript.com/autoit3/
AutoIt3.exe

xaaoclphoyys.exe_852_rwx_01280000_00001000:

.reloc

RegSvcs.exe_528:

.text
`.rsrc
@.reloc
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
`.rdata
@.data
.rsrc
%UUUU3
tcPW
-4-4--567
%s%2.2X
Browser Password Dump
%s v%s by SecurityXploded
hXXp://securityxploded.com/browser-password-dump.php
BrowserPasswordDump
%s.exe [-h | -f <output_file_name>]
//Dump login passwords from all the Browsers to console
%s.exe
//Dump login passwords from all the Browsers to a file 'c:\passlist.txt'
%s.exe -f "c:\passlist.txt"
%s.exe -h
pstorec.dll
http:/
https:/
abe2869f-9b47-4cd9-a358-c22904dba7f7
hXXps://%s
hXXp://%s
Cannot close vault. Error (%d)
Web Data
Login Data
select * from logins where blacklisted_by_user=0;
\MapleStudio\ChromePlus\User Data\Default\
\Google\Chrome SxS\User Data\Default\
\Google\Chrome\User Data\Default\
Opera\Opera\
Opera\Opera\profile\
wand.dat
<key>account</key>
passwords
<key>data</key>
<key>server</key>
%s\Safari\Apple Application Support\plutil.exe
%s\Apple\Apple Application Support\plutil.exe
%s\%s\keychain.plist
%skeytest.tmp
"%s" -convert xml1 -s -o "%s" "%s"
Google Chrome
Opera Browser
Firefox
Chrome SXS
SeaMonkey
Browser: %s
Website: %s
Username: %s
Password: %s
vaultcli.dll
Error: Failed to create file '%s' for writing Password list. Make sure you have specified correct & full file path
Browser Password Recovery Report
Website URL
Password
Produced by %s from hXXp://VVV.SecurityXploded.com
Tip: For more options type %s.exe -h
This is command-line application. Kindly Run it from the CMD Prompt
Press any key to exit....
SOFTWARE\Clients\StartMenuInternet\SEAMONKEY.EXE\shell\open\command
SOFTWARE\Clients\StartMenuInternet\firefox.exe\shell\open\command
Mozilla\SeaMonkey
Mozilla\Firefox
\profiles.ini
select * from moz_logins;
/signons.txt
/signons2.txt
/signons3.txt
\signons.sqlite
nss3.dll
PK11_GetInternalKeySlot
PK11_CheckUserPassword
SQLite format 3
CREATE TABLE sqlite_master(
sql text
CREATE TEMP TABLE sqlite_temp_master(
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
3.6.16
sqlite_version
RowKey
SQL logic error or missing database
large file support is disabled
sqlite_detach
sqlite_attach
d-d-d d:d:d
d:d:d
d-d-d
922337203685477580
%s\etilqs_
OsError 0x%x (%u)
invalid page number %d
2nd reference to page %d
Failed to read ptrmap key=%d
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
%d of %d pages missing from overflow list starting at %d
failed to get page %d
freelist leaf count too big on page %d
Page %d:
unable to get the page. error code=%d
sqlite3BtreeInitPage() returns error code %d
On tree page %d cell %d:
On page %d at right child:
Corruption detected in header on page %d
Corruption detected in cell %d on page %d
Multiple uses for byte %d of page %d
Fragmented space is %d byte reported as %d on page %d
Page %d is never used
Pointer map page %d is referenced
Outstanding page count goes from %d to %d during this analysis
keyinfo(%d
%s(%d)
%s-mjX
unable to use function %s in the requested context
cannot open savepoint - SQL statements in progress
no such savepoint: %s
cannot %s savepoint - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
sqlite_temp_master
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s
database table is locked: %s
cannot open virtual table: %s
cannot open view: %s
no such column: "%s"
cannot open indexed column for writing
cannot open value of type %s
misuse of aliased aggregate %s
%s: %s.%s.%s
%s: %s.%s
%s: %s
not authorized to use function: %s
%r %s BY term out of range - should be between 1 and %d
too many terms in %s BY clause
Expression tree is too large (maximum depth %d)
variable number must be between ?1 and ?%d
too many SQL variables
too many columns in %s
misuse of aggregate: %s()
%.*s"%w"%s
sqlite_rename_table
sqlite_rename_trigger
%s OR name=%Q
there is already another table or index with this name: %s
sqlite_
table %s may not be altered
view %s may not be altered
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
sqlite_sequence
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Cannot add a PRIMARY KEY column
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
sqlite_altertab_%s
sqlite_stat1
CREATE TABLE %Q.sqlite_stat1(tbl,idx,stat)
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
SELECT idx, stat FROM %Q.sqlite_stat1
