Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
Modifies file system:
Creates the following files:
- %TEMP%\SIT12524.tmp\gencomp.dll
- %TEMP%\SIT12524.tmp\HtmlLite.dll
- %TEMP%\SIT12524.tmp\ExpressUI.dll
- %TEMP%\SIT12524.tmp\eula.1033.txt
- %TEMP%\SIT12524.tmp\ExpressKnownIssues.htm
- %TEMP%\SIT12524.tmp\locdata.ini
- %TEMP%\SIT12524.tmp\logo.bmp
- %TEMP%\SIT12524.tmp\ie6sp_text.htm
- %TEMP%\SIT12524.tmp\IA64block_text.htm
- %TEMP%\SIT12524.tmp\ie6sp_help.htm
- %TEMP%\SIT12524.tmp\contents.htm
- %TEMP%\SIT12524.tmp\CustomText.1033.dll
- %TEMP%\SIT12524.tmp\BITS_Text.htm
- %TEMP%\dd_vserror80.txt
- %TEMP%\SIT12524.tmp\baseline.dat
- %TEMP%\SIT12524.tmp\DW20.EXE
- %TEMP%\SIT12524.tmp\DWINTL20.DLL
- %TEMP%\SIT12524.tmp\dlmgr.dll
- %TEMP%\SIT12524.tmp\deffactory.dat
- %TEMP%\SIT12524.tmp\DeleteTemp.exe
- %TEMP%\SIT12524.tmp\readme.htm
- %TEMP%\SIT12524.tmp\windows2000sp_help.htm
- %TEMP%\SIT12524.tmp\windows2000sp_text.htm
- %TEMP%\SIT12524.tmp\vs_setup.pdi
- %TEMP%\SIT12524.tmp\vs_setup.dll
- %TEMP%\SIT12524.tmp\vs_setup.MS_
- %TEMP%\SIT12524.tmp\windowsXPsp_text.htm
- %TEMP%\dd_depcheck80.txt
- %TEMP%\SIT12524.tmp\windowsXPsp_help.htm
- %TEMP%\SIT12524.tmp\windows2003sp_help.htm
- %TEMP%\SIT12524.tmp\windows2003sp_text.htm
- %TEMP%\SIT12524.tmp\setupres.dll
- %TEMP%\SIT12524.tmp\SITSetup.dll
- %TEMP%\SIT12524.tmp\setup.sdb
- %TEMP%\SIT12524.tmp\RebootStub.exe
- %TEMP%\SIT12524.tmp\setup.exe
- %TEMP%\SIT12524.tmp\vsbasereqs.dll
- %TEMP%\SIT12524.tmp\vsscenario.dll
- %TEMP%\SIT12524.tmp\vs70uimgr.dll
- %TEMP%\SIT12524.tmp\TOC.HTM
- %TEMP%\SIT12524.tmp\Troubleshoot_Guide.htm
- %TEMP%\uxeventlog.txt
- %TEMP%\IXP000.TMP\RebootStub.exe
- %TEMP%\IXP000.TMP\baseline.dat
- %TEMP%\IXP000.TMP\HtmlLite.dll
- %TEMP%\IXP000.TMP\DeleteTemp.exe
- %TEMP%\IXP000.TMP\dlmgr.dll
- %TEMP%\IXP000.TMP\vs_setup.MS_
- %TEMP%\IXP000.TMP\vs_setup.pdi
- %TEMP%\IXP000.TMP\setup.sdb
- %TEMP%\IXP000.TMP\deffactory.dat
- %TEMP%\IXP000.TMP\locdata.ini
- %TEMP%\IXP000.TMP\SITSetup.dll
- %TEMP%\IXP000.TMP\ExpressUI.dll
- %TEMP%\IXP000.TMP\setup.exe
- %TEMP%\IXP000.TMP\CustomText.1033.dll
- %TEMP%\IXP000.TMP\setupres.dll
- %TEMP%\IXP000.TMP\vsbasereqs.dll
- %TEMP%\IXP000.TMP\vsscenario.dll
- %TEMP%\IXP000.TMP\vs70uimgr.dll
- %TEMP%\IXP000.TMP\gencomp.dll
- %TEMP%\IXP000.TMP\vs_setup.dll
- %TEMP%\IXP000.TMP\DW20.EXE
- %TEMP%\IXP000.TMP\readme.htm
- %TEMP%\IXP000.TMP\TOC.HTM
- %TEMP%\IXP000.TMP\ExpressKnownIssues.htm
- %TEMP%\IXP000.TMP\BITS_Text.htm
- %TEMP%\IXP000.TMP\contents.htm
