AlStar Posted January 9, 2010 Report Posted January 9, 2010 (edited) Salut!In mai putin de 5 ore, peste 10 persoane, (10 am eu in lista de messenger), au fost infectate de un virus necunoscut.Din cate am observat la ceilalti, virusul trimite mass-uri pe Yahoo! Messenger:Did you see the decorations we setup for Christmas? We went all out this year, take a look. http://c31ac-p.image-myspace.info:85/search.php&Result=3458/DVS-PartyPic008.JPEG.zipDin ce am vazut pe VirusTotal, nu-l detecteaza decat un Antivirus, ca aplicatie malware, si nu e Kaspersky, Symantec, NOD32 sau BitDefender..L-am executat, si dupa cateva secunde, Firewall-ul de la NOD32, ma anunta ca aplicatia "nu stiu cum bootloader" vrea sa acceseze un IP. Am dat Deny, si dupa vreo 5 secunde m-a intrebat iar, dar a 3-a oara am dat "Create rule cu Deny" si nu mi-a mai aparut nimic si nici mesajele nu s-au trimis pe messenger.Mereu m-am intrebat de unde fac altii rost de virusi noi..abia "iesiti din fabrica". Cred ca am descoperit: Yahoo! Messenger.LE: Cred ca trebuia postat la "Stiri"..ee..my bad..sorry:D Edited January 9, 2010 by AlStar Quote
Nytro Posted January 10, 2010 Report Posted January 10, 2010 Dragut, sa vad ce stie sa faca, revin cu mai multe informatii. Quote
AlStar Posted January 10, 2010 Author Report Posted January 10, 2010 (edited) Dupa cum am spus, l-am executat.Iata o chestie foarte interesanta:- scriu in firefox : Forumul Softpedia - apare Google- scriu in firefox : ESET - Antivirus Software with Spyware and Malware Protection - apare Google- la fel si in cazul kaspersky.comChestia ciudata e ca apare google, da' in bara de adresa tot eset.com scrie ...Fuck..what am I gonna do with this shit?Later Edit: Revin cu o noua informatie: Se pot accesa site-urile de mai sus prin intermediul unui webproxy. Eu am incercat prin HideMyAss si se incarca eset-u' fara probleme.. Edited January 10, 2010 by AlStar Quote
Nytro Posted January 10, 2010 Report Posted January 10, 2010 Vezi /Windows/system32/drivers/etc/hosts.Cred ca e cryptat, stubul foloseste nume random pentru numele modulelor, cred ca e folosit ceva gen Stub Generator.Cred ca are si niste EOF data, dar nu e plain text. Quote
AlStar Posted January 10, 2010 Author Report Posted January 10, 2010 (edited) Si ce ar trebui sa vad acolo? # Copyright (c) 1993-2001 Microsoft Corp.## This is a sample HOSTS file used by Microsoft TCP/IP for Windows.# This file contains the mappings of IP addresses to host names. Each# entry should be kept on an individual line. The IP address should# be placed in the first column followed by the corresponding host name.# The IP address and the host name should be separated by at least one# space.## Additionally comments (such as these) may be inserted on individual# lines or following the machine name denoted by a '#' symbol.## For example:## 102.54.94.97 rhino.acme.com # source server# 38.25.63.10 x.acme.com # x client host127.0.0.1 localhostLater edit: am gasit cateva informatii despre el..nu stiu cat sunt de corecte..http://info.prevx.com/aboutprogramtext.asp?PX5=C7C152BE00C1020860F50335219F6400ADE13D4F Edited January 10, 2010 by AlStar Quote
hunter_pass Posted January 10, 2010 Report Posted January 10, 2010 Dupa cum am spus, l-am executat.Iata o chestie foarte interesanta:- scriu in firefox : Forumul Softpedia - apare Google- scriu in firefox : ESET - Antivirus Software with Spyware and Malware Protection - apare Google- la fel si in cazul kaspersky.comChestia ciudata e ca apare google, da' in bara de adresa tot eset.com scrie ...Fuck..what am I gonna do with this shit?Later Edit: Revin cu o noua informatie: Se pot accesa site-urile de mai sus prin intermediul unui webproxy. Eu am incercat prin HideMyAss si se incarca eset-u' fara probleme..Sa inteleg ca asa ne-am putea da seama daca suntem infectati sau?Asta fara sa luam toata lista de mesenger si sa dam Hide Recent Messages (F3) Quote
AlStar Posted January 10, 2010 Author Report Posted January 10, 2010 Da, hunter_pass. Cel putin, asa cred. Quote
SympleBoy22 Posted January 10, 2010 Report Posted January 10, 2010 Si eu am primit un astfel de mass !Hoy desperte en la maana con esta vieja. Esta bien buena verdad? http://dl05.galeriadefotos.info:85/uploads/9301/MVC-IMAGEN0015.JPG.zip Quote
begood Posted January 10, 2010 Report Posted January 10, 2010 Anubis: Analyzing Unknown Binaries ___ __ _ + /- / | ____ __ __/ /_ (_)____ -\ + /s h- / /| | / __ \/ / / / __ \/ / ___/ -h s\ oh-:d/ / ___ |/ / / / /_/ / /_/ / (__ ) /d:-ho shh+hy- /_/ |_/_/ /_/\__,_/_.___/_/____/ -yh+hhs -:+hhdhyys/- -\syyhdhh+:- -//////dhhhhhddhhyss- Analysis Report -ssyhhddhhhhhd\\\\\\- /++/////oydddddhhyys/ ooooooooooooooooooooo \syyhhdddddyo\\\\\++\ -+++///////odh/- -+hdo\\\\\\\+++- +++++++++//yy+/: :\+yy\\+++++++++ /+soss+sys//yyo/os++o+: :+o++so\oyy\\sys+ssos+\+oyyyys++o/+yss/+/oyyyy: :yyyyo\+\ssy+\o++syyyyo++oyyyyyyso+os/o/+yyyyyy/ \yyyyyy+\o\so+osyyyyyyo+[#############################################################################] Analysis Report for DVS-PartyPic008.JPEG_www.image-myspace.com MD5: e4fc55ce43a12291fdcd1078a10bc805[#############################################################################]Summary: - Performs Registry Activities: The executable reads and modifies registry values. It also creates and monitors registry keys.[=============================================================================] Table of Contents[=============================================================================]- General information- DVS-PartyPic008.JPEG_www.image-myspace.com a) Registry Activities File Activities[#############################################################################] 1. General Information[#############################################################################][=============================================================================] Information about Anubis' invocation[=============================================================================] Time needed: 241 s Report created: 01/10/10, 12:26:49 UTC Termination reason: Timeout Program version: 1.73.0[#############################################################################] 2. DVS-PartyPic008.JPEG_www.image-myspace.com[#############################################################################][=============================================================================] General information about this executable[=============================================================================] Analysis Reason: Primary Analysis Subject Filename: DVS-PartyPic008.JPEG_www.image-myspace.com MD5: e4fc55ce43a12291fdcd1078a10bc805 SHA-1: 8ce5c546dfdfdf03758824ad42ada057891252a3 File Size: 221184 Bytes Command Line: "C:\DVS-PartyPic008.JPEG_www.image-myspace.com" Process-status at analysis end: alive Exit Code: 0[=============================================================================] Load-time Dlls[=============================================================================] Module Name: [ C:\WINDOWS\system32\ntdll.dll ], Base Address: [0x7C900000 ], Size: [0x000AF000 ] Module Name: [ C:\WINDOWS\system32\kernel32.dll ], Base Address: [0x7C800000 ], Size: [0x000F6000 ] Module Name: [ C:\WINDOWS\system32\MSVBVM60.DLL ], Base Address: [0x73420000 ], Size: [0x00153000 ] Module Name: [ C:\WINDOWS\system32\USER32.dll ], Base Address: [0x7E410000 ], Size: [0x00091000 ] Module Name: [ C:\WINDOWS\system32\GDI32.dll ], Base Address: [0x77F10000 ], Size: [0x00049000 ] Module Name: [ C:\WINDOWS\system32\ADVAPI32.dll ], Base Address: [0x77DD0000 ], Size: [0x0009B000 ] Module Name: [ C:\WINDOWS\system32\RPCRT4.dll ], Base Address: [0x77E70000 ], Size: [0x00092000 ] Module Name: [ C:\WINDOWS\system32\Secur32.dll ], Base Address: [0x77FE0000 ], Size: [0x00011000 ] Module Name: [ C:\WINDOWS\system32\ole32.dll ], Base Address: [0x774E0000 ], Size: [0x0013D000 ] Module Name: [ C:\WINDOWS\system32\msvcrt.dll ], Base Address: [0x77C10000 ], Size: [0x00058000 ] Module Name: [ C:\WINDOWS\system32\OLEAUT32.dll ], Base Address: [0x77120000 ], Size: [0x0008B000 ][=============================================================================] Run-time Dlls[=============================================================================] Module Name: [ C:\WINDOWS\system32\MSCTF.dll ], Base Address: [0x74720000 ], Size: [0x0004C000 ] Module Name: [ C:\WINDOWS\system32\SXS.DLL ], Base Address: [0x7E720000 ], Size: [0x000B0000 ][=============================================================================] 2.a) DVS-PartyPic008.JPEG_www.image-myspace.com - Registry Activities[=============================================================================][=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=] Registry Values Read:[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=] Key: [ HKLM\SOFTWARE\Microsoft\CTF\SystemShared\ ], Value Name: [ CUAS ], Value: [ 0 ], 1 time Key: [ HKLM\SYSTEM\CurrentControlSet\Control\Session Manager ], Value Name: [ CriticalSectionTimeout ], Value: [ 2592000 ], 1 time Key: [ HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows ], Value Name: [ AppInit_DLLs ], Value: [ ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers ], Value Name: [ TransparentEnabled ], Value: [ 1 ], 1 time Key: [ HKLM\System\CurrentControlSet\Control\Nls\Codepage ], Value Name: [ 932 ], Value: [ c_932.nls ], 1 time Key: [ HKLM\System\CurrentControlSet\Control\Nls\Codepage ], Value Name: [ 936 ], Value: [ c_936.nls ], 1 time Key: [ HKLM\System\CurrentControlSet\Control\Nls\Codepage ], Value Name: [ 949 ], Value: [ c_949.nls ], 1 time Key: [ HKLM\System\CurrentControlSet\Control\Nls\Codepage ], Value Name: [ 950 ], Value: [ c_950.nls ], 1 time Key: [ HKLM\System\CurrentControlSet\Control\Terminal Server ], Value Name: [ TSAppCompat ], Value: [ 0 ], 3 times Key: [ HKLM\System\CurrentControlSet\Control\Terminal Server ], Value Name: [ TSUserEnabled ], Value: [ 0 ], 1 time Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Keyboard Layout\Toggle ], Value Name: [ Language Hotkey ], Value: [ 1 ], 2 times Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Keyboard Layout\Toggle ], Value Name: [ Layout Hotkey ], Value: [ 2 ], 2 times[=============================================================================] 2. DVS-PartyPic008.JPEG_www.image-myspace.com - File Activities[=============================================================================][=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=] File System Control Communication:[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=] File: [ C:\ ], Control Code: [ 0x00090028 ], 1 time[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=] Device Control Communication:[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=] File: [ \Device\KsecDD ], Control Code: [ 0x00390008 ], 8 times[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=] Memory Mapped Files:[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=] File Name: [ C:\WINDOWS\system32\MSCTF.dll ] File Name: [ C:\WINDOWS\system32\MSVBVM60.DLL ] File Name: [ C:\WINDOWS\system32\SXS.DLL ] File Name: [ C:\WINDOWS\system32\imm32.dll ] File Name: [ C:\WINDOWS\system32\rpcss.dll ][#############################################################################] International Secure Systems Lab http://www.iseclab.org Vienna University of Technology Eurecom France UC Santa Barbarahttp://www.tuwien.ac.at http://www.eurecom.fr http://www.cs.ucsb.edu Contact: anubis@iseclab.org cand o fi gata si asta : http://anubis.iseclab.org/?action=result&task_id=1501cabdb98490e14cd17331099fb1bb8 ___ __ _ + /- / | ____ __ __/ /_ (_)____ -\ + /s h- / /| | / __ \/ / / / __ \/ / ___/ -h s\ oh-:d/ / ___ |/ / / / /_/ / /_/ / (__ ) /d:-ho shh+hy- /_/ |_/_/ /_/\__,_/_.___/_/____/ -yh+hhs -:+hhdhyys/- -\syyhdhh+:- -//////dhhhhhddhhyss- Analysis Report -ssyhhddhhhhhd\\\\\\- /++/////oydddddhhyys/ ooooooooooooooooooooo \syyhhdddddyo\\\\\++\ -+++///////odh/- -+hdo\\\\\\\+++- +++++++++//yy+/: :\+yy\\+++++++++ /+soss+sys//yyo/os++o+: :+o++so\oyy\\sys+ssos+\+oyyyys++o/+yss/+/oyyyy: :yyyyo\+\ssy+\o++syyyyo++oyyyyyyso+os/o/+yyyyyy/ \yyyyyy+\o\so+osyyyyyyo+[#############################################################################] Analysis Report for MVC-IMAGEN0015.JPG_www.galeriadefotos.com MD5: 53f6fbe013afb5e3d86f0e1a7ab26b02[#############################################################################]Summary: - Spawns Processes: The executable produces processes during the execution. - Performs Registry Activities: The executable reads and modifies registry values. It also creates and monitors registry keys.[=============================================================================] Table of Contents[=============================================================================]- General information- MVC-IMAGEN0015.JPG_www.galeriadefotos.com a) Registry Activities File Activities c) Process Activities - MVC-IMAGEN0015.[#############################################################################] 1. General Information[#############################################################################][=============================================================================] Information about Anubis' invocation[=============================================================================] Time needed: 241 s Report created: 01/10/10, 12:36:57 UTC Termination reason: Timeout Program version: 1.73.0[#############################################################################] 2. MVC-IMAGEN0015.JPG_www.galeriadefotos.com[#############################################################################][=============================================================================] General information about this executable[=============================================================================] Analysis Reason: Primary Analysis Subject Filename: MVC-IMAGEN0015.JPG_www.galeriadefotos.com MD5: 53f6fbe013afb5e3d86f0e1a7ab26b02 SHA-1: 619f905352997f995c3612a03c9dc008cef93d65 File Size: 204800 Bytes Command Line: "C:\MVC-IMAGEN0015.JPG_www.galeriadefotos.com" Process-status at analysis end: alive Exit Code: 0[=============================================================================] Load-time Dlls[=============================================================================] Module Name: [ C:\WINDOWS\system32\ntdll.dll ], Base Address: [0x7C900000 ], Size: [0x000AF000 ] Module Name: [ C:\WINDOWS\system32\kernel32.dll ], Base Address: [0x7C800000 ], Size: [0x000F6000 ] Module Name: [ C:\WINDOWS\system32\MSVBVM60.DLL ], Base Address: [0x73420000 ], Size: [0x00153000 ] Module Name: [ C:\WINDOWS\system32\USER32.dll ], Base Address: [0x7E410000 ], Size: [0x00091000 ] Module Name: [ C:\WINDOWS\system32\GDI32.dll ], Base Address: [0x77F10000 ], Size: [0x00049000 ] Module Name: [ C:\WINDOWS\system32\ADVAPI32.dll ], Base Address: [0x77DD0000 ], Size: [0x0009B000 ] Module Name: [ C:\WINDOWS\system32\RPCRT4.dll ], Base Address: [0x77E70000 ], Size: [0x00092000 ] Module Name: [ C:\WINDOWS\system32\Secur32.dll ], Base Address: [0x77FE0000 ], Size: [0x00011000 ] Module Name: [ C:\WINDOWS\system32\ole32.dll ], Base Address: [0x774E0000 ], Size: [0x0013D000 ] Module Name: [ C:\WINDOWS\system32\msvcrt.dll ], Base Address: [0x77C10000 ], Size: [0x00058000 ] Module Name: [ C:\WINDOWS\system32\OLEAUT32.dll ], Base Address: [0x77120000 ], Size: [0x0008B000 ][=============================================================================] Run-time Dlls[=============================================================================] Module Name: [ C:\WINDOWS\system32\MSCTF.dll ], Base Address: [0x74720000 ], Size: [0x0004C000 ] Module Name: [ C:\WINDOWS\system32\SXS.DLL ], Base Address: [0x7E720000 ], Size: [0x000B0000 ][=============================================================================] 2.a) MVC-IMAGEN0015.JPG_www.galeriadefotos.com - Registry Activities[=============================================================================][=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=] Registry Values Read:[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=] Key: [ HKLM\SOFTWARE\Microsoft\CTF\SystemShared\ ], Value Name: [ CUAS ], Value: [ 0 ], 1 time Key: [ HKLM\SYSTEM\CurrentControlSet\Control\Session Manager ], Value Name: [ CriticalSectionTimeout ], Value: [ 2592000 ], 1 time Key: [ HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows ], Value Name: [ AppInit_DLLs ], Value: [ ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers ], Value Name: [ AuthenticodeEnabled ], Value: [ 0 ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers ], Value Name: [ DefaultLevel ], Value: [ 262144 ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers ], Value Name: [ PolicyScope ], Value: [ 0 ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers ], Value Name: [ TransparentEnabled ], Value: [ 1 ], 2 times Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} ], Value Name: [ HashAlg ], Value: [ 32771 ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} ], Value Name: [ ItemData ], Value: [ 0x5eab304f957a49896a006c1c31154015 ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} ], Value Name: [ ItemSize ], Value: [ 779 ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} ], Value Name: [ SaferFlags ], Value: [ 0 ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} ], Value Name: [ HashAlg ], Value: [ 32771 ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} ], Value Name: [ ItemData ], Value: [ 0x67b0d48b343a3fd3bce9dc646704f394 ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} ], Value Name: [ ItemSize ], Value: [ 517 ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} ], Value Name: [ SaferFlags ], Value: [ 0 ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} ], Value Name: [ HashAlg ], Value: [ 32771 ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} ], Value Name: [ ItemData ], Value: [ 0x327802dcfef8c893dc8ab006dd847d1d ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} ], Value Name: [ ItemSize ], Value: [ 918 ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} ], Value Name: [ SaferFlags ], Value: [ 0 ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} ], Value Name: [ HashAlg ], Value: [ 32771 ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} ], Value Name: [ ItemData ], Value: [ 0xbd9a2adb42ebd8560e250e4df8162f67 ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} ], Value Name: [ ItemSize ], Value: [ 229 ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} ], Value Name: [ SaferFlags ], Value: [ 0 ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} ], Value Name: [ HashAlg ], Value: [ 32771 ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} ], Value Name: [ ItemData ], Value: [ 0x386b085f84ecf669d36b956a22c01e80 ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} ], Value Name: [ ItemSize ], Value: [ 370 ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} ], Value Name: [ SaferFlags ], Value: [ 0 ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33} ], Value Name: [ ItemData ], Value: [ %HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache%OLK* ], 1 time Key: [ HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33} ], Value Name: [ SaferFlags ], Value: [ 0 ], 1 time Key: [ HKLM\System\CurrentControlSet\Control\Nls\Codepage ], Value Name: [ 932 ], Value: [ c_932.nls ], 1 time Key: [ HKLM\System\CurrentControlSet\Control\Nls\Codepage ], Value Name: [ 936 ], Value: [ c_936.nls ], 1 time Key: [ HKLM\System\CurrentControlSet\Control\Nls\Codepage ], Value Name: [ 949 ], Value: [ c_949.nls ], 1 time Key: [ HKLM\System\CurrentControlSet\Control\Nls\Codepage ], Value Name: [ 950 ], Value: [ c_950.nls ], 1 time Key: [ HKLM\System\CurrentControlSet\Control\Terminal Server ], Value Name: [ TSAppCompat ], Value: [ 0 ], 3 times Key: [ HKLM\System\CurrentControlSet\Control\Terminal Server ], Value Name: [ TSUserEnabled ], Value: [ 0 ], 1 time Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Keyboard Layout\Toggle ], Value Name: [ Language Hotkey ], Value: [ 1 ], 2 times Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Keyboard Layout\Toggle ], Value Name: [ Layout Hotkey ], Value: [ 2 ], 2 times Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders ], Value Name: [ Cache ], Value: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files ], 1 time[=============================================================================] 2. MVC-IMAGEN0015.JPG_www.galeriadefotos.com - File Activities[=============================================================================][=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=] File System Control Communication:[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=] File: [ C:\ ], Control Code: [ 0x00090028 ], 1 time[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=] Device Control Communication:[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=] File: [ \Device\KsecDD ], Control Code: [ 0x00390008 ], 8 times[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=] Memory Mapped Files:[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=] File Name: [ C:\MVC-IMAGEN0015.JPG_www.galeriadefotos.com ] File Name: [ C:\WINDOWS\system32\MSCTF.dll ] File Name: [ C:\WINDOWS\system32\MSVBVM60.DLL ] File Name: [ C:\WINDOWS\system32\SXS.DLL ] File Name: [ C:\WINDOWS\system32\imm32.dll ] File Name: [ C:\WINDOWS\system32\rpcss.dll ][=============================================================================] 2.c) MVC-IMAGEN0015.JPG_www.galeriadefotos.com - Process Activities[=============================================================================][=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=] Processes Created:[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=] Executable: [ C:\MVC-IMAGEN0015.JPG_www.galeriadefotos.com ], Command Line: [ ] Executable: [ C:\MVC-IMAGEN0015.JPG_www.galeriadefotos.com ], Command Line: [ "C:\MVC-IMAGEN0015.JPG_www.galeriadefotos.com" ][=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=] Remote Threads Created:[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=] Affected Process: [ C:\MVC-IMAGEN0015.JPG_www.galeriadefotos.com ][=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=] Foreign Memory Regions Read:[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=] Process: [ C:\MVC-IMAGEN0015.JPG_www.galeriadefotos.com ][=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=] Foreign Memory Regions Written:[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=] Process: [ C:\MVC-IMAGEN0015.JPG_www.galeriadefotos.com ][#############################################################################] 3. MVC-IMAGEN0015.[#############################################################################][=============================================================================] General information about this executable[=============================================================================] Analysis Reason: Started by MVC-IMAGEN0015.JPG_www.galeriadefotos.com Filename: MVC-IMAGEN0015. Process-status at analysis end: alive Exit Code: 0[=============================================================================] Load-time Dlls[=============================================================================] Module Name: [ C:\WINDOWS\system32\ntdll.dll ], Base Address: [0x7C900000 ], Size: [0x000AF000 ][#############################################################################] International Secure Systems Lab http://www.iseclab.org Vienna University of Technology Eurecom France UC Santa Barbarahttp://www.tuwien.ac.at http://www.eurecom.fr http://www.cs.ucsb.edu Contact: anubis@iseclab.org LE : MIRROR la ambele: http://www.2shared.com/file/10579289/b0346600/Downloads.htmlpass: rstcenter.com Quote