invalid name: "%s"
too many attached databases - max %d
database %s is already in use
unable to open database: %s
no such database: %s
cannot detach database %s
database %s is locked
%s %T cannot reference objects in database %s
access to %s.%s.%s is prohibited
access to %s.%s is prohibited
object name reserved for internal use: %s
there is already an index named %s
too many columns on %s
duplicate column name: %s
default value of column [%s] is not constant
table "%s" has more than one primary key
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
no such collation sequence: %s
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
CREATE TABLE %Q.sqlite_sequence(name,seq)
view %s is circularly defined
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
table %s may not be dropped
use DROP TABLE to delete table %s
use DROP VIEW to delete view %s
DELETE FROM %s.sqlite_sequence WHERE name=%Q
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
foreign key on %s should reference only one column of table %T
number of columns in foreign key does not match the number of columns in the referenced table
unknown column "%s" in foreign key definition
indexed columns are not unique
table %s may not be indexed
views may not be indexed
virtual tables may not be indexed
there is already a table named %s
index %s already exists
sqlite_autoindex_%s_%d
table %s has no column named %s
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
no such index: %S
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.%s WHERE name=%Q
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
unable to identify the object to be reindexed
table %s may not be modified
cannot modify %s because it is a view
table %S has %d columns but %d values were supplied
%d values for %d columns
table %S has no column named %s
%s.%s may not be NULL
PRIMARY KEY must be unique
sqlite3_extension_init
unable to open shared library [%s]
no entry point [%s] in shared library [%s]
error during initialization: %s
automatic extension loading failed: %s
foreign_key_list
*** in database %s ***
unsupported encoding: %s
malformed database schema (%s)
%s - %s
unsupported file format
SELECT name, rootpage, sql FROM '%q'.%s
database schema is locked: %s
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
a NATURAL join may not have an ON or USING clause
cannot have both ON and USING clauses in the same join
cannot join using column %s - column not present in both tables
%s.%s
%s:%d
ORDER BY clause should come after %s not before
LIMIT clause should come after %s not before
SELECTs to the left and right of %s do not have the same number of result columns
no such index: %s
sqlite_subquery_%p_
no such table: %s
sqlite3_get_table() called with two or more incompatible queries
cannot create %s trigger on view: %S
cannot create INSTEAD OF trigger on table: %S
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
no such trigger: %S
-- TRIGGER %s
no such column: %s
PRAGMA vacuum_db.synchronous=OFF
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
vtable constructor failed: %s
vtable constructor did not declare schema: %s
no such module: %s
table %s: xBestIndex returned an invalid plan
at most %d tables in a join
cannot use index: %s
TABLE %s
%s AS %s
%s WITH INDEX %s
%s VIA MULTI-INDEX UNION
%s USING PRIMARY KEY
%s VIRTUAL TABLE INDEX %d:%s
%s ORDER BY
unable to close due to unfinished backup operation
no such vfs: %s
GetProcessWindowStation
operator
GetProcessHeap
KERNEL32.dll
RegCloseKey
RegOpenKeyExA
ADVAPI32.dll
SHELL32.dll
ole32.dll
CRYPT32.dll
GetCPInfo
OLEAUT32.dll
zcÁ
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
kernel32.dll
\StringFileInfo\xx\%s
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msimn.exe
outlook.exe
msimn.exe
%Program Files%\Microsoft Office\Office\Outlook.exe
Email Password Dump
hXXp://securityxploded.com/email-password-dump.php
EmailPasswordDump
//Dump all the Email passwords to console
//Dump all the Email passwords to a file "c:\passlist.txt"
\.purple\accounts.xml
<password>
</password>
%s\%s
@gmail.com
@yahoo.com
Software\Paltalk\%s
Software\Google\Google Talk\Accounts\%s
Microsoft_WinInet_VVV.google.com:443
%sMiranda_Mirror_%d.bin
LoginPassword
LoginName
LoginServer
gmail.com
%s\%s\%s.dat
pop3password=
esmtpaccount=
esmtppassword=
