Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\TVTunerClassic61] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\TVTunerClassic61] 'ImagePath' = '%ALLUSERSPROFILE%\TVTunerClassic61\TVTunerClassic61.exe'
Creates the following services
- 'TVTunerClassic61' %ALLUSERSPROFILE%\TVTunerClassic61\TVTunerClassic61.exe
Modifies file system
Creates the following files
- %TEMP%\is-uov0v.tmp\<File name>.tmp
- %LOCALAPPDATA%\webkit professional\microsoft.vc90.crt\is-0ofqr.tmp
- %LOCALAPPDATA%\webkit professional\microsoft.vc90.crt\is-4gfgb.tmp
- %LOCALAPPDATA%\webkit professional\pf\common audio\is-9ird4.tmp
- %LOCALAPPDATA%\webkit professional\pf\common audio\is-hc2jc.tmp
- %LOCALAPPDATA%\webkit professional\pf\common audio\is-6b91o.tmp
- %LOCALAPPDATA%\webkit professional\pf\common audio\is-r3tls.tmp
- %LOCALAPPDATA%\webkit professional\pf\common audio\is-32ins.tmp
- %LOCALAPPDATA%\webkit professional\pf\common audio\is-ai9k0.tmp
- %LOCALAPPDATA%\webkit professional\pf\common audio\is-ib7rv.tmp
- %LOCALAPPDATA%\webkit professional\pf\common audio\is-vv2c2.tmp
- %LOCALAPPDATA%\webkit professional\pf\common audio\is-l5v5p.tmp
- %LOCALAPPDATA%\webkit professional\pf\common audio\is-acgkl.tmp
- %LOCALAPPDATA%\webkit professional\microsoft.vc90.crt\is-7k2ar.tmp
- %LOCALAPPDATA%\webkit professional\microsoft.vc90.crt\is-rphcv.tmp
- %LOCALAPPDATA%\webkit professional\pf\common audio\is-vnn69.tmp
- %LOCALAPPDATA%\webkit professional\pf\common audio\is-6shv3.tmp
- %LOCALAPPDATA%\webkit professional\pf\common audio\is-srihe.tmp
- %LOCALAPPDATA%\webkit professional\pf\common audio\is-3vsdc.tmp
- %LOCALAPPDATA%\webkit professional\pf\common audio\is-hboq9.tmp
- %LOCALAPPDATA%\webkit professional\pf\common audio\is-50611.tmp
- %LOCALAPPDATA%\webkit professional\lang\is-4hc25.tmp
- %LOCALAPPDATA%\webkit professional\lang\is-c663v.tmp
- %LOCALAPPDATA%\webkit professional\lang\is-0crqa.tmp
- %LOCALAPPDATA%\webkit professional\lang\is-vshc8.tmp
- %LOCALAPPDATA%\webkit professional\lang\is-gsih7.tmp
- %LOCALAPPDATA%\webkit professional\is-s8b27.tmp
- %LOCALAPPDATA%\webkit professional\unins000.dat
- %LOCALAPPDATA%\webkit professional\pf\common audio\is-djc2l.tmp
- %LOCALAPPDATA%\webkit professional\pf\common audio\is-us15m.tmp
- %LOCALAPPDATA%\webkit professional\lang\is-s4ufm.tmp
- %LOCALAPPDATA%\webkit professional\lang\is-ovrug.tmp
- %LOCALAPPDATA%\webkit professional\lang\is-m2dv4.tmp
- %TEMP%\is-tgl11.tmp\_isetup\_setup64.tmp
- %TEMP%\is-tgl11.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-tgl11.tmp\_isetup\_iscrypt.dll
- %LOCALAPPDATA%\webkit professional\is-7ul8k.tmp
- %LOCALAPPDATA%\webkit professional\is-m5r4o.tmp
- %LOCALAPPDATA%\webkit professional\is-udo0l.tmp
- %LOCALAPPDATA%\webkit professional\is-g0dof.tmp
- %LOCALAPPDATA%\webkit professional\is-79tcn.tmp
