Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32] 'vidc.XVID' = 'xvidvfw.dll'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\7zipsfx.000\video avatar.exe
- %WINDIR%\winsxs\installtemp\20230819152834856.0\mfc80.dll
- %WINDIR%\winsxs\installtemp\20230819152834856.0\mfc80u.dll
- %WINDIR%\winsxs\installtemp\20230819152834856.0\mfcm80.dll
- %WINDIR%\winsxs\installtemp\20230819152834856.0\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05.cat
- %WINDIR%\winsxs\installtemp\20230819152834856.0\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05.manifest
- %WINDIR%\winsxs\installtemp\20230819152834746.0\msvcm80.dll
- %WINDIR%\winsxs\installtemp\20230819152834746.0\msvcp80.dll
- %WINDIR%\winsxs\installtemp\20230819152834746.0\msvcr80.dll
- %WINDIR%\winsxs\installtemp\20230819152834746.0\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.cat
- %WINDIR%\winsxs\installtemp\20230819152834746.0\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.manifest
- %WINDIR%\winsxs\installtemp\20230819152835016.0\x86_microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303.manifest
- %WINDIR%\winsxs\installtemp\20230819152834856.0\mfcm80u.dll
- %WINDIR%\winsxs\installtemp\20230819152834686.0\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474.manifest
- %TEMP%\ixp001.tmp\vcredis1.cab
- %TEMP%\ixp001.tmp\vcredist.msi
- %TEMP%\ixp000.tmp\vcredi~3.exe
- %ProgramFiles(x86)%\geovid\video avatar\unins000.dat
- %ProgramFiles(x86)%\geovid\video avatar\homepage.url
- %HOMEPATH%\desktop\video avatar.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\video avatar\home page.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\video avatar\video avatar.lnk
- %ProgramFiles(x86)%\geovid\video avatar\is-vsj0e.tmp
- %WINDIR%\winsxs\installtemp\20230819152834686.0\atl80.dll
- %WINDIR%\syswow64\is-4g00i.tmp
- %WINDIR%\winsxs\installtemp\20230819152835016.0\x86_microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303.cat
- %WINDIR%\installer\$patchcache$\managed\b25099274a207264182f8181add555d0\8.0.56336\ul_atl80.dll.97f81af1_0e47_dc99_ff1f_c8b3b9a1e18e
- %CommonProgramFiles(x86)%\microsoft shared\vc\msdia80.dll
- %WINDIR%\winsxs\installtemp\20230819152835246.0\8.0.50727.762.cat
- %WINDIR%\winsxs\installtemp\20230819152835246.0\8.0.50727.762.policy
- %WINDIR%\winsxs\installtemp\20230819152835226.0\8.0.50727.762.cat
- %WINDIR%\winsxs\installtemp\20230819152835226.0\8.0.50727.762.policy
- %WINDIR%\winsxs\installtemp\20230819152835156.0\8.0.50727.762.cat
- %WINDIR%\winsxs\installtemp\20230819152835156.0\8.0.50727.762.policy
- %WINDIR%\winsxs\installtemp\20230819152835146.0\8.0.50727.762.cat
- %WINDIR%\winsxs\installtemp\20230819152835146.0\8.0.50727.762.policy
- %WINDIR%\winsxs\installtemp\20230819152835126.0\8.0.50727.762.cat
- %WINDIR%\winsxs\installtemp\20230819152835126.0\8.0.50727.762.policy
- %WINDIR%\winsxs\installtemp\20230819152835096.0\vcomp.dll
- %WINDIR%\winsxs\installtemp\20230819152835096.0\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a.cat
- %WINDIR%\winsxs\installtemp\20230819152835096.0\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a.manifest
- %WINDIR%\winsxs\installtemp\20230819152835016.0\mfc80kor.dll
