Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Adobe Reader and Acrobat Manager' = '"%CommonProgramFiles%\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\AdobeARM.exe"'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Java(TM) Platform SE Auto Updater' = '"%ProgramFiles%\rapget\jusched.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'BTModemProtection' = '"%ProgramFiles%\scanner\BTModemProtection.exe"'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'BTModemProtection' = '"%ProgramFiles%\MVC\BTModemProtection.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\adobe reader and acrobat manager
- <SYSTEM32>\tasks\java(tm) platform se auto updater
- <SYSTEM32>\tasks\btmodemprotection
- <SYSTEM32>\tasks\windows desktop gadgets
Modifies file system
Creates the following files
- %APPDATA%\mozilla\firefox\plugin-container.exe
- %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\plugin-container.exe
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\~xiideey.tmp
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\adobearm.exe
- %ProgramFiles%\rapget\~zzusubv.tmp
- %ProgramFiles%\rapget\jusched.exe
- %ProgramFiles%\scanner\~etztafr.tmp
- %ProgramFiles%\scanner\btmodemprotection.exe
- %ProgramFiles%\mvc\~lpmnlgm.tmp
- %ProgramFiles%\mvc\btmodemprotection.exe
- %ProgramFiles%\fptrayproc\~fnmffkc.tmp
- %ProgramFiles%\fptrayproc\sidebar.exe
- %APPDATA%\mozilla\firefox\profiles\~spxpyri.tmp
- %APPDATA%\mozilla\firefox\profiles\ati2s9ag.exe
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\~leauqrf.tmp
Deletes the following files
- %APPDATA%\mozilla\firefox\plugin-container.exe
- %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\plugin-container.exe
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\~xiideey.tmp
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\adobearm.exe
- %ProgramFiles%\rapget\~zzusubv.tmp
- %ProgramFiles%\rapget\jusched.exe
- %ProgramFiles%\scanner\~etztafr.tmp
- %ProgramFiles%\scanner\btmodemprotection.exe
- %ProgramFiles%\mvc\~lpmnlgm.tmp
- %ProgramFiles%\mvc\btmodemprotection.exe
- %ProgramFiles%\fptrayproc\~fnmffkc.tmp
- %ProgramFiles%\fptrayproc\sidebar.exe
- %APPDATA%\mozilla\firefox\profiles\~spxpyri.tmp
- %APPDATA%\mozilla\firefox\profiles\ati2s9ag.exe
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\~leauqrf.tmp
Substitutes the following files
- %APPDATA%\mozilla\firefox\plugin-container.exe
- %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\plugin-container.exe
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\adobearm.exe
- %ProgramFiles%\rapget\jusched.exe
- %ProgramFiles%\scanner\btmodemprotection.exe
- %ProgramFiles%\mvc\btmodemprotection.exe
- %ProgramFiles%\fptrayproc\sidebar.exe
- %APPDATA%\mozilla\firefox\profiles\ati2s9ag.exe
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C DIR /A:D /S /B *' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 25 /TN "Adobe Reader and Acrobat Manager" /TR "\"%CommonProgramFiles%\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\AdobeARM.exe\""' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 29 /TN "Java(TM) Platform SE Auto Updater" /TR "\"%ProgramFiles%\rapget\jusched.exe\""' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 28 /TN "BTModemProtection" /TR "\"%ProgramFiles%\scanner\BTModemProtection.exe\""' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 11 /TN "BTModemProtection" /TR "\"%ProgramFiles%\MVC\BTModemProtection.exe\""' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /CREATE /F /SC ONLOGON /TN "Windows Desktop Gadgets" /TR "\"%ProgramFiles%\fptrayproc\sidebar.exe\""' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 12 /TN "Adobe Reader and Acrobat Manager" /TR "\"%CommonProgramFiles%\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\AdobeARM.exe\""' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 23 /TN "Java(TM) Platform SE Auto Updater" /TR "\"%ProgramFiles%\rapget\jusched.exe\""' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 27 /TN "BTModemProtection" /TR "\"%ProgramFiles%\scanner\BTModemProtection.exe\""' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C DIR /A:D /S /B *
- '<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 25 /TN "Adobe Reader and Acrobat Manager" /TR "\"%CommonProgramFiles%\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\AdobeARM.exe\""
- '<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 29 /TN "Java(TM) Platform SE Auto Updater" /TR "\"%ProgramFiles%\rapget\jusched.exe\""
- '<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 28 /TN "BTModemProtection" /TR "\"%ProgramFiles%\scanner\BTModemProtection.exe\""
- '<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 11 /TN "BTModemProtection" /TR "\"%ProgramFiles%\MVC\BTModemProtection.exe\""
- '<SYSTEM32>\schtasks.exe' /CREATE /F /SC ONLOGON /TN "Windows Desktop Gadgets" /TR "\"%ProgramFiles%\fptrayproc\sidebar.exe\""
- '<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 12 /TN "Adobe Reader and Acrobat Manager" /TR "\"%CommonProgramFiles%\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\AdobeARM.exe\""
- '<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 23 /TN "Java(TM) Platform SE Auto Updater" /TR "\"%ProgramFiles%\rapget\jusched.exe\""
- '<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 27 /TN "BTModemProtection" /TR "\"%ProgramFiles%\scanner\BTModemProtection.exe\""
