Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Audio Fetcher] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Audio Fetcher] 'ImagePath' = '%ALLUSERSPROFILE%\Audio Fetcher\Audio Fetcher.exe'
Creates the following services
- 'Audio Fetcher' %ALLUSERSPROFILE%\Audio Fetcher\Audio Fetcher.exe
Modifies file system
Creates the following files
- %TEMP%\is-cn2bb.tmp\is-tp1ff.tmp
- %ProgramFiles(x86)%\virtualdvo\language\is-11mq8.tmp
- %ProgramFiles(x86)%\virtualdvo\language\is-dse84.tmp
- %ProgramFiles(x86)%\virtualdvo\language\is-2mo9r.tmp
- %ProgramFiles(x86)%\virtualdvo\language\is-75qvn.tmp
- %ProgramFiles(x86)%\virtualdvo\language\is-t02fa.tmp
- %ProgramFiles(x86)%\virtualdvo\language\is-7ni8i.tmp
- %ProgramFiles(x86)%\virtualdvo\language\is-r5suv.tmp
- %ProgramFiles(x86)%\virtualdvo\language\is-9a58b.tmp
- %ProgramFiles(x86)%\virtualdvo\is-55567.tmp
- %ProgramFiles(x86)%\virtualdvo\language\is-gfkle.tmp
- %ProgramFiles(x86)%\virtualdvo\language\is-ei9tg.tmp
- %ProgramFiles(x86)%\virtualdvo\language\is-pulft.tmp
- %ProgramFiles(x86)%\virtualdvo\language\is-0lj69.tmp
- %ProgramFiles(x86)%\virtualdvo\language\is-982pd.tmp
- %ProgramFiles(x86)%\virtualdvo\is-9f095.tmp
- %ProgramFiles(x86)%\virtualdvo\is-ou996.tmp
- %ProgramFiles(x86)%\virtualdvo\is-939vm.tmp
- %ProgramFiles(x86)%\virtualdvo\unins000.dat
- %ProgramFiles(x86)%\virtualdvo\language\is-ppluc.tmp
- %ProgramFiles(x86)%\virtualdvo\language\is-p20na.tmp
- %ProgramFiles(x86)%\virtualdvo\language\is-6lv01.tmp
- %ProgramFiles(x86)%\virtualdvo\language\is-7540d.tmp
- %ProgramFiles(x86)%\virtualdvo\language\is-02i4b.tmp
- %TEMP%\is-evek1.tmp\_isetup\_setup64.tmp
- %TEMP%\is-evek1.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-evek1.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-evek1.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\virtualdvo\is-8ks2q.tmp
- %ProgramFiles(x86)%\virtualdvo\is-ul7fu.tmp
- %ProgramFiles(x86)%\virtualdvo\is-och1r.tmp
- %ProgramFiles(x86)%\virtualdvo\is-o4rcm.tmp
- %ProgramFiles(x86)%\virtualdvo\virtualdvo.exe
- %ProgramFiles(x86)%\virtualdvo\language\is-v27e2.tmp
- %ProgramFiles(x86)%\virtualdvo\is-iarp2.tmp
- %ProgramFiles(x86)%\virtualdvo\libssl\is-muqnp.tmp
- %ProgramFiles(x86)%\virtualdvo\language\is-kgmrj.tmp
- %ProgramFiles(x86)%\virtualdvo\language\is-i149r.tmp
- %ProgramFiles(x86)%\virtualdvo\language\is-69jpb.tmp
- %ProgramFiles(x86)%\virtualdvo\language\is-7k6g3.tmp
- %ProgramFiles(x86)%\virtualdvo\language\is-sr6g4.tmp
- %ProgramFiles(x86)%\virtualdvo\language\is-4eqnh.tmp
- %ProgramFiles(x86)%\virtualdvo\language\is-djd0p.tmp
- %TEMP%\is-evek1.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\virtualdvo\libssl\is-td1k9.tmp
- %ALLUSERSPROFILE%\audio fetcher\audio fetcher.exe
Moves the following files
- from %ProgramFiles(x86)%\virtualdvo\is-8ks2q.tmp to %ProgramFiles(x86)%\virtualdvo\unins000.exe
- from %ProgramFiles(x86)%\virtualdvo\language\is-11mq8.tmp to %ProgramFiles(x86)%\virtualdvo\language\german.ini
- from %ProgramFiles(x86)%\virtualdvo\language\is-dse84.tmp to %ProgramFiles(x86)%\virtualdvo\language\greek.ini
- from %ProgramFiles(x86)%\virtualdvo\language\is-2mo9r.tmp to %ProgramFiles(x86)%\virtualdvo\language\hungarian.ini
- from %ProgramFiles(x86)%\virtualdvo\language\is-75qvn.tmp to %ProgramFiles(x86)%\virtualdvo\language\italian.ini
- from %ProgramFiles(x86)%\virtualdvo\language\is-t02fa.tmp to %ProgramFiles(x86)%\virtualdvo\language\japanese.ini
- from %ProgramFiles(x86)%\virtualdvo\language\is-7ni8i.tmp to %ProgramFiles(x86)%\virtualdvo\language\korean.ini
- from %ProgramFiles(x86)%\virtualdvo\language\is-r5suv.tmp to %ProgramFiles(x86)%\virtualdvo\language\norwegian.ini