- %LOCALAPPDATA%\webkit professional\is-cr249.tmp
- %LOCALAPPDATA%\webkit professional\is-ajil9.tmp
- %LOCALAPPDATA%\webkit professional\is-hv9ih.tmp
- %LOCALAPPDATA%\webkit professional\is-3vpe1.tmp
- %LOCALAPPDATA%\webkit professional\is-qh35q.tmp
- %TEMP%\is-tgl11.tmp\_isetup\_regdll.tmp
- %LOCALAPPDATA%\webkit professional\is-6803v.tmp
- %LOCALAPPDATA%\webkit professional\is-j04r9.tmp
- %LOCALAPPDATA%\webkit professional\is-udvj3.tmp
- %LOCALAPPDATA%\webkit professional\is-kautf.tmp
- %LOCALAPPDATA%\webkit professional\is-ie3hi.tmp
- %LOCALAPPDATA%\webkit professional\is-81an8.tmp
- %LOCALAPPDATA%\webkit professional\is-ks6pu.tmp
- %LOCALAPPDATA%\webkit professional\is-rmk6i.tmp
- %LOCALAPPDATA%\webkit professional\is-j6421.tmp
- %LOCALAPPDATA%\webkit professional\is-0grol.tmp
- %LOCALAPPDATA%\webkit professional\is-4e4c0.tmp
- %LOCALAPPDATA%\webkit professional\is-mgho0.tmp
- %LOCALAPPDATA%\webkit professional\lang\is-b08c5.tmp
- %LOCALAPPDATA%\webkit professional\lang\is-414a9.tmp
- %LOCALAPPDATA%\webkit professional\is-fbluv.tmp
- %LOCALAPPDATA%\webkit professional\webkitprof1233.exe
- %ALLUSERSPROFILE%\tvtunerclassic61\tvtunerclassic61.exe
Deletes the following files
- %LOCALAPPDATA%\webkit professional\lang\audioconverterripper.dat
- %LOCALAPPDATA%\webkit professional\lang\audioconverterripper.txt
- %LOCALAPPDATA%\webkit professional\lang\feedback.dat
- %LOCALAPPDATA%\webkit professional\lang\musictype.txt
- %LOCALAPPDATA%\webkit professional\lang\update.log
Moves the following files
- from %LOCALAPPDATA%\webkit professional\is-7ul8k.tmp to %LOCALAPPDATA%\webkit professional\unins000.exe
- from %LOCALAPPDATA%\webkit professional\lang\is-s4ufm.tmp to %LOCALAPPDATA%\webkit professional\lang\update.log
- from %LOCALAPPDATA%\webkit professional\microsoft.vc90.crt\is-7k2ar.tmp to %LOCALAPPDATA%\webkit professional\microsoft.vc90.crt\microsoft.vc90.crt.manifest
- from %LOCALAPPDATA%\webkit professional\microsoft.vc90.crt\is-rphcv.tmp to %LOCALAPPDATA%\webkit professional\microsoft.vc90.crt\msvcm90.dll
- from %LOCALAPPDATA%\webkit professional\microsoft.vc90.crt\is-0ofqr.tmp to %LOCALAPPDATA%\webkit professional\microsoft.vc90.crt\msvcp90.dll
- from %LOCALAPPDATA%\webkit professional\microsoft.vc90.crt\is-4gfgb.tmp to %LOCALAPPDATA%\webkit professional\microsoft.vc90.crt\msvcr90.dll
- from %LOCALAPPDATA%\webkit professional\pf\common audio\is-9ird4.tmp to %LOCALAPPDATA%\webkit professional\pf\common audio\aac.pf
- from %LOCALAPPDATA%\webkit professional\pf\common audio\is-hc2jc.tmp to %LOCALAPPDATA%\webkit professional\pf\common audio\ac3.pf
- from %LOCALAPPDATA%\webkit professional\pf\common audio\is-6b91o.tmp to %LOCALAPPDATA%\webkit professional\pf\common audio\aiff.pf
- from %LOCALAPPDATA%\webkit professional\pf\common audio\is-r3tls.tmp to %LOCALAPPDATA%\webkit professional\pf\common audio\amr.pf
