Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\jpsfile\shell\open\command] '' = '"<SYSTEM32>\NvStView.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\pnsfile\shell\open\command] '' = '"<SYSTEM32>\NvStView.exe" "%1"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'NVStereoReg' = '<SYSTEM32>\nvstreg.exe <SYSTEM32>\nvstdef.reg <SYSTEM32>\oglstreg.reg'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- [<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
Modifies file system:
Creates the following files:
- %TEMP%\ext2.tmp
- %TEMP%\pft3~tmp\setup.log
- %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\skin2d8e.rra
- %TEMP%\ispr2d5f.rra
- %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\_IsR26c8.rra
- %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\defa2699.rra
- %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\isrt265a.rra
- %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\Stri262b.rra
- <SYSTEM32>\SET9.tmp
- %WINDIR%\inf\SET8.tmp
- %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\core259f.rra
- %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\_ISU2522.rra
- %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\NvIn24c4.rra
- %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\IsBk2495.rra
- %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\setu2457.rra
- %TEMP%\1ff2.rra
- %TEMP%\{0FAD0B5D-2807-4AEA-B179-18516C43ADA0}\setup.ini
- %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\Font25fc.rra
- %TEMP%\pft3~tmp\nvImage.dll
- <SYSTEM32>\SETA.tmp
- %WINDIR%\security\tmp.edb
- %WINDIR%\security\edb.log
- %WINDIR%\security\res1.log
- %WINDIR%\security\res2.log
- %WINDIR%\security\edbtmp.log
- <SYSTEM32>\SET17.tmp
- <SYSTEM32>\SET16.tmp
- <SYSTEM32>\SET15.tmp
- <SYSTEM32>\SET14.tmp
- <SYSTEM32>\SET13.tmp
- <SYSTEM32>\SET12.tmp
- <SYSTEM32>\SET11.tmp
- <SYSTEM32>\SET10.tmp
- <SYSTEM32>\SETF.tmp
- <SYSTEM32>\SETE.tmp
- <SYSTEM32>\SETD.tmp
- <SYSTEM32>\SETC.tmp
- %TEMP%\{0FAD0B5D-2807-4AEA-B179-18516C43ADA0}\_Setup.dll
- %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\dotn25ce.rra
- %TEMP%\pft3~tmp\_setup.dll
- %TEMP%\pft3~tmp\setup.iss
- %TEMP%\pft3~tmp\setup.isn
- %TEMP%\pft3~tmp\3D Vision Experience\Left 4 Dead - 1 - ESRB M PEGI 18+.jps
- %TEMP%\pft3~tmp\data1.hdr
- %TEMP%\pft3~tmp\data1.cab
- %TEMP%\pft3~tmp\3D Vision Experience\Tomb Raider Underworld - 4 - ESRB T PEGI 12+.jps
- %TEMP%\pft3~tmp\3D Vision Experience\Tomb Raider Underworld - 2 - ESRB T PEGI 12+.jps
- %TEMP%\pft3~tmp\3D Vision Experience\Medusa - 2 - ESRB T PEGI 12+.jps
- %TEMP%\pft3~tmp\3D Vision Experience\Medusa - 1 - ESRB T PEGI 12+.jps
- %TEMP%\pft3~tmp\3D Vision Experience\Left 4 Dead - 3 - ESRB M PEGI 18+.jps
- %TEMP%\pft3~tmp\3D Vision Experience\Guitar Hero 3 - 2 - ESRB T PEGI 12+.jps
- %TEMP%\pft3~tmp\ISSetup.dll
- %TEMP%\pft3~tmp\3D Vision Experience\Guitar Hero 3 - 1 - ESRB T PEGI 12+.jps
- %TEMP%\pft3~tmp\3D Vision Experience\Devil May Crry 4 - 2 - ESRB T PEGI 12+.jps
- %TEMP%\pft3~tmp\3D Vision Experience\Devil May Crry 4 - 1 - ESRB T PEGI 12+.jps
- %TEMP%\pft3~tmp\3D Vision Experience\Burnout Paradise - 2 - ESRB E PEGI 7+.jps
- %TEMP%\pft3~tmp\3D Vision Experience\Burnout Paradise - 1 - ESRB E PEGI 7+.jps
- %TEMP%\pft3~tmp\pftw1.pkg
- %TEMP%\plf1.tmp
- %WINDIR%\security\edb.chk
- <SYSTEM32>\SETB.tmp
- %TEMP%\pft3~tmp\layout.bin
- %TEMP%\pft3~tmp\NvSCPAPI64.dll
- %TEMP%\pft3~tmp\data2.cab
- %TEMP%\pft3~tmp\setup.inx
- %TEMP%\pft3~tmp\setup.ini
- %TEMP%\pft3~tmp\setup.exe
- %TEMP%\pft3~tmp\OGLStReg.reg
- %TEMP%\pft3~tmp\NVStWiz.exe
- %TEMP%\pft3~tmp\NvStView.exe
- %TEMP%\pft3~tmp\NvStTest.Exe
- %TEMP%\pft3~tmp\NvStRes.dll