- from %ProgramFiles(x86)%\virtualdvo\language\is-9a58b.tmp to %ProgramFiles(x86)%\virtualdvo\language\polish.ini
- from %ProgramFiles(x86)%\virtualdvo\language\is-gfkle.tmp to %ProgramFiles(x86)%\virtualdvo\language\portuguese.ini
- from %ProgramFiles(x86)%\virtualdvo\language\is-v27e2.tmp to %ProgramFiles(x86)%\virtualdvo\language\russian.ini
- from %ProgramFiles(x86)%\virtualdvo\language\is-ei9tg.tmp to %ProgramFiles(x86)%\virtualdvo\language\slovak.ini
- from %ProgramFiles(x86)%\virtualdvo\language\is-pulft.tmp to %ProgramFiles(x86)%\virtualdvo\language\slovenian.ini
- from %ProgramFiles(x86)%\virtualdvo\language\is-0lj69.tmp to %ProgramFiles(x86)%\virtualdvo\language\spanish.ini
- from %ProgramFiles(x86)%\virtualdvo\language\is-982pd.tmp to %ProgramFiles(x86)%\virtualdvo\language\template.ini
- from %ProgramFiles(x86)%\virtualdvo\is-9f095.tmp to %ProgramFiles(x86)%\virtualdvo\license_english.rtf
- from %ProgramFiles(x86)%\virtualdvo\language\is-p20na.tmp to %ProgramFiles(x86)%\virtualdvo\language\french.ini
- from %ProgramFiles(x86)%\virtualdvo\is-ou996.tmp to %ProgramFiles(x86)%\virtualdvo\license_korean.rtf
- from %ProgramFiles(x86)%\virtualdvo\language\is-ppluc.tmp to %ProgramFiles(x86)%\virtualdvo\language\finnish.ini
- from %ProgramFiles(x86)%\virtualdvo\language\is-7540d.tmp to %ProgramFiles(x86)%\virtualdvo\language\dutch.ini
- from %ProgramFiles(x86)%\virtualdvo\is-ul7fu.tmp to %ProgramFiles(x86)%\virtualdvo\engine.dll
- from %ProgramFiles(x86)%\virtualdvo\is-och1r.tmp to %ProgramFiles(x86)%\virtualdvo\smartinstaller_x86.exe
- from %ProgramFiles(x86)%\virtualdvo\is-o4rcm.tmp to %ProgramFiles(x86)%\virtualdvo\smartinstaller_amd64.exe
- from %ProgramFiles(x86)%\virtualdvo\is-iarp2.tmp to %ProgramFiles(x86)%\virtualdvo\difxapi_x86.dll
- from %ProgramFiles(x86)%\virtualdvo\is-55567.tmp to %ProgramFiles(x86)%\virtualdvo\difxapi_amd64.dll
- from %ProgramFiles(x86)%\virtualdvo\libssl\is-td1k9.tmp to %ProgramFiles(x86)%\virtualdvo\libssl\libeay32.dll
- from %ProgramFiles(x86)%\virtualdvo\libssl\is-muqnp.tmp to %ProgramFiles(x86)%\virtualdvo\libssl\ssleay32.dll
- from %ProgramFiles(x86)%\virtualdvo\language\is-kgmrj.tmp to %ProgramFiles(x86)%\virtualdvo\language\arabic.ini
- from %ProgramFiles(x86)%\virtualdvo\language\is-i149r.tmp to %ProgramFiles(x86)%\virtualdvo\language\bulgarian.ini
- from %ProgramFiles(x86)%\virtualdvo\language\is-69jpb.tmp to %ProgramFiles(x86)%\virtualdvo\language\catalan.ini
- from %ProgramFiles(x86)%\virtualdvo\language\is-7k6g3.tmp to %ProgramFiles(x86)%\virtualdvo\language\chinesesimplified.ini
- from %ProgramFiles(x86)%\virtualdvo\language\is-sr6g4.tmp to %ProgramFiles(x86)%\virtualdvo\language\chinesetraditional.ini
- from %ProgramFiles(x86)%\virtualdvo\language\is-4eqnh.tmp to %ProgramFiles(x86)%\virtualdvo\language\croatian.ini
- from %ProgramFiles(x86)%\virtualdvo\language\is-djd0p.tmp to %ProgramFiles(x86)%\virtualdvo\language\czech.ini
- from %ProgramFiles(x86)%\virtualdvo\language\is-02i4b.tmp to %ProgramFiles(x86)%\virtualdvo\language\danish.ini
- from %ProgramFiles(x86)%\virtualdvo\language\is-6lv01.tmp to %ProgramFiles(x86)%\virtualdvo\language\english.ini
- from %ProgramFiles(x86)%\virtualdvo\is-939vm.tmp to %ProgramFiles(x86)%\virtualdvo\virtualdvo.exe
Miscellaneous
Searches for the following windows
- ClassName: 'jbbc89_dvo108FlashFixClass_jbbc89' WindowName: ''
Creates and executes the following
- '%TEMP%\is-cn2bb.tmp\is-tp1ff.tmp' /SL4 $A024E "<Full path to file>" 4022046 116224
- '%ProgramFiles(x86)%\virtualdvo\virtualdvo.exe' -i
- '%ProgramFiles(x86)%\virtualdvo\virtualdvo.exe' -s
Executes the following
- '%WINDIR%\syswow64\net.exe' helpmsg 8
- '%WINDIR%\syswow64\net1.exe' helpmsg 8