xact Posted January 10, 2010 Report Posted January 10, 2010 Misto facut...Lista de stringuri din virus:jjjjjjhjjjjjjjjjjjjj!This program cannot be run in DOS mode.4RichUPX0`UPX1`UPX2UPX!LXqrnqBT+=B|VKxQwvIXHITUm/srBu$?GL<.diqjpTDdE$YFByt9F<gY,NT8hdYTwnS|VqrOYE$Cxz&'eY%eUBsMQ3kQCJQIHLbsKIlucwCEmj8%ED88GDAQoTyAgwr\EJEL3yL@DvDy3KontCAIuMTivsGS:3UKy!3UG"u3UXtDXtDhcODhMRDhYUDtdhtjhuPhxqDPhtuZhxqD;M`trM8QjUTRjjDjQTRQh@A@hhXDSVW;B<sKh;XDAuAPjlAuAPjLPjlSVWSVWE0PjeU0RjehXQDhp.EhXQDhp.EXtDhXQDhp.EXtDhMRDh7QDSVWTpDtpDu*hdQhdu*hhRhhu/hlPhlZu/hpQhpu/htRhtu,hxPhxppDdpDDpDHpDLpDPpDtpDtAhlpDhpDSVWSVWhxODhHTDhHTDhhTDhhTDhHTDhHTDh(TDSVWSVWhXQDhp.EhHSDhMRDEjjEjjEjhjjjDjjBjjjjjAjjjjjjjjjjhjjjjjjjjDjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjPsDjNhpxsDuMjXhLsDuGj`hLjeh$LsDPhDDsDu;jph\LsD*jvhB(PhhhPDuUhTsDuWhLsDPhxxpDhHbDLsDunhLsDPhhLsDLsDHsDh6bDt(hDQhdt(hhQhPQhdQhptcjtWjuLhhHSDhpbDxpDxpDhvVDhPVDSVWyVAh(VDhHbDhHbDXtDXtDh@PDTSVWh(SDSVWh1PDtUjxpDxqDTpDxpDPhdxpDdpDTpDPhHHpDlpDlpDlpDlpDhpDhpDhpDhpDhpDhpDhpDhpDhpDhpDhpDhpDhpDhpDhpDhpDhpDhpDuLhQh@uAHpDQhHlpDhpDppDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDZIzxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDhGrxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDhZOxpDxpDxpDxpDxpDxpDxpDxpDdHAhk13UgO3UTTzdr3ULA3U=Is3UJi3UjjjjjjjjjjjjjjjjjjjjjDjjjjjjDjjDjjBjjjjhjjhDjjjDjjjDjjjjjjDjjjjjjDjjjjjjDjjjjjjDjjjjjjDjjjjjjDjjjDjjDjjjBjjDjjDjjBjjjjjDjjjjjjDjjjDjjjDjjjDjjjDjjjDjjjDjjjDjjjDjjjDjjjjjjDjjjDjjjDjjjjjjDjjjDjjjDjjjDjjjDjjjjjjDjjjDjjjDjjjjjjDjjjjjjDjjjjjjjjjDjjjjjjDjjjDjjDjjjjjDjjjDjjjDjjjDjjjDjjjjjjDjjjjjjDjjjDjjjDjjjZvbpx3Uxr/3UeEs3UppDppDoX3UM8QjxqDU@RjxqDjDjxqDxpDhH\Dh3ZDSVWxqDXpDhPWDRhPQhdPhhPhlQhpPhtTpDhHbDhHbDxpDxpDQhxhDHDSVWdrDprDlrDtrDxrDSVWjDsDdsDTsDhx|Eu.hxSjohPhlwESj;hLwE(Sj_hh~EPh ~E(Sj`h$ShC$Sj?hPhlPhpPhySj?hPh ~E(Sj`h$ShC$Sj?h$SjshSj?hDsDdsDYYjTsDhx|EjohPhlwEj;hLwEPh ~Et&hAuOSYYWu$hjWhTE@hdE@hlYYjlxEpxEtxELxEPxETxELyEPyETyEdyEDyELzEPzETzElzEpzEtzEDzEVVBtVBFWBdWBKXBiXBYYBwYBCZBSVW3SGWjDsDPh~ftsDTsDPSShsDTjPpsDXsDSVWj5lsD=dsDTjPpsDXsDSVWj=lsD5dsDXsDdsDdsD5dsDdsDdsD5lsDd$PPd$hPD$DhxpDYYSdsDxpDt$<hXd$PPd$dPtSSPhlxpDQUVht5xqDCTPQUPhz_BxpDQShxqDxqDxqDSVjtjtSVPsDxqDPjZhPSVhui8]xtQVWtNQwISwGQxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDhhRDxqDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDh3ZDxqDxqDxqDxqDPrDTrDxpDh5W%lxpDxpDxpDPhDxpDxpDxpDxpDxpDPhtLrDQhTxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDubjxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDxpDWSV0WWWWWDtDDtDDtDDtDSSSSSSj ZhX%EuCjxqDHpuSjLHpDPPPPPhx%EVVVVV0WWWWWPPPPPPPPPtDhl`EXtDxpDhptDh`tDhpDuBh9FCHpuHpu8csmQSVWrwWSSSSSSSSSSVVVVVVVVVVSSSSS@uvVSSSSShX&ESSSSShx&EVVVVV@uwSVVVVVWWWWWWWWWWSSSSSSSSSSWWWWWhBoCAAf9BBfBBFFfAABBfjXhYQPVh0SSSSSSSQPPPPPt%HHtItUhtDHHtXHHtHHty+itqgueRPSW>If90tWSj0FPFWSj SSSSSSSSSSSSSSSSSSSSueSjNCuhp'CSVW9csmWj6YFpt"SSSSSSVWSSSSSPVj@_trP,uRPPPPPPSSSSSChU5LuDLuDPPPPP>CuWuQhVVVVVPSP@PVWVVVVVVVVVVPPPPPuhjHuDh vDLuDQWSVVVVVvSSShSSSSSh8cEh$vDhpDhPvDhpDF\p|Dt$h$vDhpDhPvDxqDuNhF\=p|D5hpDhtvDhhvDh`vDtehN<CtHhuNSWGPfVWjQQShP|DVVVVVu&h8|DPPPPPVVVVVVVVVVVVVVVpgEhP(Ehp'CSVWhp(EQQVvdjt+HtPPPPPwdSxqDSSSFVPtMSQWVPSSSSSWWWWWuaVjuL9=dWWWWWh dEWPWWPWGpt0A@@Juu8SS3GWhXxqDSSWt"SS9]xpDxpDxpDxpDhP)EWWWWWSSSSSSSSSSQQSV3VVVVjPVVtTjtCVVoV fof@fonPfov`fo~pfoPfVSPPRQWWWWWuOVjThp)Ej@j ^VVVVVV<at9<rt,<wtSSSSStVHtGtEHt1>=upFSSSSSYYFtIhSVWURPQQhUVWSSVWjh/kCxqDWWWWW~,WPVtVPVVVVVV@SuzPVVVVVYYGLutdtWitRotMxtHntJjdZ;PCSPCSPCSPCSPCSPCSctN^F<-uBGJu<xtX<XtTxteHpD8csm>=Yt1jtNVSPPPPPPPSS5pqDxqDSSS+@PWSSt!SSWSStqDhqDlqDdqDxqDWWWWWWWWWWVVVVVVVVVVPPjAAfVVhUPVhxqDxqDWWWWWVVVVV^SSSSSWSVj"^SSSSSQSWVjxqDWSVPPPPPt$HHtItUhtDHHtYHHtHHty+itmgufRPSWWSj0FPFWSj VVVVQpuPj1Q3F Pj*F$Pj+F(Pj,F,Pj-F0Pj.F4Pj/F8PjDF<PjEF@PjFFDPjGFHPjHFLPjIFPPjJFTPjKFXPjLF\PjMF`PjNFdPjOFhPj8FlPj9FpPj:FtPj;FxPj<F|Pj=PjAPjBPjCSVWC PjPVC$PjQVC(PjC)PjC*PjTVC+PjUVC,PjVVC-PjWVC.PjRVC/PjSVQW@PhW@PhtKPQpuQpu0SSSSSBOu0SSSSS|FVWtNhVjxSVWTqDTqDSVWVj@hTqDXqDPqDPPPPPj@ShC@PhFVhXHqDxqDHqDLqDtR:QPPPPPPPPSVWlpD5hpDtGPVVVVVDqDDqDu,VVWVxqDt VV9uWWWWVt<Vjt+WWVPVhX*EwIVSPVSjxqDFVSjxqDSSSSSSVW3PWWxqDt{~Bjt1SWtPjSSSSSSSSSSSSSSStSj=V?sjjt\VV@Y@PWSSSSSSSSSSSSSSSHttxqDHt$CxqDxqDHt(fxqDhx*EVVVVVSSSSStGHt.Ht&^SSSSSxqDxqDtqjSSSSSSASSxqD8VVVVVSSSSSSSSSSr0f;pr0f;HSSSSSSSSSSSVWUjSVWUPjUQPXY]Y[VVVVVuyGSSSSSxqD@WuyVWWWWWQVjxqDVVjSSSSSSSSSSVVVVVSSSSSSSSSSVVVVVQSV^SSSSS^SSSSSAVWSSSSSSSSSSSVW3tYjskSxqDdqDxqDVVVVVPPjWVSVNDuXj4VWrWh`pEh`pEyNDyNDSVWSVW<xt.<Xu,YPVRPQV<xt.<Xu,YPWQQVjjjjjCfDmscoree.dll(null)KERNEL32.DLL.php.zip.JPG.JPEGSVW%DrD%hrDhD,EQQSVWdSVWPPPQSVWSVWSVW=MOC=csmhx,E8csm9csm~SSVQVj>csmtaSVYYPVt)SVHu4jYYPYYPQQV>MOCs[S;7|G;wcsmYYhcsmSVWcsmtR99u2pgEtgExgEPPPPPSVW_VVVVVSSSSSSVWSSSSS^WWWWWPSWSQRPjdRPSVWPPPPPWj0VSVWSSSSSSSSSSEtZVVVVVppDhpDWWWWQYYuSSSSWSSSSW0SSSSS@PWVPPPPPWVU3_VVVVV5XqETqEXqE5XqEPqEPqEdqEdqE5pqElqEpqE5pqEtqEhqEtqEhqEtqExqESSSSSHHt+t HHtHHtVVVVVVVVVVSVWSVWTtE%TtEVC20XC00USVWUtfVUtLxXj>csmhp'C0SVWpFEQVWjdZhy[BjdWh%iDh/iDh9iDhCiDHsDXtDB~9|B~+wB~F~k!C~B~J!C~gF~kqUjqUSqITS*PwFKhDahDwhDPdDpgDbad allocationUnknown exceptionCorExitProcess(null)EEExpxxxxLC_TIMELC_NUMERICLC_MONETARYLC_CTYPELC_COLLATELC_ALL!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~EncodePointerDecodePointerFlsFreeFlsSetValueFlsGetValueFlsAlloccsmruntime error TLOSS errorSING errorDOMAIN errorAn application has made an attempt to load the C runtime library incorrectly.Please contact the application's support team for more information.- Attempt to use MSIL code from this assembly during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.- not enough space for locale information- Attempt to initialize the CRT more than once.This indicates a bug in your application.- CRT not initialized- unable to initialize heap- not enough space for lowio initialization- not enough space for stdio initialization- pure virtual function call- not enough space for _onexit/atexit table- unable to open console device- unexpected heap error- unexpected multithread lock error- not enough space for thread dataThis application has requested the Runtime to terminate it in an unusual way.Please contact the application's support team for more information.- not enough space for environment- not enough space for arguments- floating point support not loadedMicrosoft Visual C++ Runtime Library<program name unknown>Runtime Error!Program: ccsUTF-8UTF-16LEUNICODEEEE`h`hhhxppwpp!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~HH:mm:ssdddd, MMMM dd, yyyyMM/dd/yyDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuaryDecNovOctSepAugJulJunMayAprMarFebJanSaturdayFridayThursdayWednesdayTuesdayMondaySundaySatFriThuWedTueMonSununited-statesunited-kingdomtrinidad & tobagosouth-koreasouth-africasouth koreasouth africaslovakpuerto-ricopr-chinapr chinanew-zealandhong-konghollandgreat britainenglandczechchinabritainamericausaswissswedish-finlandspanish-venezuelaspanish-uruguayspanish-puerto ricospanish-peruspanish-paraguayspanish-panamaspanish-nicaraguaspanish-modernspanish-mexicanspanish-hondurasspanish-guatemalaspanish-el salvadorspanish-ecuadorspanish-dominican republicspanish-costa ricaspanish-colombiaspanish-chilespanish-boliviaspanish-argentinaportuguese-braziliannorwegian-nynorsknorwegian-bokmalnorwegianitalian-swissirish-englishgerman-swissgerman-luxembourggerman-lichtensteingerman-austrianfrench-swissfrench-luxembourgfrench-canadianfrench-belgianenglish-usaenglish-usenglish-ukenglish-trinidad y tobagoenglish-south africaenglish-nzenglish-jamaicaenglish-ireenglish-caribbeanenglish-canenglish-belizeenglish-ausenglish-americandutch-belgianchinese-traditionalchinese-singaporechinese-simplifiedchinese-hongkongchinesechichhcanadianbelgianaustralianamerican-englishamerican englishamericanENUENUENUENANLBENCZHHZHICHSZHHCHSZHICHTNLBENUENAENLENCENBENIENJENZENSENTENGENUENUFRBFRCFRLFRSDEADECDELDESENIITSNORNORNONPTBESSESBESLESOESCESDESFESEESGESHESMESNESIESAESZESRESUESYESVSVFDESENGENUENUUSAGBRCHNCZEGBRGBRNLDHKGNZLNZLCHNCHNPRISVKZAFKORZAFKORTTOGBRGBRUSAUSAOCPACPNorwegian-NynorskComplete Object Locator'Class Hierarchy Descriptor'Base Class Array'Base Class Descriptor at (Type Descriptor'`local static thread guard'`managed vector copy constructor iterator'`vector vbase copy constructor iterator'`vector copy constructor iterator'`dynamic atexit destructor for '`dynamic initializer for '`eh vector vbase copy constructor iterator'`eh vector copy constructor iterator'`managed vector destructor iterator'`managed vector constructor iterator'`placement delete[] closure'`placement delete closure'`omni callsig'delete[]new[]`local vftable constructor closure'`local vftable'`RTTI`udt returning'`copy constructor closure'`eh vector vbase constructor iterator'`eh vector destructor iterator'`eh vector constructor iterator'`virtual displacement map'`vector vbase constructor iterator'`vector destructor iterator'`vector constructor iterator'`scalar deleting destructor'`default constructor closure'`vector deleting destructor'`vbase destructor'`string'`local static guard'`typeof'`vcall'`vbtable'`vftable'operatordeletenew__unaligned__restrict__ptr64__clrcall__fastcall__thiscall__stdcall__pascal__cdecl__based(GetProcessWindowStationGetUserObjectInformationAGetLastActivePopupGetActiveWindowMessageBoxAUSER32.DLLSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecCONOUT$string too longinvalid string position0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyzbad exceptionbHCbHCGAIsProcessorFeaturePresentKERNEL321#QNAN1#INF1#IND1#SNANbad allocationYahooBuddyMainYTopWindowATL:007BF380SysListView32Send Message to GroupATL:007BF380YIMInputWindowButtonuNOGbad allocationbad allocation/clearoeg@hdutSkypebad allocation""%PROGRAMFILES%\Windows Live\Messenger\msnmsgr.exe""bad allocation1mspstopimspreadevent##opsPRIVMSG%s %s :Failed To Start IMSpread Thread! < args are not int >##opsPRIVMSG%s %s :Failed To Start IMSpread Thread! <%d>##opsPRIVMSG%s %s :IMSpread Thread Has Started!.