- from %LOCALAPPDATA%\webkit professional\pf\common audio\is-32ins.tmp to %LOCALAPPDATA%\webkit professional\pf\common audio\ape.pf
- from %LOCALAPPDATA%\webkit professional\pf\common audio\is-ib7rv.tmp to %LOCALAPPDATA%\webkit professional\pf\common audio\flac.pf
- from %LOCALAPPDATA%\webkit professional\pf\common audio\is-50611.tmp to %LOCALAPPDATA%\webkit professional\pf\common audio\wma.pf
- from %LOCALAPPDATA%\webkit professional\pf\common audio\is-vv2c2.tmp to %LOCALAPPDATA%\webkit professional\pf\common audio\m4a.pf
- from %LOCALAPPDATA%\webkit professional\pf\common audio\is-l5v5p.tmp to %LOCALAPPDATA%\webkit professional\pf\common audio\m4b.pf
- from %LOCALAPPDATA%\webkit professional\pf\common audio\is-acgkl.tmp to %LOCALAPPDATA%\webkit professional\pf\common audio\m4r.pf
- from %LOCALAPPDATA%\webkit professional\pf\common audio\is-vnn69.tmp to %LOCALAPPDATA%\webkit professional\pf\common audio\mka.pf
- from %LOCALAPPDATA%\webkit professional\pf\common audio\is-djc2l.tmp to %LOCALAPPDATA%\webkit professional\pf\common audio\mp2.pf
- from %LOCALAPPDATA%\webkit professional\pf\common audio\is-us15m.tmp to %LOCALAPPDATA%\webkit professional\pf\common audio\mp3.pf
- from %LOCALAPPDATA%\webkit professional\pf\common audio\is-6shv3.tmp to %LOCALAPPDATA%\webkit professional\pf\common audio\ogg.pf
- from %LOCALAPPDATA%\webkit professional\pf\common audio\is-srihe.tmp to %LOCALAPPDATA%\webkit professional\pf\common audio\ra.pf
- from %LOCALAPPDATA%\webkit professional\pf\common audio\is-3vsdc.tmp to %LOCALAPPDATA%\webkit professional\pf\common audio\voc.pf
- from %LOCALAPPDATA%\webkit professional\pf\common audio\is-hboq9.tmp to %LOCALAPPDATA%\webkit professional\pf\common audio\wav.pf
- from %LOCALAPPDATA%\webkit professional\lang\is-ovrug.tmp to %LOCALAPPDATA%\webkit professional\lang\musictype.txt
- from %LOCALAPPDATA%\webkit professional\pf\common audio\is-ai9k0.tmp to %LOCALAPPDATA%\webkit professional\pf\common audio\au.pf
- from %LOCALAPPDATA%\webkit professional\lang\is-m2dv4.tmp to %LOCALAPPDATA%\webkit professional\lang\feedback.dat
- from %LOCALAPPDATA%\webkit professional\is-fbluv.tmp to %LOCALAPPDATA%\webkit professional\rmvbencode.dll
- from %LOCALAPPDATA%\webkit professional\is-m5r4o.tmp to %LOCALAPPDATA%\webkit professional\msvcp60.dll
- from %LOCALAPPDATA%\webkit professional\is-udo0l.tmp to %LOCALAPPDATA%\webkit professional\msvcr71.dll
- from %LOCALAPPDATA%\webkit professional\is-g0dof.tmp to %LOCALAPPDATA%\webkit professional\musiccd.exe
- from %LOCALAPPDATA%\webkit professional\is-79tcn.tmp to %LOCALAPPDATA%\webkit professional\nvencoderkernel.dll
- from %LOCALAPPDATA%\webkit professional\is-cr249.tmp to %LOCALAPPDATA%\webkit professional\ocxhelper.exe
