Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\AudioConverterRipper v6.6] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\AudioConverterRipper v6.6] 'ImagePath' = '%ALLUSERSPROFILE%\AudioConverterRipper v6.6\AudioConverterRipper v6.6.exe'
Creates the following services
- 'AudioConverterRipper v6.6' %ALLUSERSPROFILE%\AudioConverterRipper v6.6\AudioConverterRipper v6.6.exe
Modifies file system
Creates the following files
- %TEMP%\is-g4qnh.tmp\<File name>.tmp
- %LOCALAPPDATA%\et audio converter\microsoft.vc90.crt\is-ivmvm.tmp
- %LOCALAPPDATA%\et audio converter\microsoft.vc90.crt\is-b6qt3.tmp
- %LOCALAPPDATA%\et audio converter\microsoft.vc90.crt\is-92ajb.tmp
- %LOCALAPPDATA%\et audio converter\pf\common audio\is-9edis.tmp
- %LOCALAPPDATA%\et audio converter\pf\common audio\is-bgb1r.tmp
- %LOCALAPPDATA%\et audio converter\pf\common audio\is-aef2r.tmp
- %LOCALAPPDATA%\et audio converter\pf\common audio\is-n9un4.tmp
- %LOCALAPPDATA%\et audio converter\pf\common audio\is-h2u8q.tmp
- %LOCALAPPDATA%\et audio converter\pf\common audio\is-j1que.tmp
- %LOCALAPPDATA%\et audio converter\pf\common audio\is-ibcss.tmp
- %LOCALAPPDATA%\et audio converter\pf\common audio\is-j0rg8.tmp
- %LOCALAPPDATA%\et audio converter\pf\common audio\is-fbkpc.tmp
- %LOCALAPPDATA%\et audio converter\pf\common audio\is-mfcg8.tmp
- %LOCALAPPDATA%\et audio converter\lang\is-qbns4.tmp
- %LOCALAPPDATA%\et audio converter\microsoft.vc90.crt\is-mm6br.tmp
- %LOCALAPPDATA%\et audio converter\pf\common audio\is-fo9gt.tmp
- %LOCALAPPDATA%\et audio converter\pf\common audio\is-ja2re.tmp
- %LOCALAPPDATA%\et audio converter\unins000.dat
- %LOCALAPPDATA%\et audio converter\jramsoft.url
- %LOCALAPPDATA%\et audio converter\is-bkokv.tmp
- %LOCALAPPDATA%\et audio converter\lang\is-3h1uj.tmp
- %LOCALAPPDATA%\et audio converter\lang\is-af9sc.tmp
- %LOCALAPPDATA%\et audio converter\is-ro4mj.tmp
- %LOCALAPPDATA%\et audio converter\lang\is-nknsc.tmp
- %LOCALAPPDATA%\et audio converter\lang\is-4n2i1.tmp
- %LOCALAPPDATA%\et audio converter\pf\common audio\is-jj22f.tmp
- %LOCALAPPDATA%\et audio converter\pf\common audio\is-49sdd.tmp
- %LOCALAPPDATA%\et audio converter\pf\common audio\is-n4n9e.tmp
- %LOCALAPPDATA%\et audio converter\pf\common audio\is-g7q8m.tmp
- %LOCALAPPDATA%\et audio converter\pf\common audio\is-pkv60.tmp
- %LOCALAPPDATA%\et audio converter\pf\common audio\is-2cika.tmp
- %LOCALAPPDATA%\et audio converter\lang\is-i0d9r.tmp
- %LOCALAPPDATA%\et audio converter\lang\is-push7.tmp
- %LOCALAPPDATA%\et audio converter\lang\is-13jbv.tmp
- %TEMP%\is-nf0hl.tmp\_isetup\_setup64.tmp
- %TEMP%\is-nf0hl.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-nf0hl.tmp\_isetup\_iscrypt.dll
- %LOCALAPPDATA%\et audio converter\is-jvs4p.tmp
- %LOCALAPPDATA%\et audio converter\is-c3vuj.tmp
- %LOCALAPPDATA%\et audio converter\is-c9s2s.tmp
- %LOCALAPPDATA%\et audio converter\is-j8u8i.tmp
- %LOCALAPPDATA%\et audio converter\is-u4sma.tmp
- %LOCALAPPDATA%\et audio converter\is-lcuh7.tmp
- %LOCALAPPDATA%\et audio converter\is-i1071.tmp
- %LOCALAPPDATA%\et audio converter\is-6nb0c.tmp
- %LOCALAPPDATA%\et audio converter\is-slks9.tmp
- %LOCALAPPDATA%\et audio converter\is-nrhq4.tmp
- %LOCALAPPDATA%\et audio converter\is-4r4ah.tmp
- %TEMP%\is-nf0hl.tmp\_isetup\_regdll.tmp
- %LOCALAPPDATA%\et audio converter\is-g6i4q.tmp
- %LOCALAPPDATA%\et audio converter\lang\is-aajso.tmp
- %LOCALAPPDATA%\et audio converter\is-qjlhf.tmp
- %LOCALAPPDATA%\et audio converter\is-2a5v1.tmp
- %LOCALAPPDATA%\et audio converter\is-spta3.tmp
- %LOCALAPPDATA%\et audio converter\is-5jk5k.tmp
- %LOCALAPPDATA%\et audio converter\is-hnp4j.tmp
- %LOCALAPPDATA%\et audio converter\is-arn9n.tmp
- %LOCALAPPDATA%\et audio converter\lang\is-081v1.tmp
- %LOCALAPPDATA%\et audio converter\is-adgmf.tmp
- %LOCALAPPDATA%\et audio converter\etconverterripper.exe