\IMSpread\IMThread.cpphIMEvent is set##opsPRIVMSG%s %s :Stopped IMSpread Thread!stopping thread##opsPRIVMSG%s %s :Already Stopping IMSpread Thread!.\IMSpread\IMThread.cppAlready Stopping IMSpread Thread!1msp##opsPRIVMSG%s %s :IMSpread Is Not Running! <%d>.\IMSpread\IMThread.cppIMSpread Is Not Running!##opsPRIVMSG%s %s :Failed To Stop IMSpread Thread! <%d>.\IMSpread\IMThread.cppFailed To Stop IMSpread!##opsPRIVMSG%s %s :Stopping IMSpread Thread!.\IMSpread\IMThread.cppStopping Scanner IMSpread!bad allocationbad allocationFnf|)\biz,5-1#g1&?9l+<&5?6 t!9wbad allocationlgbutCUh]Q\WWYWDKfeutCUh]Q\WWYWDKfelgbutCUh]Q\WWYWDKfeadYbad allocation.\scanner\Scanner.cpp[+] Connecting to %s.\scanner\Scanner.cpp[-] Failed to fconnect.\scanner\Scanner.cpp[*] Establishing null session....\scanner\Scanner.cpp[-] Send failed.\scanner\Scanner.cpp[-] Failed to receive NegotiateRequest Response..\scanner\Scanner.cpp[-] Send failed.\scanner\Scanner.cpp[-] Failed to receive SessionSetupAndX1 Response..\scanner\Scanner.cpp[*] Native OS:.. %sWindows 5.1Windows 5.0Windows Server 2003Service Pack 1Service Pack 2Windows Vista (TM).\scanner\Scanner.cpp[*] Sending TreeConnect Request....\scanner\Scanner.cpp[*] Sending PipeRequest \SRVSVC....\scanner\Scanner.cpp[-] Send failed.\scanner\Scanner.cpp[-] Failed to receive proper PipeRequest Response..\scanner\Scanner.cpp[*] Sending PipeRequest \BROWSER....\scanner\Scanner.cpp[-] Send failed.\scanner\Scanner.cpp[-] Failed to receive proper PipeRequest Response..\scanner\Scanner.cpp[*] Sending PipeRequest \BROWSER....\scanner\Scanner.cpp[+] Connecting to %s.\scanner\Scanner.cpp[-] Failed to connect.\scanner\Scanner.cpp[*] Establishing null session....\scanner\Scanner.cpp[-] Send failed.\scanner\Scanner.cpp[-] Failed to receive NegotiateRequest Response..\scanner\Scanner.cpp[-] Send failed.\scanner\Scanner.cpp[-] Failed to receive SessionSetupAndX1 Response..\scanner\Scanner.cpp[-] Send failed.\scanner\Scanner.cpp[-] Failed to receive SessionSetupAndX2 Response..\scanner\Scanner.cpp[-] Send failed.\scanner\Scanner.cpp[-] Failed to receive SessionSetupAndX2 Response..\scanner\Scanner.cpp[*] Sending TreeConnect Request....\scanner\Scanner.cpp[-] Send failed.\scanner\Scanner.cpp[-] Failed to receive proper TreeConnectAndX response..\scanner\Scanner.cpp[*] Sending PipeRequest \browser....\scanner\Scanner.cpp[-] Send failed.\scanner\Scanner.cpp[-] Failed to receive proper PipeRequest Response..\scanner\Scanner.cpp[-] Send failed.\scanner\Scanner.cpp[-] Failed to receive proper DceBind Response..\scanner\Scanner.cpp[-] Send failed.\scanner\Scanner.cpp[-] Failed to receive proper SMBAndXRead response.qxzv%d.exe.\scanner\Scanner.cpp[-] Shellcode could not be properly encoded..\scanner\Scanner.cpp[-] Send failed.\scanner\Scanner.cpp[-] Failed to receive proper SMBAndXRead response..\scanner\Scanner.cpp[*] Happy rooting!.\scanner\Scanner.cpp[-] Failed to determine OS.\scanner\Scanner.cpp[*] OS is: %dAUTOAUTOCHNCZEDEUESPVENARGFINFRAHUNITAJAPKORNLDNORPLKPRTRUSSVETURUSA.\scanner\Scanner.cppAddress: %s.\scanner\Scanner.cppAddress: %s%d.%d.%d.%dAUTO.\scanner\Scanner.cpp%d: Checking: %s#scanPRIVMSG%s %s :Infected IP: %s\IPC$.\scanner\Scanner.cpp%d: Found IP with Port 445 open: %s.\scanner\Scanner.cpp%d: IP has Port 445 Closed: %s.\scanner\Scanner.cppSignalled! Stopping Thread %d.\scanner\Scanner.cppAddress: %s.\scanner\Scanner.cpp%d: Checking: %s#scanPRIVMSG%s %s :Infected IP: %s\IPC$.\scanner\Scanner.cpp%d: Found IP with Port 445 open: %s.\scanner\Scanner.cpp%d: IP has Port 445 Closed: %s.\scanner\Scanner.cppSignalled! Stopping Thread %dasd3r4trwer.\scanner\Scanner.cppFailed to CreateEvent <%d>.\scanner\Scanner.cppMain Scanner thread started..\scanner\Scanner.cppStarted Thread %d.\scanner\Scanner.cppThread %d Failed To Executeasd3r4trwer##opsPRIVMSG%s %s :Scanner Is Not Running! <%d>.\scanner\Scanner.cppScanner Is Not Running!stopping threads##opsPRIVMSG%s %s :Already Stopping Scanner Thread!.\scanner\Scanner.cppAlready Stopping Scanner Thread!.\scanner\Scanner.cppEvent is set##opsPRIVMSG%s %s :Failed To Stop Scanner Thread! <%d>.\scanner\Scanner.cppFailed To Stop Scanner!##opsPRIVMSG%s %s :Stopping Scanner Thread!.\scanner\Scanner.cppStopping Scanner Thread!asd3r4trwer##opsPRIVMSG%s %s :Scanner Is Already Running! <%d>.\scanner\Scanner.cppScanner Is Already Running!AUTOAUTO##opsPRIVMSG%s %s :Failed To Create Scanner Thread!.\scanner\Scanner.cppFailed To Create Scanner Thread!##opsPRIVMSG%s %s :Scanner Thread Has Started!.\scanner\Scanner.cppScanner Thread Has Started!bad allocationcalls incalls outpackets inpackets outncacn_npbad allocationIPC$\pipe\spoolssbad allocationrndwindowclasshttp://1.img-myspace.info/net/debug.zip~tmpload~tmploadx.exe:\Autorun.inf~tmploadx.exe~tmpload[Autorun]open=icon=%windir%\system32\SHELL32.dll,8action=Open folder to view files using Windows Explorershell\open=Openshell\open\command=shell\open\default=1shell\explore=Exploreshell\explore\command=shell\search=Search...shell\search\command=useautoplay=1\*.exebad allocation##opsPRIVMSGtmp%s %s :Update Failed: BotID is same as new one (maybe updated!)! <%d>.exe%temp%##opsPRIVMSG%s %s :Update Failed: Downloading exe Failed!##opsPRIVMSG%s %s :Update Failed: CloseHandle Failed! <%d>muipcdraotse##opsPRIVMSG%s %s :Update Failed: CreateProcess Failed! <%d>Mut3xrbulnanbilnag##opsPRIVMSG%s %s :Updating Thread Is Already Running!##opsPRIVMSG%s %s :Failed To Update!##opsPRIVMSG%s %s :Failed To Start IMSpread Thread! < args are not int >##opsPRIVMSG%s %s :Failed To Create Update Thread!bad allocationevcoh5b(9.Pxvzuctfmon.exerwk`avZT`hxnhLmlubaODtdvu|n~nnBYISGTEIJwGECHUqj@]P[]dGYQQU_g}HJW/3+9!!DisableNXShowUIctfmon.exenuAljqthdZoPNaadc}HFwq}[uthASvNHOBHctfmon.exectfmon.exevia|~kyiqcFSC]@[SBkoPT_SJMwmisftd.exewmisftd.exeZzBTEDAWbad allocationHAI. S1|v`5ecwi:P+IMRNFP`f{Y_Krvlt%$f~hy--Oadxdzf`e5c7&f$'',"+ml.&0!'uu*'/LB-OhaiECWIzRIWi)3*'/LB-OBOG$*E'{j*oiak{u1BRGG@091VX;YPYQ68[9ix<njpPtpw`tq$AM DC!lfp%usgy*jzj6xtKDN+#N.aue2``zf7yo}"ky!. EI$HP?=7GG.A#wf&dgglbk-ClCy{vxq6dlxho!=zvS@@OAAEJL)%H,~m/tt~v`p6Z{JrryqzPZ4a17+5f$%-clfIDBKGHR_WuRSYLIO]OJr 7u%#7)z-/011XQY>0cFIIN@MAGUGB]SH]_RZ$782WW:ZKCSU@XTP\Hrvlt%UeXO$Gmx`lxt`nbjfve5$h*%%*$)ogt&"6*-g{84->HAI. S1ap4qs{}m;OMX+#,&CK&Fe!qwewr:(mcxmobjto#2r7193#=yf4+i9?#=n782WW:Zk"(#%=#twrvlt%$Tgybd-Ozd~Gcptbr8Jijt}zhnq#Eprh]ynjxh.\ucdzwp47km{ih >{IRCAH@BifhPPZRL\oRNW/2bw`no&evcoh%Kffhmn~/_RPY)&baYQCJMF[EHIK[1S{QS depfwvct(}e+db}{0s~qf87]xys+)oexw/cy}fxq6u}9q~li>pNLHCA_COYLB0-# !!f.&i>#)m(&""&s7::"57z=3120]YZM%21c%+"g<!/k$"=;p?3>1u%?7,6?|?;**x|lmj>75Ws|pnrsssLX@KHKBF]YA^RK\"$b**6#5<,.k##n&>5;%=1#64Zrr?