Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\TeamViewerSession\shell\open\command] '' = '"%ProgramFiles%\TeamViewer\TeamViewer.exe" --play "%1"'
- [<HKLM>\Software\Classes\tvsqcustomer1\shell\open\command] '' = '"%ProgramFiles%\TeamViewer\TeamViewer.exe" "%1"'
- [<HKLM>\Software\Classes\tvsqsupport1\shell\open\command] '' = '"%ProgramFiles%\TeamViewer\TeamViewer.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\tvjoinv8\shell\open\command] '' = '"%ProgramFiles%\TeamViewer\TeamViewer.exe" "%1"'
- [<HKLM>\Software\Classes\tvoneweblogin\shell\open\command] '' = '"%ProgramFiles%\TeamViewer\TeamViewer.exe" "%1"'
- [<HKLM>\Software\Classes\teamviewer10\shell\open\command] '' = '"%ProgramFiles%\TeamViewer\TeamViewer.exe" "%1"'
- [<HKLM>\Software\Classes\teamviewer8\shell\open\command] '' = '"%ProgramFiles%\TeamViewer\TeamViewer.exe" "%1"'
- [<HKLM>\Software\Classes\tvsendfile1\shell\open\command] '' = '"%ProgramFiles%\TeamViewer\TeamViewer.exe" "%1"'
- [<HKLM>\Software\Classes\tvvideocall1\shell\open\command] '' = '"%ProgramFiles%\TeamViewer\TeamViewer.exe" "%1"'
- [<HKLM>\Software\Classes\tvpresent1\shell\open\command] '' = '"%ProgramFiles%\TeamViewer\TeamViewer.exe" "%1"'
- [<HKLM>\Software\Classes\tvchat1\shell\open\command] '' = '"%ProgramFiles%\TeamViewer\TeamViewer.exe" "%1"'
- [<HKLM>\Software\Classes\tvvpn1\shell\open\command] '' = '"%ProgramFiles%\TeamViewer\TeamViewer.exe" "%1"'
- [<HKLM>\Software\Classes\tvfiletransfer1\shell\open\command] '' = '"%ProgramFiles%\TeamViewer\TeamViewer.exe" "%1"'
- [<HKLM>\Software\Classes\tvcontrol1\shell\open\command] '' = '"%ProgramFiles%\TeamViewer\TeamViewer.exe" "%1"'
- [<HKLM>\Software\Classes\TeamViewerPilotSessionReporting\shell\open\command] '' = '"%ProgramFiles%\TeamViewer\TeamViewer.exe" --opentpsr "%1"'
- [<HKLM>\Software\Classes\TeamViewerConfiguration\shell\open\command] '' = '"%ProgramFiles%\TeamViewer\TeamViewer.exe" --control "%1"'
- [<HKLM>\Software\Classes\teamviewerapi\shell\open\command] '' = '"%ProgramFiles%\TeamViewer\TeamViewer.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\blizzv1\shell\open\command] '' = '"%ProgramFiles%\TeamViewer\TeamViewer.exe" "%1"'
Creates or modifies the following files
- <SYSTEM32>\tasks\tvinstallrestore
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\TeamViewer] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\TeamViewer] 'ImagePath' = '"%ProgramFiles%\TeamViewer\TeamViewer_Service.exe"'
Creates the following services
- 'TeamViewer' "%ProgramFiles%\TeamViewer\TeamViewer_Service.exe"
- 'TeamViewer' %ProgramFiles%\TeamViewer\TeamViewer_Service.exe
Malicious functions
Executes the following
- '%WINDIR%\syswow64\net.exe' stop TeamViewer
Modifies file system
Creates the following files
- %TEMP%\aut6058.tmp
- %ProgramFiles%\teamviewer\tvextracttemp\x64\tvmonitor.cat
- %ProgramFiles%\teamviewer\tvextracttemp\x64\teamviewer_virtualsmartcardreader.cat
- %ProgramFiles%\teamviewer\tvextracttemp\x64\teamviewervpn.cat
- %ProgramFiles%\teamviewer\tvextracttemp\x64\vpn_win7\teamviewervpn.cat
- %ProgramFiles%\teamviewer\tvextracttemp\tvfilesx64.7z
- %ProgramFiles%\teamviewer\tvextracttemp\tv_x64.dll
- %ProgramFiles%\teamviewer\tvextracttemp\tv_w32.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_staticres.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_zhtw.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_zhcn.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_uk.dll
- %ProgramFiles%\teamviewer\tvextracttemp\x64\vpn_win7\teamviewervpn.inf
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_tr.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_th.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_sv.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_sr.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_sk.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ru.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ro.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_pt.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_pl.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_vi.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_de.dll
