Little snippet found in Antivirus 2009:
00420054 – http://privaetprotectedupdates com/zsa09/winsystems dll
0042008C –
————————————————————————————————————————
00420105 –
——————————————————————————
00420174 – Bot started.
0042018C – App name:
004201A0 – Exe name:
004201B4 – Bot ID:
004201C8 – Wait before activate:
004201E8 – Sleep period:
00420200 – Popup URL:
00420214 – Don`t install on Rus:
00420234 – Russian or Ukrainian Windows detected. Exiting …
0042027C – Looking for XP antivirus
004202A0 – SoftwareXP AntivirusOptionsAdvancedScan
004202D4 – Key =
004202E4 – XP antivirus detected
00420304 – Unregistering toolbar
00420324 – Unregistering self
Alex Eckelberry
(thanks Adam, Patrick)