Technical Information
Malicious functions
Injects code into
the following user processes:
- urmain.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'FileMonClass', WindowName: ''
- ClassName: 'RegMonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\yusetup2010.exe
- %TEMP%\is-1jhjd.tmp\is-9mnf4.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\is-gimus.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\is-uce5m.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\templates\is-lp7pm.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\templates\is-f2tjb.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\templates\is-tlvrh.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\templates\is-6f781.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\templates\is-h5k15.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\templates\is-5a1fr.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\templates\is-b426k.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\templates\is-k92t8.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\templates\is-uu097.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\templates\is-mgi2r.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\templates\is-mn5pe.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\templates\is-5idtj.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\is-8s8ri.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\is-en3be.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\unins000.dat
- %ProgramFiles(x86)%\your uninstaller 2010\is-e8i8t.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\unins000.msg
- %HOMEPATH%\desktop\your unin-staller!.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\your uninstaller 2010\visit our site.url
- %PROGRAMDATA%\microsoft\windows\start menu\programs\your uninstaller 2010\uninstall.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\your uninstaller 2010\help document.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\your uninstaller 2010\your uninstaller! - hunter mode.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\your uninstaller 2010\your uninstaller!.lnk
- %ProgramFiles(x86)%\your uninstaller 2010\is-q261h.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\is-pj1f5.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\is-nuhph.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\is-qmj29.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\is-j4haf.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\is-itqfv.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\is-7oicn.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\is-crv3g.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\templates\is-3mjt3.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\is-aii20.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\templates\is-ui2ek.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\languages\is-b293o.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\languages\is-57mfn.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\languages\is-ntuqn.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\languages\is-btbjb.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\languages\is-bml5n.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\languages\is-e8cl2.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\languages\is-tbccc.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\languages\is-m9erg.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\is-phi35.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\is-258nh.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\is-lpijs.tmp
- %TEMP%\is-1jhjd.tmp\is-a3euc.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\is-thbfh.tmp
