Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\LmpcService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\LmpcService] 'ImagePath' = '%ProgramFiles%\Lock My PC 4\LmpcServ.exe'
Modifies file system
Creates the following files
- %TEMP%\sibaabe.tmp\sibca.dll
- %APPDATA%\microsoft\windows\start menu\programs\lock my pc 4\uninstall lock my pc.lnk
- %APPDATA%\microsoft\windows\start menu\programs\lock my pc 4\lock my pc help.lnk
- %APPDATA%\microsoft\windows\start menu\programs\lock my pc 4\lock my pc settings.lnk
- %APPDATA%\microsoft\windows\start menu\programs\lock my pc 4\lock my pc.lnk
- %APPDATA%\microsoft\windows\start menu\programs\lock my pc 4\fspro labs in web ....lnk
- %ProgramFiles%\lock my pc 4\lockscreens\is-tja8h.tmp
- %ProgramFiles%\lock my pc 4\lockscreens\is-gcsh1.tmp
- %ProgramFiles%\lock my pc 4\lockscreens\is-g0um5.tmp
- %ProgramFiles%\lock my pc 4\lockscreens\is-fva0r.tmp
- %ProgramFiles%\lock my pc 4\lockscreens\is-pln3k.tmp
- %ProgramFiles%\lock my pc 4\lockscreens\is-fe0m8.tmp
- %ProgramFiles%\lock my pc 4\lockscreens\is-eape7.tmp
- %ProgramFiles%\lock my pc 4\is-1vn3r.tmp
- %ProgramFiles%\lock my pc 4\unins000.msg
- %ProgramFiles%\lock my pc 4\is-o4d6e.tmp
- %ProgramFiles%\lock my pc 4\is-ou3i3.tmp
- %ProgramFiles%\lock my pc 4\is-73bvk.tmp
- <SYSTEM32>\is-pr1u6.tmp
- <DRIVERS>\is-he4ub.tmp
- %ProgramFiles%\lock my pc 4\is-edj11.tmp
- %ProgramFiles%\lock my pc 4\is-1hhqd.tmp
- %ProgramFiles%\lock my pc 4\is-562c5.tmp
- %ProgramFiles%\lock my pc 4\is-t5rto.tmp
- %TEMP%\is-eu6ea.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-eu6ea.tmp\_isetup\_setup64.tmp
- %TEMP%\is-l5qlt.tmp\lmpc4_free_setup.tmp
- %TEMP%\sibaabe.tmp\0\lmpc4_free_setup.exe
- %TEMP%\sibaabe.tmp\sibclr.dll
- %ProgramFiles%\lock my pc 4\is-4cs6j.tmp
- %ProgramFiles%\lock my pc 4\unins000.dat
Deletes the following files
- %TEMP%\is-eu6ea.tmp\_isetup\_setup64.tmp
- %TEMP%\is-eu6ea.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-l5qlt.tmp\lmpc4_free_setup.tmp
- %TEMP%\sibaabe.tmp\0\lmpc4_free_setup.exe
- %TEMP%\sibaabe.tmp\sibca.dll
- %TEMP%\sibaabe.tmp\sibclr.dll
Moves the following files
- from %ProgramFiles%\lock my pc 4\is-t5rto.tmp to %ProgramFiles%\lock my pc 4\unins000.exe
- from %ProgramFiles%\lock my pc 4\lockscreens\is-g0um5.tmp to %ProgramFiles%\lock my pc 4\lockscreens\lockscreen5_b.gif
- from %ProgramFiles%\lock my pc 4\lockscreens\is-fva0r.tmp to %ProgramFiles%\lock my pc 4\lockscreens\lockscreen4.jpg
- from %ProgramFiles%\lock my pc 4\lockscreens\is-pln3k.tmp to %ProgramFiles%\lock my pc 4\lockscreens\lockscreen3.jpg
- from %ProgramFiles%\lock my pc 4\lockscreens\is-fe0m8.tmp to %ProgramFiles%\lock my pc 4\lockscreens\lockscreen2.jpg
- from %ProgramFiles%\lock my pc 4\lockscreens\is-eape7.tmp to %ProgramFiles%\lock my pc 4\lockscreens\lockscreen1.jpg
- from %ProgramFiles%\lock my pc 4\is-1vn3r.tmp to %ProgramFiles%\lock my pc 4\register.url
- from %ProgramFiles%\lock my pc 4\is-o4d6e.tmp to %ProgramFiles%\lock my pc 4\fsprolabs.url
- from %ProgramFiles%\lock my pc 4\is-4cs6j.tmp to %ProgramFiles%\lock my pc 4\license.txt
- from %ProgramFiles%\lock my pc 4\is-ou3i3.tmp to %ProgramFiles%\lock my pc 4\lockmypc.chm
- from %ProgramFiles%\lock my pc 4\is-73bvk.tmp to %ProgramFiles%\lock my pc 4\locklib.dll
- from <SYSTEM32>\is-pr1u6.tmp to <SYSTEM32>\fsp_lmwl.dll
- from <DRIVERS>\is-he4ub.tmp to <DRIVERS>\lmpc4.sys
- from %ProgramFiles%\lock my pc 4\is-edj11.tmp to %ProgramFiles%\lock my pc 4\lmpcserv.exe
- from %ProgramFiles%\lock my pc 4\is-1hhqd.tmp to %ProgramFiles%\lock my pc 4\lockcp.exe
- from %ProgramFiles%\lock my pc 4\is-562c5.tmp to %ProgramFiles%\lock my pc 4\lockpc.exe
- from %ProgramFiles%\lock my pc 4\lockscreens\is-gcsh1.tmp to %ProgramFiles%\lock my pc 4\lockscreens\lockscreen6_r.gif
- from %ProgramFiles%\lock my pc 4\lockscreens\is-tja8h.tmp to %ProgramFiles%\lock my pc 4\lockscreens\sample.isf
Network activity
UDP
- DNS ASK fs##o.net
Miscellaneous
Searches for the following windows
- ClassName: 'TLMPCMainForm' WindowName: ''
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\sibaabe.tmp\0\lmpc4_free_setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART
- '%TEMP%\is-l5qlt.tmp\lmpc4_free_setup.tmp' /SL5="$70236,1667084,118784,%TEMP%\sibAABE.tmp\0\lmpc4_free_setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART
- '%ProgramFiles%\lock my pc 4\lockpc.exe' /i
- '%ProgramFiles%\lock my pc 4\lockpc.exe' /s
- '%ProgramFiles%\lock my pc 4\lmpcserv.exe'
- '%WINDIR%\syswow64\sc.exe' stop LmpcService' (with hidden window)
- '%ProgramFiles%\lock my pc 4\lockpc.exe' /i' (with hidden window)
- '<SYSTEM32>\sc.exe' create LmpcService binPath= "%ProgramFiles%\Lock My PC 4\LmpcServ.exe" start= auto group= UIGroup DisplayName= "Lock My PC Service"' (with hidden window)
- '<SYSTEM32>\sc.exe' start LmpcService' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\sc.exe' stop LmpcService
- '<SYSTEM32>\sc.exe' create LmpcService binPath= "%ProgramFiles%\Lock My PC 4\LmpcServ.exe" start= auto group= UIGroup DisplayName= "Lock My PC Service"
- '<SYSTEM32>\sc.exe' start LmpcService
