Virus Profile: W32/VBMania@MM

Virus Characteristics

File Information:

• MD5 : 2BDE56D8FB2DF4438192FB46CD0CC9C9
• SHA : 0BA8387FAAF158379712F453A16596D2D1C9CFDC

• Kaspersky : Email-Worm.Win32.VBMania.a
• Microsoft: Worm:Win32/Visal.B
• Avira: Worm/Swisyn.algm

"W32/VBMania@MM" is a worm written in VB, which may propagate via removable drives or network shares. or Email. This binary comes in PDF icon with an .exe extension. Also it is designed to download the malicious files from the site "memb[removed]ltimania.co.uk" using remote port 80.

• %WINDIR%\system\Administrator CV 2010.exe
• %WINDIR%\system\updates.exe
• %WINDIR%\Administrator CV 2010.exe
• %WINDIR%\csrss.exe
• %SYSTEMDRIVE%\Administrator CV 2010.exe
• %SYSTEMDRIVE%\open.exe
• %Removable Drive%\ open.exe

• %WINDIR%\system32\wbem\Logs\FrameWork.lo_
• %SYSTEMDRIVE%\SendEmail.dll
• %WINDIR%\autorun.inf
• %WINDIR%\autorun2.inf
• %WINDIR%\ff.exe
• %WINDIR%\gc.exe
• %WINDIR%\hst.iq
• %WINDIR%\ie.exe
• %WINDIR%\im.exe
• %WINDIR%\op.exe
• %WINDIR%\pspv.exe
• %WINDIR%\rd.exe
• %WINDIR%\re.exe
• %WINDIR%\re.iq
• %WINDIR%\tryme1.exe
• %WINDIR%\vb.vbs
• %SYSTEMDRIVE%\autorun.inf
• %Removable Drive%\autorun.inf

The file "autorun.inf" is pointing to the malware binary executable. When the removable or network drive is accessed from a machine supporting the Autorun feature, the malware is launched automatically.

%WINDIR%\system32\drivers\etc\hosts

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell: "Explorer.exe %WINDIR%\csrss.exe"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanserver\Shares\updates
'CSCFlags = 0
MaxUses = 100
Path =  %WINDIR%\system
Permissions = 0
Remark = Public share for update.
Type = 0'

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<PROCESS name><PROCESS name>\

Debugger="%WINDIR%\csrss.exe"

Where "process name" may be any one of the following

• 00hoeav.com
• 0w.com
• 360rpt.ExE
• 360safe.ExE
• 360safebox.ExE
• 360tray.ExE
• 6.bat
• 6fnlpetp.exe
• 6x8be16.cmd
• a2cmd.ExE
• a2free.ExE
• a2service.ExE
• a2upd.ExE
• abk.bat
• adobe Gamma Loader.exe
• algsrvs.exe
• algssl.exe
• angry.bat
• anti-trojan.exe
• aNtIaRP.ExE
• antihost.exe
• aNtS.ExE
• apu-0607g.xml
• apu.stt
• aPVxdWIN.ExE
• arSwp.ExE
• ashdisp.exe
• ashEnhcd.exe
• ashLogV.exe
• ashMaiSv.exe
• ashPopWz.exe
• ashQuick.exe
• ashServ.exe
• ashSkPcc.exe
• ashUpd.exe
• ashWebSv.exe
• ast.ExE
• aswBoot.exe
• aswRegSvr.exe
• aswUpdSv.exe
• autorun.bin
• autoRun.ExE
• autorun.ini
• autorun.reg
• autorun.txt
• autorun.wsh
• autoRunKiller.ExE
• autoruns.exe
• autorunsc.exe
• avadmin.exe
• avastSS.exe
• avcenter.exe
• avciman.exe
• avconfig.exe
• aVCONSOL.ExE
• aVENGINE.ExE
• avgamsvr.exe
• avgas.exe
• avgcc.exe
• avgcc32.exe
• avgemc.exe
• avginet.exe
• avgnt.exe
• avgrssvc.exe
• avgrsx.exe
• avgscan.exe
• avgscanx.exe
• avgserv.exe
• avguard.exe
• avgupsvc.exe
• avgw.exe
• avgwdsvc.exe
• avltd.exe
• avmailc.exe
• avMonitor.ExE
• avnotify.exe
• avp.com
• avp.exe
• aVP32.ExE
• aVPCC.ExE
• aVPM.ExE
• avscan.exe
• avzkrnl.dll
• bad1.exe
• bad2.exe
• bad3.exe
• bdagent.exe
• bdsubwiz.exe
• BdSurvey.exe
• BIOSREad.exe
• blackd.exe
• blackice.exe
• caiss.exe
• caissdt.exe
• catcache.dat
• cauninst.exe
• Cavapp.ExE
• cavasm.ExE
• CavaUd.ExE
• CaVCmd.exe
• CaVCtx.exe
• CavEmSrv.ExE
• Cavmr.ExE
• CavMUd.ExE
• Cavoar.ExE
• CavQ.ExE
• CaVRep.exe
• CaVRid.exe
• CaVSCons.ExE
• cavse.ExE
• CavSn.ExE
• CavSub.ExE
• CaVSubmit.ExE
• CavUMaS.ExE
• CavUserUpd.ExE
• Cavvl.ExE
• CCenter.ExE
• CEmRep.ExE
• ckahcomm.dll
• ckahrule.dll
• ckahum.dll
• cleaner.exe
• cleaner3.exe
• clldr.dll
• CMain.ExE
• copy.exe
• curidsbase.kdz
• destrukto.vbs
• dF5Serv.exe
• diffs.dll
• drvins32.exe
• drwadins.exe
• drweb32w.exe
• drweb386.exe
• drwebscd.exe
• drwebupw.exe
• drwebwcl.exe
• drwreg.exe
• e.cmd
• e9ehn1m8.com
• edb.chk
• egui.exe
• ekrn.exe
• EMdISK.exe
• f0.cmd
• FileKan.exe
• flashy.exe
• FPaVServer.exe
• FProttray.exe
• fpscan.exe
• fptrayproc.exe
• FPWin.exe
• FrameworkService.exe
• Frameworkservice.ExE
• FRW.ExE
• FrzState2k.exe
• fs6519.dll.vbs
• fssf.exe
• fssync.dll
• fun.xls.exe
• g2pfnid.com
• GetSI.dll
• GFUpd.ExE
• guard.exe
• GuardField.ExE
• guardgui.exe
• guardxkickoff.exe
• guardxkickoff_x64.exe
• guardxservice.exe
• guardxup.exe
• h3.bat
• Hijackthis.ExE
• hookinst.exe
• host.exe
• i.bat
• iamapp.exe
• iamserv.exe
• IceSword.ExE
• ICLOad95.ExE
• ICLOadNt.ExE
• ICMON.ExE
• ICSUPP95.ExE
• ICSUPPNt.ExE
• Identity.exe
• iefqwp.cmd
• IEShow.exe
• IFaCE.ExE
• ij.bat
• InstallCaVS.ExE
• InstLsp.ExE
• Iparmor.ExE
• iSafe.exe
• iSafInst.exe
• KaSaRP.ExE
• kav.bav
• kav32.ExE
• kavbase.kdl
• KaVPFW.ExE
• kavstart.ExE
• ker.vbs
• KeyMgr.exe
• killVBS.vbs
• kissvc.ExE
• kl1.sys
• klavemu.kdl
• klbg.cat
• klbg.sys
• klif.cat
• klif.sys
• klim5.sys
• kmailmon.ExE
• KPfwSvc.ExE
• KRegEx.ExE
• KVSrvxP.ExE
• KVWSC.ExE
• kwatch.ExE
• licmgr.ex
• licreg.exe
• lky.exe
• lockdown2000.exe
• m2nl.bat
• mbam.exe
• mcagent.exe
• mcappins.exe
• mcaupdate.exe
• mcdash.exe
• Mcdetect.exe
• mcinfo.exe
• mcinsupd.exe
• mcmnhdlr.exe
• mcregwiz.exe
• McShield.exe
• Mctray.exe
• mcupdmgr.exe
• mcupdui.exe
• McVSEscn.exe
• mcvsftsn.exe
• mcvsmap.exe
• mghtml.exe
• Mmsk.ExE
• MooLive.exe
• msdos.pif
• msfir80.exe
• MSGrc32.vbs
• msime80.exe
• msizap.exe
• msmsgs.exe
• msvcm80.dll
• msvcp80.dll
• msvcr71.dll
• msvcr80.dll
• mzvkbd.dll
• mzvkbd3.dll
• naiavfin.exe
• naPrdMgr.exe
• Navapsvc.ExE
• NaVaPW32.ExE
• NaVW32.ExE
• netcfg.dll
• new folder.exe
• njibyekk.com
• nod32.exe
• nod32krn.exe
• nod32kui.exe
• oasclnt.exe
• olb1iimw.bat
• OnaccessInstaller.ExE
• Pagent.exe
• Pagentwd.exe
• PavFnSvr.exe
• pavprsrv.exe
• PavReport.exe
• pavsched.exe
• PaVSRV51.ExE
• pavtest.exe
• pctsauxs.exe
• pctsSvc.exe
• pctstray.exe
• PFW.ExE
• preupd.exe
• prloader.dll
• procexp.exe
• psctrlc.exe
• PsCtrlS.exe
• PSHost.exe
• PsImSvc.exe
• pskmssvc.exe
• QQdoctor.ExE
• QtnMaint.exe
• RaV.ExE
• ravmon.exe
• Ravservice.ExE
• RavStub.ExE
• RaVtRaY.ExE
• rcukd.cmd
• reload.exe
• rescue32.exe
• rescuecd.zip
• rfwmain.ExE
• rfwProxy.ExE
• rfwsrv.ExE
• Rfwstub.ExE
• rose.exe
• RStray.ExE
• Runiep.ExE
• safeboxtray.ExE
• sal.xls.exe
• sched.exe
• SCVHOSt.exe
• scvhosts.exe
• SCVHSOt.exe
• SCVVHOSt.exe
• scvvhosts.exe
• SCVVHSOt.exe
• seccenter.exe
• SendLogs.exe
• session.exe
• shstat.exe
• Socksa.ex
• SOLOCFG.exe
• SOLOLItE.exe
• SOLOSCaN.exe
• SOLOSENt.exe
• Sphinx.exe
• spidercpl.exe
• spiderml.exe
• spidernt.exe
• spiderui.exe
• spml_set.exe
• Spybotsd.exe
• SREngLdr.ExE
• ssvichosst.exe
• sxs.exe
• system.exe
• tca.exe
• temp.exe
• temp2.exe
• toy.exe
• tPSrv.exe
• trojandetector.ExE
• trojanwall.ExE
• trojdie.KxP
• UdaterUI.exe
• uiscan.exe
• unp_test.ExE
• update.exe
• updater.dll
• UPSdbMaker.ExE
• userdump.exe
• UUpd.ExE
• v.exe
• Vba32act.exe
• Vba32arkit.exe
• Vba32ECM.exe
• Vba32ifs.exe
• vba32ldr.exe
• Vba32PP3.exe
• Vba32Qtn.exe
• vbcmserv.exe
• vbcons.exe
• vbglobal.exe
• vbimport.exe
• vbinst.exe
• vbscan.exe
• vbsystry.exe
• VetMsg.exe
• virusutilities.exe
• Visthaux.exe
• VPC32.ExE
• VPtRaY.ExE
• VSECOMR.ExE
• VSHWIN32.ExE
• vsmon.exe
• vsserv.exe
• VSStat.ExE
• VstskMgr.exe
• WEBPROxY.ExE
• WEBSCaNx.ExE
• whi.com
• WinGrc32.dll
• WOPtILItIES.ExE
• Wradmin.exe
• WrCtrl.exe
• wscntfy.exe
• wsctool.exe
• yannh.cmd
• ybj8df.exe
• zonealarm.exe
• _aVP32.ExE
• _aVPCC.ExE
• _aVPM.ExE

Thus, the Worm gets executed every time the above mentioned files are opened.

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\]
  EnableLUA="0"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\]
  PromptOnSecureDesktop="0"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\]
  EnableVirtualization="0"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Outlook\Security\]
  ObjectModelGuard="2"

The above mentioned registries confirm that the Worm disables the windows and outlook security settings.

• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\]
  EnableFirewall="0"

The above mentioned registry confirms that the Worm disable the default Windows Firewall on the infected machine.

The worm drops the .vbs file (VBScript file) into the following location

%WINDIR%\vb.vbs

And then the VBScript file spreads the malicious file "N73.Image12.03.2009.JPG.scr" over network shares. This worm searches all drives that are connected to the host system, if it finds any system in the network which is accessible, then it looks for the drives [C:D:E: F: G: H: ] and copies the above mentioned file on it.

It also attempts to copy the file "N73.Image12.03.2009.JPG.scr"into the following shared folders.

• Music,
• New Folder,
• Print

The worm attempts to harvest email addresses from the local system and send the copies of itself to all the address lists in the user's Outlook Address Book.

Here you have

Email Body:

Hello:

This is The Document I told you about,you can find it Here.

http://www.share[removed].com/library/PDF_Document21.025542010.pdf

Please check it and reply as soon as possible.

Cheers,

Just for you

Hello:

This is The Free Dowload Sex Movies,you can find it Here.

http://www.share[removed]om/library/SEX21.025542010.wmv

Enjoy Your Time.

Cheers,

The above mentioned links directs the user to download the copy of the worm.

• Avast! Antivirus
• aswUpdSv
• avast! Mail Scanner
• avast! Web Scanner
• AntiVirService
• AntiVirMailGuard
• AntiVirSchedulerService
• McShield
• AntiVirFirewallService
• NIS
• MSK80Service
• 0053591272669638mcinstcleanup
• mfefire
• McNASvc
• Mc0obeSv
• McMPFSvc
• McProxy
• Mc0DS
• mcmscsvc
• McAfee SiteAdvisor Service
• mfevtp
• Avgfws9
• AVG Security Toolbar Service
• avg9wd
• AVGIDSAgent
• PAVFNSVR
• Gwmsrv
• PSHost
• PSIMSVC
• PAVSRV
• PavPrSrv
• PskSvcRetail
• Panda Software Controller
• TPSrv
• SfCtlCom
• prlo
• TmProxy
• TMBMServer
• Arrakis3
• LIVESRV
• scan
• VSSERV
• sdAuxService
• sdCoreService
• AVP

[Where %WinDir% is the Windows Directory - for example c:\windows]

                         --------------------------

This Virus has been seen in large spam runs with the subject line: "Here you have".

When executed, the following files are dropped:

• %WINDIR%\system\Administrator CV 2010.exe
• %WINDIR%\system\updates.exe
• %WINDIR%\Administrator CV 2010.exe
• %WINDIR%\autorun.inf
• %WINDIR%\autorun2.inf
• %WINDIR%\csrss.exe
• %WINDIR%\vb.vbs
• %DIR%\Administrator CV 2010.exe
• %WINDIR%\tryme1.exe
• %WINDIR%\im.exe
• %WINDIR%\csrss.exe
• %WINDIR%\vb.vbs
• %TEMP%\~DF1DC7.tmp
• %WINDIR%\ie.exe
• %WINDIR%\rd.exe
• %WINDIR%\re.exe
• %WINDIR%\system\updates.exe
• %WINDIR%\SYSTEM32\SendEmail.dll
• %WINDIR%\gc.exe
• %WINDIR%\hst.iq
• %WINDIR%\ff.exe
• %WINDIR%\op.exe
• %WINDIR%\pspv.exe
• %WINDIR%\re.iq
• %WINDIR%\ff.dlm
• %APPDATA%\addons.dat

Where %WINDIR% = \WINDOWS (Windows 9x/ME/XP/Vista/7), \WINNT (Windows NT/2000)

The following files were temporarily written to disk then later removed:
 

• %WINDIR%\ff.iq
• %WINDIR%\ie.iq
• %WINDIR%\SendEmail.iq
• %WINDIR%\w.iq
• %WINDIR%\m.iq
• %WINDIR%\gc.iq
• %WINDIR%\SYSTEM32\drivers\etc\hosts
• %WINDIR%\pspv.iq
• %WINDIR%\w.exe
• %WINDIR%\tryme.iq
• %WINDIR%\im.iq
• %WINDIR%\rd.iq
• %TEMP%\~DFAFA.tmp
• %WINDIR%\m.exe
• %WINDIR%\SendEmail.dll
• %WINDIR%\b.bat
• %WINDIR%\op.iq

The following file was modified:
 

• %WINDIR%\SYSTEM32\wbem\logs\wbemprox.log

The malware has been known to randomly delete certain existing executables and replaces the current host file.

Registry changes are made like the ones below to prevent certain system tools from running. This is a subset of the complete changes :

• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\00hoeav.com
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\0w.com
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.ExE
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.ExE
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.ExE
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.ExE
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\6.bat
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\6fnlpetp.exe
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\6x8be16.cmd
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2cmd.ExE
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2free.ExE
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2service.ExE
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2upd.ExE
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\abk.bat
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adobe Gamma Loader.exe
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\algsrvs.exe
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\algssl.exe
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\angry.bat
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\anti-trojan.exe
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aNtIaRP.ExE
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antihost.exe
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aNtS.ExE
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apu-0607g.xml
• HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS SCRIPT HOST\
  HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS SCRIPT HOST\SETTINGS\

The following registry element was modified:

• HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\LOCKED = 1

The following registry key was added to get past the outlook security message prompt

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\12.0\Outlook\Security\ObjectModelGuard = 0x00000002

Connections to the following resources are attempted:

• hxxp://members.multimania.co.uk/yahoophoto/*****
• 213.131.252.***:80

This virus will search and ternminate processes and services belonging to various security products.  It searches for the following strings of any running process or service:

• 'wscsvc'
• 'MpsSvc'
• 'WinDefend'
• 'wuauserv'
• 'AntiVirWebService'
• 'McNaiAnn'
• 'Avast! Antivirus'
• 'aswUpdSv'
• 'avast! Mail Scanner'
• 'avast! Web Scanner'
• 'AntiVirService'
• 'AntiVirMailGuard'
• 'AntiVirSchedulerService'
• 'McShield'
• 'AntiVirFirewallService'
• 'mfefire'
• 'McNASvc'
• 'Mc0obeSv'
• 'McMPFSvc'
• 'McProxy'
• 'Mc0DS'
• 'mcmscsvc'
• 'McAfee SiteAdvisor Service'
• 'mfevtp'
• 'Avgfws9'
• 'AVG Security Toolbar Service'
• 'avg9wd'
• 'AVGIDSAgent'
• PAVFNSVR'
• 'Gwmsrv'
• 'PSHost'
• 'PSIMSVC'
• 'PAVSRV'
• 'PavPrSrv'
• 'PskSvcRetail'
• 'Panda Software Controller'
• 'TPSrv'
• SfCtlCom'
• 'TmProxy'
• 'TMBMServer'
• Arrakis3'
• 'LIVESRV'
• 'scan'
• 'VSSERV'
• sdAuxService'
• 'sdCoreService'
• 'AVP'
• rescue32
• vzkrnl
• hcomm
• hrule
• cll
• hum
• iffs
• fssync
• msvcm80
• msvcp80
• msvcr80
• mzvkb
• com
• rescuec
• rvins32
• vemu
• curi
• vgcc
• msvr
• vgserv
• vgcc32
• sSvc
• meworkService
• Mgr
• erUI
• shs
• skMgr
• 360rp
• 360s
• febo
• 360
• rSwp
• oRun
• oRunKiller
• vMoni
• CCen
• meworkservice
• GFUp
• IceSwor
• rmor
• v32
• VPFW
• kissvc
• ilmon
• KPfwSvc
• KRegE
• KVSrv
• KVWSC
• Mmsk
• psvc
• PFW
• vservice
• rfwm
• rfwPro
• rfwsrv
• Rfws
• SREngL
• oruns
• orunsc
• reg
• ini
• bin
• 8be16
• 00hoe
• 6fnlpe
• lky
• m2nl
• rcuk
• whi
• msiz
• wscn
• 32krn
• 32kui
• swBoo
• isp
• shServ
• Vis
• shWebSv
• shM
• iSv
• shLogV
• swRegSvr
• shSkPcc
• swUp
• shQuick
• shEnhc
• shPopWz
• sche
• shUp
• vgine
• vgrssvc
• vgsc
• vgupsvc
• vgemc
• vgw
• svc
• vgrs
• vgn
• vno
• ify
• vsc
• vgu
• vcen
• min
• licmgr
• ekrn
• vconfig
• ilc
• gui
• preup
• wsc
• ool
• gen
• subwiz
• Survey
• seccen
• uisc
• vsserv
• IEShow
• unins
• iss
• licreg
• VCm
• VRep
• fIns
• VRi
• Msg
• VServer
• FPro
• fpsc
• yproc
• FPWin
• fssf
• llC
• user
• ump
• mcregwiz
• mcup
• mgr
• ppins
• mcinfo
• mgh
• mcmnh
• mcinsup
• McShiel
• mcvsm
• McVSEscn
• mcvsf
• scln
• vfin
• VP32
• VPCC
• VPM
• PW32
• VW32
• ICLO
• ICMON
• ICSUPP95
• ICSUPPN
• mserv
• FRW
• ckice
• zone
• vsmon
• WrC
• cle
• ner3
• ner
• MooLive
• lock
• own2000
• Sphin
• VSHWIN32
• VSECOMR
• WEBSC
• VCONSOL
• VSS
• 2free
• 2service
• 2up
• 2cm
• vEmSrv
• vmr
• vMU
• VSCons
• vse
• vSn
• vSub
• VSubmi
• vUM
• vUserUp
• vvl
• CEmRep
• Ins
• Lsp
• ccessIns
• ller
• unp_
• UPS
• ker
• UUp
• F5Serv
• FrzS
• e2k
• obe G
•  Lo
• WIN
• vcim
• VENGINE
• PSHos
• vFnSvr
• VSRV51
• PsC
• rlS
• PsImSvc
• PSC
• pskmssvc
• vRepor
• vsche
• PSrv
• WEBPRO