- %TEMP%\is-1jhjd.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-1jhjd.tmp\_isetup\_setup64.tmp
- %TEMP%\is-7oej4.tmp\yusetup2010.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\languages\is-9iaa0.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\languages\is-3mljk.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\templates\is-0bu5b.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\languages\is-aaof8.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\templates\is-oe4s1.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\languages\is-uhrpd.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\languages\is-4rtv5.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\languages\is-t5kko.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\languages\is-dlhpa.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\languages\is-psfdf.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\languages\is-9fe8i.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\languages\is-nuvg1.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\languages\is-ssrs5.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\languages\is-9a8p1.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\languages\is-2pb6l.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\languages\is-8frve.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\languages\is-el0vr.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\languages\is-oivec.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\languages\is-pa4mo.tmp
- %ProgramFiles(x86)%\your uninstaller 2010\templates\is-kn016.tmp
- %APPDATA%\ursoft\your uninstaller\uruninstaller.ini
Deletes the following files
- %PROGRAMDATA%\microsoft\windows\start menu\programs\your uninstaller 2010\your uninstaller! - hunter mode.lnk
- %TEMP%\is-1jhjd.tmp\pskill.exe
- %TEMP%\is-1jhjd.tmp\pintaskbar.vbs
- %TEMP%\is-1jhjd.tmp\_isetup\_setup64.tmp
- %TEMP%\is-1jhjd.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-7oej4.tmp\yusetup2010.tmp
- %TEMP%\7zipsfx.000\yusetup2010.exe
Moves the following files
- from %ProgramFiles(x86)%\your uninstaller 2010\is-thbfh.tmp to %ProgramFiles(x86)%\your uninstaller 2010\unins000.exe
- from %ProgramFiles(x86)%\your uninstaller 2010\templates\is-3mjt3.tmp to %ProgramFiles(x86)%\your uninstaller 2010\templates\proginfo_en.tpl
- from %ProgramFiles(x86)%\your uninstaller 2010\templates\is-5idtj.tmp to %ProgramFiles(x86)%\your uninstaller 2010\templates\proginfo_fr.tpl
- from %ProgramFiles(x86)%\your uninstaller 2010\templates\is-mn5pe.tmp to %ProgramFiles(x86)%\your uninstaller 2010\templates\proginfo_hu.tpl
- from %ProgramFiles(x86)%\your uninstaller 2010\templates\is-mgi2r.tmp to %ProgramFiles(x86)%\your uninstaller 2010\templates\proginfo_it.tpl
- from %ProgramFiles(x86)%\your uninstaller 2010\templates\is-uu097.tmp to %ProgramFiles(x86)%\your uninstaller 2010\templates\proginfo_ko.tpl
- from %ProgramFiles(x86)%\your uninstaller 2010\templates\is-k92t8.tmp to %ProgramFiles(x86)%\your uninstaller 2010\templates\proginfo_pl.tpl
- from %ProgramFiles(x86)%\your uninstaller 2010\templates\is-b426k.tmp to %ProgramFiles(x86)%\your uninstaller 2010\templates\proginfo_pt.tpl
- from %ProgramFiles(x86)%\your uninstaller 2010\templates\is-5a1fr.tmp to %ProgramFiles(x86)%\your uninstaller 2010\templates\proginfo_ru.tpl
- from %ProgramFiles(x86)%\your uninstaller 2010\templates\is-h5k15.tmp to %ProgramFiles(x86)%\your uninstaller 2010\templates\proginfo_sp.tpl
- from %ProgramFiles(x86)%\your uninstaller 2010\templates\is-6f781.tmp to %ProgramFiles(x86)%\your uninstaller 2010\templates\proginfo_tr.tpl
- from %ProgramFiles(x86)%\your uninstaller 2010\templates\is-tlvrh.tmp to %ProgramFiles(x86)%\your uninstaller 2010\templates\proginfo_tw.tpl
- from %ProgramFiles(x86)%\your uninstaller 2010\templates\is-f2tjb.tmp to %ProgramFiles(x86)%\your uninstaller 2010\templates\proginfo_uk.tpl
- from %ProgramFiles(x86)%\your uninstaller 2010\languages\is-aaof8.tmp to %ProgramFiles(x86)%\your uninstaller 2010\languages\italian.lng
- from %ProgramFiles(x86)%\your uninstaller 2010\templates\is-lp7pm.tmp to %ProgramFiles(x86)%\your uninstaller 2010\templates\proginfo_vn.tpl
- from %ProgramFiles(x86)%\your uninstaller 2010\is-gimus.tmp to %ProgramFiles(x86)%\your uninstaller 2010\crosshair.ani
- from %TEMP%\is-1jhjd.tmp\is-9mnf4.tmp to %TEMP%\is-1jhjd.tmp\pintaskbar.vbs
- from %ProgramFiles(x86)%\your uninstaller 2010\is-8s8ri.tmp to %ProgramFiles(x86)%\your uninstaller 2010\autoupdater.exe
- from %ProgramFiles(x86)%\your uninstaller 2010\is-aii20.tmp to %ProgramFiles(x86)%\your uninstaller 2010\autoupdater.exe.manifest
- from %ProgramFiles(x86)%\your uninstaller 2010\is-en3be.tmp to %ProgramFiles(x86)%\your uninstaller 2010\skipfilenames.dat
- from %ProgramFiles(x86)%\your uninstaller 2010\is-e8i8t.tmp to %ProgramFiles(x86)%\your uninstaller 2010\fos.exe
- from %ProgramFiles(x86)%\your uninstaller 2010\is-crv3g.tmp to %ProgramFiles(x86)%\your uninstaller 2010\fos.exe.manifest
- from %ProgramFiles(x86)%\your uninstaller 2010\is-7oicn.tmp to %ProgramFiles(x86)%\your uninstaller 2010\license.rtf
- from %ProgramFiles(x86)%\your uninstaller 2010\is-itqfv.tmp to %ProgramFiles(x86)%\your uninstaller 2010\update.ini
- from %ProgramFiles(x86)%\your uninstaller 2010\is-j4haf.tmp to %ProgramFiles(x86)%\your uninstaller 2010\uruninstaller.ini
- from %ProgramFiles(x86)%\your uninstaller 2010\is-qmj29.tmp to %ProgramFiles(x86)%\your uninstaller 2010\vcl70.bpl
- from %ProgramFiles(x86)%\your uninstaller 2010\is-nuhph.tmp to %ProgramFiles(x86)%\your uninstaller 2010\rtl70.bpl
- from %ProgramFiles(x86)%\your uninstaller 2010\templates\is-kn016.tmp to %ProgramFiles(x86)%\your uninstaller 2010\templates\proginfo_cn.tpl
- from %ProgramFiles(x86)%\your uninstaller 2010\templates\is-ui2ek.tmp to %ProgramFiles(x86)%\your uninstaller 2010\templates\proginfo_da.tpl
- from %ProgramFiles(x86)%\your uninstaller 2010\templates\is-0bu5b.tmp to %ProgramFiles(x86)%\your uninstaller 2010\templates\proginfo_bg.tpl
- from %ProgramFiles(x86)%\your uninstaller 2010\templates\is-oe4s1.tmp to %ProgramFiles(x86)%\your uninstaller 2010\templates\proginfo_ar.tpl
- from %ProgramFiles(x86)%\your uninstaller 2010\languages\is-uhrpd.tmp to %ProgramFiles(x86)%\your uninstaller 2010\languages\vietnamese.lng
- from %ProgramFiles(x86)%\your uninstaller 2010\is-lpijs.tmp to %ProgramFiles(x86)%\your uninstaller 2010\inimerge.exe
- from %ProgramFiles(x86)%\your uninstaller 2010\is-258nh.tmp to %ProgramFiles(x86)%\your uninstaller 2010\urmain.exe
- from %ProgramFiles(x86)%\your uninstaller 2010\is-phi35.tmp to %ProgramFiles(x86)%\your uninstaller 2010\uninstaller.chm
- from %ProgramFiles(x86)%\your uninstaller 2010\languages\is-m9erg.tmp to %ProgramFiles(x86)%\your uninstaller 2010\languages\arabic.lng
- from %ProgramFiles(x86)%\your uninstaller 2010\languages\is-tbccc.tmp to %ProgramFiles(x86)%\your uninstaller 2010\languages\belarusian.lng
- from %ProgramFiles(x86)%\your uninstaller 2010\languages\is-e8cl2.tmp to %ProgramFiles(x86)%\your uninstaller 2010\languages\bulgarian.lng
- from %ProgramFiles(x86)%\your uninstaller 2010\languages\is-bml5n.tmp to %ProgramFiles(x86)%\your uninstaller 2010\languages\czech.lng
- from %ProgramFiles(x86)%\your uninstaller 2010\languages\is-btbjb.tmp to %ProgramFiles(x86)%\your uninstaller 2010\languages\danish.lng