smtphost=
SmtpPassword
ESMTPAccountKey
c:\Program Files\Foxmail\mail
%s\%s\Account.stg
%Program Files%\Foxmail 7.0\Data\AccCfg\Accounts.tdat
PopPassword
SmtpAccount
SmtpServer
%s\%s\Accounts
%s\%s\Accounts\%s
Mozilla Thunderbird
Windows Live Mail
Windows Credential Manager
Application:%s
Email ID: %s
WindowsLive:name=*
Software\Microsoft\Windows Live Mail
<SMTP_Email_Address
<POP3_Port
<POP3_Password2
<IMAP_Port
<IMAP_Password2
<HTTPMail_Server
<HTTPMail_User_Name
<HTTPMail_Password2
<SMTP_Server
<SMTP_Port
<SMTP_User_Name
<SMTP_Password2
hXXps://
00000050
.oeaccount
Software\Microsoft\IdentityCRL\Creds\%s
ps:password
Email Password Recovery Report
Produced by EmailPasswordDump v%s from hXXp://VVV.SecurityXploded.com
SOFTWARE\Clients\Mail\Mozilla Thunderbird\shell\open\command
kpstorec.dll
220D5CC1-853A-11D0-84BC-00C04FD43F8F
417e2d75-84bd-11d0-84bb-00c04fd43f8f
220D5CD0-853A-11D0-84BC-00C04FD43F8F
220D5CD1-853A-11D0-84BC-00C04FD43F8F
IMAP Password
IMAP Port
POP3 Password
POP3 Port
SMTP User
SMTP Password
SMTP Server
SMTP Port
HTTP User
HTTP Password
HTTP Server URL
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows Messaging Subsystem\Profiles
%s\%s\%s
%s\%s\%s\%s
SMTP Email Address
IMAP Password2
POP3 Password2
SMTP User Name
SMTP Password2
HTTPMail User Name
HTTPMail Password2
HTTPMail Server
LDAP Password2
Specified master password "%s" is wrong. Please try again with correct password
GetWindowsDirectoryA
RegEnumKeyExA
USERENV.dll
VERSION.dll
RPCRT4.dll
v2.0.50727
Stub.exe
Microsoft.VisualBasic
System.Windows.Forms
System.Drawing
System.Management
System.Xml
tapi32.dll
rtm.dll
user32.dll
ntdll.dll
Crypt32.dll
Stub.Form1.resources
Stub.Resources.resources
Stub.My
WindowsFormsApplicationBase
Microsoft.VisualBasic.ApplicationServices
System.Collections.Generic
.ctor
.cctor
System.Diagnostics
System.Threading
System.Runtime.CompilerServices
System.ComponentModel
System.CodeDom.Compiler
Microsoft.VisualBasic.Devices
m_MyWebServicesObjectProvider
get_WebServices
HelpKeywordAttribute
System.ComponentModel.Design
WebServices
Microsoft.VisualBasic.CompilerServices
System.Collections
System.Reflection
ContainsKey
InvalidOperationException
MyWebServices
System.Runtime.InteropServices
encryptedpassstring
encryptedsmtpstring
portstring
encryptedftphost
encryptedftpuser
encryptedftppass
useftp
websitevisitor
websiteblocker
fakeMSGholder
passstring
smtpstring
ftphost
ftpuser
ftppass
WM_KEYUP
WM_KEYDOWN
WM_SYSKEYDOWN
WM_SYSKEYUP
KeyboardHandle
KeyLog
CleanedPasswordsMAIL
CleanedPasswordsWB
System.IO
get_ExecutablePath
WindowsIdentity
System.Security.Principal
set_WindowState
FormWindowState
UnhookWindowsHookEx
SetWindowsHookEx
SetWindowsHookExA
GetAsyncKeyState
vKey
HookKeyboard
UnhookKeyboard
Operators
get_Keyboard
Keyboard
get_CtrlKeyDown
get_AltKeyDown
KeyboardCallback
set_UseShellExecute
Microsoft.VisualBasic.MyServices
System.Collections.ObjectModel
MsgBox
MsgBoxResult
MsgBoxStyle
ForceSteamLogin
System.Net.NetworkInformation
get_OperationalStatus
OperationalStatus
FakemsgInstall
System.Net.Mail
SmtpClient
System.Globalization
set_Port
System.Net
Microsoft.Win32
RegistryKey
OpenSubKey
System.Security.Cryptography
System.Text
set_Key
StealPasswords
stealWebroswers
WebClient
readweb
System.IO.Compression
SendLogsFTP
FtpWebRequest
WebRequest
UploadFTP
secretKey
set_KeySize
get_KeySize
System.Net.Sockets
virtualKey
KeyboardHookDelegate
get_Msg
System.Security
ProcessHandle
Stub.My.Resources
System.Resources
get_WebBrowserPassView
WebBrowserPassView
System.Configuration
GoogleChrome
MozillaFirefox
loadCerts
FTPCommander
System.Text.RegularExpressions
WindowsKey
SQLite
SQLDataTypeSize
sqlite_master_entry
sql_statement
Passwords
PasswordSource
FtpCommander
8.0.0.0
My.Computer
My.Application
My.User
My.Forms
My.WebServices
System.Windows.Forms.Form
My.MyProject.Forms
4System.Web.Services.Protocols.SoapHttpClientProtocol
3System.Resources.Tools.StronglyTypedResourceBuilder
4.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
12.0.0.0
My.Settings
$3e46a124-e015-4b12-9390-f16ac4d7ad53
1.0.0.0
_CorExeMain
mscoree.dll
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
{3C374A40-BAE4-11CF-BF7D-00AA006946EE}
{AFA0DC11-C313-11D0-831A-00C04FD5AE38}
hXXp://
Hmscoree.dll
- CRT not initialized
- Attempt to initialize the CRT more than once.