- %ProgramFiles%\teamviewer\tvextracttemp\x64\teamviewer_virtualsmartcardreader.inf
- %TEMP%\aut40f8.tmp
- %ProgramFiles%\teamviewer\tvtools_alterid.exe
- %TEMP%\aut4099.tmp
- %ProgramFiles%\teamviewer\teamviewer15_logfile.log
- %ProgramFiles%\teamviewer\tvinfo.ini
- %WINDIR%\fonts\teamviewer15.otf
- %APPDATA%\teamviewer\teamviewer15_logfile.log
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\teamviewer.lnk
- C:\users\public\desktop\teamviewer.lnk
- %APPDATA%\microsoft\windows\sendto\teamviewer.lnk
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_no.dll
- %ProgramFiles%\teamviewer\tvextracttemp\x64\teamviewervpn.inf
- %ProgramFiles%\teamviewer\tvextracttemp\printer\teamviewer_xpsdriverfilter.inf
- %ProgramFiles%\teamviewer\tvextracttemp\printer\teamviewer_xpsdriverfilter.gpd
- %ProgramFiles%\teamviewer\tvextracttemp\printer\teamviewer_xpsdriverfilter.cat
- %ProgramFiles%\teamviewer\tvextracttemp\printer\teamviewer_xpsdriverfilter-manifest.ini
- %ProgramFiles%\teamviewer\tvextracttemp\printer\teamviewer_xpsdriverfilter-pipelineconfig.xml
- %ProgramFiles%\teamviewer\tvextracttemp\tvfiles_printer_withoutpdfsupport_x64.7z
- %ProgramFiles%\teamviewer\tvextracttemp\x64\teamviewer_virtualsmartcardreader.dll
- %ProgramFiles%\teamviewer\tvextracttemp\x64\tvmonitor.sy_
- %ProgramFiles%\teamviewer\tvextracttemp\x64\teamviewervpn.sy_
- %ProgramFiles%\teamviewer\tvextracttemp\x64\vpn_win7\teamviewervpn.sy_
- %ProgramFiles%\teamviewer\tvextracttemp\printer\x64\teamviewer_xpsdriverfilter.dll
- %ProgramFiles%\teamviewer\tvextracttemp\x64\tvmonitor.inf
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_nl.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_lt.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ko.dll
- %TEMP%\nsc7cb0.tmp\nsexec.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer.exe
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer15.otf
- %ProgramFiles%\teamviewer\tvextracttemp\copyrightfull.txt
- %ProgramFiles%\teamviewer\tvextracttemp\eula-en.html
- %ProgramFiles%\teamviewer\tvextracttemp\eula-de.html
- %ProgramFiles%\teamviewer\tvextracttemp\dpa-en.html
- %ProgramFiles%\teamviewer\tvextracttemp\dpa-de.html
- %TEMP%\nsc7cb0.tmp\nsis7z.dll
- %ProgramFiles%\teamviewer\tvextracttemp\tvfiles.7z
- %ProgramFiles%\teamviewer\id_reset.exe
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_note.exe
- %TEMP%\teamviewer\tv15install.log
- %TEMP%\nsc7cb0.tmp\uac.dll
- %TEMP%\nsc7cb0.tmp\tvgetversion.dll
- %TEMP%\nsc7cb0.tmp\userinfo.dll
- %TEMP%\nsc7cb0.tmp\system.dll
- %TEMP%\nsc7c61.tmp
- %TEMP%\teamviewer\tvinfo.ini
- %TEMP%\teamviewer\teamviewer_.exe
- %TEMP%\nsc733d.tmp\tvgetversion.dll
- %CommonProgramFiles(x86)%\~dfmtsly.tmp
- %TEMP%\nsc7cb0.tmp\nsarray.dll
- C:\users\default\appdata\roaming\microsoft\windows\sendto\teamviewer.lnk
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_service.exe
- %ProgramFiles%\teamviewer\tvextracttemp\uninstall.exe
- %ProgramFiles%\teamviewer\tvextracttemp\tv_w32.exe
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ja.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_it.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_id.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_hu.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_hr.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_he.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_fr.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_fi.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_es.dll
- %ProgramFiles%\teamviewer\tvextracttemp\tv_x64.exe
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_en.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_desktop.exe
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_da.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_cs.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_bg.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ar.dll
- %ProgramFiles%\teamviewer\tvextracttemp\outlook\teamviewermeetingaddinshim64.dll
- %ProgramFiles%\teamviewer\tvextracttemp\outlook\teamviewermeetingaddinshim.dll
- %ProgramFiles%\teamviewer\tvextracttemp\outlook\teamviewermeetingaddin.dll
- %ProgramFiles%\teamviewer\tvextracttemp\outlook\managedaggregator.dll
- %ProgramFiles%\teamviewer\tvextracttemp\writedump.exe
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_el.dll
- C:\users\public\desktop\teamviewer (with id reset).lnk
Sets the 'hidden' attribute to the following files
- %CommonProgramFiles(x86)%\~dfmtsly.tmp
Deletes the following files
- %TEMP%\aut6058.tmp
- %CommonProgramFiles(x86)%\~dfmtsly.tmp
- %TEMP%\nsc733d.tmp\tvgetversion.dll
- %TEMP%\nsc7cb0.tmp\userinfo.dll
- %TEMP%\nsc7cb0.tmp\uac.dll
- %TEMP%\nsc7cb0.tmp\tvgetversion.dll
- %TEMP%\nsc7cb0.tmp\system.dll
- %TEMP%\nsc7cb0.tmp\nsis7z.dll
- %TEMP%\nsc7cb0.tmp\nsexec.dll
- %TEMP%\nsc7cb0.tmp\nsarray.dll
- %ProgramFiles%\teamviewer\tvextracttemp\x64\teamviewervpn.sy_
- %ProgramFiles%\teamviewer\tvextracttemp\x64\teamviewervpn.inf
- %ProgramFiles%\teamviewer\tvextracttemp\x64\teamviewervpn.cat
- %TEMP%\teamviewer\tvinstalltemp\tvfile164.bak
- <SYSTEM32>\tasks\tvinstallrestore
- %ProgramFiles%\teamviewer\tvextracttemp\tvfiles_printer_withoutpdfsupport_x64.7z
- %ProgramFiles%\teamviewer\tvextracttemp\tvfilesx64.7z
- %ProgramFiles%\teamviewer\tvextracttemp\tvfiles.7z
- %TEMP%\aut4099.tmp
- %TEMP%\aut40f8.tmp
Moves the following files
- from %ProgramFiles%\teamviewer\tvextracttemp\eula-de.html to %ProgramFiles%\teamviewer\eula-de.html
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_pl.dll to %ProgramFiles%\teamviewer\teamviewer_resource_pl.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_zhcn.dll to %ProgramFiles%\teamviewer\teamviewer_resource_zhcn.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ar.dll to %ProgramFiles%\teamviewer\teamviewer_resource_ar.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_cs.dll to %ProgramFiles%\teamviewer\teamviewer_resource_cs.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ko.dll to %ProgramFiles%\teamviewer\teamviewer_resource_ko.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ru.dll to %ProgramFiles%\teamviewer\teamviewer_resource_ru.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ja.dll to %ProgramFiles%\teamviewer\teamviewer_resource_ja.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_no.dll to %ProgramFiles%\teamviewer\teamviewer_resource_no.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_fi.dll to %ProgramFiles%\teamviewer\teamviewer_resource_fi.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_sv.dll to %ProgramFiles%\teamviewer\teamviewer_resource_sv.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_pt.dll to %ProgramFiles%\teamviewer\teamviewer_resource_pt.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_nl.dll to %ProgramFiles%\teamviewer\teamviewer_resource_nl.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_it.dll to %ProgramFiles%\teamviewer\teamviewer_resource_it.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_fr.dll to %ProgramFiles%\teamviewer\teamviewer_resource_fr.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_da.dll to %ProgramFiles%\teamviewer\teamviewer_resource_da.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_tr.dll to %ProgramFiles%\teamviewer\teamviewer_resource_tr.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_el.dll to %ProgramFiles%\teamviewer\teamviewer_resource_el.dll
- from %ProgramFiles%\teamviewer\x64\teamviewervpn.sy_ to %ProgramFiles%\teamviewer\x64\teamviewervpn.sys
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_he.dll to %ProgramFiles%\teamviewer\teamviewer_resource_he.dll
- from %ProgramFiles%\teamviewer\copyrightfull.txt to %ProgramFiles%\teamviewer\copyrights.txt
- from %ProgramFiles%\teamviewer\x64\vpn_win7\teamviewervpn.sy_ to %ProgramFiles%\teamviewer\x64\teamviewervpn.sy_
- from %ProgramFiles%\teamviewer\x64\vpn_win7\teamviewervpn.inf to %ProgramFiles%\teamviewer\x64\teamviewervpn.inf
