Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Classes\TurboMeeting\shell\open\command] '' = '"%APPDATA%\TurboMeeting\PCStarter.exe" %1'
Modifies file system
Creates the following files
- %TEMP%\tmsetup.txt
- %APPDATA%\turbomeeting\turbomeeting\sss.exe
- %APPDATA%\turbomeeting\turbomeeting\rsp1024hcmd.txt
- %APPDATA%\turbomeeting\turbomeeting\pcstarterxp.exe
- %APPDATA%\turbomeeting\turbomeeting\pcstarter.exe
- %APPDATA%\turbomeeting\turbomeeting\jsproxy.dll
- %APPDATA%\turbomeeting\turbomeeting\installservice.exe
- %APPDATA%\turbomeeting\turbomeeting\image\ymeetee.ico
- %APPDATA%\turbomeeting\turbomeeting\image\turbomeetingwatermark.png
- %APPDATA%\turbomeeting\turbomeeting\image\seperatorline.png
- %APPDATA%\turbomeeting\turbomeeting\dictionary_client_ger.tmd
- %APPDATA%\turbomeeting\turbomeeting\image\separator1.png
- %APPDATA%\turbomeeting\turbomeeting\image\mxmeeting.ico
- %APPDATA%\turbomeeting\turbomeeting\image\imdefault.png
- %APPDATA%\turbomeeting\turbomeeting\image\dummywebcam.png
- %APPDATA%\turbomeeting\turbomeeting\image\ctmeeting.ico
- %APPDATA%\turbomeeting\turbomeeting\image\applicationicon.ico
- %APPDATA%\turbomeeting\turbomeeting\dictionary_client_tur.tmd
- %APPDATA%\turbomeeting\turbomeeting\dictionary_client_spa.tmd
- %APPDATA%\turbomeeting\turbomeeting\dictionary_client_prt.tmd
- %APPDATA%\turbomeeting\turbomeeting\dictionary_client_jpn.tmd
- %APPDATA%\turbomeeting\turbomeeting\image\profileinfodialogbackground.bmp
- %APPDATA%\turbomeeting\turbomeeting\dictionary_client_ita.tmd
- %APPDATA%\turbomeeting\turbomeeting\tmdownloader.exe
- %APPDATA%\turbomeeting\pcstarter.exe
- %HOMEPATH%\desktop\turbomeeting.lnk
- %APPDATA%\turbomeeting\turbomeeting\setup_status.txt
- %APPDATA%\turbomeeting\turbomeeting\hookdll\tm1617218254.dll
- %TEMP%\svedetector.txt
- %APPDATA%\turbomeeting\turbomeeting\hookdll\tm1617218253.dll
- %APPDATA%\turbomeeting\turbomeeting\configure.xml
- %TEMP%\rsp1024h.txt
- %APPDATA%\turbomeeting\tmlauncher.exe
- %APPDATA%\turbomeeting\tminstaller.exe
- %APPDATA%\turbomeeting\turbomeeting\tmlauncher.exe
- %APPDATA%\turbomeeting\turbomeeting\tminstaller.exe
- %APPDATA%\turbomeeting\turbomeeting\cache.xml
- %APPDATA%\turbomeeting\turbomeeting\accessory_status.txt
- %APPDATA%\turbomeeting\turbomeeting\vistafunc.dll
- %APPDATA%\turbomeeting\turbomeeting\version.txt
- %APPDATA%\turbomeeting\turbomeeting\turbomeeting.exe
- %APPDATA%\turbomeeting\turbomeeting\turbomeeting.dll
- %APPDATA%\turbomeeting\turbomeeting\tmservice.exe
- %APPDATA%\turbomeeting\turbomeeting\tmresource.dll
- %APPDATA%\turbomeeting\turbomeeting\tmremover.exe
- %APPDATA%\turbomeeting\tmremover.exe
- %APPDATA%\turbomeeting\turbomeeting\dictionary_client_fre.tmd
- %APPDATA%\turbomeeting\turbomeeting\dictionary_client_eng.tmd
- %APPDATA%\turbomeeting\turbomeeting\dictionary_client_dth.tmd
- %TEMP%\tm_starter_dir\image\mxmeeting.ico
- %TEMP%\tm_starter_dir\image\imdefault.png
- %TEMP%\tm_starter_dir\image\dummywebcam.png
- %TEMP%\tm_starter_dir\image\ctmeeting.ico
- %TEMP%\tm_starter_dir\image\applicationicon.ico
- %TEMP%\tm_starter_dir\dictionary_client_tur.tmd
- %TEMP%\tm_starter_dir\dictionary_client_spa.tmd
- %TEMP%\tm_starter_dir\dictionary_client_prt.tmd
- %TEMP%\tm_starter_dir\image\separator1.png
- %TEMP%\tm_starter_dir\dictionary_client_jpn.tmd
- %TEMP%\tm_starter_dir\dictionary_client_ger.tmd
- %TEMP%\tm_starter_dir\dictionary_client_fre.tmd
- %TEMP%\tm_starter_dir\dictionary_client_eng.tmd
- %TEMP%\tm_starter_dir\dictionary_client_dth.tmd
- %TEMP%\tm_starter_dir\dictionary_client_chit.tmd
- %TEMP%\tm_starter_dir\dictionary_client_chi.tmd
- %TEMP%\tm_starter_dir\dbghelp.dll
- %TEMP%\tm_starter_dir\clientdatabase
- %TEMP%\pcclient.zip
- %TEMP%\tm_starter_dir\dictionary_client_ita.tmd
- %TEMP%\tm_starter_dir\image\seperatorline.png