- %WINDIR%\winsxs\installtemp\20230819152835016.0\mfc80jpn.dll
- %WINDIR%\winsxs\installtemp\20230819152835016.0\mfc80ita.dll
- %WINDIR%\winsxs\installtemp\20230819152835016.0\mfc80fra.dll
- %WINDIR%\winsxs\installtemp\20230819152835016.0\mfc80deu.dll
- %WINDIR%\winsxs\installtemp\20230819152835016.0\mfc80enu.dll
- %WINDIR%\winsxs\installtemp\20230819152835016.0\mfc80esp.dll
- %WINDIR%\winsxs\installtemp\20230819152835016.0\mfc80cht.dll
- %ProgramFiles(x86)%\geovid\video avatar\is-fnevr.tmp
- %WINDIR%\winsxs\installtemp\20230819152834686.0\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474.cat
- %ProgramFiles(x86)%\geovid\video avatar\is-drkoj.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-fba3p.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-vogqf.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-lhn4p.tmp
- %ProgramFiles(x86)%\geovid\video avatar\lang\is-06it9.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-uokmf.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-bqf1o.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-gflbl.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-0jrk9.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-2vs99.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-glbat.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-amajm.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-be9ct.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-itnvj.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-hdurs.tmp
- %ProgramFiles(x86)%\geovid\video avatar\lang\is-sha02.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-jc82b.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-b4lbm.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-pv0cj.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-gf6ge.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-cqq3r.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-ku03p.tmp
- %TEMP%\is-ljkjk.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-ljkjk.tmp\_isetup\_setup64.tmp
- %TEMP%\is-ljkjk.tmp\_isetup\_regdll.tmp
- %TEMP%\is-omok9.tmp\video avatar.tmp
- %WINDIR%\installer\$patchcache$\managed\b25099274a207264182f8181add555d0\8.0.56336\ul_msvcr80.dll.98cb24ad_52fb_db5f_ff1f_c8b3b9a1e18e
- %WINDIR%\winsxs\installtemp\20230819152835016.0\mfc80chs.dll
- %WINDIR%\syswow64\is-s7vou.tmp
- %WINDIR%\syswow64\is-3ffgh.tmp
- %ProgramFiles(x86)%\geovid\video avatar\lang\is-a6rrh.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-su2v8.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-knp08.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-9mg4a.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-pb8qc.tmp
- %CommonProgramFiles(x86)%\geovid\wmv\is-norm8.tmp
- %CommonProgramFiles(x86)%\geovid\wmv\is-1vh9f.tmp
- %CommonProgramFiles(x86)%\geovid\wmv\is-tvori.tmp
- %ALLUSERSPROFILE%\geovid\wmvconfig\is-lht8e.tmp
- %ALLUSERSPROFILE%\geovid\wmvconfig\is-opo02.tmp
- %ALLUSERSPROFILE%\geovid\wmvconfig\is-1u26e.tmp
- %ALLUSERSPROFILE%\geovid\wmvconfig\is-j1t6o.tmp
- %ALLUSERSPROFILE%\geovid\wmvconfig\is-hqhgs.tmp
- %ALLUSERSPROFILE%\geovid\wmvconfig\is-gutbu.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-lcudd.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-pg5n5.tmp
