Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\WBICreatorService 6.5] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\WBICreatorService 6.5] 'ImagePath' = '%ALLUSERSPROFILE%\WBICreatorService 6.5\WBICreatorService 6.5.exe'
Creates the following services
- 'WBICreatorService 6.5' %ALLUSERSPROFILE%\WBICreatorService 6.5\WBICreatorService 6.5.exe
Modifies file system
Creates the following files
- %TEMP%\is-61fpl.tmp\<File name>.tmp
- %TEMP%\is-mhtlu.tmp\_isetup\_setup64.tmp
- %TEMP%\is-mhtlu.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-mhtlu.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-mhtlu.tmp\_isetup\_iscrypt.dll
- %LOCALAPPDATA%\cd dvd identifier\is-r883l.tmp
- %LOCALAPPDATA%\cd dvd identifier\is-78f8f.tmp
- %LOCALAPPDATA%\cd dvd identifier\is-14q1o.tmp
- %LOCALAPPDATA%\cd dvd identifier\is-k3r6c.tmp
- %LOCALAPPDATA%\cd dvd identifier\is-040ss.tmp
- %LOCALAPPDATA%\cd dvd identifier\is-h559i.tmp
- %LOCALAPPDATA%\cd dvd identifier\is-ngam9.tmp
- %LOCALAPPDATA%\cd dvd identifier\is-toqo3.tmp
- %LOCALAPPDATA%\cd dvd identifier\unins000.dat
- %LOCALAPPDATA%\cd dvd identifier\cddvdidentifier.exe
- %ALLUSERSPROFILE%\wbicreatorservice 6.5\wbicreatorservice 6.5.exe
Deletes the following files
- %LOCALAPPDATA%\cd dvd identifier\libgcc_s_dw2-1.dll
Moves the following files
- from %LOCALAPPDATA%\cd dvd identifier\is-r883l.tmp to %LOCALAPPDATA%\cd dvd identifier\unins000.exe
- from %LOCALAPPDATA%\cd dvd identifier\is-78f8f.tmp to %LOCALAPPDATA%\cd dvd identifier\libgcc_s_dw2-1.dll
- from %LOCALAPPDATA%\cd dvd identifier\is-k3r6c.tmp to %LOCALAPPDATA%\cd dvd identifier\libogg-0.dll
- from %LOCALAPPDATA%\cd dvd identifier\is-040ss.tmp to %LOCALAPPDATA%\cd dvd identifier\libvorbis-0.dll
- from %LOCALAPPDATA%\cd dvd identifier\is-h559i.tmp to %LOCALAPPDATA%\cd dvd identifier\libwinpthread-1.dll
- from %LOCALAPPDATA%\cd dvd identifier\is-ngam9.tmp to %LOCALAPPDATA%\cd dvd identifier\libbz2-1.dll
- from %LOCALAPPDATA%\cd dvd identifier\is-toqo3.tmp to %LOCALAPPDATA%\cd dvd identifier\cddvdidentifier.exe
Substitutes the following files
- %LOCALAPPDATA%\cd dvd identifier\libgcc_s_dw2-1.dll
Miscellaneous
Searches for the following windows
- ClassName: 'T87e6d_Flash2272FixClass_T87e6d' WindowName: ''
Creates and executes the following
- '%TEMP%\is-61fpl.tmp\<File name>.tmp' /SL5="$9024C,2248936,56832,<Full path to file>"
- '%LOCALAPPDATA%\cd dvd identifier\cddvdidentifier.exe' -i
- '%LOCALAPPDATA%\cd dvd identifier\cddvdidentifier.exe' -s
