Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\FLVFile\shell\open\command] '' = '"%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:5 /Play "%L"'
- [<HKLM>\Software\Classes\MP4File\shell\open\command] '' = '"%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:5 /Play "%L"'
- [<HKLM>\Software\Classes\MKVFile\shell\open\command] '' = '"%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe" /prefetch:5 /Play "%L"'
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\audioswitcher.ax
- %CommonProgramFiles(x86)%\gabest\set382a.tmp
- %CommonProgramFiles(x86)%\gabest\set37fa.tmp
- %CommonProgramFiles(x86)%\gabest\set37ca.tmp
- %CommonProgramFiles(x86)%\gabest\set379a.tmp
- %CommonProgramFiles(x86)%\gabest\set376b.tmp
- %CommonProgramFiles(x86)%\gabest\set373b.tmp
- %CommonProgramFiles(x86)%\gabest\set36ec.tmp
- %CommonProgramFiles(x86)%\gabest\set36bc.tmp
- %TEMP%\ixp000.tmp\w95inf32.dll
- %CommonProgramFiles(x86)%\gabest\set368c.tmp
- %CommonProgramFiles(x86)%\gabest\set363c.tmp
- %CommonProgramFiles(x86)%\gabest\set360c.tmp
- %CommonProgramFiles(x86)%\gabest\set35dc.tmp
- %CommonProgramFiles(x86)%\gabest\set358d.tmp
- %CommonProgramFiles(x86)%\gabest\set356d.tmp
- %CommonProgramFiles(x86)%\gabest\set351d.tmp
- %CommonProgramFiles(x86)%\gabest\set3480.tmp
- %WINDIR%\inf\set3450.tmp
- %CommonProgramFiles(x86)%\gabest\set365c.tmp
- %TEMP%\ixp000.tmp\w95inf16.dll
- %CommonProgramFiles(x86)%\gabest\set385a.tmp
- %CommonProgramFiles(x86)%\gabest\set3af5.tmp
- %CommonProgramFiles(x86)%\gabest\set3ca4.tmp
- %CommonProgramFiles(x86)%\gabest\set3c84.tmp
- %CommonProgramFiles(x86)%\gabest\set3c54.tmp
- %CommonProgramFiles(x86)%\gabest\set3c34.tmp
- %CommonProgramFiles(x86)%\gabest\set3c13.tmp
- %CommonProgramFiles(x86)%\gabest\set3bf3.tmp
- %CommonProgramFiles(x86)%\gabest\set3bc3.tmp
- %CommonProgramFiles(x86)%\gabest\set3b84.tmp
- %CommonProgramFiles(x86)%\gabest\set38d9.tmp
- %CommonProgramFiles(x86)%\gabest\set3899.tmp
- %CommonProgramFiles(x86)%\gabest\set3ac5.tmp
- %CommonProgramFiles(x86)%\gabest\set3a95.tmp
- %CommonProgramFiles(x86)%\gabest\set3a66.tmp
- %CommonProgramFiles(x86)%\gabest\set3a36.tmp
- %CommonProgramFiles(x86)%\gabest\set39f6.tmp
- %CommonProgramFiles(x86)%\gabest\set39c6.tmp
- %CommonProgramFiles(x86)%\gabest\set3996.tmp
- %CommonProgramFiles(x86)%\gabest\set3967.tmp
- %CommonProgramFiles(x86)%\gabest\set3b54.tmp
- %TEMP%\ixp000.tmp\advpack.dll
- %TEMP%\ixp000.tmp\wavdest.ax
- %TEMP%\ixp000.tmp\vtsreader.ax
- %TEMP%\ixp000.tmp\matroskamuxer.ax
- %TEMP%\ixp000.tmp\flvsplitter.ax
- %TEMP%\ixp000.tmp\flicsource.ax
- %TEMP%\ixp000.tmp\flacsource.ax
- %TEMP%\ixp000.tmp\dtsac3source.ax
- %TEMP%\ixp000.tmp\dsmsplitter.ax
- %TEMP%\ixp000.tmp\dsmmuxer.ax
- %TEMP%\ixp000.tmp\meritmgr.exe
- %TEMP%\ixp000.tmp\decssfilter.ax
- %TEMP%\ixp000.tmp\copying.txt
- %TEMP%\ixp000.tmp\changelog.txt
- %TEMP%\ixp000.tmp\cdxareader.ax
- %TEMP%\ixp000.tmp\cddareader.ax
