Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\Start MUSICbox.lnk
Modifies file system:
Creates the following files:
- <Current directory>\pcmw7u.exe
- <Current directory>\PCMHelperSvc.tmp.exe
- <Current directory>\pcmw7inst.exe
- %HOMEPATH%\Start Menu\Programs\PCM\MUSICbox\Start MUSICbox.lnk
- %HOMEPATH%\Start Menu\Programs\PCM\MUSICbox\Run MUSICbox Recovery.lnk
- <Current directory>\PCMHelper.log
- <Current directory>\temp.txt
Moves the following files:
- from <Current directory>\PCMHelperSvc.tmp.exe to <Current directory>\PCMHelperSvc.exe
Network activity:
Connects to:
- 'we#.#cmedia.ca':80
- 'se####1.pcmedia.ca':4950
TCP:
HTTP GET requests:
- http://we#.#cmedia.ca/%2FPCMHelper%2FAPP%2FVersions%2FLatest%2Fver%2Ebin
UDP:
- DNS ASK we#.#cmedia.ca
- DNS ASK se####1.pcmedia.ca
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'PCMHelperHiddenMsgWnd' WindowName: 'PCM Helper'
- ClassName: '' WindowName: '<Current directory>\PCMHelperSvc.exe'
Creates and executes the following:
- '<Current directory>\pcmw7u.exe' -l
- '<Current directory>\pcmw7inst.exe' -l -elv
- '<Current directory>\PCMHelperSvc.exe'