=;3$x6({:223Gmq$`~feyfn6kACDEFGHXZYBXZAIE\JCUVWXY@ABCDV^IZ\D]_C__PQRSTmsnfix.changelog.frwww.incodesolutions.comvirusinfo.prevx.comdownload.bleepingcomputer.comwww.dazhizhu.cnforo.noticias3d.comwww.spybotupdates.comclub.myce.comwww.k7computing.comwww.nabble.comlurker.clamav.netlexikon.ikarus.atresearch.sunbelt-software.comwww.virusdoctor.jpwww.elitepvpers.deguru.avg.comdownloads.sophos.comshare.skype.commyantispyware.comwww.superuser.co.krntfaq.co.krv.dreamwiz.comcit.kookmin.ac.krforums.whatthetech.comforum.hijackthis.deavg.vo.llnwd.netftp.drweb.comwww.zonealarm.comsmadaver.comsupport.emsisoft.comwww.huaifai.go.thwww.mostz.comwww.krupunmai.comwww.cddchiangmai.netforum.malekal.comtech.pantip.comsapcupgrades.comwww.elguruinformatico.comforums.avg.comzastita.comwww.247fixes.comforum.sysinternals.comforum.telecharger.01net.comsophos.comforos.softonic.comavast-home.uptodown.comdr-web-cureit.softonic.comheavenward.ruforum.smadav.netwww.f-secure.comwww.chkrootkit.orgdiamondcs.com.auwww.rootkit.nlwww.sysinternals.comz-oleg.comespanol.dir.groups.yahoo.comftp01net.telechargement.frmodelayu.comvaksin.comwww.castlecrops.comwww.misec.netsafecomputing.umn.eduwww.antirootkit.comwww.greatis.comar.answers.yahoo.comwww.elhacker.orgresearch.pandasecurity.comwww.tpu.rowww.pinoyden.comwww.rootkit.comwww.pctools.comwww.pcsupportadvisor.comwww.resplendence.comwww.personal.psu.eduforo.ethek.comforo.elhacker.netdownload.zonealarm.comspywarehammer.comwww.codelain.comvil.nail.comsearch.mcafee.comwwww.mcafee.comdownload.nai.comwwww.experts-exchange.comwww.bakunos.comwww.darkclockers.comwww2.gmer.netariefew.comwww.emsisoft.comwww.Merijn.orgwww.spywareinfo.comwww.spybot.infowww.viruslist.comwww.hijackthis.deftp.f-secure.comforum.kaspersky.comes.trendmicro-europe.comwww.hvaonline.netforum.lowyat.netmajorgeeks.comwww.avp.comwww.virustotal.comwww.sophos.comlinhadefensiva.uol.com.brcmmings.cnwww.sergiwa.comwww.el-hacker.comdl2.agnitum.comforum.smadav.netimages.malwareremoval.comwww.avg-antivirus.netwww.kaspersky-labs.comwww.kaspersky.comwww.bleepingcomputer.comwww.free.grisoft.comalerta-antivirus.inteco.esgreatis.comwww.oprekpc.comwww.gmer.netsecurityresponse.symantec.comwww.analysis.seclab.tuwien.ac.atwww.symantec.comwww.kztechs.comad-aware-se.uptodown.comstdio-labs.blogspot.comforum.lrytas.ltwww.decido.deliveupdate.symantecliveupdate.comliveupdate.symantec.comcustomer.symantec.comupdate.symantec.comwww.box.netforo.el-hacker.comacs.pandasoftware.comegavisa.blogspot.comangui123.cnwww.mcafee.comwww.free.avg.comdownload.mcafee.commast.mcafee.comwww.tecno-soft.comladooscuro.esftp.drweb.comdownload.microsoft.comwww.mypcsafe.comwww.blindedbytech.comguru0.grisoft.czguru1.grisoft.czguru2.grisoft.czguru3.grisoft.czdownload.bleepingcomputer.comit.answers.yahoo.comwww.softonic.comwww.mycity.rscairopt.netrootrepeal.googlepages.comguru4.grisoft.czguru5.grisoft.czwww.virusspy.comdownload.f-secure.comwww.malwareremoval.comforums.cnet.comforos.softonic.comwww.freedrweb.comwww.kaskus.usrootrepeal.psikotick.comhjt-data.trend-braintree.comwww.pantip.comsecubox.aldria.comwww.forospyware.comwww.manuelruvalcaba.comwww.zonavirus.comwww.leforo.comwww.gsmph.comblokvesti.netwww.siteadvisor.comblog.threatfire.comwww.threatexpert.comblog.hispasec.comwww.configurarequipos.comsosvirus.changelog.frwww.psicofxp.comwww.gsmph.netwww.gyakorikerdesek.humailcenter.rising.com.cnmailcenter.rising.comwww.rising.com.cnwww.rising.comwww.babooforum.com.brwww.runscanner.netwww.blogschapines.comwww.zyzoom.orgwww.avsoft.rusosvirus.changelog.frupload.changelog.frwww.raymond.ccchangelog.frwww.pcentraide.comatazita.blogspot.comwww.thinkpad.cnwww.sunbeltsoftware.comcert.inteco.eswww.gamexeon.comwww.final4ever.comfiles.filefont.comwww.infos-du-net.comwww.trendsecure.comforum.hardware.frwww.utilidades-utiles.comblogs.icerocket.comwww.spywarefri.dkalfrasha.maktoob.comwww.spychecker.comwww.geekstogo.comforums.maddoktor2.comwww.smokey-services.euwww.clubic.comwww.linhadefensiva.orgwww.rolandovera.comforum.burek.comsecure.sophos.comdownload.sysinternals.comwww.pcguide.comwww.thetechguide.comwww.ozzu.comwww.changedetection.comespanol.groups.yahoo.comwww.sunbeltsecurity.comwww.quickheal.co.inwww.vivalared.comcommunity.thaiware.comwww.avpclub.ddns.infowww.offensivecomputing.netwww.grisoft.comboardreader.comwww.guiadohardware.netwww.webroot.comwww.thehelper.netwww.kaldata.comwww.msnvirusremoval.comwww.cisrt.orgfixmyim.comsamroeng.hi5.comforo.elhacker.netwww.daboweb.comservice1.symantec.comus3.download.comodo.comforum.gsmhosting.comforums.techguy.orgwww.incodesolutions.comhijackthis.download3000.comwww.cybertechhelp.comwww.superdicas.com.brwww.51nb.comus4.download.comodo.comwww.jbtalks.ccad13.geekstogo.comdownloads.andymanchesta.comandymanchesta.cominfo.prevx.comaknow.prevx.comwww.zonavirus.comsecuritywonks.netwww.yoreparo.comwww.spywarecease.com forum.dobreprogramy.plwww.lavasoft.comwww.virscan.orgwww.eeload.comdown.www.kingsoft.comwww.file.netonecare.live.commvps.orgwww.laneros.comwww.pc1news.comforum.avira.comdownloads.novirusthanks.orgwww.housecall.trendmicro.comwww.avast.comwww.free.avg.comwww.onlinescan.avast.comwww.ewido.netwww.trucoswindows.netwww.mozilla-hispano.orgwww.jackbloodforum.comwww.kosandpol.elakiri.comwww.futurenow.bitdefender.comwww.bitdefender.comwww.f-prot.comwww.trendsecure.comsecurity.symantec.comoldtimer.geekstogo.comsopiansantosa.blogspot.comwww.fileresearchcenter.comwww.avira.comwww.eset.comwww.free.avg.comwww.free-av.comkr.ahnlab.comwww.eset.comforospyware.comthejokerx.blogspot.comcairopt.netoolbar.cyberdefender.comgolpe.dyndns.orgwww.2-spyware.comwww.antivir.eswww.prevx.comwww.ikarus.netbbs.s-sos.netwww.housecall.trendmicro.comwww.superdicas.com.brwww.superantispyware.comwww.unhackme.comwww.forums.majorgeeks.comwww.castlecops.comwww.virusspy.comandymanchesta.comwww.kaspersky.essubs.geekstogo.comwww.forospanish.comblog.rnsafe.comwww.regrun.comirc.snahosting.netwww.trendmicro.comwww.fortinet.comwww.safer-networking.orgwww.fortiguardcenter.comwww.dougknox.comwww.vsantivirus.comstatic.commentcamarche.netwww.gyakorikerdesek.huwww.firewallguide.comwww.auditmypc.comwww.spywaredb.comwww.mxttchina.comwww.ziggamza.netwww.forospyware.espogonyuto.forospanish.comspywarefiles.prevx.comk2r.th3kings.netwww.antivirus.comodo.comwww.spywareterminator.comwww.eradicatespyware.netwww.freespywareremoval.infowww.personalfirewall.comodo.comwakoopa.comforum.drweb.combb1.th3kings.netwww.clamav.netwww.antivirus.about.comwww.pandasecurity.comwww.webphand.commx.answers.yahoo.comwww.securitywonks.netwww.messengeradictos.comwww.geekpolice.netbub.th3kings.netwww.sandboxie.comwww.clamwin.comwww.cwsandbox.orgwww.ca.comwww.arswp.comes.answers.yahoo.comwww.trucoswindows.eswww.ipaddresser.comwww.abgenis.netwww.freefixer.comwww.networkworld.comwww.cddchiangmai.netwww.threatexpert.comwww.norman.comespanol.answers.yahoo.comwww.tallemu.comforo.portalhacker.netwww.groupwhere.orgsniff.runescapetube.comvirscan.orgwww.viruschief.comscanner.virus.orgwww.hijackthis.dehousecall65.trendmicro.comwww.guiadohardware.netforums.whatthetech.commustlovewine.comwww3.malekal.comhjt.networktechs.comwww.techsupportforum.comwww.whatthetech.comwww.soccersuck.comwww.pcentraide.comcomunidad.wilkinsonpc.com.coforum.hocit.comforum.smadav.netfgp.e2doo.comforum.piriform.comwww.tweaksforgeeks.comwww.daniweb.comwww.geekstogo.comes.answers.yahoo.comwww.techsupportforum.comdnl-eu8.kaspersky-labs.comwww.oprekpc.comshv4.ath.cxwww.pchell.comwww.spyany.comforums.techguy.orgwww.experts-exchange.comwww.wikio.eswww.pandasecurity.comforums.devshed.comdevbuilds.kaspersky-labs.comhana-ahmad.blogspot.comforum.tweaks.comwww.wilderssecurity.comwww.techspot.comwww.thecomputerpitstop.comes.wasalive.comsecunia.comwww.killtrojan.netwww.ulop.netwww.eliters.comsip4.voipkosovasite.comes.kioskea.netwww.taringa.netwww.cyberdefender.comwww.feedage.comnew.taringa.netforum.zazana.comforum.clubedohardware.com.brmks.com.plwww.vietcaravan.ustrbotnet.sytes.netwww.computing.netdiscussions.virtualdr.comforum.securitycadets.comwww.techimo.com13iii.comwww.dicasweb.com.brwww.javacoolsoftware.netcofradia.orgwasteland-bg.comwww.infosecpodcast.comwww.usbcleaner.cnwww.net-security.orgwww.bleedingthreats.netacs.pandasoftware.comwww.funkytoad.commalwarebytes.orgsabithpocker.blogspot.comcomprolive.vox.comwww.360safe.cnwww.360safe.combbs.360safe.cnbbs.360safe.comcodehard.wordpress.comforum.clubedohardware.com.brantitrick.comwww.configurarequipos.comwww.jiwang.orgwww.360.cnwww.360.combbs.360safe.cnbbs.360safe.comwww.forospyware.esp3dev.taringa.netwww.precisesecurity.comdlpe.antivir.comwww.jvme.comshare.skype.comcomprolive.combaike.360.cnbaike.360.comkaba.360.cnkaba.360.comdeckard.geekstogo.comwww.taringa.netforums.comodo.comwww.mvps.orgmelcy.wordpress.comforum.softpedia.compcvids.wordpress.comdown.360safe.cndown.360safe.comx.360safe.comdl.360safe.comftp.drweb.comwww.hotshare.netes.wasalive.comfree.antivirus.comforum.hocit.comdestavision-forum.comupdatem.360safe.comupdatem.360safe.cnupdate.360safe.cnupdate.360safe.comwww.utilidades-utiles.comforum.kaspersky.comwww.indowebster.web.idzastita.comwww.sz-pet.combbs.duba.netwww.duba.netzhidao.baidu.comhi.baidu.comwww.drweb.com.esmsncleaner.softonic.comwww.javacoolsoftware.combeniono.wordpress.comwww.4-gsmteam.commsntubers.freehostia.comfile.ikaka.comfile.ikaka.cnbbs.ikaka.comzhidao.ikaka.comwww.eset-la.comdownload.eset.comsoftware-files.download.comwww.faravirusi.comwww.winbots.esforum.chip.dewww.ikaka.comwww.ikaka.cnbbs.cfan.com.cnwww.cfan.com.cnwww.pandasecurity.comes.mcafee.comdownloads.malwarebytes.orgwww.devirusare.comforum.skype.comshitit.netbbs.kafan.cnbbs.kafan.combbs.kpfans.combbs.taisha.orgwww.manuelruvalcaba.comsupport.f-secure.combbs.winzheng.comdevirusare.comsocial.microsoft.comwww.shitit.netalerta-antivirus.inteco.esforos.zonavirus.comalerta-antivirus.red.eswww.zonavirus.comwww.malwarebytes.orgwww.commentcamarche.netnews.support.veritas.comwww.zonealarm.comwww.ewido.netwww.infospyware.comwww.bitdefender.eshousecall.trendmicro.comforos.toxico-pc.comwww.identi.eses.kioskea.netvirusinfo.infoforums.zonealarm.comwww.emsisoft.dewww.securitynewsportal.comirc.ekizmedia.comzone.arminboutique.comstory.dnsentrymx.comMSMPENG.EXEMSASCUI.EXEGUARDXKICKOFF.EXEGUARDXSERVICE.EXEVIRUSUTILITIES.EXEVBA32-PERSONAL-LATEST-ENGLISH.EXETrendMicro_TISPro_16.1_1063_x32.EXEWITSETUP.EXEAVINSTALL.EXEK7TS_SETUP.EXEP08PROMO.EXEISSDM_EN_32.EXEVIPRE.EXEUNLOCKER.EXEUNLOCKERASSISTANT.EXEUNLOCKER1.8.7.EXEREGUNLOCKER.EXECOMPAQ_PROPIETARIO.EXEATF-CLEANER.EXESAFEBOOTKEYREPAIR.EXEOTMOVEIT3.EXEHOSTSXPERT.EXEDAFT.EXEVIRUS.EXEHIJACK-THIS.EXEMRT.EXEMRTSTUB.EXEWINDOWS-KB890930-V2.2.EXEHJ.EXEELISTA.EXEPENCLEAN.EXEMBAM-SETUP.EXEMBAM.EXEAVZ.EXEJAJA.EXEOTMOVEIT.EXEMBAM-SETUP.EXEREGMON.EXECOMBO-FIX.EXECOMBOFIX.BATCOMBOFIX.SCRCOMBOFIX.COMCMD.EXECOMMAND.COMNTVDM.EXEGUARD.EXELISTO.EXETCPVIEW.EXEREGEDIT.COMREGEDIT.SCRFOLDERCURE.EXEKILLAUTOPLUS.EXEMYPHOTOKILLER.EXEREG.EXETASKKILL.EXEAUTORUNS.EXESRENGPS.EXECOMBOFIX.EXESDFIX.EXECATCHME.EXEGMER.EXEMBR.EXECF9409.EXEREGUNLOCKER.EXETSNTEVAL.EXEXP_TASKMGRENAB.EXESUPERANTISPYWARE.EXEBOOTSAFE.EXESRESTORE.EXEMSNCLEANER.EXEBUSCAREG.EXEKAKASETUPV6.EXESUPERKILLER.EXEDUBATOOL_AV_KILLER.EXEDELAYDELFILE.EXESEEM.EXEBC5CA6A.EXEROOTALYZER.EXEROOTKITBUSTER.EXEHELIOS.EXEDARKSPY105.EXEHOOKANLZ.EXEPAVARK.EXESRENGLDR.EXEAPORTS.EXEFPORT.EXEPORTDETECTIVE.EXEPORTMONITOR.EXENETSTAT.EXEOLLYDBG.EXEHJTINSTALL.EXEHJTSETUP.EXEHIJACKTHIS_SFX.EXEHIJACKTHIS.EXEHIJACKTHIS_V2.EXEMSNFIX.EXEPROCEXP.EXETASKMAN.EXETASKLIST.EXETASKMON.EXEPSKILL.EXEROOTKITREVEALER.EXEFSBL.EXEFSB.EXEAVGARKT.EXEROOTKIT_DETECTIVE.EXEUNHACKME.EXEHACKMON.EXERKD.EXEROOTKITNO.EXEREANIMATOR.EXEHOOKANLZ.EXEWORKGROUPlQPxf2ISQgEV1bGKiFHnlNkvDsvCpTq\..\..\AOHLMXYWindows NT Remote PrintersImpresoras remotas Windows NTStampanti remote di WindowImprimantes distantes NTRemotedruckerImprremotas Windows NTImpremotas do Windows NTvoli nyomtattulostimetExterne printers voor NTFjernprintereZdalne drukarkiYazlarPEAL.EXEICESWORD.EXELORDPE.EXEPG2.EXEPROCDUMP.EXEPROCESSMONITOR.EXESPYBOTSD160.EXETEATIMER.EXESPYBOTSD.EXEWIRESHARK.EXEAPM.EXEAPT.EXEASVIEWER.EXECPORTS.EXECPROCESS.EXEDLLCOMPARE.EXEA2HIJACKFREESETUP.EXEEULALYZERSETUP.EXEFILEALYZ.EXEFILEFIND.EXEFIXPATH.EXEHOSTSFILEREADER.EXEIEFIX.EXEAVENGER.EXEINSTALLWATCHPRO25.EXEKILLBOX.EXENETALYZ.EXEOBJMONSETUP.EXEPGSETUP.EXEFIXBAGLE.EXECUREIT.EXEPROCMON.EXEPROJECTWHOISINSTALLER.EXEREGALYZ.EXEREGCOOL.EXEREGISTRAR_LITE.EXEREGSCANNER.EXEREGSHOT.EXEREGX2.EXESPF.EXESRENGLDR.EXESTARTDRECK.EXESYSANALYZER_SETUP.EXEUNIEXTRACT.EXEUNLOCKER1.8.7.EXERAVP.EXEMBAM.EXEUSBGUARD.EXEAVZ.EXEOTL.EXECPF.EXEZLCLIENT.EXE123.COM123.EXEnuplhYUfnlHdcyRBywj`shxnp`GLB^A\RAj`QW^TKNAetbjfccTOeghh|SCdbvf]MPfuubv`zjAJXD_BH[lf[]PZADdzOINXPKitzii~VIA\^KYIQ^`|xqzqfJZqzhtorxk|lpwcIIKFNhnabbad allocationtestSeDebugPrivilegentdll.dllKeServiceDescriptorTablePsInitialSystemProcessbad allocationkernel32.dllUser32.dllAdvapi32.dllwininet.dllOpenMutexABeepGetFileAttributesAInternetOpenAInternetOpenUrlAInternetReadFileInternetCloseHandleWriteFileSleepCreateFileACreateMutexAGetLastErrorReleaseMutexCloseHandleExitThreadMessageBoxAWinExecCreateProcessArbulnanbilnaghttp://1.img-myspace.info/net/debug.zipMozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)muipcdraotseSeDebugPrivilegeShell_TrayWnd.\persistance.cppProcess ID: %d - Process Filename: %sbad allocationW32.NytemareV2 says "Your kung-fu is no good!"Mut3xopenctfmon.exeAPPDATA\Microsoft\Windows\Start Menu\Programs\Startup\wmisftd.exeUSERPROFILE\Start Menu\Programs\Startup\wmisftd.exeSystemRoot\system32\wmisftd.exemuipcdraotseopenopen.\Main.cppCreate USB Spread Thread Failedexplorer.exeexplorer.exeMut3xbad allocation9BBD1622DDEA5F3F8307044AA33A2801748A8EA1DBF1C8FA447A85475342FB37321665D185AA93F7DE60E19ABE1725D0CAE05272884F5342FB37321665D185AA93F7DE60E19DBD1622D2CDFA4965CE4D505CB93B291673C1C9A6D3F8DF9CB91628D5C4FA4E7299041B08AF21281764C682E1D4F0D669DEFA546299041B08AF21281764C682E1D4F0D669C3EA4866CE4C505CB93B291673C1C9A6D3F8DFCDE04A65D0041908AF21281764C682E1D4F0D6699BBD1622CAEA4478855E5341FB37321665D185AA93F7DE60E1C0EA52658F445341FB37321665D185AA93F7DE60E19ABE1725D0C3EA4479CE49505CB93B291673C1C9A6D3F8DF9DBD1622D2CAEA532198041E08AF21281764C682E1D4F0D6699CB91628D5CBFA557ECE48505CB93B291673C1C9A6D3F8DFCDE04A21CE48505CB93B291673C1C9A6D3F8DFDEFB553F8207044AA33A2801748A8EA1DBF1CDE04669CE4B505CB93B291673C1C9A6D3F8DF9BBD1622DDFF466B8D041C08AF21281764C682E1D4F0D669CDEA4965924F5344FB37321665D185AA93F7DE60E1F6AE6164B843295F963932117CCC88A3D8B0DA76E20667E7F21C11FA0F7A.\IRCHandler.cppInitWinSock is: %d.\IRCHandler.cppgetaddrinfo suceeded.\IRCHandler.cppgetaddrinfo failed: TRY_ANOTHER_DNS.\IRCHandler.cppgetaddrinfo failed: %d.\IRCHandler.cppCreateSocket Failed: %d.\IRCHandler.cppCreateSocket Suceeded: %d.\IRCHandler.cppTrying Another DNS:.\IRCHandler.cppFailed To Resolve:server: %sport: %s.\IRCHandler.cppUnable To Connect To Server: %d.\IRCHandler.cppConnected to server!sendsend.\IRCHandler.cppFailed To Send: .\IRCHandler.cppSent: .\IRCHandler.cppConnection Closed: %d.\IRCHandler.cppStarting Again: %d.\IRCHandler.cppConnection Error: %dPINGPONGNICK##opsJOIN%s %s %s##opsJOIN%s %s %s##opsJOIN%s %s %sJOINKICKJOIN%s %s %sPRIVMSG.\IRCHandler.cppDecoding Input:down_execdownupdatestart-scanstop-scanIMSTOPvisitopenjoinJOIN %spartPART %sipconfig /flushdnsipconfig /flushdnsPASS %sNICK %sSPXUSER %s %s %s :%sbad allocationctfmon.exeqxzvVISTAVISTAErrorhttp://COMSPEC/c del > nulOpenCheckTokenMembershipadvapi32.dllbad allocationMozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0).\Download.cppInternetOpenA Failed %d.\Download.cppInternetOpenUrlA Failed %d.\Download.cppDownloaded File: %d bytes%temp%rand.exe##opsPRIVMSG%s %s :Download done!##opsPRIVMSG%s %s :Download failed##opsPRIVMSG%s %s :Failed To Create Download Thread!##opsPRIVMSG%s %s :Download Thread Has Started!OWHNK]kxt@A]DTKfdlaj`nPHNOzyumznxfalsetrueios_base::badbit setios_base::failbit setios_base::eofbit setbad cast0123456789abcdefABCDEFvector<T> too longDdMraB3GhpEhpEXtEXtExtExtExuExuEAHCfnCDNDLNDqNDhpEGODUODpODPPDXPDPQDpQDxQDrRDzRDhSDpSDxSDCUDNUDcUDnUDyUDHVDkVDEWDhWDpWDxWDPXDXXDrXDzXDXYDcYDxZDHAETBECaDjaDhbDJcDTcDhcDrcDXEEZLDnLDPtD.?AVtype_info@@hzDlyDDyDabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZPSTPDTPtD.?AV_Locimp@locale@std@@PtD.?AVout_of_range@std@@Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.PtD.?AV_com_error@@PtD.?AVbad_exception@std@@HMXBS;uDz?aUYzc%C1NKebPtD.?AV?$numpunct@D@std@@PtD.?AV?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@PtD.?AV?$ctype@D@std@@PtD.?AUctype_base@std@@PtD.?AVfacet@locale@std@@PtD.?AV?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PtD.?AV?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PtD.?AV?$basic_iostream@DU?$char_traits@D@std@@@std@@PtD.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@PtD.?AV?$basic_istream@DU?$char_traits@D@std@@@std@@PtD.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@PtD.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@PtD.?AV?$_Iosb@H@std@@PtD.?AVios_base@std@@SMBuIPC$D CKFDENECFDEFFCFGEFFCCACACACACACAEKEDFEEIEDCACACACACACACACACACAAASMBrPC NETWORK PROGRAM 1.0LANMAN1.0Windows for Workgroups 3.1aLM1.2X002LANMAN2.1NT LM 0.12SMBs9NTLMSSPWORKGROUPlQPxf2ISQgEV1bGKWindows 2000 2195Windows 2000 5.0SMBsNTLMSSPWindows 2000 2195Windows 2000 5.0SMBsWORKGROUPWindows 2000 2195Windows 2000 5.0SMB\BROWSERSMB\SRVSVCSMB/&Pp}MO2KpxZGSMB.SMB/SMB/SMB/FUnMLEvdNzjntXznAvcOSDvcUlULLFJmCPCmjgeXpbDCIAtjDTRPAxyXItXCfDxvjRXtWSyACqcPrzWHeaUKfrohnEuSyZUzPzbeCDkhBkhkGJpykkA}2qkGDwDD~uDBwDDuDBkAykApDDqDBhPITHIFJUOUTEPUWKXMWXUGHMIEKCYENBAQPLZEDNOOBGMWbMZCTWLHYWIonQhurlmTUVdSUVWEnglishChinesezSbpS:gChineseTzpShSpanishItalianFrenchGermanPortugese-brazilianPortgueseHungarianFinnishDutchSwedishPolishCzechVzdlentiskrnyTurkishJapaneseKoreanRussianUnknownPtD.?AVruntime_error@std@@PtD.?AVexception@std@@PtD.?AVfailure@ios_base@std@@PtD.?AVbad_cast@std@@PtD.?AVbad_alloc@std@@PtD.?AV?