Trojan.Siggen24.19661

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\AudioConverterRipper v6.1] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\AudioConverterRipper v6.1] 'ImagePath' = '%ALLUSERSPROFILE%\AudioConverterRipper v6.1\AudioConverterRipper v6.1.exe'

Creates the following services

'AudioConverterRipper v6.1' %ALLUSERSPROFILE%\AudioConverterRipper v6.1\AudioConverterRipper v6.1.exe

Modifies file system

Creates the following files

%TEMP%\is-gaod0.tmp\<File name>.tmp
%LOCALAPPDATA%\ev audio center\microsoft.vc90.crt\is-cldmc.tmp
%LOCALAPPDATA%\ev audio center\microsoft.vc90.crt\is-i66a2.tmp
%LOCALAPPDATA%\ev audio center\microsoft.vc90.crt\is-q8ktq.tmp
%LOCALAPPDATA%\ev audio center\pf\common audio\is-pn7mn.tmp
%LOCALAPPDATA%\ev audio center\pf\common audio\is-e9u2h.tmp
%LOCALAPPDATA%\ev audio center\pf\common audio\is-5fg9s.tmp
%LOCALAPPDATA%\ev audio center\pf\common audio\is-t7vbp.tmp
%LOCALAPPDATA%\ev audio center\pf\common audio\is-cmm7k.tmp
%LOCALAPPDATA%\ev audio center\pf\common audio\is-n0ae1.tmp
%LOCALAPPDATA%\ev audio center\pf\common audio\is-ck0ma.tmp
%LOCALAPPDATA%\ev audio center\pf\common audio\is-0oe8v.tmp
%LOCALAPPDATA%\ev audio center\pf\common audio\is-99hkh.tmp
%LOCALAPPDATA%\ev audio center\pf\common audio\is-os7lj.tmp
%LOCALAPPDATA%\ev audio center\lang\is-06u49.tmp
%LOCALAPPDATA%\ev audio center\microsoft.vc90.crt\is-2mps3.tmp
%LOCALAPPDATA%\ev audio center\pf\common audio\is-vqnv4.tmp
%LOCALAPPDATA%\ev audio center\pf\common audio\is-a4s43.tmp
%LOCALAPPDATA%\ev audio center\unins000.dat
%LOCALAPPDATA%\ev audio center\lramsoft.url
%LOCALAPPDATA%\ev audio center\is-9s68n.tmp
%LOCALAPPDATA%\ev audio center\lang\is-plutf.tmp
%LOCALAPPDATA%\ev audio center\lang\is-9tj08.tmp
%LOCALAPPDATA%\ev audio center\is-146k9.tmp
%LOCALAPPDATA%\ev audio center\lang\is-0hgos.tmp
%LOCALAPPDATA%\ev audio center\lang\is-suqov.tmp
%LOCALAPPDATA%\ev audio center\pf\common audio\is-1g1fv.tmp
%LOCALAPPDATA%\ev audio center\pf\common audio\is-lfudd.tmp
%LOCALAPPDATA%\ev audio center\pf\common audio\is-vb2vu.tmp
%LOCALAPPDATA%\ev audio center\pf\common audio\is-p79o3.tmp
%LOCALAPPDATA%\ev audio center\pf\common audio\is-5fr9v.tmp
%LOCALAPPDATA%\ev audio center\pf\common audio\is-vcm77.tmp
%LOCALAPPDATA%\ev audio center\lang\is-51nb5.tmp
%LOCALAPPDATA%\ev audio center\lang\is-ruf0p.tmp
%LOCALAPPDATA%\ev audio center\lang\is-o02lv.tmp
%TEMP%\is-m27uj.tmp\_isetup\_setup64.tmp
%TEMP%\is-m27uj.tmp\_isetup\_shfoldr.dll
%TEMP%\is-m27uj.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\ev audio center\is-65cat.tmp
%LOCALAPPDATA%\ev audio center\is-dfoop.tmp
%LOCALAPPDATA%\ev audio center\is-f1ff9.tmp
%LOCALAPPDATA%\ev audio center\is-583m3.tmp
%LOCALAPPDATA%\ev audio center\is-pdu7e.tmp
%LOCALAPPDATA%\ev audio center\is-gpmae.tmp
%LOCALAPPDATA%\ev audio center\is-5hnmk.tmp
%LOCALAPPDATA%\ev audio center\is-71j5s.tmp
%LOCALAPPDATA%\ev audio center\is-q1bda.tmp
%LOCALAPPDATA%\ev audio center\is-glmqo.tmp
%LOCALAPPDATA%\ev audio center\is-mnj76.tmp
%TEMP%\is-m27uj.tmp\_isetup\_regdll.tmp
%LOCALAPPDATA%\ev audio center\is-tupjl.tmp
%LOCALAPPDATA%\ev audio center\lang\is-8ntof.tmp
%LOCALAPPDATA%\ev audio center\is-pdrp8.tmp
%LOCALAPPDATA%\ev audio center\is-kvppf.tmp
%LOCALAPPDATA%\ev audio center\is-l6nfn.tmp
%LOCALAPPDATA%\ev audio center\is-n8q97.tmp
%LOCALAPPDATA%\ev audio center\is-32ns1.tmp
%LOCALAPPDATA%\ev audio center\is-sd1q9.tmp
%LOCALAPPDATA%\ev audio center\lang\is-dkij8.tmp
%LOCALAPPDATA%\ev audio center\is-ck9it.tmp
%LOCALAPPDATA%\ev audio center\evcenterripper.exe
%LOCALAPPDATA%\ev audio center\is-g8il1.tmp
%LOCALAPPDATA%\ev audio center\is-37k7j.tmp
%LOCALAPPDATA%\ev audio center\is-84c6k.tmp
%LOCALAPPDATA%\ev audio center\is-l5sd1.tmp
%LOCALAPPDATA%\ev audio center\is-kpf5d.tmp
%LOCALAPPDATA%\ev audio center\is-oseqc.tmp
%ALLUSERSPROFILE%\audioconverterripper v6.1\audioconverterripper v6.1.exe