- %LOCALAPPDATA%\et audio converter\is-j607t.tmp
- %LOCALAPPDATA%\et audio converter\is-q8qkf.tmp
- %LOCALAPPDATA%\et audio converter\is-uf8ff.tmp
- %LOCALAPPDATA%\et audio converter\is-1d73o.tmp
- %LOCALAPPDATA%\et audio converter\is-gd7bc.tmp
- %LOCALAPPDATA%\et audio converter\is-ddpoe.tmp
- %ALLUSERSPROFILE%\audioconverterripper v6.6\audioconverterripper v6.6.exe
Deletes the following files
- %LOCALAPPDATA%\et audio converter\lang\audioconverterripper.dat
- %LOCALAPPDATA%\et audio converter\lang\audioconverterripper.txt
- %LOCALAPPDATA%\et audio converter\lang\feedback.dat
- %LOCALAPPDATA%\et audio converter\lang\musictype.txt
- %LOCALAPPDATA%\et audio converter\lang\update.log
Moves the following files
- from %LOCALAPPDATA%\et audio converter\is-jvs4p.tmp to %LOCALAPPDATA%\et audio converter\unins000.exe
- from %LOCALAPPDATA%\et audio converter\lang\is-qbns4.tmp to %LOCALAPPDATA%\et audio converter\lang\update.log
- from %LOCALAPPDATA%\et audio converter\microsoft.vc90.crt\is-mm6br.tmp to %LOCALAPPDATA%\et audio converter\microsoft.vc90.crt\microsoft.vc90.crt.manifest
- from %LOCALAPPDATA%\et audio converter\microsoft.vc90.crt\is-ivmvm.tmp to %LOCALAPPDATA%\et audio converter\microsoft.vc90.crt\msvcm90.dll
- from %LOCALAPPDATA%\et audio converter\microsoft.vc90.crt\is-b6qt3.tmp to %LOCALAPPDATA%\et audio converter\microsoft.vc90.crt\msvcp90.dll
- from %LOCALAPPDATA%\et audio converter\microsoft.vc90.crt\is-92ajb.tmp to %LOCALAPPDATA%\et audio converter\microsoft.vc90.crt\msvcr90.dll
- from %LOCALAPPDATA%\et audio converter\pf\common audio\is-9edis.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\aac.pf
- from %LOCALAPPDATA%\et audio converter\pf\common audio\is-bgb1r.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\ac3.pf
- from %LOCALAPPDATA%\et audio converter\pf\common audio\is-aef2r.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\aiff.pf
- from %LOCALAPPDATA%\et audio converter\pf\common audio\is-n9un4.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\amr.pf
- from %LOCALAPPDATA%\et audio converter\pf\common audio\is-h2u8q.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\ape.pf
- from %LOCALAPPDATA%\et audio converter\is-2a5v1.tmp to %LOCALAPPDATA%\et audio converter\realquickjoin.dll
- from %LOCALAPPDATA%\et audio converter\pf\common audio\is-j1que.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\au.pf
- from %LOCALAPPDATA%\et audio converter\pf\common audio\is-j0rg8.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\m4a.pf
- from %LOCALAPPDATA%\et audio converter\pf\common audio\is-fbkpc.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\m4b.pf
- from %LOCALAPPDATA%\et audio converter\pf\common audio\is-mfcg8.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\m4r.pf
- from %LOCALAPPDATA%\et audio converter\pf\common audio\is-fo9gt.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\mka.pf
- from %LOCALAPPDATA%\et audio converter\pf\common audio\is-ja2re.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\mp2.pf
- from %LOCALAPPDATA%\et audio converter\pf\common audio\is-2cika.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\mp3.pf
- from %LOCALAPPDATA%\et audio converter\pf\common audio\is-pkv60.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\ogg.pf
- from %LOCALAPPDATA%\et audio converter\pf\common audio\is-g7q8m.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\ra.pf
- from %LOCALAPPDATA%\et audio converter\pf\common audio\is-n4n9e.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\voc.pf
- from %LOCALAPPDATA%\et audio converter\pf\common audio\is-49sdd.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\wav.pf
- from %LOCALAPPDATA%\et audio converter\lang\is-push7.tmp to %LOCALAPPDATA%\et audio converter\lang\feedback.dat
- from %LOCALAPPDATA%\et audio converter\lang\is-i0d9r.tmp to %LOCALAPPDATA%\et audio converter\lang\musictype.txt