- %TEMP%\tm_starter_dir\image\profileinfodialogbackground.bmp
- %TEMP%\tm_starter_dir\image\turbomeetingwatermark.png
- %APPDATA%\turbomeeting\turbomeeting\dictionary_client_chit.tmd
- %TEMP%\tm_starter_dir\turbomeeting.dll
- %APPDATA%\turbomeeting\turbomeeting\dictionary_client_chi.tmd
- %APPDATA%\turbomeeting\turbomeeting\dbghelp.dll
- %APPDATA%\turbomeeting\turbomeeting\clientdatabase
- %TEMP%\tminstaller.txt
- %TEMP%\tm_starter_dir\rsp1024hcmd.txt
- %TEMP%\tm_starter_dir\tmlauncher.exe
- %TEMP%\tm_starter_dir\vistafunc.dll
- %TEMP%\tm_starter_dir\version.txt
- %TEMP%\tm_starter_dir\turbomeeting.exe
- %TEMP%\tm_starter_dir\tmservice.exe
- %TEMP%\tm_starter_dir\image\ymeetee.ico
- %TEMP%\tm_starter_dir\tmresource.dll
- %TEMP%\tm_starter_dir\tmremover.exe
- %TEMP%\tm_starter_dir\tminstaller.exe
- %TEMP%\tm_starter_dir\tmdownloader.exe
- %TEMP%\tm_starter_dir\sss.exe
- %TEMP%\tm_starter_dir\pcstarterxp.exe
- %TEMP%\tm_starter_dir\pcstarter.exe
- %TEMP%\tm_starter_dir\jsproxy.dll
- %TEMP%\tm_starter_dir\installservice.exe
- %APPDATA%\microsoft\windows\start menu\programs\turbomeeting\turbomeeting start meeting.lnk
- %APPDATA%\microsoft\windows\start menu\programs\turbomeeting\turbomeeting uninstall.lnk
Deletes the following files
- %TEMP%\pcclient.zip
- %TEMP%\tm_starter_dir\installservice.exe
- %TEMP%\tm_starter_dir\jsproxy.dll
- %TEMP%\tm_starter_dir\pcstarter.exe
- %TEMP%\tm_starter_dir\pcstarterxp.exe
- %TEMP%\tm_starter_dir\rsp1024hcmd.txt
- %TEMP%\tm_starter_dir\sss.exe
- %TEMP%\tm_starter_dir\tmdownloader.exe
- %TEMP%\tm_starter_dir\dictionary_client_jpn.tmd
- %TEMP%\tm_starter_dir\tminstaller.exe
- %TEMP%\tm_starter_dir\tmremover.exe
- %TEMP%\tm_starter_dir\tmresource.dll
- %TEMP%\tm_starter_dir\tmservice.exe
- %TEMP%\tm_starter_dir\turbomeeting.dll
- %TEMP%\tm_starter_dir\turbomeeting.exe
- %TEMP%\tm_starter_dir\version.txt
- %TEMP%\tm_starter_dir\vistafunc.dll
- %TEMP%\tm_starter_dir\image\turbomeetingwatermark.png
- %TEMP%\tm_starter_dir\image\ymeetee.ico
- %TEMP%\tm_starter_dir\image\seperatorline.png
- %TEMP%\tm_starter_dir\image\separator1.png
- %TEMP%\tm_starter_dir\image\profileinfodialogbackground.bmp
- %TEMP%\tm_starter_dir\dbghelp.dll
- %TEMP%\tm_starter_dir\dictionary_client_chi.tmd
- %TEMP%\tm_starter_dir\dictionary_client_chit.tmd
- %TEMP%\tm_starter_dir\dictionary_client_dth.tmd
- %TEMP%\tm_starter_dir\dictionary_client_eng.tmd
- %TEMP%\tm_starter_dir\dictionary_client_fre.tmd
- %TEMP%\tm_starter_dir\dictionary_client_ger.tmd
- %APPDATA%\turbomeeting\turbomeeting\hookdll\tm1617218253.dll
- %TEMP%\tm_starter_dir\tmlauncher.exe
- %TEMP%\tm_starter_dir\dictionary_client_ita.tmd
- %TEMP%\tm_starter_dir\dictionary_client_spa.tmd
- %TEMP%\tm_starter_dir\dictionary_client_tur.tmd
- %TEMP%\tm_starter_dir\image\applicationicon.ico
- %TEMP%\tm_starter_dir\image\ctmeeting.ico
- %TEMP%\tm_starter_dir\image\dummywebcam.png
- %TEMP%\tm_starter_dir\image\imdefault.png
- %TEMP%\tm_starter_dir\image\mxmeeting.ico
- %TEMP%\tm_starter_dir\clientdatabase
- %TEMP%\tm_starter_dir\dictionary_client_prt.tmd
- %APPDATA%\turbomeeting\turbomeeting\rsp1024hcmd.txt
Deletes itself.
Network activity
Connects to
- 'su#####.aims.wisc.edu':443
- 'su#####.aims.wisc.edu':80
TCP
- 'su#####.aims.wisc.edu':443
UDP
- DNS ASK su#####.aims.wisc.edu
Miscellaneous
Searches for the following windows
- ClassName: 'TurboMeetingMainWindowClass' WindowName: ''
- ClassName: 'TMSetupWindow' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Creates and executes the following
- '%TEMP%\tm_starter_dir\tmlauncher.exe'
- '%APPDATA%\turbomeeting\turbomeeting\turbomeeting.exe' --program %APPDATA%\TurboMeeting\TurboMeeting\rsp1024hcmd.txt
- '%APPDATA%\turbomeeting\turbomeeting\turbomeeting.exe' --VSEDetect
- '%TEMP%\tm_starter_dir\tmlauncher.exe' ' (with hidden window)
