Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\DeskSpace.lnk
Malicious functions:
Creates and executes the following:
- '%TEMP%\$AlgTemp772866$\deskspace.exe'
Installs hooks to intercept notifications
on keystrokes:
- Handler for all processes: %TEMP%\$AlgTemp772866$\otomoinput1589.dll
Modifies file system :
Creates the following files:
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Information\Picture\Desktop 2.ico
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Information\Picture\Desktop 2.png
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Information\Picture\Desktop 3.ico
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Information\Picture\Desktop 1.png
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Information\Picture\DeskSpace.ico
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Information\Picture\DeskSpace.png
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Information\Picture\Desktop 1.ico
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Information\Picture\Desktop 3.png
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Information\Picture\Desktop 6.ico
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Information\Picture\Desktop 6.png
- %TEMP%\$AlgTemp772866$\Resources\Localization\Language\English (UK).lng
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Information\Picture\Desktop 5.png
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Information\Picture\Desktop 4.ico
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Information\Picture\Desktop 4.png
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Information\Picture\Desktop 5.ico
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Background\Picture\Desktop 2.jpg
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Background\Picture\Desktop 3.jpg
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Background\Picture\Desktop 4.jpg
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Background\Picture\Desktop 1.jpg
- %TEMP%\$AlgTemp772866$\Resources\Application\QuickSetupDisplayQualityNone.jpg
- %TEMP%\$AlgTemp772866$\Resources\Application\QuickSetupDisplayQualityVeryHigh.jpg
- %TEMP%\$AlgTemp772866$\Resources\Application\ApplicationInstructions.avi
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Background\Picture\Desktop 5.jpg
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Background\Sky Box\Green Beach\left.jpg
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Background\Sky Box\Green Beach\right.jpg
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Background\Sky Box\Green Beach\top.jpg
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Background\Sky Box\Green Beach\front.jpg
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Background\Picture\Desktop 6.jpg
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Background\Sky Box\Green Beach\back.jpg
- %TEMP%\$AlgTemp772866$\Resources\Desktop\Background\Sky Box\Green Beach\bottom.jpg
- %APPDATA%\OtakuSoftware\DeskSpace\DesktopIcon\DesktopIconDesktop5Configuration.cfg
- %APPDATA%\OtakuSoftware\DeskSpace\DesktopIcon\DesktopIconDesktop6Configuration.cfg
- %APPDATA%\OtakuSoftware\DeskSpace\DesktopInformation\DesktopInformationDesktop1Configuration.cfg
- %APPDATA%\OtakuSoftware\DeskSpace\DesktopIcon\DesktopIconDesktop4Configuration.cfg
- %APPDATA%\OtakuSoftware\DeskSpace\DesktopIcon\DesktopIconDesktop1Configuration.cfg
- %APPDATA%\OtakuSoftware\DeskSpace\DesktopIcon\DesktopIconDesktop2Configuration.cfg
- %APPDATA%\OtakuSoftware\DeskSpace\DesktopIcon\DesktopIconDesktop3Configuration.cfg
- %APPDATA%\OtakuSoftware\DeskSpace\DesktopInformation\DesktopInformationDesktop2Configuration.cfg
- %APPDATA%\OtakuSoftware\DeskSpace\View\OSD\ViewOSDConfiguration.cfg
- %APPDATA%\OtakuSoftware\DeskSpace\SystemTray\SystemTrayIcon.cfg
- %APPDATA%\OtakuSoftware\DeskSpace\SystemTray\SystemTrayMenu.cfg
- %APPDATA%\OtakuSoftware\DeskSpace\DesktopInformation\DesktopInformationDesktop6Configuration.cfg
- %APPDATA%\OtakuSoftware\DeskSpace\DesktopInformation\DesktopInformationDesktop3Configuration.cfg
- %APPDATA%\OtakuSoftware\DeskSpace\DesktopInformation\DesktopInformationDesktop4Configuration.cfg
- %APPDATA%\OtakuSoftware\DeskSpace\DesktopInformation\DesktopInformationDesktop5Configuration.cfg
- %APPDATA%\OtakuSoftware\DeskSpace\deskspace.cfg
- %APPDATA%\OtakuSoftware\DeskSpace\Server\Startup\Startup.cfg
- %APPDATA%\OtakuSoftware\DeskSpace\Server\Monitor\MonitorState.cfg
- %TEMP%\$AlgTemp772866$\ProgStart.name
- %TEMP%\$AlgTemp772866$\Resources\Localization\Language\Russian (RU).lng
- %TEMP%\$AlgTemp772866$\Resources\Localization\Picture\English (UK).ico
- %TEMP%\$AlgTemp772866$\Resources\Localization\Picture\Russian (RU).ico
- %APPDATA%\OtakuSoftware\DeskSpace\Server\Localization\Localization.cfg
- %APPDATA%\OtakuSoftware\DeskSpace\DesktopWindow\DesktopWindowDraggingConfiguration.cfg
- %APPDATA%\OtakuSoftware\DeskSpace\DesktopWindow\DesktopWindowAdvancedConfiguration.cfg
- %APPDATA%\OtakuSoftware\DeskSpace\DesktopIcon\DesktopIconManagementConfiguration.cfg
- %APPDATA%\OtakuSoftware\DeskSpace\DesktopWindow\DesktopWindowTaskbarConfiguration.cfg
- %APPDATA%\OtakuSoftware\DeskSpace\DesktopConfiguration.cfg
- %APPDATA%\OtakuSoftware\DeskSpace\Server\Graphics\GraphicsAdvanced.cfg
- %APPDATA%\OtakuSoftware\DeskSpace\DesktopWindow\DesktopWindowCompatibilityConfiguration.cfg
- %TEMP%\$AlgTemp772866$\Resources\Application\QuickSetupDisplayQualityMedium.jpg
- %TEMP%\$AlgTemp772866$\Help\images\configure_general_options_mouse.jpg
- %TEMP%\$AlgTemp772866$\Help\images\configure_general_options_zoom.jpg
- %TEMP%\$AlgTemp772866$\Help\images\configure_language.jpg
- %TEMP%\$AlgTemp772866$\Help\images\configure_general_options_hot_keys.jpg
- %TEMP%\$AlgTemp772866$\Help\images\configure_advanced_window_options.jpg
- %TEMP%\$AlgTemp772866$\Help\images\configure_general_options_activation.jpg
- %TEMP%\$AlgTemp772866$\Help\images\configure_general_options_display.jpg
- %TEMP%\$AlgTemp772866$\Help\images\configure_on_screen_display.jpg
- %TEMP%\$AlgTemp772866$\Help\images\configure_window_dragging.jpg
- %TEMP%\$AlgTemp772866$\Help\images\cube.jpg
- %TEMP%\$AlgTemp772866$\Help\images\deskspace.gif
- %TEMP%\$AlgTemp772866$\Help\images\configure_window_compatibility.jpg
- %TEMP%\$AlgTemp772866$\Help\images\configure_startup.jpg
- %TEMP%\$AlgTemp772866$\Help\images\configure_system_tray_icons.jpg
- %TEMP%\$AlgTemp772866$\Help\images\configure_system_tray_menu.jpg
- %TEMP%\$AlgTemp772866$\Help\configuring_deskspace.html
- %TEMP%\$AlgTemp772866$\Help\getting_started.html
- %TEMP%\$AlgTemp772866$\Help\index.html
- %TEMP%\$AlgTemp772866$\otomowindow1589.dll
- %TEMP%\$AlgTemp772866$\deskspace.exe
- %TEMP%\$AlgTemp772866$\otomodesktop1589.dll
- %TEMP%\$AlgTemp772866$\otomoinput1589.dll
- %TEMP%\$AlgTemp772866$\Help\managing_desktops.html
- %TEMP%\$AlgTemp772866$\Help\css\blueprint\screen.css
- %TEMP%\$AlgTemp772866$\Help\images\activation.jpg
- %TEMP%\$AlgTemp772866$\Help\images\configure_advanced_display_options.jpg
- %TEMP%\$AlgTemp772866$\Help\css\blueprint\print.css
- %TEMP%\$AlgTemp772866$\Help\using_deskspace.html
- %TEMP%\$AlgTemp772866$\Help\css\otaku.css
- %TEMP%\$AlgTemp772866$\Help\css\blueprint\ie.css
- %TEMP%\$AlgTemp772866$\Resources\Application\GettingStartedDeskSpaceSystemTrayMenuDragAndDrop.jpg
- %TEMP%\$AlgTemp772866$\Resources\Application\GettingStartedDeskSpaceSystemTrayMenuManage.jpg
- %TEMP%\$AlgTemp772866$\Resources\Application\GettingStartedDeskSpaceSystemTrayMenuSwitchToDesktop.jpg
- %TEMP%\$AlgTemp772866$\Resources\Application\GettingStartedDeskSpaceSystemTrayMenuConfigure.jpg
- %TEMP%\$AlgTemp772866$\Resources\Application\ApplicationLogo.png
- %TEMP%\$AlgTemp772866$\Resources\Application\GettingStartedDeskSpaceSystemTrayIconActivateDesktopCube.jpg
- %TEMP%\$AlgTemp772866$\Resources\Application\GettingStartedDeskSpaceSystemTrayIconDisplaySystemTrayMenu.jpg
- %TEMP%\$AlgTemp772866$\Resources\Application\GettingStartedDeskSpaceSystemTrayMenuSwitchToWindow.jpg
- %TEMP%\$AlgTemp772866$\Resources\Application\GettingStartedDesktopSystemTrayIconSwitchToDesktop.jpg
- %TEMP%\$AlgTemp772866$\Resources\Application\QuickSetupDisplayQualityHigh.jpg
- %TEMP%\$AlgTemp772866$\Resources\Application\QuickSetupDisplayQualityLow.jpg
- %TEMP%\$AlgTemp772866$\Resources\Application\GettingStartedDesktopSystemTrayIconDisplaySystemTrayMenu.jpg
- %TEMP%\$AlgTemp772866$\Resources\Application\GettingStartedDesktopCubeActivation.jpg
- %TEMP%\$AlgTemp772866$\Resources\Application\GettingStartedDesktopCubeNavigation.jpg
- %TEMP%\$AlgTemp772866$\Resources\Application\GettingStartedDesktopInstantSwitch.jpg
- %TEMP%\$AlgTemp772866$\Help\images\manage_desktop_icons.jpg
- %TEMP%\$AlgTemp772866$\Help\images\manage_desktop_names_and_pictures.jpg
- %TEMP%\$AlgTemp772866$\Help\images\manage_desktop_taskbar.jpg
- %TEMP%\$AlgTemp772866$\Help\images\manage_desktop_backgrounds.jpg
- %TEMP%\$AlgTemp772866$\Help\images\help_quick_setup.jpg
- %TEMP%\$AlgTemp772866$\Help\images\help_troubleshooting.jpg
- %TEMP%\$AlgTemp772866$\Help\images\manage_desktop_application_assignment.jpg
- %TEMP%\$AlgTemp772866$\Help\images\system_tray_icons.jpg
- %TEMP%\$AlgTemp772866$\Help\images\window_dragging.jpg
- %TEMP%\$AlgTemp772866$\Help\images\window_title_bar.png
- %TEMP%\$AlgTemp772866$\Resources\Application\ApplicationAlreadyRunningSystemTray.jpg
- %TEMP%\$AlgTemp772866$\Help\images\system_tray_menu_show_desktop_cube.jpg
- %TEMP%\$AlgTemp772866$\Help\images\system_tray_menu.jpg
- %TEMP%\$AlgTemp772866$\Help\images\system_tray_menu_configure.jpg
- %TEMP%\$AlgTemp772866$\Help\images\system_tray_menu_manage.jpg
Deletes the following files:
- <SYSTEM32>\d3d8caps.dat
Moves the following files:
- from <SYSTEM32>\d3d8caps.tmp to <SYSTEM32>\d3d8caps.dat
Miscellaneous:
Searches for the following windows:
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
