Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\VNC.ConnectionInfo\shell\open\command] '' = '"%ProgramFiles%\RealVNC\VNC Viewer\vncviewer.exe" -config "%1"'
Modifies file system:
Creates the following files:
- %ProgramFiles%\RealVNC\VNC Server\Printer Driver\VNC.lng
- %ProgramFiles%\RealVNC\VNC Server\Printer Driver\VNCpm.dll
- %ProgramFiles%\RealVNC\VNC Server\Printer Driver\VNCprint.gpd
- %ProgramFiles%\RealVNC\VNC Server\Printer Driver\VNC.ini
- %ProgramFiles%\RealVNC\VNC Server\saslib.dll
- %ProgramFiles%\RealVNC\VNC Server\vncserver.exe
- %ProgramFiles%\RealVNC\VNC Server\Printer Driver\VNCprint.ppd
- %ProgramFiles%\RealVNC\VNC Server\Printer Driver\VNCui.dll
- %ProgramFiles%\RealVNC\VNC Server\Mirror Driver\nt_x86\vncmirror.sys
- %ProgramFiles%\RealVNC\VNC Server\vncguihelper.exe
- %ProgramFiles%\RealVNC\VNC Server\wm_hooks.dll
- %WINDIR%\Installer\MSI29.tmp
- %ProgramFiles%\RealVNC\VNC Server\SetupCache\VNC-Server-5.2.0-Windows-32bit.msi
- %ProgramFiles%\RealVNC\VNC Server\Mirror Driver\nt_x86\vncmirror.dll
- %ProgramFiles%\RealVNC\VNC Server\Mirror Driver\vncmirror.inf
- %ProgramFiles%\RealVNC\VNC Server\logmessages.dll
- %ProgramFiles%\RealVNC\VNC Server\Mirror Driver\vncmirror-nt_x86.cat
- %ALLUSERSPROFILE%\Start Menu\Programs\RealVNC\Advanced\Enter VNC Server License Key.lnk
- %WINDIR%\Installer\MSI32.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\RealVNC\VNC Server.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\RealVNC\Advanced\VNC Server (User Mode).lnk
- %WINDIR%\Installer\MSI34.tmp
- %WINDIR%\Installer\MSI35.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\RealVNC\Documentation\VNC Server on the Web.url
- %WINDIR%\Installer\MSI33.tmp
- %ProgramFiles%\RealVNC\VNC Server\vncservice.exe
- %ProgramFiles%\RealVNC\VNC Server\vnclicensewiz.exe
- %ProgramFiles%\RealVNC\VNC Server\vncpipehelper.exe
- %ProgramFiles%\RealVNC\VNC Server\vnckeyhelper.exe
- %ProgramFiles%\RealVNC\VNC Server\vnclicensehelper.exe
- %ProgramFiles%\RealVNC\VNC Server\vncpasswd.exe
- %ProgramFiles%\RealVNC\VNC Server\vncserverui.exe
- %ProgramFiles%\RealVNC\VNC Server\Printer Driver\printerinst.exe
- %ProgramFiles%\RealVNC\VNC Server\vnclicense.exe
- C:\Config.Msi\292c3.rbs
- %WINDIR%\Installer\MSID.tmp
- %WINDIR%\Installer\292c2.ipi
- %WINDIR%\Installer\MSIB.tmp
- %ProgramFiles%\RealVNC\VNC Viewer\vncviewer.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\RealVNC\VNC Viewer.lnk
- %ProgramFiles%\RealVNC\VNC Viewer\SetupCache\VNC-Viewer-5.2.0-Windows-32bit.msi
- %ProgramFiles%\RealVNC\VNC Viewer\vncaddrbook.exe
- %WINDIR%\Installer\MSIA.tmp
- %TEMP%\is-78CSH.tmp\VNC-5.2.0-Windows.tmp
- %TEMP%\is-I40FJ.tmp\_isetup\_RegDLL.tmp
- %TEMP%\1.tmp\2.bat
- %TEMP%\1.tmp\VNC-5.2.0-Windows.exe
- %TEMP%\is-I40FJ.tmp\is-9QM7C.tmp
- %WINDIR%\Installer\292c0.msi
- %TEMP%\is-I40FJ.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-I40FJ.tmp\bootstrapinstallerhelper32.exe
- %WINDIR%\Installer\292c8.ipi
- %WINDIR%\Installer\MSI24.tmp
- %WINDIR%\Installer\292c6.msi
- %WINDIR%\Installer\MSI23.tmp
- C:\Config.Msi\292c9.rbs
- %WINDIR%\Installer\MSI28.tmp
- %WINDIR%\Installer\MSI25.tmp
- %WINDIR%\Installer\MSI26.tmp
- %TEMP%\is-I40FJ.tmp\is-3G6CI.tmp
- %WINDIR%\Installer\292c4.msi
- %WINDIR%\Installer\{A7E035A9-BD1B-43C7-985D-7E6CCE39FD40}\IconViewer.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\RealVNC\Advanced\Start Listening VNC Viewer.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\RealVNC\VNC Address Book.lnk
- C:\Config.Msi\292c5.rbs
- %WINDIR%\Installer\MSI19.tmp
- %WINDIR%\Installer\MSI16.tmp
- %WINDIR%\Installer\MSI17.tmp
Deletes the following files:
- %WINDIR%\Installer\MSI23.tmp
- %TEMP%\Cab21.tmp
- %WINDIR%\Installer\MSI26.tmp
- %WINDIR%\Installer\MSI25.tmp
- %TEMP%\Cab1B.tmp
- %WINDIR%\Installer\292c2.ipi
- %TEMP%\Cab1F.tmp
- %TEMP%\Cab1D.tmp
- %WINDIR%\Installer\MSI28.tmp
- %WINDIR%\Installer\MSI32.tmp
- %TEMP%\Cab30.tmp
- %WINDIR%\Installer\MSI34.tmp
- %WINDIR%\Installer\MSI33.tmp
- %TEMP%\Cab2A.tmp
- %WINDIR%\Installer\MSI29.tmp
- %TEMP%\Cab2E.tmp
- %TEMP%\Cab2C.tmp
- %TEMP%\CabE.tmp
- %WINDIR%\Installer\MSID.tmp
- %TEMP%\Cab12.tmp
- %TEMP%\Cab10.tmp
- %TEMP%\Cab6.tmp
- %TEMP%\Cab4.tmp
- %WINDIR%\Installer\MSIA.tmp
- %TEMP%\Cab8.tmp
- %TEMP%\Cab14.tmp
- C:\Config.Msi\292c3.rbs
- %WINDIR%\Installer\MSI17.tmp
- %WINDIR%\Installer\292c0.msi
- C:\Config.Msi\292c5.rbs
- %WINDIR%\Installer\MSIB.tmp
- %WINDIR%\Installer\MSI16.tmp
- %WINDIR%\Installer\MSI19.tmp
- %TEMP%\realvnc_msi_log
Moves the following files:
- from %TEMP%\is-I40FJ.tmp\is-3G6CI.tmp to %TEMP%\is-I40FJ.tmp\VNC-Server-5.2.0-Windows-32bit.msi
- from %TEMP%\is-I40FJ.tmp\is-9QM7C.tmp to %TEMP%\is-I40FJ.tmp\VNC-Viewer-5.2.0-Windows-32bit.msi
Substitutes the following files:
- %TEMP%\realvnc_msi_log
Network activity:
Connects to:
- 'download.windowsupdate.com':80
- 'wp#d':80
TCP:
HTTP GET requests:
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab via download.windowsupdate.com
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt via download.windowsupdate.com
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK wp#d
Miscellaneous:
Creates and executes the following:
- '%TEMP%\is-I40FJ.tmp\bootstrapinstallerhelper32.exe' -checklicense
- '%ProgramFiles%\RealVNC\VNC Server\vncserver.exe' -service -generatekeys
- '%TEMP%\1.tmp\VNC-5.2.0-Windows.exe' /VERYSILENT /NORESTART /SERVERARGS ENABLEAUTOUPDATECHECKS=0 /SERVERARGS LICENSEKEY=66TVV-E9QDP-NXGEQ-X3VM4-W288A
- '%TEMP%\is-78CSH.tmp\VNC-5.2.0-Windows.tmp' /SL5="$300DE,12465839,54272,%TEMP%\1.tmp\VNC-5.2.0-Windows.exe" /VERYSILENT /NORESTART /SERVERARGS ENABLEAUTOUPDATECHECKS=0 /SERVERARGS LICENSEKEY=66TVV-E9QDP-NXGEQ-X3VM4-W288A
Executes the following:
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\is-I40FJ.tmp\VNC-Server-5.2.0-Windows-32bit.msi" REBOOT=ReallySuppress /qn SHOWLICENSE=0 WARNLICENSE=0 ProductLanguage=1033 ADDLOCAL=FeatureServer,FeaturePrinterDriver,FeatureMirrorD...
- '<SYSTEM32>\msiexec.exe' -Embedding 892753A481D9C9A7FC885EB1E7C3A01C M Global\MSI0000
- '<SYSTEM32>\msiexec.exe' -Embedding 22EB9C5FDBC063B671C23491EB0EDD17 M Global\MSI0000
- '<SYSTEM32>\msiexec.exe' -Embedding D0C0861EC1DBDC05242E1ACB2EBA275C
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\is-I40FJ.tmp\VNC-Viewer-5.2.0-Windows-32bit.msi" REBOOT=ReallySuppress /qn SHOWLICENSE=0 WARNLICENSE=0 ProductLanguage=1033 VIEWERDIR="%ProgramFiles%\RealVNC\VNC Viewer" ADDLOCAL=Fea...
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\2.bat" <Full path to file>"
- '<SYSTEM32>\msiexec.exe' -Embedding B6AD27B7D099DE767DFC5FE9F8BAC9DF
- '<SYSTEM32>\msiexec.exe' /V