Deletes the following files

%LOCALAPPDATA%\ev audio center\lang\audioconverterripper.dat
%LOCALAPPDATA%\ev audio center\lang\audioconverterripper.txt
%LOCALAPPDATA%\ev audio center\lang\feedback.dat
%LOCALAPPDATA%\ev audio center\lang\musictype.txt
%LOCALAPPDATA%\ev audio center\lang\update.log

Moves the following files

from %LOCALAPPDATA%\ev audio center\is-65cat.tmp to %LOCALAPPDATA%\ev audio center\unins000.exe
from %LOCALAPPDATA%\ev audio center\lang\is-06u49.tmp to %LOCALAPPDATA%\ev audio center\lang\update.log
from %LOCALAPPDATA%\ev audio center\microsoft.vc90.crt\is-2mps3.tmp to %LOCALAPPDATA%\ev audio center\microsoft.vc90.crt\microsoft.vc90.crt.manifest
from %LOCALAPPDATA%\ev audio center\microsoft.vc90.crt\is-cldmc.tmp to %LOCALAPPDATA%\ev audio center\microsoft.vc90.crt\msvcm90.dll
from %LOCALAPPDATA%\ev audio center\microsoft.vc90.crt\is-i66a2.tmp to %LOCALAPPDATA%\ev audio center\microsoft.vc90.crt\msvcp90.dll
from %LOCALAPPDATA%\ev audio center\microsoft.vc90.crt\is-q8ktq.tmp to %LOCALAPPDATA%\ev audio center\microsoft.vc90.crt\msvcr90.dll
from %LOCALAPPDATA%\ev audio center\pf\common audio\is-pn7mn.tmp to %LOCALAPPDATA%\ev audio center\pf\common audio\aac.pf
from %LOCALAPPDATA%\ev audio center\pf\common audio\is-e9u2h.tmp to %LOCALAPPDATA%\ev audio center\pf\common audio\ac3.pf
from %LOCALAPPDATA%\ev audio center\pf\common audio\is-5fg9s.tmp to %LOCALAPPDATA%\ev audio center\pf\common audio\aiff.pf
from %LOCALAPPDATA%\ev audio center\pf\common audio\is-t7vbp.tmp to %LOCALAPPDATA%\ev audio center\pf\common audio\amr.pf
from %LOCALAPPDATA%\ev audio center\pf\common audio\is-cmm7k.tmp to %LOCALAPPDATA%\ev audio center\pf\common audio\ape.pf
from %LOCALAPPDATA%\ev audio center\is-kvppf.tmp to %LOCALAPPDATA%\ev audio center\realquickjoin.dll
from %LOCALAPPDATA%\ev audio center\pf\common audio\is-n0ae1.tmp to %LOCALAPPDATA%\ev audio center\pf\common audio\au.pf
from %LOCALAPPDATA%\ev audio center\pf\common audio\is-0oe8v.tmp to %LOCALAPPDATA%\ev audio center\pf\common audio\m4a.pf
from %LOCALAPPDATA%\ev audio center\pf\common audio\is-99hkh.tmp to %LOCALAPPDATA%\ev audio center\pf\common audio\m4b.pf
from %LOCALAPPDATA%\ev audio center\pf\common audio\is-os7lj.tmp to %LOCALAPPDATA%\ev audio center\pf\common audio\m4r.pf
from %LOCALAPPDATA%\ev audio center\pf\common audio\is-vqnv4.tmp to %LOCALAPPDATA%\ev audio center\pf\common audio\mka.pf