- from %LOCALAPPDATA%\webkit professional\is-ajil9.tmp to %LOCALAPPDATA%\webkit professional\postproc-52.dll
- from %LOCALAPPDATA%\webkit professional\is-hv9ih.tmp to %LOCALAPPDATA%\webkit professional\productcontrol.dll
- from %LOCALAPPDATA%\webkit professional\is-3vpe1.tmp to %LOCALAPPDATA%\webkit professional\pthreadgc2.dll
- from %LOCALAPPDATA%\webkit professional\is-qh35q.tmp to %LOCALAPPDATA%\webkit professional\pthreadvc2.dll
- from %LOCALAPPDATA%\webkit professional\is-6803v.tmp to %LOCALAPPDATA%\webkit professional\realquickjoin.dll
- from %LOCALAPPDATA%\webkit professional\is-j04r9.tmp to %LOCALAPPDATA%\webkit professional\rmvbencodesync.dll
- from %LOCALAPPDATA%\webkit professional\lang\is-b08c5.tmp to %LOCALAPPDATA%\webkit professional\lang\audioconverterripper.dat
- from %LOCALAPPDATA%\webkit professional\is-udvj3.tmp to %LOCALAPPDATA%\webkit professional\simage.dll
- from %LOCALAPPDATA%\webkit professional\is-kautf.tmp to %LOCALAPPDATA%\webkit professional\soundtouch.dll
- from %LOCALAPPDATA%\webkit professional\is-ie3hi.tmp to %LOCALAPPDATA%\webkit professional\ssleay32.dll
- from %LOCALAPPDATA%\webkit professional\is-81an8.tmp to %LOCALAPPDATA%\webkit professional\swresample-0.dll
- from %LOCALAPPDATA%\webkit professional\is-ks6pu.tmp to %LOCALAPPDATA%\webkit professional\uitoolkit.dll.intermediate.manifest
- from %LOCALAPPDATA%\webkit professional\is-rmk6i.tmp to %LOCALAPPDATA%\webkit professional\ve32.dll
- from %LOCALAPPDATA%\webkit professional\is-j6421.tmp to %LOCALAPPDATA%\webkit professional\ve64.dll
- from %LOCALAPPDATA%\webkit professional\is-0grol.tmp to %LOCALAPPDATA%\webkit professional\wait.gif
- from %LOCALAPPDATA%\webkit professional\is-4e4c0.tmp to %LOCALAPPDATA%\webkit professional\webrtc.dll
- from %LOCALAPPDATA%\webkit professional\is-mgho0.tmp to %LOCALAPPDATA%\webkit professional\wmadecode.dll
- from %LOCALAPPDATA%\webkit professional\lang\is-414a9.tmp to %LOCALAPPDATA%\webkit professional\lang\audioconverterripper.txt
- from %LOCALAPPDATA%\webkit professional\is-s8b27.tmp to %LOCALAPPDATA%\webkit professional\webkitprof1233.exe
Substitutes the following files
- %LOCALAPPDATA%\webkit professional\lang\audioconverterripper.dat
- %LOCALAPPDATA%\webkit professional\lang\audioconverterripper.txt
- %LOCALAPPDATA%\webkit professional\lang\feedback.dat
- %LOCALAPPDATA%\webkit professional\lang\musictype.txt
- %LOCALAPPDATA%\webkit professional\lang\update.log
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'P8e3e9_WKP1233FlashFixClass_P8e3e9'
Creates and executes the following
- '%TEMP%\is-uov0v.tmp\<File name>.tmp' /SL5="$A0250,4157725,54272,<Full path to file>"
- '%LOCALAPPDATA%\webkit professional\webkitprof1233.exe' -i
- '%LOCALAPPDATA%\webkit professional\webkitprof1233.exe' -s
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "WKPR1233"