- %TEMP%\pft3~tmp\nvStReg.exe
- %TEMP%\pft3~tmp\nvstlink.exe
- %TEMP%\pft3~tmp\nvStInst.exe
- %TEMP%\pft3~tmp\nvStereoApiI64.dll
- %TEMP%\pft3~tmp\nvStereoApiI.dll
- %TEMP%\pft3~tmp\NVSTEREO.INF
- %TEMP%\pft3~tmp\NvStDef.reg
- %TEMP%\pft3~tmp\nvSCPAPISvr.exe
- %TEMP%\pft3~tmp\NvSCPAPI.dll
- %WINDIR%\security\logs\scecomp.log
Deletes the following files:
- %TEMP%\ext2.tmp
- %TEMP%\pft3~tmp\pftw1.pkg
- %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\skin2d8e.rra
Moves the following files:
- from %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\setu2457.rra to %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\setup.inx
- from <SYSTEM32>\SET16.tmp to <SYSTEM32>\nvstlink.exe
- from <SYSTEM32>\SET15.tmp to <SYSTEM32>\nvstwiz.exe
- from <SYSTEM32>\SET14.tmp to <SYSTEM32>\nvStInst.exe
- from <SYSTEM32>\SET13.tmp to <SYSTEM32>\nvStereoApiI64.dll
- from <SYSTEM32>\SET12.tmp to <SYSTEM32>\nvStereoApiI.dll
- from <SYSTEM32>\SET11.tmp to <SYSTEM32>\nvSCPAPI64.dll
- from <SYSTEM32>\SET10.tmp to <SYSTEM32>\nvSCPAPI.dll
- from <SYSTEM32>\SETF.tmp to <SYSTEM32>\nvstdef.reg
- from <SYSTEM32>\SETE.tmp to <SYSTEM32>\oglstreg.reg
- from <SYSTEM32>\SETD.tmp to <SYSTEM32>\nvstreg.exe
- from <SYSTEM32>\SETC.tmp to <SYSTEM32>\nvimage.dll
- from <SYSTEM32>\SETB.tmp to <SYSTEM32>\nvsttest.exe
- from <SYSTEM32>\SETA.tmp to <SYSTEM32>\nvstres.dll
- from <SYSTEM32>\SET9.tmp to <SYSTEM32>\nvstview.exe
- from %WINDIR%\inf\SET8.tmp to %WINDIR%\inf\nvstereo.inf
- from %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\_IsR26c8.rra to %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\_IsRes.dll
- from %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\defa2699.rra to %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\default.pal
- from %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\isrt265a.rra to %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\isrt.dll
- from %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\Stri262b.rra to %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\StringTable-0009-English.ips
- from %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\Font25fc.rra to %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\FontData.ini
- from %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\dotn25ce.rra to %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\dotnetinstaller.exe
- from %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\core259f.rra to %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\corecomp.ini
- from %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\_ISU2522.rra to %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\_ISUser.dll
- from %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\NvIn24c4.rra to %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\NvInstNT.dll
- from %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\IsBk2495.rra to %TEMP%\{2DDE9934-9AEC-4D2C-8D27-31D1F540C6CE}\{13c5d420-cae2-11d4-b34d-00105a1c23dd}\IsBkgd.bmp
- from <SYSTEM32>\SET17.tmp to <SYSTEM32>\nvSCPAPISvr.exe
- from %WINDIR%\security\edbtmp.log to %WINDIR%\security\edb.log
Substitutes the following files:
- %WINDIR%\security\edbtmp.log
Miscellaneous:
Creates and executes the following:
- '%TEMP%\pft3~tmp\setup.exe' -i -s
- '%TEMP%\pft3~tmp\nvStInst.exe' /check /srcdir=%TEMP%\pft3~tmp\
- '<SYSTEM32>\nvstreg.exe' <SYSTEM32>\nvstdef.reg <SYSTEM32>\oglstreg.reg
Executes the following:
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\SETUPAPI.DLL,InstallHinfSection DefaultInstall.NT 132 %TEMP%\pft3~tmp\NVSTEREO.INF
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\grpconv.exe' -o