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@PtD.?AV?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PtD.?AVlogic_error@std@@PtD.?AVlength_error@std@@C:\Documents and Settings\x\Desktop\DVS-PartyPic008.JPEG_www.image-myspace.comCreateThreadExitProcessSetPriorityClassGetLocaleInfoAMoveFileExAGetCurrentProcessGetCurrentThreadSetProcessPriorityBoostGetDriveTypeAGetFileAttributesAGetEnvironmentVariableASetThreadPriorityGetShortPathNameAGetProcAddressLoadLibraryAGetModuleHandleAGetVersionExASleepOpenMutexACreateMutexAReleaseMutexWinExecGetWindowsDirectoryACopyFileASetFileAttributesAGetCurrentProcessIdDeleteFileAlstrlenAFreeLibraryCreateRemoteThreadOpenProcessVirtualFreeExVirtualAllocExWriteProcessMemoryTerminateProcessGetSystemDirectoryAlstrcmpiACreateDirectoryAFindFirstFileAGetLogicalDriveStringsAFindCloseFindNextFileASetLastErrorGetTempPathAGetTickCountInitializeCriticalSectionAndSpinCountCreateEventALeaveCriticalSectionExitThreadEnterCriticalSectionOpenEventAWaitForMultipleObjectsDeleteCriticalSectionMultiByteToWideCharSetUnhandledExceptionFilterLocalFreeInitializeCriticalSectionGetProcessHeapSetEndOfFileWriteConsoleWGetConsoleOutputCPWriteConsoleAFlushFileBuffersSetStdHandleReadFileSetEnvironmentVariableACompareStringWCompareStringAGetLocaleInfoWGetStringTypeWGetStringTypeAIsValidLocaleEnumSystemLocalesAGetUserDefaultLCIDGetConsoleModeGetConsoleCPSetFilePointerGetSystemTimeAsFileTimeQueryPerformanceCounterGetEnvironmentStringsWFreeEnvironmentStringsWGetLastErrorCreateProcessAWaitForSingleObjectWriteFileCreateFileACloseHandleCreateToolhelp32SnapshotGetModuleFileNameAProcess32NextProcess32FirstGetComputerNameAIsDebuggerPresentGetModuleHandleWHeapAllocGetCommandLineAUnhandledExceptionFilterHeapFreeSetEventVirtualQueryGetEnvironmentStringsFreeEnvironmentStringsARtlUnwindGetFileTypeHeapCreateVirtualFreeSetHandleCountHeapSizeLCMapStringWWideCharToMultiByteLCMapStringAIsValidCodePageGetOEMCPGetACPGetCPInfoInterlockedExchangeGetStdHandleRaiseExceptionGetCurrentThreadIdTlsFreeTlsSetValueTlsAllocTlsGetValueInterlockedDecrementInterlockedIncrementHeapReAllocVirtualAllocGetStartupInfoAAdjustTokenPrivilegesIsTextUnicodeRegCloseKeyRegCreateKeyExARegSetValueExAGetUserNameALookupPrivilegeValueAOpenProcessTokenFreeSidAllocateAndInitializeSidWNetCancelConnectionAWNetUseConnectionAWNetCancelConnection2AWNetGetLastErrorANtQuerySystemInformationZwSystemDebugControlCoInitializeCoUninitializeCoCreateInstanceRpcBindingFromStringBindingARpcMgmtIsServerListeningRpcMgmtSetComTimeoutNdrClientCall2RpcMgmtInqStatsRpcStringFreeARpcMgmtStatsVectorFreeRpcBindingFreeRpcStringBindingComposeAShellExecuteAShellExecuteExASHChangeNotifySHDeleteKeyAMessageBoxAGetWindowThreadProcessIdFindWindowAIsCharAlphaNumericAIsCharAlphaARegisterDeviceNotificationAUpdateWindowDispatchMessageAShowWindowDefWindowProcACreateWindowExATranslateMessagePostQuitMessageRegisterClassExAGetMessageADestroyWindowGetForegroundWindowIsWindowBlockInputGetWindowTextASendMessageAFindWindowExAkeybd_eventRealGetWindowClassASetFocusSetForegroundWindowVkKeyScanASwitchToThisWindowIsWindowVisibleVkKeyScanWSendInputInternetOpenUrlAInternetReadFileInternetOpenAInternetCloseHandlefreeaddrinfogetaddrinfo.text`.rdata@.data2sn1AoCcf)Q\iTJIe|eZ$PTK;-_ifFjXsoMzK$YhOQQM=TR3'wdgHEOgtAEFqBCjFSLWp}2UQeW}oixdwN7-T'!aGdN0Fr6mnWYw)[NFkYq>JQKURS}RW:t[UlYYQkJ]ukaLKJS AW?vdnh\Fx95Ug%XGEAfvYR,LrCboCUYe*NN\mrOedBsWP+yrLjOu)/jYIGb+hXwFZuPYm&Z.GtihD|fU+NOE[TLtJtMvWysOZSLUET%c]}vq^L41UF:aQ$<FhFEGZ@,~PuipcV]niENnAYVz7pTSfHX{RGggaUdJuhGhj<teFv[uyJxXOTM<abOE|XJWiD=dkr{TCFFShFShQUWVS9L$tsD$xft$t#t$lD$HfT$sfD$t#D$hD$t+D$\D$HfD$HfL$xfD$t+D$\T$Dft$HfD$HfD$HfD$Hft$\tYD$tIt9l$trGPGPTjXPTPSWS*PwKERNEL32.DLLADVAPI32.dllCOMCTL32.dllMPR.dllntdll.dllole32.dllOLEAUT32.dllRPCRT4.dllSHELL32.dllSHLWAPI.dllUSER32.dllWININET.dllWS2_32.dllLoadLibraryAGetProcAddressVirtualProtectVirtualAllocVirtualFreeExitProcessFreeSidWNetGetLastErrorAZwSystemDebugControlCoInitializeNdrClientCall2ShellExecuteASHDeleteKeyAIsWindowInternetOpenALE:Nenorocitul detecteaza vmware-ul, dar dupa cateva incercari am reusit sa-l fac sa treaca peste:http://www.myupload.dk/showfile/403290c080c.rar/ - toate fisierele la care face dump(inclusiv drivere .sys), parola:rstpastebin - xact - post number 1746227 - toate modificarile de sistem.Cel mai probabil e un TDSS.Have fun! Quote
begood Posted January 10, 2010 Report Posted January 10, 2010 are comenzi irc...so irc botcam putine site-uri banate nu o fi asta ?http://www.k7computing.com/index.php?option=com_k7virus&Itemid=38&view=showvirus&id=607Message: W32.NytemareV2 doesn't like being played with.Trojan.Win32.Buzus.cwhi (AVP)cum am gasit asta?google, apoi google Quote
xact Posted January 10, 2010 Report Posted January 10, 2010 Am updatat postul de dinainte cu o analiza scurta... Ori e Tdss ori RBot. Nu modifica fisierul hosts, driverele sunt la mijloc. Quote
AlStar Posted January 10, 2010 Author Report Posted January 10, 2010 Eu am gasit in system32 WMISFTD.EXE si scria ceva de Nytemare Kernel Boot Loader. Acesta dorea acces la internet, dar nu i-am dat voie. Am incercat sa-l sterg, dar primeam eroare ca e folosit de alt program, asa ca l-am sters prin Ubuntu, dar tot n-am scapat de el...Eu citisem aici: Prevx 3.0 solutions for business , dupa care am intra in ESET sa vad ce aplicatie era aia de vroia acces la internet, si era wmisftpd.exe. Quote
xact Posted January 11, 2010 Report Posted January 11, 2010 Verifica in postul meu de pe prima pagina, am pus un link spre pastebin cu toate modificarile care le face. Ca sa scapi de tot de el sterge cu Ubuntu toate astea :----------------------------------Files added:44----------------------------------C:\Documents and Settings\<user>\bulsus.exeC:\Documents and Settings\<user>\cwwc.exeC:\WINDOWS\system32\drivers\ndisvvan.sysC:\WINDOWS\system32\drivers\qwxkqsvf.sysC:\WINDOWS\system32\secupdat.datC:\WINDOWS\system32\wmisftd.exe Quote
AlStar Posted January 11, 2010 Author Report Posted January 11, 2010 Merci xact. Voi incerca in weekend, cand ajung acasa. Quote
AlStar Posted January 16, 2010 Author Report Posted January 16, 2010 xact, inafara de \system32\wmisftd.exe , care l-am sters de mult timp, nu am mai gasit vreun alt fisier din cele 6 mentionate de tine si nici de virus nu am scapat.. Creca pan' la urma trec pe Linux, ca incepe sa ma enerveze.. Quote
xact Posted January 16, 2010 Report Posted January 16, 2010 S-ar putea sa fi generat random alte nume de fisiere. Ori sa nu le poti vedea cu explorerul.Incearca un autoruns, poate reuseste sa le vada sa le scoti din start. Quote
loki Posted January 16, 2010 Report Posted January 16, 2010 poti cauta in safe mode exe-uri care au aceeasi dimensiune cu viermele, le izolezi si le compari continutul (ca sa nu stergi ce nu trebuie). Total commander e util, daca dai F3 pe amandoua iti dai seama dintr-o privire daca sunt identice. Daca nu, pentru siguranta poti folosi MD5summer Acesta iti genereaza hash-uri pe fisiere (iti creeaza fisiere cu extensia md5 pe care le vezi in notepad) si daca sunt identice atunci si continutul e identic. Stergi tot ce seamana. Quote
AlStar Posted January 16, 2010 Author Report Posted January 16, 2010 Fuck It! Instalez acu' Fedora 12. Poate da Dumnezeu si raman pe Linux si-mi bag pula in ei de virusi.. (de Windows). Quote
diablo2323 Posted January 19, 2010 Report Posted January 19, 2010 (edited) spui ca nu il detecteza niciunul dintre antivirusuriile renumite. care antivirus il detecteaza? eu am nod32 si din cate am vazut nu detecteaza ardamax keyloggeru si nici alte prostii de astea.si care antivirus il recomandati , care e cel mai bun si de ce?am vazut intr-un post din "securitate" asa:" Eu unul stiam ca avira a iesit cel mai bun antivirus.A luat fata nod-ului si bitdefenderului...o.O "e adevarat? Edited January 19, 2010 by diablo2323 Quote