- %TEMP%\ixp000.tmp\bufferfilter.ax
- %TEMP%\ixp000.tmp\avisplitter.ax
- %TEMP%\ixp000.tmp\avi2ac3filter.ax
- %TEMP%\ixp000.tmp\authors.txt
- %TEMP%\ixp000.tmp\d2vsource.ax
- %TEMP%\ixp000.tmp\mp4splitter.ax
- %TEMP%\ixp000.tmp\matroskasplitter.ax
- %TEMP%\ixp000.tmp\mpadecfilter.ax
- %TEMP%\ixp000.tmp\vsfilter.dll
- %TEMP%\ixp000.tmp\readme.txt
- %TEMP%\ixp000.tmp\udpreader.ax
- %TEMP%\ixp000.tmp\subtitlesource.ax
- %TEMP%\ixp000.tmp\streamdrivethru.ax
- %TEMP%\ixp000.tmp\ssfsplitter.ax
- %TEMP%\ixp000.tmp\shoutcastsource.ax
- %TEMP%\ixp000.tmp\setacl_x86.exe
- %TEMP%\ixp000.tmp\roqsplitter.ax
- %TEMP%\ixp000.tmp\realmediasplitter.ax
- %TEMP%\ixp000.tmp\pclemp4filereader.ax
- %TEMP%\ixp000.tmp\mpasplitter.ax
- %TEMP%\ixp000.tmp\oggsplitter.ax
- %TEMP%\ixp000.tmp\mpegsplitter.inf
- %TEMP%\ixp000.tmp\mpegsplitter.ax
- %TEMP%\ixp000.tmp\mpeg2decfilter.ax
- %TEMP%\ixp000.tmp\mpcvideodec.inf
- %TEMP%\ixp000.tmp\mpcvideodec.ax
- %TEMP%\ixp000.tmp\mpcaudiorendererfilter.ax
- %TEMP%\ixp000.tmp\mpcaudiorenderer.ax
- %CommonProgramFiles(x86)%\gabest\set3cc4.tmp
- %CommonProgramFiles(x86)%\gabest\set3cd5.tmp
Moves the following files
- from %WINDIR%\inf\set3450.tmp to %WINDIR%\inf\mpcvideodec.inf
- from %CommonProgramFiles(x86)%\gabest\set3996.tmp to %CommonProgramFiles(x86)%\gabest\mpcaudiorenderer.ax
- from %CommonProgramFiles(x86)%\gabest\set39c6.tmp to %CommonProgramFiles(x86)%\gabest\mpcaudiorendererfilter.ax
- from %CommonProgramFiles(x86)%\gabest\set39f6.tmp to %CommonProgramFiles(x86)%\gabest\mpeg2decfilter.ax
- from %CommonProgramFiles(x86)%\gabest\set3a36.tmp to %CommonProgramFiles(x86)%\gabest\mpegsplitter.ax
- from %CommonProgramFiles(x86)%\gabest\set3a66.tmp to %CommonProgramFiles(x86)%\gabest\oggsplitter.ax
- from %CommonProgramFiles(x86)%\gabest\set3a95.tmp to %CommonProgramFiles(x86)%\gabest\pclemp4filereader.ax
- from %CommonProgramFiles(x86)%\gabest\set3ac5.tmp to %CommonProgramFiles(x86)%\gabest\realmediasplitter.ax
- from %CommonProgramFiles(x86)%\gabest\set3af5.tmp to %CommonProgramFiles(x86)%\gabest\roqsplitter.ax
- from %CommonProgramFiles(x86)%\gabest\set3b54.tmp to %CommonProgramFiles(x86)%\gabest\shoutcastsource.ax
- from %CommonProgramFiles(x86)%\gabest\set3b84.tmp to %CommonProgramFiles(x86)%\gabest\ssfsplitter.ax
- from %CommonProgramFiles(x86)%\gabest\set3bc3.tmp to %CommonProgramFiles(x86)%\gabest\streamdrivethru.ax
- from %CommonProgramFiles(x86)%\gabest\set3bf3.tmp to %CommonProgramFiles(x86)%\gabest\subtitlesource.ax
- from %CommonProgramFiles(x86)%\gabest\set3c13.tmp to %CommonProgramFiles(x86)%\gabest\udpreader.ax
- from %CommonProgramFiles(x86)%\gabest\set3c34.tmp to %CommonProgramFiles(x86)%\gabest\vtsreader.ax
- from %CommonProgramFiles(x86)%\gabest\set3c54.tmp to %CommonProgramFiles(x86)%\gabest\wavdest.ax
- from %CommonProgramFiles(x86)%\gabest\set3c84.tmp to %CommonProgramFiles(x86)%\gabest\authors.txt
- from %CommonProgramFiles(x86)%\gabest\set3ca4.tmp to %CommonProgramFiles(x86)%\gabest\changelog.txt
- from %CommonProgramFiles(x86)%\gabest\set3967.tmp to %CommonProgramFiles(x86)%\gabest\mpasplitter.ax
- from %CommonProgramFiles(x86)%\gabest\set3cc4.tmp to %CommonProgramFiles(x86)%\gabest\copying.txt
- from %CommonProgramFiles(x86)%\gabest\set38d9.tmp to %CommonProgramFiles(x86)%\gabest\mpadecfilter.ax
- from %CommonProgramFiles(x86)%\gabest\set385a.tmp to %CommonProgramFiles(x86)%\gabest\matroskasplitter.ax
- from %CommonProgramFiles(x86)%\gabest\set3480.tmp to %CommonProgramFiles(x86)%\gabest\mpcvideodec.ax
- from %CommonProgramFiles(x86)%\gabest\set351d.tmp to %CommonProgramFiles(x86)%\gabest\vsfilter.dll
- from %CommonProgramFiles(x86)%\gabest\set356d.tmp to %CommonProgramFiles(x86)%\gabest\audioswitcher.ax
- from %CommonProgramFiles(x86)%\gabest\set358d.tmp to %CommonProgramFiles(x86)%\gabest\avi2ac3filter.ax
- from %CommonProgramFiles(x86)%\gabest\set35dc.tmp to %CommonProgramFiles(x86)%\gabest\avisplitter.ax
- from %CommonProgramFiles(x86)%\gabest\set360c.tmp to %CommonProgramFiles(x86)%\gabest\bufferfilter.ax
- from %CommonProgramFiles(x86)%\gabest\set363c.tmp to %CommonProgramFiles(x86)%\gabest\cddareader.ax
- from %CommonProgramFiles(x86)%\gabest\set365c.tmp to %CommonProgramFiles(x86)%\gabest\cdxareader.ax
- from %CommonProgramFiles(x86)%\gabest\set368c.tmp to %CommonProgramFiles(x86)%\gabest\d2vsource.ax
- from %CommonProgramFiles(x86)%\gabest\set36bc.tmp to %CommonProgramFiles(x86)%\gabest\decssfilter.ax
- from %CommonProgramFiles(x86)%\gabest\set36ec.tmp to %CommonProgramFiles(x86)%\gabest\dsmmuxer.ax
- from %CommonProgramFiles(x86)%\gabest\set373b.tmp to %CommonProgramFiles(x86)%\gabest\dsmsplitter.ax
- from %CommonProgramFiles(x86)%\gabest\set376b.tmp to %CommonProgramFiles(x86)%\gabest\dtsac3source.ax
- from %CommonProgramFiles(x86)%\gabest\set379a.tmp to %CommonProgramFiles(x86)%\gabest\flacsource.ax
- from %CommonProgramFiles(x86)%\gabest\set37ca.tmp to %CommonProgramFiles(x86)%\gabest\flicsource.ax
- from %CommonProgramFiles(x86)%\gabest\set37fa.tmp to %CommonProgramFiles(x86)%\gabest\flvsplitter.ax
- from %CommonProgramFiles(x86)%\gabest\set382a.tmp to %CommonProgramFiles(x86)%\gabest\matroskamuxer.ax
- from %CommonProgramFiles(x86)%\gabest\set3899.tmp to %CommonProgramFiles(x86)%\gabest\mp4splitter.ax
- from %CommonProgramFiles(x86)%\gabest\set3cd5.tmp to %CommonProgramFiles(x86)%\gabest\readme.txt
Miscellaneous
Creates and executes the following
- '%TEMP%\ixp000.tmp\setacl_x86.exe' -ot reg -on HKLM\SOFTWARE\Microsoft\DirectShow\Preferred -actn setowner -ownr n:Administrators;s:n
- '%TEMP%\ixp000.tmp\setacl_x86.exe' -ot reg -on HKLM\SOFTWARE\Microsoft\DirectShow\Preferred -actn ace -ace n:Administrators;p:full;s:n;i:so,sc;m:grant;w:dacl
- '%TEMP%\ixp000.tmp\meritmgr.exe' -merit 0x00910000 -guid {008BAC12-FBAF-497B-9670-BC6F6FBAE2C4}
- '%TEMP%\ixp000.tmp\meritmgr.exe' -merit 0x00820000 -guid {39F498AF-1A09-4275-B193-673B0BA3D478}