from %LOCALAPPDATA%\ev audio center\pf\common audio\is-a4s43.tmp to %LOCALAPPDATA%\ev audio center\pf\common audio\mp2.pf
from %LOCALAPPDATA%\ev audio center\pf\common audio\is-vcm77.tmp to %LOCALAPPDATA%\ev audio center\pf\common audio\mp3.pf
from %LOCALAPPDATA%\ev audio center\pf\common audio\is-5fr9v.tmp to %LOCALAPPDATA%\ev audio center\pf\common audio\ogg.pf
from %LOCALAPPDATA%\ev audio center\pf\common audio\is-p79o3.tmp to %LOCALAPPDATA%\ev audio center\pf\common audio\ra.pf
from %LOCALAPPDATA%\ev audio center\pf\common audio\is-vb2vu.tmp to %LOCALAPPDATA%\ev audio center\pf\common audio\voc.pf
from %LOCALAPPDATA%\ev audio center\pf\common audio\is-lfudd.tmp to %LOCALAPPDATA%\ev audio center\pf\common audio\wav.pf
from %LOCALAPPDATA%\ev audio center\lang\is-ruf0p.tmp to %LOCALAPPDATA%\ev audio center\lang\feedback.dat
from %LOCALAPPDATA%\ev audio center\lang\is-51nb5.tmp to %LOCALAPPDATA%\ev audio center\lang\musictype.txt
from %LOCALAPPDATA%\ev audio center\lang\is-o02lv.tmp to %LOCALAPPDATA%\ev audio center\lang\audioconverterripper.txt
from %LOCALAPPDATA%\ev audio center\lang\is-8ntof.tmp to %LOCALAPPDATA%\ev audio center\lang\audioconverterripper.dat
from %LOCALAPPDATA%\ev audio center\is-kpf5d.tmp to %LOCALAPPDATA%\ev audio center\wmadecode.dll
from %LOCALAPPDATA%\ev audio center\is-f1ff9.tmp to %LOCALAPPDATA%\ev audio center\msvcr71.dll
from %LOCALAPPDATA%\ev audio center\is-583m3.tmp to %LOCALAPPDATA%\ev audio center\musiccd.exe
from %LOCALAPPDATA%\ev audio center\is-pdu7e.tmp to %LOCALAPPDATA%\ev audio center\nvencoderkernel.dll
from %LOCALAPPDATA%\ev audio center\is-gpmae.tmp to %LOCALAPPDATA%\ev audio center\ocxhelper.exe
from %LOCALAPPDATA%\ev audio center\is-5hnmk.tmp to %LOCALAPPDATA%\ev audio center\pic2m2v.dll
from %LOCALAPPDATA%\ev audio center\is-71j5s.tmp to %LOCALAPPDATA%\ev audio center\popcorn.dll
from %LOCALAPPDATA%\ev audio center\is-q1bda.tmp to %LOCALAPPDATA%\ev audio center\popcorn.dll.intermediate.manifest
from %LOCALAPPDATA%\ev audio center\is-glmqo.tmp to %LOCALAPPDATA%\ev audio center\postproc-52.dll
from %LOCALAPPDATA%\ev audio center\is-mnj76.tmp to %LOCALAPPDATA%\ev audio center\productcontrol.dll
from %LOCALAPPDATA%\ev audio center\is-tupjl.tmp to %LOCALAPPDATA%\ev audio center\pthreadgc2.dll
