Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\multimedia\updatemedia
- <SYSTEM32>\tasks\microsoft\windows\diskdiagnostic\disk performance
Modifies file system
Creates the following files
- %TEMP%\$inst\2.tmp
- %WINDIR%\media\update\syslog.xml
- %TEMP%\is-gdvil.tmp\logo3.png
- %WINDIR%\media\update\setup.bat
- %TEMP%\is-gdvil.tmp\server.png
- %TEMP%\is-gdvil.tmp\installer.png
- %TEMP%\is-gdvil.tmp\icon.png
- %TEMP%\is-gdvil.tmp\eng.png
- %TEMP%\is-gdvil.tmp\rus.png
- %TEMP%\is-gdvil.tmp\botva2.dll
- %TEMP%\is-gdvil.tmp\b2p.dll
- %TEMP%\is-gdvil.tmp\iswin7logo.dll
- %WINDIR%\media\update\updatem.exe
- %WINDIR%\media\update\update.vbs
- %TEMP%\is-gdvil.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-gdvil.tmp\_isetup\_regdll.tmp
- %WINDIR%\temp\sew.bat
- %WINDIR%\temp\diskperf.exe
- %WINDIR%\temp\wbc.xml
- %TEMP%\is-nc842.tmp\lbf3856ad364e35.tmp
- %TEMP%\youtube by click premium\uninstall.ini
- %TEMP%\youtube by click premium\uninstall.exe
- %TEMP%\$inst\0001.tmp
- %TEMP%\sf0ab75af7a5b5c\lbf3856ad364e35.exe
- %TEMP%\sidnrozftm\getidk\nfxtmp.exe
- %TEMP%\fc507me\sv7c\ftest.exe
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\is-gdvil.tmp\_isetup\_setup64.tmp
- %WINDIR%\temp\sew.vbs
Sets the 'hidden' attribute to the following files
- %TEMP%\is-gdvil.tmp\iswin7logo.dll
- %TEMP%\is-gdvil.tmp\b2p.dll
- %TEMP%\is-gdvil.tmp\botva2.dll
- %TEMP%\is-gdvil.tmp\rus.png
- %TEMP%\is-gdvil.tmp\eng.png
- %TEMP%\is-gdvil.tmp\icon.png
- %TEMP%\is-gdvil.tmp\installer.png
- %TEMP%\is-gdvil.tmp\server.png
Deletes the following files
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\0001.tmp
- %TEMP%\$inst\2.tmp
- %WINDIR%\media\update\update.vbs
- %WINDIR%\media\update\syslog.xml
- %WINDIR%\temp\sew.vbs
- %WINDIR%\temp\wbc.xml
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\fc507me\sv7c\ftest.exe' -psystem
- '%TEMP%\sf0ab75af7a5b5c\lbf3856ad364e35.exe'
- '%TEMP%\sidnrozftm\getidk\nfxtmp.exe' -psystem
- '%TEMP%\is-nc842.tmp\lbf3856ad364e35.tmp' /SL5="$300AC,11719914,104960,%TEMP%\sf0ab75af7a5b5c\lbf3856ad364e35.exe"
- '%WINDIR%\syswow64\wscript.exe' "%WINDIR%\Media\Update\update.vbs"
- '%WINDIR%\syswow64\wscript.exe' "%WINDIR%\Temp\sew.vbs"
- '%TEMP%\fc507me\sv7c\ftest.exe' -psystem' (with hidden window)
- '%TEMP%\sidnrozftm\getidk\nfxtmp.exe' -psystem' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\Temp\sew.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\Media\Update\setup.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\Temp\sew.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\Media\Update\setup.bat" "
- '%WINDIR%\syswow64\reg.exe' add "hkey_current_user\software\sysinternals\psexec" /v EulaAccepted /t reg_dword /d 00000001 /f
- '%WINDIR%\syswow64\attrib.exe' +h "%WINDIR%\media\Update"
- '%WINDIR%\syswow64\schtasks.exe' /Create /F /TN "\Microsoft\Windows\DiskDiagnostic\Disk Performance" /xml "%WINDIR%\Temp\wbc.xml"
- '%WINDIR%\syswow64\schtasks.exe' /create /f /tn "\Microsoft\Windows\Multimedia\UpdateMedia" /xml "%WINDIR%\Media\Update\syslog.xml"
- '%WINDIR%\syswow64\timeout.exe' /t 7
- '%WINDIR%\syswow64\timeout.exe' /T 10
