Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\QuickTime.mov\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" /prefetch:5 /Play "%L"'
- [<HKLM>\SOFTWARE\Classes\MKVFile\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" /prefetch:5 /Play "%L"'
- [<HKLM>\SOFTWARE\Classes\MP4File\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" /prefetch:5 /Play "%L"'
Malicious functions:
Creates and executes the following:
- '%TEMP%\IXP000.TMP\SetACL_x86.exe' -ot reg -on HKLM\SOFTWARE\Microsoft\DirectShow\Preferred -actn ace -ace n:%USERNAME%s;p:full;s:n;i:so,sc;m:grant;w:dacl
- '%TEMP%\IXP000.TMP\SetACL_x86.exe' -ot reg -on HKLM\SOFTWARE\Microsoft\DirectShow\Preferred -actn setowner -ownr n:%USERNAME%s;s:n
Modifies file system :
Creates the following files:
- %CommonProgramFiles%\CyberLink\SETE.tmp
- %CommonProgramFiles%\CyberLink\SETF.tmp
- %CommonProgramFiles%\CyberLink\SETC.tmp
- %CommonProgramFiles%\CyberLink\SETD.tmp
- %CommonProgramFiles%\CyberLink\SET10.tmp
- %CommonProgramFiles%\CyberLink\SET13.tmp
- %CommonProgramFiles%\CyberLink\SET14.tmp
- %CommonProgramFiles%\CyberLink\SET11.tmp
- %CommonProgramFiles%\CyberLink\SET12.tmp
- %CommonProgramFiles%\CyberLink\SETB.tmp
- %TEMP%\IXP000.TMP\W95INF16.DLL
- %WINDIR%\inf\SET5.tmp
- %TEMP%\IXP000.TMP\ADVPACK.DLL
- %TEMP%\IXP000.TMP\W95INF32.DLL
- %CommonProgramFiles%\CyberLink\SET6.tmp
- %CommonProgramFiles%\CyberLink\SET9.tmp
- %CommonProgramFiles%\CyberLink\SETA.tmp
- %CommonProgramFiles%\CyberLink\SET7.tmp
- %CommonProgramFiles%\CyberLink\SET8.tmp
- %CommonProgramFiles%\CyberLink\SET15.tmp
- %CommonProgramFiles%\CyberLink\SET22.tmp
- %CommonProgramFiles%\CyberLink\SET23.tmp
- %CommonProgramFiles%\CyberLink\SET20.tmp
- %CommonProgramFiles%\CyberLink\SET21.tmp
- %CommonProgramFiles%\CyberLink\SET24.tmp
- %CommonProgramFiles%\CyberLink\SET27.tmp
- %CommonProgramFiles%\CyberLink\SET28.tmp
- %CommonProgramFiles%\CyberLink\SET25.tmp
- %CommonProgramFiles%\CyberLink\SET26.tmp
- %CommonProgramFiles%\CyberLink\SET1F.tmp
- %CommonProgramFiles%\CyberLink\SET18.tmp
- %CommonProgramFiles%\CyberLink\SET19.tmp
- %CommonProgramFiles%\CyberLink\SET16.tmp
- %CommonProgramFiles%\CyberLink\SET17.tmp
- %CommonProgramFiles%\CyberLink\SET1A.tmp
- %CommonProgramFiles%\CyberLink\SET1D.tmp
- %CommonProgramFiles%\CyberLink\SET1E.tmp
- %CommonProgramFiles%\CyberLink\SET1B.tmp
- %CommonProgramFiles%\CyberLink\SET1C.tmp
- %TEMP%\IXP000.TMP\Xdec.dll
- %TEMP%\IXP000.TMP\CLFLVSplitter.ax
- %TEMP%\IXP000.TMP\CLLine21.ax
- %TEMP%\IXP000.TMP\cldor2.dll
- %TEMP%\IXP000.TMP\cldor2d.dll
- %TEMP%\IXP000.TMP\clm2vdec.dll
- %TEMP%\IXP000.TMP\CLMKVSplter_License.rtf
- %TEMP%\IXP000.TMP\clmvcd.dll
- %TEMP%\IXP000.TMP\clm4splt.ax
- %TEMP%\IXP000.TMP\CLMKVSplter.ax
- %TEMP%\IXP000.TMP\CLDemuxer2.ax
- %TEMP%\IXP000.TMP\264dsse2.dll
- %TEMP%\IXP000.TMP\264dsse3.dll
- %TEMP%\IXP000.TMP\264dmmx.dll
- %TEMP%\IXP000.TMP\264dsse.dll
- %TEMP%\IXP000.TMP\ACBDWrapper.dll
- %TEMP%\IXP000.TMP\CLCVD.ax
- %TEMP%\IXP000.TMP\clcvd.inf
- %TEMP%\IXP000.TMP\cl265dec.dll
- %TEMP%\IXP000.TMP\CLAVCHDNav.ax
- %TEMP%\IXP000.TMP\CLQTSrc.ax
- %TEMP%\IXP000.TMP\pthread_LGPL.txt
- %TEMP%\IXP000.TMP\pthreadVC2.dll
- %TEMP%\IXP000.TMP\meritmgr.exe
- %TEMP%\IXP000.TMP\PowerDVD.sim
- %TEMP%\IXP000.TMP\SetACL_x86.exe
- %TEMP%\IXP000.TMP\vc1dsse2.dll
- %TEMP%\IXP000.TMP\VDShell.dll
- %TEMP%\IXP000.TMP\vc1dmmx.dll
- %TEMP%\IXP000.TMP\vc1dsse.dll
- %TEMP%\IXP000.TMP\libmjpgdec.dll
- %TEMP%\IXP000.TMP\CLVDec_license.txt
- %TEMP%\IXP000.TMP\clwmvd.dll
- %TEMP%\IXP000.TMP\CLSplter.ax
- %TEMP%\IXP000.TMP\CLSubTitle.ax
- %TEMP%\IXP000.TMP\libass.dll
