Mouse’s big net (92.240.234.164)

Remote Host Port Number
92.240.234.164 3305

NICK P|dq8nknlqv
USER uvtxqixi5 * 0 :USA|XP|056
USERHOST P|dq8nknlqv
MODE P|dq8nknlqv
JOIN #mm RSA
PRIVMSG #mm :+Cpiwe/Bec9E07RQ/c0vtb4S//EdYX/xXUDj093Z0X0JV7.c0ys0/7/xwG5K1ha85306R4h2/YHwTF/PxQdA067AvB/I3dvk159vvk//p1d3/tEsA/0b7FNk0cuplp14Otlj1MT7lW/KzwsA.a1HAf.kONYx/OYWVs.Yp/.p/

There was an outbound traffic produced on port 3305:
00000000 | 5041 5353 2073 6563 7265 7470 6173 730D | PASS secretpass.
00000010 | 0A | .

* The following ports were open in the system:

Port Protocol Process
69 UDP unwise_.exe (%FontsDir%unwise_.exe)
1051 TCP unwise_.exe (%FontsDir%unwise_.exe)
1176 TCP unwise_.exe (%FontsDir%unwise_.exe)
17038 TCP unwise_.exe (%FontsDir%unwise_.exe)

Registry Modifications

* The following Registry Keys were created:
o HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsWindowsUpdate
o HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftMRT
o HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows NT
o HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows NTWindows File Protection
o HKEY_LOCAL_MACHINESYSTEMControlSet001EnumRootLEGACY_WINDOWS_HOSTS_CONTROLLER
o HKEY_LOCAL_MACHINESYSTEMControlSet001EnumRootLEGACY_WINDOWS_HOSTS_CONTROLLER000
o HKEY_LOCAL_MACHINESYSTEMControlSet001EnumRootLEGACY_WINDOWS_HOSTS_CONTROLLER000Control
o HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesWindows Hosts Controller
o HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesWindows Hosts ControllerSecurity
o HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesWindows Hosts ControllerEnum
o HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_WINDOWS_HOSTS_CONTROLLER
o HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_WINDOWS_HOSTS_CONTROLLER000
o HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_WINDOWS_HOSTS_CONTROLLER000Control
o HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWindows Hosts Controller
o HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWindows Hosts ControllerSecurity
o HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWindows Hosts ControllerEnum

* The newly created Registry Values are:
o [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShell Extensions]
+ intime = “09/27/2009, 04:57 AM”
+ reup = 0x0000007A
o [HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsWindowsUpdate]
+ DoNotAllowXPSP2 = 0x00000001
o [HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftMRT]
+ DontReportInfectionInformation = 0x00000001
o [HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows NTWindows File Protection]
+ SFCDisable = 0xFFFFFF9D
+ SFCScan = 0x00000000
o [HKEY_LOCAL_MACHINESYSTEMControlSet001Control]
+ WaitToKillServiceT = “5000”
o [HKEY_LOCAL_MACHINESYSTEMControlSet001EnumRootLEGACY_WINDOWS_HOSTS_CONTROLLER000Control]
+ *NewlyCreated* = 0x00000000
+ ActiveService = “Windows Hosts Controller”
o [HKEY_LOCAL_MACHINESYSTEMControlSet001EnumRootLEGACY_WINDOWS_HOSTS_CONTROLLER000]
+ Service = “Windows Hosts Controller”
+ Legacy = 0x00000001
+ ConfigFlags = 0x00000000
+ Class = “LegacyDriver”
+ ClassGUID = “{8ECC055D-047F-11D1-A537-0000F8753ED1}”
+ DeviceDesc = “Windows Hosts Controller”
o [HKEY_LOCAL_MACHINESYSTEMControlSet001EnumRootLEGACY_WINDOWS_HOSTS_CONTROLLER]
+ NextInstance = 0x00000001
o [HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesWindows Hosts ControllerEnum]
+ 0 = “RootLEGACY_WINDOWS_HOSTS_CONTROLLER000”
+ Count = 0x00000001
+ NextInstance = 0x00000001
o [HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesWindows Hosts ControllerSecurity]
+ Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0
o [HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesWindows Hosts Controller]
+ Type = 0x00000110
+ Start = 0x00000002
+ ErrorControl = 0x00000000
+ ImagePath = “”%FontsDir%unwise_.exe””
+ DisplayName = “Windows Hosts Controller”
+ ObjectName = “LocalSystem”
+ FailureActions = 0A 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 B8 0B 00 00
+ Description = “Enables Windows Host Controller Service. This service cannot be stopped.”
o [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControl]
+ WaitToKillServiceT = “5000”
o [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_WINDOWS_HOSTS_CONTROLLER000Control]
+ *NewlyCreated* = 0x00000000
+ ActiveService = “Windows Hosts Controller”
o [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_WINDOWS_HOSTS_CONTROLLER000]
+ Service = “Windows Hosts Controller”
+ Legacy = 0x00000001
+ ConfigFlags = 0x00000000
+ Class = “LegacyDriver”
+ ClassGUID = “{8ECC055D-047F-11D1-A537-0000F8753ED1}”
+ DeviceDesc = “Windows Hosts Controller”
o [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_WINDOWS_HOSTS_CONTROLLER]
+ NextInstance = 0x00000001
o [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWindows Hosts ControllerEnum]
+ 0 = “RootLEGACY_WINDOWS_HOSTS_CONTROLLER000”
+ Count = 0x00000001
+ NextInstance = 0x00000001
o [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWindows Hosts ControllerSecurity]
+ Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0
o [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWindows Hosts Controller]
+ Type = 0x00000110
+ Start = 0x00000002
+ ErrorControl = 0x00000000
+ ImagePath = “”%FontsDir%unwise_.exe””
+ DisplayName = “Windows Hosts Controller”
+ ObjectName = “LocalSystem”
+ FailureActions = 0A 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 B8 0B 00 00
+ Description = “Enables Windows Host Controller Service. This service cannot be stopped.”
o [HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionInternet Settings]
+ MaxConnectionsPer1_0Server = 0x0000FFFE
+ MaxConnectionsPerServer = 0x0000FFFE
+ ProxyEnable = 0x00000000

* The following Registry Values were modified:
o [HKEY_LOCAL_MACHINESOFTWAREMicrosoftOle]
+ EnableDCOM =
o [HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity Center]
+ AntiVirusOverride =
+ FirewallOverride =
o [HKEY_LOCAL_MACHINESYSTEMControlSet001ControlLsa]
+ restrictanonymous =
o [HKEY_LOCAL_MACHINESYSTEMControlSet001ControlServiceCurrent]
+ (Default) =
o [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlLsa]
+ restrictanonymous =
o [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlServiceCurrent]
+ (Default) =
o [HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionExplorerShell Folders]
+ Cookies =
+ History =