- %WINDIR%\syswow64\is-5nc3u.tmp
- %WINDIR%\syswow64\is-omht5.tmp
- %WINDIR%\syswow64\is-h1ool.tmp
- %ProgramFiles(x86)%\geovid\video avatar\is-9iki0.tmp
- %WINDIR%\syswow64\is-laolt.tmp
- %WINDIR%\syswow64\is-r7mau.tmp
- %WINDIR%\syswow64\is-8sm6d.tmp
- %WINDIR%\syswow64\is-gs9v1.tmp
- %TEMP%\msif2809.log
Перемещает следующие файлы
- %ProgramFiles(x86)%\geovid\video avatar\is-ku03p.tmp в %ProgramFiles(x86)%\geovid\video avatar\unins000.exe
- %ProgramFiles(x86)%\geovid\video avatar\is-9iki0.tmp в %ProgramFiles(x86)%\geovid\video avatar\vcredist_x86_sp1.exe
- %WINDIR%\syswow64\is-h1ool.tmp в %WINDIR%\syswow64\xvid.ax
- %WINDIR%\syswow64\is-omht5.tmp в %WINDIR%\syswow64\xvidcore.dll
- %WINDIR%\syswow64\is-5nc3u.tmp в %WINDIR%\syswow64\xvidvfw.dll
- %ProgramFiles(x86)%\geovid\video avatar\is-pg5n5.tmp в %ProgramFiles(x86)%\geovid\video avatar\lamedshowencoder.dll
- %ProgramFiles(x86)%\geovid\video avatar\is-lcudd.tmp в %ProgramFiles(x86)%\geovid\video avatar\wmvconfig.dll
- %ALLUSERSPROFILE%\geovid\wmvconfig\is-gutbu.tmp в %ALLUSERSPROFILE%\geovid\wmvconfig\1.prx
- %ALLUSERSPROFILE%\geovid\wmvconfig\is-hqhgs.tmp в %ALLUSERSPROFILE%\geovid\wmvconfig\2.prx
- %ALLUSERSPROFILE%\geovid\wmvconfig\is-j1t6o.tmp в %ALLUSERSPROFILE%\geovid\wmvconfig\3.prx
- %ALLUSERSPROFILE%\geovid\wmvconfig\is-1u26e.tmp в %ALLUSERSPROFILE%\geovid\wmvconfig\4.prx
- %ALLUSERSPROFILE%\geovid\wmvconfig\is-lht8e.tmp в %ALLUSERSPROFILE%\geovid\wmvconfig\cust.prx
- %ProgramFiles(x86)%\geovid\video avatar\is-fnevr.tmp в %ProgramFiles(x86)%\geovid\video avatar\gvsourcefilter.dll
- %CommonProgramFiles(x86)%\geovid\wmv\is-tvori.tmp в %CommonProgramFiles(x86)%\geovid\wmv\wmfdist.exe
- %CommonProgramFiles(x86)%\geovid\wmv\is-1vh9f.tmp в %CommonProgramFiles(x86)%\geovid\wmv\wmenceng.dll
- %CommonProgramFiles(x86)%\geovid\wmv\is-norm8.tmp в %CommonProgramFiles(x86)%\geovid\wmv\wmexres.dll
- %ProgramFiles(x86)%\geovid\video avatar\is-pb8qc.tmp в %ProgramFiles(x86)%\geovid\video avatar\avcodec-51.dll
- %ProgramFiles(x86)%\geovid\video avatar\is-9mg4a.tmp в %ProgramFiles(x86)%\geovid\video avatar\avformat-51.dll
- %ProgramFiles(x86)%\geovid\video avatar\is-knp08.tmp в %ProgramFiles(x86)%\geovid\video avatar\avutil-49.dll
- %ProgramFiles(x86)%\geovid\video avatar\is-su2v8.tmp в %ProgramFiles(x86)%\geovid\video avatar\libamrnb-3.dll
- %ProgramFiles(x86)%\geovid\video avatar\is-vogqf.tmp в %ProgramFiles(x86)%\geovid\video avatar\libamrwb-3.dll
- %ProgramFiles(x86)%\geovid\video avatar\is-fba3p.tmp в %ProgramFiles(x86)%\geovid\video avatar\libfaac.dll
- %ProgramFiles(x86)%\geovid\video avatar\is-drkoj.tmp в %ProgramFiles(x86)%\geovid\video avatar\libmp3lame-0.dll
- %WINDIR%\syswow64\is-laolt.tmp в %WINDIR%\syswow64\msvcr71.dll
- %ALLUSERSPROFILE%\geovid\wmvconfig\is-opo02.tmp в %ALLUSERSPROFILE%\geovid\wmvconfig\5.prx
- %WINDIR%\syswow64\is-r7mau.tmp в %WINDIR%\syswow64\msvcp71.dll
- %ProgramFiles(x86)%\geovid\video avatar\is-glbat.tmp в %ProgramFiles(x86)%\geovid\video avatar\pictcodec.dll
- %ProgramFiles(x86)%\geovid\video avatar\is-cqq3r.tmp в %ProgramFiles(x86)%\geovid\video avatar\videoavatar.exe
- %ProgramFiles(x86)%\geovid\video avatar\is-gf6ge.tmp в %ProgramFiles(x86)%\geovid\video avatar\mediaengine.dll
- %ProgramFiles(x86)%\geovid\video avatar\is-pv0cj.tmp в %ProgramFiles(x86)%\geovid\video avatar\exportrenderers.dll
- %ProgramFiles(x86)%\geovid\video avatar\is-b4lbm.tmp в %ProgramFiles(x86)%\geovid\video avatar\medialog.dll
- %ProgramFiles(x86)%\geovid\video avatar\is-jc82b.tmp в %ProgramFiles(x86)%\geovid\video avatar\mediasettings.dll
- %ProgramFiles(x86)%\geovid\video avatar\is-hdurs.tmp в %ProgramFiles(x86)%\geovid\video avatar\commondialogs.dll
- %ProgramFiles(x86)%\geovid\video avatar\is-lhn4p.tmp в %ProgramFiles(x86)%\geovid\video avatar\muisupport.dll
- %ProgramFiles(x86)%\geovid\video avatar\is-itnvj.tmp в %ProgramFiles(x86)%\geovid\video avatar\softbitmaplib.dll
- %ProgramFiles(x86)%\geovid\video avatar\is-be9ct.tmp в %ProgramFiles(x86)%\geovid\video avatar\zlib1.dll
- %ProgramFiles(x86)%\geovid\video avatar\is-amajm.tmp в %ProgramFiles(x86)%\geovid\video avatar\zlib.dll
- %ProgramFiles(x86)%\geovid\video avatar\is-2vs99.tmp в %ProgramFiles(x86)%\geovid\video avatar\isobuilderdll.dll
- %WINDIR%\syswow64\is-3ffgh.tmp в %WINDIR%\syswow64\mfc71.dll
- %ProgramFiles(x86)%\geovid\video avatar\is-0jrk9.tmp в %ProgramFiles(x86)%\geovid\video avatar\isoburner.dll
- %ProgramFiles(x86)%\geovid\video avatar\is-gflbl.tmp в %ProgramFiles(x86)%\geovid\video avatar\starburn.dll
- %ProgramFiles(x86)%\geovid\video avatar\is-bqf1o.tmp в %ProgramFiles(x86)%\geovid\video avatar\sender.exe
- %ProgramFiles(x86)%\geovid\video avatar\is-uokmf.tmp в %ProgramFiles(x86)%\geovid\video avatar\license.txt
- %ProgramFiles(x86)%\geovid\video avatar\lang\is-06it9.tmp в %ProgramFiles(x86)%\geovid\video avatar\lang\english.txt
- %ProgramFiles(x86)%\geovid\video avatar\lang\is-a6rrh.tmp в %ProgramFiles(x86)%\geovid\video avatar\lang\russian.txt
- %ProgramFiles(x86)%\geovid\video avatar\lang\is-sha02.tmp в %ProgramFiles(x86)%\geovid\video avatar\lang\spanish.txt
- %WINDIR%\syswow64\is-s7vou.tmp в %WINDIR%\syswow64\dsetup.dll
- %WINDIR%\syswow64\is-4g00i.tmp в %WINDIR%\syswow64\gdiplus.dll
- %WINDIR%\syswow64\is-gs9v1.tmp в %WINDIR%\syswow64\atl71.dll
- %WINDIR%\syswow64\is-8sm6d.tmp в %WINDIR%\syswow64\mfc71u.dll
- %ProgramFiles(x86)%\geovid\video avatar\is-vsj0e.tmp в %ProgramFiles(x86)%\geovid\video avatar\gvmediaexporterex.dll
Другое
Создает и запускает на исполнение
- '%TEMP%\7zipsfx.000\video avatar.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\is-omok9.tmp\video avatar.tmp' /SL5="$D0166,16614842,53248,%TEMP%\7ZipSfx.000\Video Avatar.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%ProgramFiles(x86)%\geovid\video avatar\vcredist_x86_sp1.exe' /Q
- '%TEMP%\ixp000.tmp\vcredi~3.exe'
- '%ProgramFiles(x86)%\geovid\video avatar\vcredist_x86_sp1.exe' /Q' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\xvid.ax"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\GeoVid\Video Avatar\LameDshowEncoder.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\GeoVid\WMV\WMEncEng.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\GeoVid\Video Avatar\GVSourceFilter.dll"
- '%WINDIR%\syswow64\msiexec.exe' /i vcredist.msi