- floating point support not loaded
Fkernel32.dll
USER32.DLL
hXXp://VVV.facebook.com/
hXXps://VVV.facebook.com/
hXXp://twitter.com/
hXXps://twitter.com/
hXXps://login.yahoo.com/config/login
hXXps://pinterest.com/login/
hXXp://VVV.linkedin.com/
hXXps://my.screenname.aol.com/_cqr/login/login.psp
hXXps://VVV.amazon.com/ap/signin/190-9059340-4656153
hXXps://signin.ebay.com/ws/ebayisapi.dll
hXXps://accounts.google.com/servicelogin
hXXps://VVV.google.com/accounts/servicelogin
hXXp://digg.com
hXXp://VVV.myspace.com
hXXps://myspace.com
hXXps://VVV.amazon.com/gp/css/homepage.html
hXXp://VVV.stumbleupon.com/sign_up.php
hXXp://slashdot.org/bookmark.pl
hXXp://VVV.reddit.com/login
noftp
MessageBoxIcon.Information
Disablecmd
\Windows Update.exe
\WindowsUpdate.exe
SysInfo.txt
\pid.txt
\pidloc.txt
HawkEyeKeylogger
\Mozilla\Firefox\Profiles
127.0.0.1
\SteamAppData.vdf
\ClientRegistry.blob
MessageBoxIcon.Error
MessageBoxIcon.Exclamation
MessageBoxIcon.Question
Dear HawkEye Customers!
HawkEye Admin
HawkEye Logger Details
Keylogger Enabled:
Operating System:
HawkEye_Keylogger_Execution_Confirmed_
HawkEye Keylogger | Execution Confirmed |
<b>Dear HawkEye Customer!</b><br><br>This is a notification generated by
after successful injection of your server.<br><br><b>Best Regards<br>HawkEye Admin<br><br><br>************************************************************<br>HawkEye Keylogger's Detail<br>************************************************************<br>Server Name: </b>
<br><b>Keylogger Enabled: </b>
<br><b>Operating System: </b>
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
autorun.inf
open=Sys.exe
Sys.exe
Software\Microsoft\Windows\CurrentVersion\Run
Windows Update
\bitcoin\wallet.dat
_wallet.dat
wallet.dat
Microsoft.NET\Framework\v2.0.50727\vbc.exe
holdermail.txt"
holdermail.txt
Source:{4}{4}{0}{5}Host:{4}{4}{1}{5}Username:{4}{2}{5}Password:{4}{3}{5}{5}
Operating System Intel Recovery
Operating System Platform:
Operating System Version:
HawkEye_Keylogger_Recoveries_
HawkEye Keylogger | Recoveries |
<b>****************************************************<br>Operating System Intel Recovery<br>****************************************************<br>PC Name: </b>
<br><b>Operating System Platform: </b>
<br><b>Operating System Version: </b>
C:\Users\
_Pin0.jpeg
_Pin1.jpeg
_Pin2.jpeg
_Pin3.jpeg
_Pin4.jpeg
HawkEye Keylogger | RuneScape Recoveries |
Dear HawkEye Customer!
HawkEye Keylogger | BitCoin Recoveries |
As you can see, this email has attached file(s) containing the wallet.dat file which holds the users Bitcoin Currency.
\.minecraft\lastlogin
HawkEye Keylogger | MineCraft Recoveries |
As you can see, this email has the attached file(s) containing MineCraft Username and Password. Please download it then decrypt the login credential / information with MineCraft Decryptor.
HawkEye Keylogger | Keyboard
Keyboard Records
.jpeg
HawkEye_Keylogger_Keylog_Records_
PTF://
HawkEye Keylogger | Keyboard <> Clipboards Records |
<br><b>**************************************<br>Keyboard Records<br>**************************************</b>
hXXp://192.99.212.64/WebPanel/log.php?username=
hXXp://whatismyipaddress.com/
Stub.Resources
:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
\Google\Chrome\User Data\Default\Login Data
logins
origin_url
password_value
moz_logins
formSubmitURL
encryptedPassword
\Mozilla Firefox\
mozglue.dll
\sitemanager.xml
\recentservers.xml
;Server=(?<server>.*?);Port=(?<port>.*?);Password=(?<password>.*?);User=(?<username>.*?);
port
password
C:\cftp\Ftplist.txt
\cftp\Ftplist.txt
\FTP Commander Deluxe\Ftplist.txt
password = (?<password>.*?)
hXXp://dyn.com/dns/
\Dyn\Updater\daemon.cfg
\Dyn\Updater\config.dyndns
hXXps://VVV.noip.com/
CKey
SOFTWARE\Microsoft\Windows NT\CurrentVersion

RegSvcs.exe_528_rwx_00400000_00122000:

.text
`.rsrc
@.reloc
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
`.rdata
@.data
.rsrc
%UUUU3
tcPW
-4-4--567
%s%2.2X
Browser Password Dump
%s v%s by SecurityXploded
hXXp://securityxploded.com/browser-password-dump.php
BrowserPasswordDump
%s.exe [-h | -f <output_file_name>]
//Dump login passwords from all the Browsers to console
%s.exe
//Dump login passwords from all the Browsers to a file 'c:\passlist.txt'
%s.exe -f "c:\passlist.txt"
%s.exe -h
pstorec.dll
http:/
https:/
abe2869f-9b47-4cd9-a358-c22904dba7f7
hXXps://%s
hXXp://%s
Cannot close vault. Error (%d)
Web Data
Login Data
select * from logins where blacklisted_by_user=0;
\MapleStudio\ChromePlus\User Data\Default\
\Google\Chrome SxS\User Data\Default\
\Google\Chrome\User Data\Default\
Opera\Opera\
Opera\Opera\profile\
wand.dat
<key>account</key>
passwords
<key>data</key>
<key>server</key>
%s\Safari\Apple Application Support\plutil.exe
%s\Apple\Apple Application Support\plutil.exe
%s\%s\keychain.plist
%skeytest.tmp
"%s" -convert xml1 -s -o "%s" "%s"
Google Chrome
Opera Browser
Firefox
Chrome SXS
SeaMonkey
Browser: %s
Website: %s
Username: %s
Password: %s
vaultcli.dll
Error: Failed to create file '%s' for writing Password list. Make sure you have specified correct & full file path
Browser Password Recovery Report
Website URL
Password
Produced by %s from hXXp://VVV.SecurityXploded.com
Tip: For more options type %s.exe -h
This is command-line application. Kindly Run it from the CMD Prompt
Press any key to exit....