- from %ProgramFiles%\teamviewer\x64\vpn_win7\teamviewervpn.cat to %ProgramFiles%\teamviewer\x64\teamviewervpn.cat
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_zhtw.dll to %ProgramFiles%\teamviewer\teamviewer_resource_zhtw.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_vi.dll to %ProgramFiles%\teamviewer\teamviewer_resource_vi.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_uk.dll to %ProgramFiles%\teamviewer\teamviewer_resource_uk.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_th.dll to %ProgramFiles%\teamviewer\teamviewer_resource_th.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_sr.dll to %ProgramFiles%\teamviewer\teamviewer_resource_sr.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_sk.dll to %ProgramFiles%\teamviewer\teamviewer_resource_sk.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ro.dll to %ProgramFiles%\teamviewer\teamviewer_resource_ro.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_lt.dll to %ProgramFiles%\teamviewer\teamviewer_resource_lt.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_id.dll to %ProgramFiles%\teamviewer\teamviewer_resource_id.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_hu.dll to %ProgramFiles%\teamviewer\teamviewer_resource_hu.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_hr.dll to %ProgramFiles%\teamviewer\teamviewer_resource_hr.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_es.dll to %ProgramFiles%\teamviewer\teamviewer_resource_es.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_bg.dll to %ProgramFiles%\teamviewer\teamviewer_resource_bg.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_de.dll to %ProgramFiles%\teamviewer\teamviewer_resource_de.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\outlook\managedaggregator.dll to %ProgramFiles%\teamviewer\outlook\managedaggregator.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\copyrightfull.txt to %ProgramFiles%\teamviewer\copyrightfull.txt
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_note.exe to %ProgramFiles%\teamviewer\teamviewer_note.exe
- from %ProgramFiles%\teamviewer\tvextracttemp\tv_x64.exe to %ProgramFiles%\teamviewer\tv_x64.exe
- from %ProgramFiles%\teamviewer\tvextracttemp\tv_x64.dll to %ProgramFiles%\teamviewer\tv_x64.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\tv_w32.exe to %ProgramFiles%\teamviewer\tv_w32.exe
- from %ProgramFiles%\teamviewer\tvextracttemp\tv_w32.dll to %ProgramFiles%\teamviewer\tv_w32.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_staticres.dll to %ProgramFiles%\teamviewer\teamviewer_staticres.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\uninstall.exe to %ProgramFiles%\teamviewer\uninstall.exe
- from %ProgramFiles%\teamviewer\tvextracttemp\writedump.exe to %ProgramFiles%\teamviewer\writedump.exe
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_service.exe to %ProgramFiles%\teamviewer\teamviewer_service.exe
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_desktop.exe to %ProgramFiles%\teamviewer\teamviewer_desktop.exe
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer.exe to %ProgramFiles%\teamviewer\teamviewer.exe
- from %ProgramFiles%\teamviewer\tvextracttemp\dpa-en.html to %ProgramFiles%\teamviewer\dpa-en.html
- from %ProgramFiles%\teamviewer\tvextracttemp\dpa-de.html to %ProgramFiles%\teamviewer\dpa-de.html
- from %ProgramFiles%\teamviewer\tvextracttemp\eula-en.html to %ProgramFiles%\teamviewer\eula-en.html
- from %ProgramFiles%\teamviewer\tvextracttemp\outlook\teamviewermeetingaddin.dll to %ProgramFiles%\teamviewer\outlook\teamviewermeetingaddin.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\outlook\teamviewermeetingaddinshim.dll to %ProgramFiles%\teamviewer\outlook\teamviewermeetingaddinshim.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\printer\x64\teamviewer_xpsdriverfilter.dll to %ProgramFiles%\teamviewer\printer\x64\teamviewer_xpsdriverfilter.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\outlook\teamviewermeetingaddinshim64.dll to %ProgramFiles%\teamviewer\outlook\teamviewermeetingaddinshim64.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\x64\teamviewer_virtualsmartcardreader.dll to %ProgramFiles%\teamviewer\x64\teamviewer_virtualsmartcardreader.dll