- from %ProgramFiles(x86)%\your uninstaller 2010\languages\is-ntuqn.tmp to %ProgramFiles(x86)%\your uninstaller 2010\languages\dutch.lng
- from %ProgramFiles(x86)%\your uninstaller 2010\languages\is-57mfn.tmp to %ProgramFiles(x86)%\your uninstaller 2010\languages\english.lng
- from %ProgramFiles(x86)%\your uninstaller 2010\languages\is-9iaa0.tmp to %ProgramFiles(x86)%\your uninstaller 2010\languages\french.lng
- from %ProgramFiles(x86)%\your uninstaller 2010\languages\is-b293o.tmp to %ProgramFiles(x86)%\your uninstaller 2010\languages\german.lng
- from %ProgramFiles(x86)%\your uninstaller 2010\is-pj1f5.tmp to %ProgramFiles(x86)%\your uninstaller 2010\vclx70.bpl
- from %ProgramFiles(x86)%\your uninstaller 2010\is-uce5m.tmp to %ProgramFiles(x86)%\your uninstaller 2010\diskclean.ico
- from %ProgramFiles(x86)%\your uninstaller 2010\languages\is-3mljk.tmp to %ProgramFiles(x86)%\your uninstaller 2010\languages\hungarian.lng
- from %ProgramFiles(x86)%\your uninstaller 2010\languages\is-oivec.tmp to %ProgramFiles(x86)%\your uninstaller 2010\languages\korean_001.lng
- from %ProgramFiles(x86)%\your uninstaller 2010\languages\is-el0vr.tmp to %ProgramFiles(x86)%\your uninstaller 2010\languages\norwegian.lng
- from %ProgramFiles(x86)%\your uninstaller 2010\languages\is-8frve.tmp to %ProgramFiles(x86)%\your uninstaller 2010\languages\polish.lng
- from %ProgramFiles(x86)%\your uninstaller 2010\languages\is-2pb6l.tmp to %ProgramFiles(x86)%\your uninstaller 2010\languages\portugues.lng
- from %ProgramFiles(x86)%\your uninstaller 2010\languages\is-9a8p1.tmp to %ProgramFiles(x86)%\your uninstaller 2010\languages\russian.lng
- from %ProgramFiles(x86)%\your uninstaller 2010\languages\is-ssrs5.tmp to %ProgramFiles(x86)%\your uninstaller 2010\languages\serbian.lng
- from %ProgramFiles(x86)%\your uninstaller 2010\languages\is-nuvg1.tmp to %ProgramFiles(x86)%\your uninstaller 2010\languages\simplified chinese.lng
- from %ProgramFiles(x86)%\your uninstaller 2010\languages\is-9fe8i.tmp to %ProgramFiles(x86)%\your uninstaller 2010\languages\slovak.lng
- from %ProgramFiles(x86)%\your uninstaller 2010\languages\is-psfdf.tmp to %ProgramFiles(x86)%\your uninstaller 2010\languages\spanish.lng
- from %ProgramFiles(x86)%\your uninstaller 2010\languages\is-dlhpa.tmp to %ProgramFiles(x86)%\your uninstaller 2010\languages\t-chinese.lng
- from %ProgramFiles(x86)%\your uninstaller 2010\languages\is-t5kko.tmp to %ProgramFiles(x86)%\your uninstaller 2010\languages\turkish.lng
- from %ProgramFiles(x86)%\your uninstaller 2010\languages\is-4rtv5.tmp to %ProgramFiles(x86)%\your uninstaller 2010\languages\ukrainian.lng
- from %TEMP%\is-1jhjd.tmp\is-a3euc.tmp to %TEMP%\is-1jhjd.tmp\pskill.exe
- from %ProgramFiles(x86)%\your uninstaller 2010\languages\is-pa4mo.tmp to %ProgramFiles(x86)%\your uninstaller 2010\languages\korean.lng
- from %ProgramFiles(x86)%\your uninstaller 2010\is-q261h.tmp to %ProgramFiles(x86)%\your uninstaller 2010\wintools.ini
Miscellaneous
Searches for the following windows
- ClassName: 'ThunderRT6FormDC' WindowName: 'Shareware Cheater v 3.0'
- ClassName: 'ThunderRT6FormDC' WindowName: ''
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following
- '%TEMP%\7zipsfx.000\yusetup2010.exe' /VERYSILENT /SP-
- '%TEMP%\is-7oej4.tmp\yusetup2010.tmp' /SL5="$90232,5160409,141824,%TEMP%\7ZipSfx.000\yusetup2010.exe" /VERYSILENT /SP-
- '%TEMP%\is-1jhjd.tmp\pskill.exe' uruninstaller.exe
- '%TEMP%\is-1jhjd.tmp\pskill.exe' urmain.exe
- '%TEMP%\is-1jhjd.tmp\pskill.exe' autoupdater.exe
- '%ProgramFiles(x86)%\your uninstaller 2010\urmain.exe' -buildcache
- '%ProgramFiles(x86)%\your uninstaller 2010\inimerge.exe' "%ProgramFiles(x86)%\Your Uninstaller 2010\uruninstaller.ini" "%APPDATA%\URSoft\Your Uninstaller\uruninstaller.ini"