SOFTWARE\Clients\StartMenuInternet\SEAMONKEY.EXE\shell\open\command
SOFTWARE\Clients\StartMenuInternet\firefox.exe\shell\open\command
Mozilla\SeaMonkey
Mozilla\Firefox
\profiles.ini
select * from moz_logins;
/signons.txt
/signons2.txt
/signons3.txt
\signons.sqlite
nss3.dll
PK11_GetInternalKeySlot
PK11_CheckUserPassword
SQLite format 3
CREATE TABLE sqlite_master(
sql text
CREATE TEMP TABLE sqlite_temp_master(
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
3.6.16
sqlite_version
RowKey
SQL logic error or missing database
large file support is disabled
sqlite_detach
sqlite_attach
d-d-d d:d:d
d:d:d
d-d-d
922337203685477580
%s\etilqs_
OsError 0x%x (%u)
invalid page number %d
2nd reference to page %d
Failed to read ptrmap key=%d
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
%d of %d pages missing from overflow list starting at %d
failed to get page %d
freelist leaf count too big on page %d
Page %d:
unable to get the page. error code=%d
sqlite3BtreeInitPage() returns error code %d
On tree page %d cell %d:
On page %d at right child:
Corruption detected in header on page %d
Corruption detected in cell %d on page %d
Multiple uses for byte %d of page %d
Fragmented space is %d byte reported as %d on page %d
Page %d is never used
Pointer map page %d is referenced
Outstanding page count goes from %d to %d during this analysis
keyinfo(%d
%s(%d)
%s-mjX
unable to use function %s in the requested context
cannot open savepoint - SQL statements in progress
no such savepoint: %s
cannot %s savepoint - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
sqlite_temp_master
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s
database table is locked: %s
cannot open virtual table: %s
cannot open view: %s
no such column: "%s"
cannot open indexed column for writing
cannot open value of type %s
misuse of aliased aggregate %s
%s: %s.%s.%s
%s: %s.%s
%s: %s
not authorized to use function: %s
%r %s BY term out of range - should be between 1 and %d
too many terms in %s BY clause
Expression tree is too large (maximum depth %d)
variable number must be between ?1 and ?%d
too many SQL variables
too many columns in %s
misuse of aggregate: %s()
%.*s"%w"%s
sqlite_rename_table
sqlite_rename_trigger
%s OR name=%Q
there is already another table or index with this name: %s
sqlite_
table %s may not be altered
view %s may not be altered
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
sqlite_sequence
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Cannot add a PRIMARY KEY column
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
sqlite_altertab_%s
sqlite_stat1
CREATE TABLE %Q.sqlite_stat1(tbl,idx,stat)
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
SELECT idx, stat FROM %Q.sqlite_stat1
invalid name: "%s"
too many attached databases - max %d
database %s is already in use
unable to open database: %s
no such database: %s
cannot detach database %s
database %s is locked
%s %T cannot reference objects in database %s
access to %s.%s.%s is prohibited
access to %s.%s is prohibited
object name reserved for internal use: %s
there is already an index named %s
too many columns on %s
duplicate column name: %s
default value of column [%s] is not constant
table "%s" has more than one primary key
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
no such collation sequence: %s
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
CREATE TABLE %Q.sqlite_sequence(name,seq)
view %s is circularly defined
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
table %s may not be dropped
use DROP TABLE to delete table %s
use DROP VIEW to delete view %s
DELETE FROM %s.sqlite_sequence WHERE name=%Q
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
foreign key on %s should reference only one column of table %T
number of columns in foreign key does not match the number of columns in the referenced table
unknown column "%s" in foreign key definition
indexed columns are not unique
table %s may not be indexed
views may not be indexed
virtual tables may not be indexed
there is already a table named %s
index %s already exists
sqlite_autoindex_%s_%d
table %s has no column named %s