- from %ProgramFiles%\teamviewer\tvextracttemp\x64\teamviewer_virtualsmartcardreader.inf to %ProgramFiles%\teamviewer\x64\teamviewer_virtualsmartcardreader.inf
- from %ProgramFiles%\teamviewer\tvextracttemp\x64\teamviewer_virtualsmartcardreader.cat to %ProgramFiles%\teamviewer\x64\teamviewer_virtualsmartcardreader.cat
- from %ProgramFiles%\teamviewer\tvextracttemp\x64\tvmonitor.sy_ to %ProgramFiles%\teamviewer\x64\tvmonitor.sy_
- from %ProgramFiles%\teamviewer\tvextracttemp\x64\tvmonitor.inf to %ProgramFiles%\teamviewer\x64\tvmonitor.inf
- from %ProgramFiles%\teamviewer\tvextracttemp\x64\tvmonitor.cat to %ProgramFiles%\teamviewer\x64\tvmonitor.cat
- from %ProgramFiles%\teamviewer\tvextracttemp\x64\vpn_win7\teamviewervpn.sy_ to %ProgramFiles%\teamviewer\x64\vpn_win7\teamviewervpn.sy_
- from %ProgramFiles%\teamviewer\tvextracttemp\x64\vpn_win7\teamviewervpn.inf to %ProgramFiles%\teamviewer\x64\vpn_win7\teamviewervpn.inf
- from %ProgramFiles%\teamviewer\tvextracttemp\x64\vpn_win7\teamviewervpn.cat to %ProgramFiles%\teamviewer\x64\vpn_win7\teamviewervpn.cat
- from %ProgramFiles%\teamviewer\tvextracttemp\printer\teamviewer_xpsdriverfilter-pipelineconfig.xml to %ProgramFiles%\teamviewer\printer\teamviewer_xpsdriverfilter-pipelineconfig.xml
- from %ProgramFiles%\teamviewer\tvextracttemp\printer\teamviewer_xpsdriverfilter-manifest.ini to %ProgramFiles%\teamviewer\printer\teamviewer_xpsdriverfilter-manifest.ini
- from %ProgramFiles%\teamviewer\tvextracttemp\printer\teamviewer_xpsdriverfilter.inf to %ProgramFiles%\teamviewer\printer\teamviewer_xpsdriverfilter.inf
- from %ProgramFiles%\teamviewer\tvextracttemp\printer\teamviewer_xpsdriverfilter.gpd to %ProgramFiles%\teamviewer\printer\teamviewer_xpsdriverfilter.gpd
- from %ProgramFiles%\teamviewer\tvextracttemp\printer\teamviewer_xpsdriverfilter.cat to %ProgramFiles%\teamviewer\printer\teamviewer_xpsdriverfilter.cat
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer15.otf to %ProgramFiles%\teamviewer\teamviewer15.otf
- from %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_en.dll to %ProgramFiles%\teamviewer\teamviewer_resource_en.dll
- from %ProgramFiles%\teamviewer\teamviewer15.otf to %TEMP%\teamviewer\tvinstalltemp\tvfile164.bak
Substitutes the following files
- %ProgramFiles%\teamviewer\x64\teamviewervpn.sy_
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'TeamViewer'
Creates and executes the following
- '%CommonProgramFiles(x86)%\~dfmtsly.tmp' /S
- '%TEMP%\teamviewer\teamviewer_.exe' /S
- '%ProgramFiles%\teamviewer\teamviewer_service.exe' -install
- '%ProgramFiles%\teamviewer\teamviewer.exe' api --install
- '%ProgramFiles%\teamviewer\teamviewer_service.exe'
- '%WINDIR%\syswow64\net.exe' stop TeamViewer' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN TVInstallRestore /TR "%TEMP%\TeamViewer\TeamViewer_.exe /RESTORE" /RU SYSTEM /SC ONLOGON /F' (with hidden window)
- '%ProgramFiles%\teamviewer\teamviewer_service.exe' -install' (with hidden window)
- '%ProgramFiles%\teamviewer\teamviewer.exe' api --install' (with hidden window)
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles%\TeamViewer\outlook\TeamViewerMeetingAddinShim64.dll"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Delete /TN TVInstallRestore /F' (with hidden window)
- '%WINDIR%\syswow64\net.exe' start TeamViewer' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\net1.exe' stop TeamViewer
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN TVInstallRestore /TR "%TEMP%\TeamViewer\TeamViewer_.exe /RESTORE" /RU SYSTEM /SC ONLOGON /F
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles%\TeamViewer\outlook\TeamViewerMeetingAddinShim64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\TeamViewer\outlook\TeamViewerMeetingAddinShim64.dll"
- '%WINDIR%\syswow64\schtasks.exe' /Delete /TN TVInstallRestore /F
- '%WINDIR%\syswow64\net.exe' start TeamViewer
- '%WINDIR%\syswow64\net1.exe' start TeamViewer