- %TEMP%\msinterr.txt
- %TEMP%\dd_vsinstall80.txt
- %TEMP%\IXP000.TMP\logo.bmp
- %TEMP%\IXP000.TMP\Troubleshoot_Guide.htm
- %TEMP%\IXP000.TMP\eula.1033.txt
- %TEMP%\IXP000.TMP\ie6sp_text.htm
- %TEMP%\IXP000.TMP\windows2000sp_help.htm
- %TEMP%\IXP000.TMP\ie6sp_help.htm
- %TEMP%\IXP000.TMP\DWINTL20.DLL
- %TEMP%\IXP000.TMP\IA64block_text.htm
- %TEMP%\IXP000.TMP\windowsXPsp_help.htm
- %TEMP%\IXP000.TMP\windowsXPsp_text.htm
- %TEMP%\IXP000.TMP\windows2003sp_text.htm
- %TEMP%\IXP000.TMP\windows2000sp_text.htm
- %TEMP%\IXP000.TMP\windows2003sp_help.htm
Deletes the following files:
- %TEMP%\IXP000.TMP\RebootStub.exe
- %TEMP%\IXP000.TMP\baseline.dat
- %TEMP%\IXP000.TMP\HtmlLite.dll
- %TEMP%\IXP000.TMP\DeleteTemp.exe
- %TEMP%\IXP000.TMP\dlmgr.dll
- %TEMP%\IXP000.TMP\vs_setup.MS_
- %TEMP%\IXP000.TMP\vs_setup.pdi
- %TEMP%\IXP000.TMP\setup.sdb
- %TEMP%\IXP000.TMP\deffactory.dat
- %TEMP%\IXP000.TMP\locdata.ini
- %TEMP%\IXP000.TMP\SITSetup.dll
- %TEMP%\IXP000.TMP\ExpressUI.dll
- %TEMP%\IXP000.TMP\setup.exe
- %TEMP%\IXP000.TMP\CustomText.1033.dll
- %TEMP%\IXP000.TMP\setupres.dll
- %TEMP%\IXP000.TMP\vsbasereqs.dll
- %TEMP%\IXP000.TMP\vsscenario.dll
- %TEMP%\IXP000.TMP\vs70uimgr.dll
- %TEMP%\IXP000.TMP\gencomp.dll
- %TEMP%\IXP000.TMP\vs_setup.dll
- %TEMP%\IXP000.TMP\ExpressKnownIssues.htm
- %TEMP%\IXP000.TMP\readme.htm
- %TEMP%\IXP000.TMP\contents.htm
- %TEMP%\IXP000.TMP\windowsXPsp_text.htm
- %TEMP%\IXP000.TMP\BITS_Text.htm
- %TEMP%\IXP000.TMP\logo.bmp
- %TEMP%\msinterr.txt
- %TEMP%\IXP000.TMP\eula.1033.txt
- %TEMP%\IXP000.TMP\TOC.HTM
- %TEMP%\IXP000.TMP\Troubleshoot_Guide.htm
- %TEMP%\IXP000.TMP\ie6sp_help.htm
- %TEMP%\IXP000.TMP\ie6sp_text.htm
- %TEMP%\IXP000.TMP\IA64block_text.htm
- %TEMP%\IXP000.TMP\DW20.EXE
- %TEMP%\IXP000.TMP\DWINTL20.DLL
- %TEMP%\IXP000.TMP\windows2003sp_text.htm
- %TEMP%\IXP000.TMP\windowsXPsp_help.htm
- %TEMP%\IXP000.TMP\windows2003sp_help.htm
- %TEMP%\IXP000.TMP\windows2000sp_help.htm
- %TEMP%\IXP000.TMP\windows2000sp_text.htm
Substitutes the following files:
- %TEMP%\msinterr.txt
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'Program Manager'
Creates and executes the following:
- '%TEMP%\SIT12524.tmp\setup.exe' /web /CreatedTemp /NoExclude /InstalledFrom "%TEMP%\IXP000.TMP"
- '%TEMP%\IXP000.TMP\setup.exe' /web
Executes the following:
- '<SYSTEM32>\msiexec.exe' /V
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ngen.exe' queue continue
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ngen.exe' queue pause
