filenameJRT.EXE
size1016261 (0xf81c5)
md5ca630dbadeb5b6101531f986adfe46c9
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x60
blocks_in_file1
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x60

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 52 65  |........!..L.!Re|
00000010: 71 75 69 72 65 20 57 69  6e 64 6f 77 73 0d 0a 24  |quire Windows..$|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4c26f87e
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion8.0
SizeOfCode0x11400
SizeOfInitializedData0x4e00
SizeOfUninitializedData0
AddressOfEntryPoint0x11def
BaseOfCode0x1000
BaseOfData0x13000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x1c000
SizeOfHeaders0x200
CheckSum0x1e027
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x113170x11400R-X CODE
.rdata0x130000x30ea0x3200R-- IDATA
.data0x170000x292c0x800RW- IDATA
.rsrc0x1a0000x12d70x1400R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x150dc0xb4
RESOURCE0x1a0000x12d7
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x130000x310
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#134640
GROUP_ICON#101201252
VERSION#14000
MANIFEST#16351252
module_namehintordfunction_name
COMCTL32.dll17
KERNEL32.dll353GetFileAttributesW
KERNEL32.dll78CreateDirectoryW
KERNEL32.dll932WriteFile
KERNEL32.dll441GetStdHandle
KERNEL32.dll899VirtualFree
KERNEL32.dll386GetModuleHandleW
KERNEL32.dll416GetProcAddress
KERNEL32.dll594LoadLibraryA
KERNEL32.dll613LockResource
KERNEL32.dll599LoadResource
KERNEL32.dll853SizeofResource
KERNEL32.dll228FindResourceExA
KERNEL32.dll628MulDiv
KERNEL32.dll511GlobalFree
KERNEL32.dll504GlobalAlloc
KERNEL32.dll963lstrcmpiA
KERNEL32.dll446GetSystemDefaultLCID
KERNEL32.dll448GetSystemDefaultUILanguage
KERNEL32.dll485GetUserDefaultUILanguage
KERNEL32.dll629MultiByteToWideChar
KERNEL32.dll373GetLocaleInfoW
KERNEL32.dll972lstrlenA
KERNEL32.dll964lstrcmpiW
KERNEL32.dll345GetEnvironmentVariableW
KERNEL32.dll961lstrcmpW
KERNEL32.dll517GlobalMemoryStatusEx
KERNEL32.dll897VirtualAlloc
KERNEL32.dll916WideCharToMultiByte
KERNEL32.dll189ExpandEnvironmentStringsW
KERNEL32.dll709RemoveDirectoryW
KERNEL32.dll206FindClose
KERNEL32.dll221FindNextFileW
KERNEL32.dll132DeleteFileW
KERNEL32.dll213FindFirstFileW
KERNEL32.dll835SetThreadLocale
KERNEL32.dll371GetLocalTime
KERNEL32.dll458GetSystemTimeAsFileTime
KERNEL32.dll973lstrlenW
KERNEL32.dll470GetTempPathW
KERNEL32.dll788SetEnvironmentVariableW
KERNEL32.dll52CloseHandle
KERNEL32.dll86CreateFileW
KERNEL32.dll340GetDriveTypeW
KERNEL32.dll779SetCurrentDirectoryW
KERNEL32.dll382GetModuleFileNameW
KERNEL32.dll273GetCommandLineW
KERNEL32.dll490GetVersionExW
KERNEL32.dll80CreateEventW
KERNEL32.dll790SetEvent
KERNEL32.dll719ResetEvent
KERNEL32.dll547InitializeCriticalSection
KERNEL32.dll863TerminateThread
KERNEL32.dll722ResumeThread
KERNEL32.dll856SuspendThread
KERNEL32.dll563IsBadReadPtr
KERNEL32.dll604LocalFree
KERNEL32.dll967lstrcpyW
KERNEL32.dll244FormatMessageW
KERNEL32.dll450GetSystemDirectoryW
KERNEL32.dll129DeleteCriticalSection
KERNEL32.dll355GetFileSize
KERNEL32.dll795SetFilePointer
KERNEL32.dll693ReadFile
KERNEL32.dll799SetFileTime
KERNEL32.dll784SetEndOfFile
KERNEL32.dll152EnterCriticalSection
KERNEL32.dll593LeaveCriticalSection
KERNEL32.dll910WaitForMultipleObjects
KERNEL32.dll383GetModuleHandleA
KERNEL32.dll859SystemTimeToFileTime
KERNEL32.dll369GetLastError
KERNEL32.dll111CreateThread
KERNEL32.dll912WaitForSingleObject
KERNEL32.dll347GetExitCodeThread
KERNEL32.dll854Sleep
KERNEL32.dll808SetLastError
KERNEL32.dll794SetFileAttributesW
KERNEL32.dll335GetDiskFreeSpaceExW
KERNEL32.dll958lstrcatW
KERNEL32.dll185ExitProcess
KERNEL32.dll57CompareFileTime
KERNEL32.dll439GetStartupInfoA
USER32.dll55CharUpperW
USER32.dll198EndDialog
USER32.dll153DestroyWindow
USER32.dll437KillTimer
USER32.dll554ReleaseDC
USER32.dll162DispatchMessageW
USER32.dll318GetMessageW
USER32.dll634SetTimer
USER32.dll97CreateWindowExW
USER32.dll561ScreenToClient
USER32.dll372GetWindowRect
USER32.dll728wsprintfW
USER32.dll325GetParent
USER32.dll348GetSystemMenu
USER32.dll194EnableMenuItem
USER32.dll196EnableWindow
USER32.dll478MessageBeep
USER32.dll447LoadIconW
USER32.dll449LoadImageW
USER32.dll730wvsprintfW
USER32.dll429IsWindow
USER32.dll143DefWindowProcW
USER32.dll28CallWindowProcW
USER32.dll183DrawIconEx
USER32.dll157DialogBoxIndirectParamW
USER32.dll362GetWindow
USER32.dll64ClientToScreen
USER32.dll268GetDC
USER32.dll191DrawTextW
USER32.dll658ShowWindow
USER32.dll666SystemParametersInfoW
USER32.dll598SetFocus
USER32.dll641SetWindowLongW
USER32.dll349GetSystemMetrics
USER32.dll255GetClientRect
USER32.dll273GetDlgItem
USER32.dll289GetKeyState
USER32.dll479MessageBoxA
USER32.dll727wsprintfA
USER32.dll647SetWindowTextW
USER32.dll346GetSysColor
USER32.dll377GetWindowTextLengthW
USER32.dll378GetWindowTextW
USER32.dll252GetClassNameA
USER32.dll367GetWindowLongW
USER32.dll300GetMenu
USER32.dll643SetWindowPos
USER32.dll73CopyImage
USER32.dll576SendMessageW
USER32.dll364GetWindowDC
GDI32.dll356GetCurrentObject
GDI32.dll585StretchBlt
GDI32.dll568SetStretchBltMode
GDI32.dll44CreateCompatibleBitmap
GDI32.dll526SelectObject
GDI32.dll45CreateCompatibleDC
GDI32.dll407GetObjectW
GDI32.dll363GetDeviceCaps
GDI32.dll143DeleteObject
GDI32.dll61CreateFontIndirectW
GDI32.dll140DeleteDC
SHELL32.dll173SHGetFileInfoW
SHELL32.dll122SHBrowseForFolderW
SHELL32.dll189SHGetPathFromIDListW
SHELL32.dll183SHGetMalloc
SHELL32.dll266ShellExecuteExW
SHELL32.dll197SHGetSpecialFolderPathW
SHELL32.dll267ShellExecuteW
ole32.dll59CoInitialize
ole32.dll131CreateStreamOnHGlobal
ole32.dll16CoCreateInstance
OLEAUT32.dll9
OLEAUT32.dll418
OLEAUT32.dll2
MSVCRT.dll129__set_app_type
MSVCRT.dll111__p__fmode
MSVCRT.dll106__p__commode
MSVCRT.dll157_adjust_fdiv
MSVCRT.dll131__setusermatherr
MSVCRT.dll271_initterm
MSVCRT.dll88__getmainargs
MSVCRT.dll143_acmdln
MSVCRT.dll585exit
MSVCRT.dll72_XcptFilter
MSVCRT.dll211_exit
MSVCRT.dll14public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

MSVCRT.dll390_onexit
MSVCRT.dll85__dllonexit
MSVCRT.dll65_CxxThrowException
MSVCRT.dll166_beginthreadex
MSVCRT.dll66_EH_prolog
MSVCRT.dll665memset
MSVCRT.dll494_wcsnicmp
MSVCRT.dll704strncmp
MSVCRT.dll657malloc
MSVCRT.dll664memmove
MSVCRT.dll558_wtol
MSVCRT.dll663memcpy
MSVCRT.dll606free
MSVCRT.dll662memcmp
MSVCRT.dll402_purecall
MSVCRT.dll15void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

MSVCRT.dll16void __cdecl operator delete(void *)

??3@YAXPAX@Z

MSVCRT.dll202_except_handler3
MSVCRT.dll183_controlfp

StringTable 000004b0

CompanyNameThisisu
FileDescriptionJunkware Removal Tool
ProductVersion6.1.4

VS_FIXEDFILEINFO

FileVersion1.2.0.715
ProductVersion1.2.0.715
StrucVersion0x10000
FileFlagsMask0
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
091136EXE06/27/2010 07:06:38#
15c115HTM#
16400925125BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 1016261 bytes (993 KiB)


--
Type = 7z
Offset = 91470
Physical Size = 924791
Headers Size = 2298
Method = LZMA:21 BCJ
Solid = +
Blocks = 2