- %TEMP%\IXP000.TMP\libm4vdec.dll
- %TEMP%\IXP000.TMP\libmatroska.dll
- %TEMP%\IXP000.TMP\libass_License.txt
- %TEMP%\IXP000.TMP\libebml.dll
Moves the following files:
- from %CommonProgramFiles%\CyberLink\SET1D.tmp to %CommonProgramFiles%\CyberLink\clwmvd.dll
- from %CommonProgramFiles%\CyberLink\SET1C.tmp to %CommonProgramFiles%\CyberLink\clm2vdec.dll
- from %CommonProgramFiles%\CyberLink\SET1F.tmp to %CommonProgramFiles%\CyberLink\vc1dsse.dll
- from %CommonProgramFiles%\CyberLink\SET1E.tmp to %CommonProgramFiles%\CyberLink\vc1dmmx.dll
- from %CommonProgramFiles%\CyberLink\SET1B.tmp to %CommonProgramFiles%\CyberLink\cldor2d.dll
- from %CommonProgramFiles%\CyberLink\SET18.tmp to %CommonProgramFiles%\CyberLink\CLMKVSplter_License.rtf
- from %CommonProgramFiles%\CyberLink\SET17.tmp to %CommonProgramFiles%\CyberLink\libmatroska.dll
- from %CommonProgramFiles%\CyberLink\SET1A.tmp to %CommonProgramFiles%\CyberLink\cldor2.dll
- from %CommonProgramFiles%\CyberLink\SET19.tmp to %CommonProgramFiles%\CyberLink\CLFLVSplitter.ax
- from %CommonProgramFiles%\CyberLink\SET26.tmp to %CommonProgramFiles%\CyberLink\libass_License.txt
- from %CommonProgramFiles%\CyberLink\SET25.tmp to %CommonProgramFiles%\CyberLink\libmjpgdec.dll
- from %CommonProgramFiles%\CyberLink\SET28.tmp to %CommonProgramFiles%\CyberLink\PowerDVD.sim
- from %CommonProgramFiles%\CyberLink\SET27.tmp to %CommonProgramFiles%\CyberLink\CLAVCHDNav.ax
- from %CommonProgramFiles%\CyberLink\SET24.tmp to %CommonProgramFiles%\CyberLink\libass.dll
- from %CommonProgramFiles%\CyberLink\SET21.tmp to %CommonProgramFiles%\CyberLink\CLQTSrc.ax
- from %CommonProgramFiles%\CyberLink\SET20.tmp to %CommonProgramFiles%\CyberLink\vc1dsse2.dll
- from %CommonProgramFiles%\CyberLink\SET23.tmp to %CommonProgramFiles%\CyberLink\cl265dec.dll
- from %CommonProgramFiles%\CyberLink\SET22.tmp to %CommonProgramFiles%\CyberLink\ACBDWrapper.dll
- from %CommonProgramFiles%\CyberLink\SETB.tmp to %CommonProgramFiles%\CyberLink\CLSplter.ax
- from %CommonProgramFiles%\CyberLink\SETA.tmp to %CommonProgramFiles%\CyberLink\CLm4splt.ax
- from %CommonProgramFiles%\CyberLink\SETD.tmp to %CommonProgramFiles%\CyberLink\264dsse.dll
- from %CommonProgramFiles%\CyberLink\SETC.tmp to %CommonProgramFiles%\CyberLink\264dmmx.dll
- from %CommonProgramFiles%\CyberLink\SET9.tmp to %CommonProgramFiles%\CyberLink\CLDemuxer2.ax
- from %CommonProgramFiles%\CyberLink\SET6.tmp to %CommonProgramFiles%\CyberLink\CLCVD.ax
- from %WINDIR%\inf\SET5.tmp to %WINDIR%\inf\clcvd.inf
- from %CommonProgramFiles%\CyberLink\SET8.tmp to %CommonProgramFiles%\CyberLink\CLSubTitle.ax
- from %CommonProgramFiles%\CyberLink\SET7.tmp to %CommonProgramFiles%\CyberLink\CLLine21.ax
- from %CommonProgramFiles%\CyberLink\SET14.tmp to %CommonProgramFiles%\CyberLink\pthread_LGPL.txt
- from %CommonProgramFiles%\CyberLink\SET13.tmp to %CommonProgramFiles%\CyberLink\CLVDec_license.txt
- from %CommonProgramFiles%\CyberLink\SET16.tmp to %CommonProgramFiles%\CyberLink\libebml.dll
- from %CommonProgramFiles%\CyberLink\SET15.tmp to %CommonProgramFiles%\CyberLink\CLMKVSplter.ax
- from %CommonProgramFiles%\CyberLink\SET12.tmp to %CommonProgramFiles%\CyberLink\VDShell.dll
- from %CommonProgramFiles%\CyberLink\SETF.tmp to %CommonProgramFiles%\CyberLink\264dsse3.dll
- from %CommonProgramFiles%\CyberLink\SETE.tmp to %CommonProgramFiles%\CyberLink\264dsse2.dll
- from %CommonProgramFiles%\CyberLink\SET11.tmp to %CommonProgramFiles%\CyberLink\pthreadVC2.dll
- from %CommonProgramFiles%\CyberLink\SET10.tmp to %CommonProgramFiles%\CyberLink\libm4vdec.dll
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