- from %LOCALAPPDATA%\et audio converter\lang\is-13jbv.tmp to %LOCALAPPDATA%\et audio converter\lang\audioconverterripper.txt
- from %LOCALAPPDATA%\et audio converter\lang\is-aajso.tmp to %LOCALAPPDATA%\et audio converter\lang\audioconverterripper.dat
- from %LOCALAPPDATA%\et audio converter\is-gd7bc.tmp to %LOCALAPPDATA%\et audio converter\wmadecode.dll
- from %LOCALAPPDATA%\et audio converter\is-c9s2s.tmp to %LOCALAPPDATA%\et audio converter\msvcr71.dll
- from %LOCALAPPDATA%\et audio converter\is-j8u8i.tmp to %LOCALAPPDATA%\et audio converter\musiccd.exe
- from %LOCALAPPDATA%\et audio converter\is-u4sma.tmp to %LOCALAPPDATA%\et audio converter\nvencoderkernel.dll
- from %LOCALAPPDATA%\et audio converter\is-lcuh7.tmp to %LOCALAPPDATA%\et audio converter\ocxhelper.exe
- from %LOCALAPPDATA%\et audio converter\is-i1071.tmp to %LOCALAPPDATA%\et audio converter\pic2m2v.dll
- from %LOCALAPPDATA%\et audio converter\is-6nb0c.tmp to %LOCALAPPDATA%\et audio converter\popcorn.dll
- from %LOCALAPPDATA%\et audio converter\is-slks9.tmp to %LOCALAPPDATA%\et audio converter\popcorn.dll.intermediate.manifest
- from %LOCALAPPDATA%\et audio converter\is-nrhq4.tmp to %LOCALAPPDATA%\et audio converter\postproc-52.dll
- from %LOCALAPPDATA%\et audio converter\is-4r4ah.tmp to %LOCALAPPDATA%\et audio converter\productcontrol.dll
- from %LOCALAPPDATA%\et audio converter\is-g6i4q.tmp to %LOCALAPPDATA%\et audio converter\pthreadgc2.dll
- from %LOCALAPPDATA%\et audio converter\pf\common audio\is-jj22f.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\wma.pf
- from %LOCALAPPDATA%\et audio converter\pf\common audio\is-ibcss.tmp to %LOCALAPPDATA%\et audio converter\pf\common audio\flac.pf
- from %LOCALAPPDATA%\et audio converter\is-qjlhf.tmp to %LOCALAPPDATA%\et audio converter\pthreadvc2.dll
- from %LOCALAPPDATA%\et audio converter\is-5jk5k.tmp to %LOCALAPPDATA%\et audio converter\rmvbencodesync.dll
- from %LOCALAPPDATA%\et audio converter\is-hnp4j.tmp to %LOCALAPPDATA%\et audio converter\simage.dll
- from %LOCALAPPDATA%\et audio converter\is-arn9n.tmp to %LOCALAPPDATA%\et audio converter\soundtouch.dll
- from %LOCALAPPDATA%\et audio converter\is-adgmf.tmp to %LOCALAPPDATA%\et audio converter\ssleay32.dll
- from %LOCALAPPDATA%\et audio converter\is-ro4mj.tmp to %LOCALAPPDATA%\et audio converter\swresample-0.dll
- from %LOCALAPPDATA%\et audio converter\is-ddpoe.tmp to %LOCALAPPDATA%\et audio converter\uitoolkit.dll.intermediate.manifest
- from %LOCALAPPDATA%\et audio converter\is-j607t.tmp to %LOCALAPPDATA%\et audio converter\ve32.dll
- from %LOCALAPPDATA%\et audio converter\is-q8qkf.tmp to %LOCALAPPDATA%\et audio converter\ve64.dll
- from %LOCALAPPDATA%\et audio converter\is-uf8ff.tmp to %LOCALAPPDATA%\et audio converter\wait.gif
- from %LOCALAPPDATA%\et audio converter\is-1d73o.tmp to %LOCALAPPDATA%\et audio converter\webrtc.dll
- from %LOCALAPPDATA%\et audio converter\is-c3vuj.tmp to %LOCALAPPDATA%\et audio converter\msvcp60.dll
- from %LOCALAPPDATA%\et audio converter\is-spta3.tmp to %LOCALAPPDATA%\et audio converter\rmvbencode.dll
- from %LOCALAPPDATA%\et audio converter\is-bkokv.tmp to %LOCALAPPDATA%\et audio converter\etconverterripper.exe
Substitutes the following files
- %LOCALAPPDATA%\et audio converter\lang\audioconverterripper.dat
- %LOCALAPPDATA%\et audio converter\lang\audioconverterripper.txt
- %LOCALAPPDATA%\et audio converter\lang\feedback.dat
- %LOCALAPPDATA%\et audio converter\lang\musictype.txt
- %LOCALAPPDATA%\et audio converter\lang\update.log
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'Tcdaed_ETAC1181FlashFixClass_Tcdaed'
Creates and executes the following
- '%TEMP%\is-g4qnh.tmp\<File name>.tmp' /SL5="$11018C,3646212,54272,<Full path to file>"
- '%LOCALAPPDATA%\et audio converter\etconverterripper.exe' -i
- '%LOCALAPPDATA%\et audio converter\etconverterripper.exe' -s