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
no such index: %S
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.%s WHERE name=%Q
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
unable to identify the object to be reindexed
table %s may not be modified
cannot modify %s because it is a view
table %S has %d columns but %d values were supplied
%d values for %d columns
table %S has no column named %s
%s.%s may not be NULL
PRIMARY KEY must be unique
sqlite3_extension_init
unable to open shared library [%s]
no entry point [%s] in shared library [%s]
error during initialization: %s
automatic extension loading failed: %s
foreign_key_list
*** in database %s ***
unsupported encoding: %s
malformed database schema (%s)
%s - %s
unsupported file format
SELECT name, rootpage, sql FROM '%q'.%s
database schema is locked: %s
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
a NATURAL join may not have an ON or USING clause
cannot have both ON and USING clauses in the same join
cannot join using column %s - column not present in both tables
%s.%s
%s:%d
ORDER BY clause should come after %s not before
LIMIT clause should come after %s not before
SELECTs to the left and right of %s do not have the same number of result columns
no such index: %s
sqlite_subquery_%p_
no such table: %s
sqlite3_get_table() called with two or more incompatible queries
cannot create %s trigger on view: %S
cannot create INSTEAD OF trigger on table: %S
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
no such trigger: %S
-- TRIGGER %s
no such column: %s
PRAGMA vacuum_db.synchronous=OFF
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
vtable constructor failed: %s
vtable constructor did not declare schema: %s
no such module: %s
table %s: xBestIndex returned an invalid plan
at most %d tables in a join
cannot use index: %s
TABLE %s
%s AS %s
%s WITH INDEX %s
%s VIA MULTI-INDEX UNION
%s USING PRIMARY KEY
%s VIRTUAL TABLE INDEX %d:%s
%s ORDER BY
unable to close due to unfinished backup operation
no such vfs: %s
GetProcessWindowStation
operator
GetProcessHeap
KERNEL32.dll
RegCloseKey
RegOpenKeyExA
ADVAPI32.dll
SHELL32.dll
ole32.dll
CRYPT32.dll
GetCPInfo
OLEAUT32.dll
zcÁ
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
kernel32.dll
\StringFileInfo\xx\%s
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msimn.exe
outlook.exe
msimn.exe
%Program Files%\Microsoft Office\Office\Outlook.exe
Email Password Dump
hXXp://securityxploded.com/email-password-dump.php
EmailPasswordDump
//Dump all the Email passwords to console
//Dump all the Email passwords to a file "c:\passlist.txt"
\.purple\accounts.xml
<password>
</password>
%s\%s
@gmail.com
@yahoo.com
Software\Paltalk\%s
Software\Google\Google Talk\Accounts\%s
Microsoft_WinInet_VVV.google.com:443
%sMiranda_Mirror_%d.bin
LoginPassword
LoginName
LoginServer
gmail.com
%s\%s\%s.dat
pop3password=
esmtpaccount=
esmtppassword=
smtphost=
SmtpPassword
ESMTPAccountKey
c:\Program Files\Foxmail\mail
%s\%s\Account.stg
%Program Files%\Foxmail 7.0\Data\AccCfg\Accounts.tdat
PopPassword
SmtpAccount
SmtpServer
%s\%s\Accounts
%s\%s\Accounts\%s
Mozilla Thunderbird
Windows Live Mail
Windows Credential Manager
Application:%s
Email ID: %s
WindowsLive:name=*
Software\Microsoft\Windows Live Mail
<SMTP_Email_Address
<POP3_Port
<POP3_Password2
<IMAP_Port
<IMAP_Password2
<HTTPMail_Server
<HTTPMail_User_Name
<HTTPMail_Password2
<SMTP_Server
<SMTP_Port
<SMTP_User_Name
<SMTP_Password2
hXXps://
00000050
.oeaccount
Software\Microsoft\IdentityCRL\Creds\%s
ps:password
Email Password Recovery Report
Produced by EmailPasswordDump v%s from hXXp://VVV.SecurityXploded.com
SOFTWARE\Clients\Mail\Mozilla Thunderbird\shell\open\command
kpstorec.dll
220D5CC1-853A-11D0-84BC-00C04FD43F8F
417e2d75-84bd-11d0-84bb-00c04fd43f8f
220D5CD0-853A-11D0-84BC-00C04FD43F8F
220D5CD1-853A-11D0-84BC-00C04FD43F8F
IMAP Password
IMAP Port
POP3 Password
POP3 Port
SMTP User
SMTP Password
SMTP Server
SMTP Port
HTTP User
HTTP Password
HTTP Server URL
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Software\Microsoft\Windows Messaging Subsystem\Profiles
%s\%s\%s
%s\%s\%s\%s
SMTP Email Address
IMAP Password2
POP3 Password2
SMTP User Name
SMTP Password2
HTTPMail User Name
HTTPMail Password2
HTTPMail Server
LDAP Password2
Specified master password "%s" is wrong. Please try again with correct password
GetWindowsDirectoryA
RegEnumKeyExA
USERENV.dll
VERSION.dll
RPCRT4.dll
v2.0.50727
Stub.exe
Microsoft.VisualBasic
System.Windows.Forms
System.Drawing
System.Management
System.Xml
tapi32.dll
rtm.dll
user32.dll
ntdll.dll
Crypt32.dll
Stub.Form1.resources
Stub.Resources.resources
Stub.My
WindowsFormsApplicationBase
Microsoft.VisualBasic.ApplicationServices
System.Collections.Generic
.ctor
.cctor
System.Diagnostics
System.Threading
System.Runtime.CompilerServices
System.ComponentModel
System.CodeDom.Compiler
Microsoft.VisualBasic.Devices
m_MyWebServicesObjectProvider
get_WebServices
HelpKeywordAttribute
System.ComponentModel.Design
WebServices
Microsoft.VisualBasic.CompilerServices
System.Collections
System.Reflection
ContainsKey
InvalidOperationException
MyWebServices
System.Runtime.InteropServices
encryptedpassstring
encryptedsmtpstring
portstring
encryptedftphost
encryptedftpuser
encryptedftppass
useftp
websitevisitor
websiteblocker
fakeMSGholder
passstring
smtpstring
ftphost
ftpuser
ftppass
WM_KEYUP
WM_KEYDOWN
WM_SYSKEYDOWN
WM_SYSKEYUP
KeyboardHandle
KeyLog
CleanedPasswordsMAIL
CleanedPasswordsWB
System.IO
get_ExecutablePath
WindowsIdentity
System.Security.Principal
set_WindowState
FormWindowState
UnhookWindowsHookEx
SetWindowsHookEx
SetWindowsHookExA
GetAsyncKeyState
vKey
HookKeyboard
UnhookKeyboard
Operators
get_Keyboard
Keyboard
get_CtrlKeyDown
get_AltKeyDown
KeyboardCallback
set_UseShellExecute
Microsoft.VisualBasic.MyServices
System.Collections.ObjectModel
MsgBox
MsgBoxResult
MsgBoxStyle
ForceSteamLogin
System.Net.NetworkInformation
get_OperationalStatus
OperationalStatus
FakemsgInstall
System.Net.Mail
SmtpClient
System.Globalization
set_Port
System.Net
Microsoft.Win32
RegistryKey
OpenSubKey
System.Security.Cryptography
System.Text
set_Key
StealPasswords
stealWebroswers
WebClient
readweb
System.IO.Compression
SendLogsFTP
FtpWebRequest
WebRequest
UploadFTP
secretKey
set_KeySize
get_KeySize
System.Net.Sockets
virtualKey
KeyboardHookDelegate
get_Msg
System.Security
ProcessHandle
Stub.My.Resources
System.Resources
get_WebBrowserPassView
WebBrowserPassView
System.Configuration
GoogleChrome
MozillaFirefox
loadCerts
FTPCommander
System.Text.RegularExpressions
WindowsKey
SQLite
SQLDataTypeSize
sqlite_master_entry
sql_statement
Passwords
PasswordSource
FtpCommander
8.0.0.0
My.Computer
My.Application
My.User
My.Forms
My.WebServices
System.Windows.Forms.Form
My.MyProject.Forms
4System.Web.Services.Protocols.SoapHttpClientProtocol
3System.Resources.Tools.StronglyTypedResourceBuilder
4.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
12.0.0.0
My.Settings
$3e46a124-e015-4b12-9390-f16ac4d7ad53
1.0.0.0
_CorExeMain
mscoree.dll
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
{3C374A40-BAE4-11CF-BF7D-00AA006946EE}
{AFA0DC11-C313-11D0-831A-00C04FD5AE38}
hXXp://
Hmscoree.dll
- CRT not initialized
- Attempt to initialize the CRT more than once.
- floating point support not loaded
Fkernel32.dll
USER32.DLL
hXXp://VVV.facebook.com/
hXXps://VVV.facebook.com/
hXXp://twitter.com/
hXXps://twitter.com/
hXXps://login.yahoo.com/config/login
hXXps://pinterest.com/login/
hXXp://VVV.linkedin.com/
hXXps://my.screenname.aol.com/_cqr/login/login.psp
hXXps://VVV.amazon.com/ap/signin/190-9059340-4656153
hXXps://signin.ebay.com/ws/ebayisapi.dll
hXXps://accounts.google.com/servicelogin
hXXps://VVV.google.com/accounts/servicelogin
hXXp://digg.com
hXXp://VVV.myspace.com
hXXps://myspace.com
hXXps://VVV.amazon.com/gp/css/homepage.html
hXXp://VVV.stumbleupon.com/sign_up.php
hXXp://slashdot.org/bookmark.pl
hXXp://VVV.reddit.com/login
noftp
MessageBoxIcon.Information
Disablecmd
\Windows Update.exe
\WindowsUpdate.exe
SysInfo.txt
\pid.txt
\pidloc.txt
HawkEyeKeylogger
\Mozilla\Firefox\Profiles
127.0.0.1
\SteamAppData.vdf
\ClientRegistry.blob
MessageBoxIcon.Error
MessageBoxIcon.Exclamation
MessageBoxIcon.Question
Dear HawkEye Customers!
HawkEye Admin
HawkEye Logger Details
Keylogger Enabled:
Operating System:
HawkEye_Keylogger_Execution_Confirmed_
HawkEye Keylogger | Execution Confirmed |
<b>Dear HawkEye Customer!</b><br><br>This is a notification generated by
after successful injection of your server.<br><br><b>Best Regards<br>HawkEye Admin<br><br><br>************************************************************<br>HawkEye Keylogger's Detail<br>************************************************************<br>Server Name: </b>
<br><b>Keylogger Enabled: </b>
<br><b>Operating System: </b>
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
autorun.inf
open=Sys.exe
Sys.exe
Software\Microsoft\Windows\CurrentVersion\Run
Windows Update
\bitcoin\wallet.dat
_wallet.dat
wallet.dat
Microsoft.NET\Framework\v2.0.50727\vbc.exe
holdermail.txt"
holdermail.txt
Source:{4}{4}{0}{5}Host:{4}{4}{1}{5}Username:{4}{2}{5}Password:{4}{3}{5}{5}
Operating System Intel Recovery
Operating System Platform:
Operating System Version:
HawkEye_Keylogger_Recoveries_
HawkEye Keylogger | Recoveries |
<b>****************************************************<br>Operating System Intel Recovery<br>****************************************************<br>PC Name: </b>
<br><b>Operating System Platform: </b>
<br><b>Operating System Version: </b>
C:\Users\
_Pin0.jpeg
_Pin1.jpeg
_Pin2.jpeg
_Pin3.jpeg
_Pin4.jpeg
HawkEye Keylogger | RuneScape Recoveries |
Dear HawkEye Customer!
HawkEye Keylogger | BitCoin Recoveries |
As you can see, this email has attached file(s) containing the wallet.dat file which holds the users Bitcoin Currency.
\.minecraft\lastlogin
HawkEye Keylogger | MineCraft Recoveries |
As you can see, this email has the attached file(s) containing MineCraft Username and Password. Please download it then decrypt the login credential / information with MineCraft Decryptor.
HawkEye Keylogger | Keyboard
Keyboard Records
.jpeg
HawkEye_Keylogger_Keylog_Records_
PTF://
HawkEye Keylogger | Keyboard <> Clipboards Records |
<br><b>**************************************<br>Keyboard Records<br>**************************************</b>
hXXp://192.99.212.64/WebPanel/log.php?username=
hXXp://whatismyipaddress.com/
Stub.Resources
:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
\Google\Chrome\User Data\Default\Login Data
logins
origin_url
password_value
moz_logins
formSubmitURL
encryptedPassword
\Mozilla Firefox\
mozglue.dll
\sitemanager.xml
\recentservers.xml
;Server=(?<server>.*?);Port=(?<port>.*?);Password=(?<password>.*?);User=(?<username>.*?);
port
password
C:\cftp\Ftplist.txt
\cftp\Ftplist.txt
\FTP Commander Deluxe\Ftplist.txt
password = (?<password>.*?)
hXXp://dyn.com/dns/
\Dyn\Updater\daemon.cfg
\Dyn\Updater\config.dyndns
hXXps://VVV.noip.com/
CKey
SOFTWARE\Microsoft\Windows NT\CurrentVersion

RegSvcs.exe_528_rwx_675A6000_00003000:

.Qg<-Qg
*Rg`.Rg|)RgL Rg


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    vbc.exe:344
    vbc.exe:1144
    %original file name%.exe:636

  2. Delete the original Worm file.
  3. Delete or disinfect the following files created/modified by the Worm:

    %Documents and Settings%\%current user%\Local Settings\Temp\holdermail.txt (400 bytes)
    %Documents and Settings%\%current user%\1f5pn1963m431\amtryglqrhnpf.vbs (131 bytes)
    %Documents and Settings%\%current user%\1f5pn1963m431\run.vbs (94 bytes)
    %Documents and Settings%\%current user%\1f5pn1963m431\odsuxp.cmd (73 bytes)
    %Documents and Settings%\%current user%\Application Data\pid.txt (3 bytes)
    %Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe (32 bytes)
    %System%\wbem\Logs\wbemprox.log (152 bytes)
    %Documents and Settings%\%current user%\Application Data\pidloc.txt (57 bytes)
    %Documents and Settings%\%current user%\1f5pn1963m431\wqysku.ZAJ (90 bytes)
    %Documents and Settings%\%current user%\1f5pn1963m431\zvvuayagm.EMS (7547 bytes)
    %Documents and Settings%\%current user%\1f5pn1963m431\yxsjjocyy (2409088 bytes)
    %Documents and Settings%\%current user%\1f5pn1963m431\xaaoclphoyys.exe (15361 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\C:\DOCUME~1\adm]
    "1F5PN1~1" = "C:\DOCUME~1\"%CurrentUserName%"\1F5PN1~1\amtryglqrhnpf.vbs"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "Windows Update" = "%Documents and Settings%\%current user%\Application Data\WindowsUpdate.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
  7. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now