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2012-12-08 07:27:02 ....A          565       770286  erunt/ERUNT.EXE.manifest
2014-04-06 05:12:38 ....A        29635               ask.bat
2014-04-06 05:12:44 ....A        13963               chrome.bat
2014-04-06 05:12:51 ....A         1813               delfolders.bat
2013-07-10 00:21:16 ....A           85               delorphans.bat
2014-04-06 05:13:01 ....A          719               ev_clear.bat
2014-04-06 05:13:06 ....A       152733               firefox.bat
2014-04-06 05:13:11 ....A         1226               FWPolicy.bat
2014-04-06 05:51:21 ....A        15919               get.bat
2014-04-06 05:13:18 ....A        31401               iexplore.bat
2014-04-06 05:14:37 ....A        10161               JRT.bat
2014-04-06 05:14:43 ....A        18670               medfos.bat
2014-04-06 05:14:49 ....A       154678               misc.bat
2014-04-06 05:14:54 ....A         8104               modules.bat
2014-04-06 05:14:59 ....A        39458               prelim.bat
2014-04-06 05:30:02 ....A         9516               runvalues.bat
2014-04-06 05:15:07 ....A        24738               searchlnk.bat
2014-04-06 05:15:13 ....A         1230               TDL4.bat
2013-02-03 12:34:40 ....A          370               clean_shortcut.vbs
2014-04-06 04:31:19 ....A           13               currentmd5.txt
2012-12-08 07:27:02 ....A        31952               erunt/README.TXT
2013-01-24 12:52:14 ....A          100               sednewline.txt
2013-09-02 00:20:59 ....A          144               appinit64_null.reg
2013-08-29 02:30:41 ....A          132               appinit_null.reg
2013-10-15 23:14:27 ....A          414               CHR_open_x64.reg
2013-10-15 23:19:59 ....A          402               CHR_open_x86.reg
2013-08-22 03:41:47 ....A          386               datamngr_del.reg
2013-10-15 23:13:50 ....A          388               FF_open_x64.reg
2013-10-15 23:19:21 ....A          376               FF_open_x86.reg
2013-10-15 23:15:19 ....A          388               IE_open_x64.reg
2013-10-15 23:22:54 ....A          388               IE_open_x86.reg
2014-04-06 04:26:20 ....A        18307               badFOLDERS.cfg
2013-10-06 06:30:34 ....A          119               badFOLDERScom.cfg
2014-03-23 21:19:41 ....A         1007               badFOLDERSstart.cfg
2014-02-04 05:57:38 ....A          221               badLNK.cfg
2014-03-23 21:20:12 ....A         4583               badvalues.cfg
2013-04-29 22:18:34 ....A          128               browsermngr_keys.cfg
2012-12-09 02:32:58 ....A           94               browsermngr_values.cfg
2013-04-29 22:19:38 ....A          174               CHRregkey_x64.cfg
2013-04-29 22:19:46 ....A          107               CHRregkey_x86.cfg
2014-03-23 21:20:48 ....A         6866               CHR_extensions.cfg
2013-04-21 22:24:56 ....A           38               defaultscope.cfg
2013-04-05 14:41:14 ....A          159               FFwhtlist.cfg
2013-04-23 14:41:32 ....A           86               IEwhtlst.cfg
2013-09-12 07:37:49 ....A         8130               REGhcr.cfg
2013-07-09 07:37:54 ....A           48               REGhkcu_and_hklm_allow.cfg
2014-02-04 06:29:17 ....A         3377               REGhkcu_and_hklm_software.cfg
2013-11-05 22:23:48 ....A         3025               REGhkcu_software_appdatalow.cfg
2014-01-08 02:07:18 ....A         1664               REGhkcu_software_microsoft.cfg
2013-11-05 22:20:01 ....A        36278               REGhklm_software_classes.cfg
2013-11-05 22:21:04 ....A           79               REGISTRYUSERSID.cfg
2013-04-21 23:19:58 ....A          211               runvalues_x64.cfg
2013-04-21 23:15:04 ....A          129               runvalues_x86.cfg
2013-11-05 22:22:15 ....A           45               serviceseventlog.cfg
2013-11-05 22:19:47 ....A         1718               APPID_clsid.dat
2013-11-05 22:19:27 ....A         1599               APPID_files.dat
2013-09-12 07:36:00 ....A           84               APPPATHS.dat
2013-08-02 22:26:50 ....A           78               APPROVEDEXTENSIONS_clsid.dat
2013-07-11 20:28:28 ....A         3158               askCLSID.dat
2013-04-29 22:13:32 ....A          488               askregkey_x64.dat
2013-04-29 22:14:04 ....A          260               askregkey_x86.dat
2013-04-29 22:16:08 ....A          424               askregvalue_x64.dat
2013-04-29 22:16:24 ....A          345               askregvalue_x86.dat
2013-07-08 20:10:58 ....A           30               askservices.dat
2014-03-23 21:19:10 ....A          174               badAPPINIT.dat
2014-03-23 21:21:58 ....A        30558               BHO_clsid.dat
2014-03-23 21:21:25 ....A         1459               BHO_name.dat
2005-02-28 00:40:46 ....A        45056               CHOICE.DAT
2014-01-01 09:17:59 ....A        13038               CLSID_clsid.dat
2012-12-08 07:27:02 ....A        17920               CUT.DAT
2013-11-05 22:20:33 ....A         3836               ELEVATIONPOLICY_clsid.dat
2013-08-02 15:39:08 ....A           16               EXT.dat
2012-12-08 07:27:02 ....A          119               FFbrowsermngr.dat
2014-03-23 21:22:13 ....A        10561               FFextensions.dat
2013-11-05 22:17:50 ....A          353               FFpluginREG.dat
2012-12-08 07:27:02 ....A           75               FFplugins.dat
2014-03-23 21:21:07 ....A         3653               FFprefs.dat
2013-04-29 22:21:20 ....A          177               FFregkey_x64.dat
2013-04-29 22:21:30 ....A          109               FFregkey_x86.dat
2014-03-23 21:19:25 ....A         1512               FFXML.dat
2014-03-23 21:20:29 ....A         1433               FFXPI.dat
2013-08-29 03:15:27 ....A         6957               FWCLSID.dat
2013-08-22 03:06:01 ....A           15               IFEO.dat
2013-11-05 22:21:34 ....A         5598               INTERFACE_clsid.dat
2013-11-05 22:24:21 ....A          277               MENUEXT.dat
2013-10-15 19:02:40 ....A          392               modules.dat
2013-01-24 13:19:44 ....A          178               moduleservices.dat
2012-12-15 11:36:10 ....A        43520               NIRCMD.DAT
2013-08-02 14:41:12 ....A           33               NOTIFY.dat
2013-09-12 07:38:33 ....A          878               PREAPPROVED_clsid.dat
2014-01-08 02:06:59 ....A          141               PRODUCTS.dat
2014-01-08 01:58:54 ....A         1732               S1518COMPONENTS.dat
2010-10-22 01:15:22 ....A        98816               SED.DAT
2014-04-06 04:32:27 ....A         4173               services.dat
2013-11-05 22:23:16 ....A         1518               SETTINGS_clsid.dat
2013-02-01 15:14:00 ....A        57344               SHORTCUT.DAT
2014-01-01 09:18:15 ....A         1638               STATS_clsid.dat
2014-01-08 02:05:48 ....A         7685               TRACING.dat
2013-11-05 22:21:17 ....A         3518               TYPELIB_clsid.dat
2014-01-08 02:06:06 ....A        14243               UNINSTALL.dat
2013-08-02 14:37:58 ....A          100               UpgradeCodes.dat
2013-08-08 08:46:04 ....A       401408               WGET.DAT
2014-02-04 06:00:17 ....A          502               WOW6432NODE.dat
2012-12-08 07:27:02 ....A       163328               erunt/ERDNT.E_E
2012-12-08 07:27:02 ....A         2815               erunt/ERDNTDOS.LOC
2012-12-08 07:27:02 ....A         3275               erunt/ERDNTWIN.LOC
2012-12-08 07:27:02 ....A         4090               erunt/ERUNT.LOC
2012-12-08 07:27:02 ....A       157696       152207  erunt/ERUNT.EXE
2014-04-06 05:17:36 ....A            0            0  temp/null.txt
2014-04-06 05:17:36 D....            0            0  temp
2014-04-06 04:25:43 D....            0            0  erunt
------------------- ----- ------------ ------------  ------------------------
2014-04-06 05:51:21            1755045       922493  109 files, 2 folders
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK