Trojan.DownLoader35.25786

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-tkcu0.tmp\<File name>.tmp
%ProgramFiles(x86)%\jwis copy\skins\0\is-5c3pu.tmp
%ProgramFiles(x86)%\jwis copy\is-l7fp3.tmp
%ProgramFiles(x86)%\jwis copy\is-r3ir3.tmp
%ProgramFiles(x86)%\jwis copy\is-que4f.tmp
%ProgramFiles(x86)%\jwis copy\is-5jqfh.tmp
%ProgramFiles(x86)%\jwis copy\is-oejk4.tmp
%ProgramFiles(x86)%\jwis copy\skins\0\is-5bvo2.tmp
%ProgramFiles(x86)%\jwis copy\is-6p2da.tmp
%ProgramFiles(x86)%\jwis copy\is-9g8sp.tmp
%ProgramFiles(x86)%\jwis copy\is-nhilc.tmp
%WINDIR%\is-2egeh.tmp
%ProgramFiles(x86)%\jwis copy\help\is-vle3l.tmp
%WINDIR%\syswow64\is-76m1e.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\jwis copy\iwis copy.lnk
%ProgramFiles(x86)%\jwis copy\skins\0\is-1jb25.tmp
%ProgramFiles(x86)%\jwis copy\skins\0\is-fii0o.tmp
%ProgramFiles(x86)%\jwis copy\skins\0\is-4ndpg.tmp
%ProgramFiles(x86)%\jwis copy\skins\0\is-afb07.tmp
%ProgramFiles(x86)%\jwis copy\skins\0\is-gieij.tmp
%TEMP%\is-tltu5.tmp\_isetup\_setup64.tmp
%TEMP%\is-tltu5.tmp\_isetup\_shfoldr.dll
%TEMP%\is-tltu5.tmp\_isetup\_isdecmp.dll
%TEMP%\is-tltu5.tmp\_isetup\_iscrypt.dll
%ProgramFiles(x86)%\jwis copy\is-rh00t.tmp
%ProgramFiles(x86)%\jwis copy\language\is-6nvvu.tmp
%ProgramFiles(x86)%\jwis copy\windvdcopy.url
%ProgramFiles(x86)%\jwis copy\is-me9mh.tmp
%ProgramFiles(x86)%\jwis copy\skins\0\is-7ijhe.tmp
%ProgramFiles(x86)%\jwis copy\skins\0\is-8ne5m.tmp
%ProgramFiles(x86)%\jwis copy\skins\0\is-d2cp2.tmp
%ProgramFiles(x86)%\jwis copy\skins\0\is-o2pl9.tmp
%ProgramFiles(x86)%\jwis copy\skins\0\is-so5ak.tmp
%ProgramFiles(x86)%\jwis copy\skins\0\is-fjvuj.tmp
%ProgramFiles(x86)%\jwis copy\skins\0\is-l5egn.tmp
%TEMP%\is-tltu5.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\jwis copy\skins\0\is-87p5e.tmp
%ProgramFiles(x86)%\jwis copy\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\jwis copy\is-rh00t.tmp to %ProgramFiles(x86)%\jwis copy\unins000.exe
from %WINDIR%\is-2egeh.tmp to %WINDIR%\windvdbootrecdoe.sys
from %ProgramFiles(x86)%\jwis copy\is-nhilc.tmp to %ProgramFiles(x86)%\jwis copy\readme.txt
from %ProgramFiles(x86)%\jwis copy\is-9g8sp.tmp to %ProgramFiles(x86)%\jwis copy\videoburn.dll
from %ProgramFiles(x86)%\jwis copy\is-me9mh.tmp to %ProgramFiles(x86)%\jwis copy\fileio.dll
from %ProgramFiles(x86)%\jwis copy\is-6p2da.tmp to %ProgramFiles(x86)%\jwis copy\aspi.dll
from %ProgramFiles(x86)%\jwis copy\is-oejk4.tmp to %ProgramFiles(x86)%\jwis copy\dvdcopy.dll
from %ProgramFiles(x86)%\jwis copy\is-5jqfh.tmp to %ProgramFiles(x86)%\jwis copy\core.dll
from %ProgramFiles(x86)%\jwis copy\is-que4f.tmp to %ProgramFiles(x86)%\jwis copy\avidvdcopy.exe
from %ProgramFiles(x86)%\jwis copy\is-r3ir3.tmp to %ProgramFiles(x86)%\jwis copy\dvd2one.dll
from %ProgramFiles(x86)%\jwis copy\is-l7fp3.tmp to %ProgramFiles(x86)%\jwis copy\mpeg2videotranslator.dll
from %ProgramFiles(x86)%\jwis copy\skins\0\is-5c3pu.tmp to %ProgramFiles(x86)%\jwis copy\skins\0\animation.gif
from %ProgramFiles(x86)%\jwis copy\skins\0\is-fii0o.tmp to %ProgramFiles(x86)%\jwis copy\skins\0\copynow.bmp
from %ProgramFiles(x86)%\jwis copy\help\is-vle3l.tmp to %ProgramFiles(x86)%\jwis copy\help\winavi dvd copy help.chm
from %ProgramFiles(x86)%\jwis copy\skins\0\is-1jb25.tmp to %ProgramFiles(x86)%\jwis copy\skins\0\setting.bmp
from %ProgramFiles(x86)%\jwis copy\skins\0\is-afb07.tmp to %ProgramFiles(x86)%\jwis copy\skins\0\down.bmp
from %ProgramFiles(x86)%\jwis copy\skins\0\is-gieij.tmp to %ProgramFiles(x86)%\jwis copy\skins\0\wizard.bmp
from %ProgramFiles(x86)%\jwis copy\skins\0\is-l5egn.tmp to %ProgramFiles(x86)%\jwis copy\skins\0\splash.bmp
from %ProgramFiles(x86)%\jwis copy\skins\0\is-fjvuj.tmp to %ProgramFiles(x86)%\jwis copy\skins\0\min.bmp
from %ProgramFiles(x86)%\jwis copy\skins\0\is-so5ak.tmp to %ProgramFiles(x86)%\jwis copy\skins\0\menu.bmp
from %ProgramFiles(x86)%\jwis copy\skins\0\is-o2pl9.tmp to %ProgramFiles(x86)%\jwis copy\skins\0\help.bmp
from %ProgramFiles(x86)%\jwis copy\skins\0\is-d2cp2.tmp to %ProgramFiles(x86)%\jwis copy\skins\0\close.bmp
from %ProgramFiles(x86)%\jwis copy\skins\0\is-8ne5m.tmp to %ProgramFiles(x86)%\jwis copy\skins\0\web.bmp
from %ProgramFiles(x86)%\jwis copy\skins\0\is-87p5e.tmp to %ProgramFiles(x86)%\jwis copy\skins\0\buynow.bmp
from %ProgramFiles(x86)%\jwis copy\skins\0\is-5bvo2.tmp to %ProgramFiles(x86)%\jwis copy\skins\0\background.bmp
from %ProgramFiles(x86)%\jwis copy\skins\0\is-7ijhe.tmp to %ProgramFiles(x86)%\jwis copy\skins\0\skin.ini
from %ProgramFiles(x86)%\jwis copy\language\is-6nvvu.tmp to %ProgramFiles(x86)%\jwis copy\language\english.ini
from %ProgramFiles(x86)%\jwis copy\skins\0\is-4ndpg.tmp to %ProgramFiles(x86)%\jwis copy\skins\0\select.bmp
from %WINDIR%\syswow64\is-76m1e.tmp to %WINDIR%\syswow64\sqlite3.dll