from %LOCALAPPDATA%\ev audio center\pf\common audio\is-1g1fv.tmp to %LOCALAPPDATA%\ev audio center\pf\common audio\wma.pf
from %LOCALAPPDATA%\ev audio center\pf\common audio\is-ck0ma.tmp to %LOCALAPPDATA%\ev audio center\pf\common audio\flac.pf
from %LOCALAPPDATA%\ev audio center\is-pdrp8.tmp to %LOCALAPPDATA%\ev audio center\pthreadvc2.dll
from %LOCALAPPDATA%\ev audio center\is-n8q97.tmp to %LOCALAPPDATA%\ev audio center\rmvbencodesync.dll
from %LOCALAPPDATA%\ev audio center\is-32ns1.tmp to %LOCALAPPDATA%\ev audio center\simage.dll
from %LOCALAPPDATA%\ev audio center\is-sd1q9.tmp to %LOCALAPPDATA%\ev audio center\soundtouch.dll
from %LOCALAPPDATA%\ev audio center\is-ck9it.tmp to %LOCALAPPDATA%\ev audio center\ssleay32.dll
from %LOCALAPPDATA%\ev audio center\is-146k9.tmp to %LOCALAPPDATA%\ev audio center\swresample-0.dll
from %LOCALAPPDATA%\ev audio center\is-oseqc.tmp to %LOCALAPPDATA%\ev audio center\uitoolkit.dll.intermediate.manifest
from %LOCALAPPDATA%\ev audio center\is-g8il1.tmp to %LOCALAPPDATA%\ev audio center\ve32.dll
from %LOCALAPPDATA%\ev audio center\is-37k7j.tmp to %LOCALAPPDATA%\ev audio center\ve64.dll
from %LOCALAPPDATA%\ev audio center\is-84c6k.tmp to %LOCALAPPDATA%\ev audio center\wait.gif
from %LOCALAPPDATA%\ev audio center\is-l5sd1.tmp to %LOCALAPPDATA%\ev audio center\webrtc.dll
from %LOCALAPPDATA%\ev audio center\is-dfoop.tmp to %LOCALAPPDATA%\ev audio center\msvcp60.dll
from %LOCALAPPDATA%\ev audio center\is-l6nfn.tmp to %LOCALAPPDATA%\ev audio center\rmvbencode.dll
from %LOCALAPPDATA%\ev audio center\is-9s68n.tmp to %LOCALAPPDATA%\ev audio center\evcenterripper.exe

Substitutes the following files

%LOCALAPPDATA%\ev audio center\lang\audioconverterripper.dat
%LOCALAPPDATA%\ev audio center\lang\audioconverterripper.txt
%LOCALAPPDATA%\ev audio center\lang\feedback.dat
%LOCALAPPDATA%\ev audio center\lang\musictype.txt
%LOCALAPPDATA%\ev audio center\lang\update.log

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'n6694d_EVACR1183FlashFixClass_n6694d'

Creates and executes the following

'%TEMP%\is-gaod0.tmp\<File name>.tmp' /SL5="$90242,3568195,54272,<Full path to file>"
'%LOCALAPPDATA%\ev audio center\evcenterripper.exe' -i
'%LOCALAPPDATA%\ev audio center\evcenterripper.exe' -s

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "EVCR1183"

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial