Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'PSwitch' = '%ProgramFiles%\Proxy Switcher Standard\ProxySwitcher.exe'
Modifies file system:
Creates the following files:
- %TEMP%\aut1.tmp
- %APPDATA%\WNR\PSW\psw.lz.bak
- %APPDATA%\WNR\PSW\psw.lz.tmp.3044-3048
- %ALLUSERSPROFILE%\Application Data\WNR\PSW\44F120ED19413048_44
- %ALLUSERSPROFILE%\Application Data\WNR\PSW\44F120ED19413048.tmp.3044-3048
- %ProgramFiles%\Proxy Switcher Standard\unins000.dat
- %ProgramFiles%\Proxy Switcher Standard\unins000.msg
- %ALLUSERSPROFILE%\Start Menu\Programs\Proxy Switcher Standard\Setting Up Mozilla FireFox Tutorial.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Proxy Switcher Standard\Anonymous Surfing Tutorial.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Proxy Switcher Standard\Uninstall ProxySwitcher Standard.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Proxy Switcher Standard\ProxySwitcher Standard Help.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Proxy Switcher Standard\Readme.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Proxy Switcher Standard\License.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Proxy Switcher Standard\Support\ProxySwitcher Standard (Safe mode).lnk
- %ProgramFiles%\Proxy Switcher Standard\ProxySwitcher.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\Proxy Switcher Standard\ProxySwitcher Standard.lnk
- %ProgramFiles%\Proxy Switcher Standard\is-O4J08.tmp
- %ProgramFiles%\Proxy Switcher Standard\is-6BVO5.tmp
- %ProgramFiles%\Proxy Switcher Standard\is-IFDMP.tmp
- %ProgramFiles%\Proxy Switcher Standard\is-IRM9P.tmp
- %ProgramFiles%\Proxy Switcher Standard\is-PG0HD.tmp
- %ProgramFiles%\Proxy Switcher Standard\is-R1586.tmp
- %ProgramFiles%\Proxy Switcher Standard\is-6NUND.tmp
- %ProgramFiles%\Proxy Switcher Standard\is-AKC83.tmp
- %ProgramFiles%\Proxy Switcher Standard\is-3MHJ9.tmp
- %ProgramFiles%\Proxy Switcher Standard\is-GCDOC.tmp
- %TEMP%\is-4UKKR.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-OQBO4.tmp\~hukmrlz.tmp
- %CommonProgramFiles%\~hukmrlz.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Proxy Switcher Standard\Upgrade ProxySwitcher Standard Anytime....lnk
- %HOMEPATH%\Desktop\ProxySwitcher Standard.lnk
Sets the 'hidden' attribute to the following files:
- %CommonProgramFiles%\~hukmrlz.tmp
Deletes the following files:
- %TEMP%\aut1.tmp
- %TEMP%\is-4UKKR.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-OQBO4.tmp\~hukmrlz.tmp
Moves the following files:
- from %ProgramFiles%\Proxy Switcher Standard\is-GCDOC.tmp to %ProgramFiles%\Proxy Switcher Standard\unins000.exe
- from %ProgramFiles%\Proxy Switcher Standard\is-3MHJ9.tmp to %ProgramFiles%\Proxy Switcher Standard\ProxySwitcher.exe
- from %ProgramFiles%\Proxy Switcher Standard\is-AKC83.tmp to %ProgramFiles%\Proxy Switcher Standard\uPCRE.dll
- from %ProgramFiles%\Proxy Switcher Standard\is-6NUND.tmp to %ProgramFiles%\Proxy Switcher Standard\STLHash.dll
- from %ProgramFiles%\Proxy Switcher Standard\is-R1586.tmp to %ProgramFiles%\Proxy Switcher Standard\uSSL.dll
- from %ProgramFiles%\Proxy Switcher Standard\is-PG0HD.tmp to %ProgramFiles%\Proxy Switcher Standard\ReadMe.txt
- from %ProgramFiles%\Proxy Switcher Standard\is-IRM9P.tmp to %ProgramFiles%\Proxy Switcher Standard\License.rtf
- from %ProgramFiles%\Proxy Switcher Standard\is-IFDMP.tmp to %ProgramFiles%\Proxy Switcher Standard\psw.chm
- from %ProgramFiles%\Proxy Switcher Standard\is-6BVO5.tmp to %ProgramFiles%\Proxy Switcher Standard\AnSurf.exe
- from %ProgramFiles%\Proxy Switcher Standard\is-O4J08.tmp to %ProgramFiles%\Proxy Switcher Standard\FireFox.exe
- from %ALLUSERSPROFILE%\Application Data\WNR\PSW\44F120ED19413048.tmp.3044-3048 to %ALLUSERSPROFILE%\Application Data\WNR\PSW\44F120ED19413048
- from %APPDATA%\WNR\PSW\psw.lz.tmp.3044-3048 to %APPDATA%\WNR\PSW\psw.lz
Substitutes the following files:
- %ALLUSERSPROFILE%\Application Data\WNR\PSW\44F120ED19413048.tmp.3044-3048
- %ALLUSERSPROFILE%\Application Data\WNR\PSW\44F120ED19413048
- %APPDATA%\WNR\PSW\psw.lz.tmp.3044-3048
- %APPDATA%\WNR\PSW\psw.lz
Network activity:
Connects to:
- 'localhost':3128
TCP:
HTTP GET requests:
- http://PR######TCHER.INTERNAL.HOST/ via localhost
Miscellaneous:
Searches for the following windows:
- ClassName: 'TTPSWMainForm' WindowName: ''
- ClassName: 'TProxyManager' WindowName: ''
Creates and executes the following:
- '%CommonProgramFiles%\~hukmrlz.tmp' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\is-OQBO4.tmp\~hukmrlz.tmp' /SL5="$100E0,5618628,140800,%CommonProgramFiles%\~hukmrlz.tmp" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%ProgramFiles%\Proxy Switcher Standard\ProxySwitcher.exe' -first -fast -z -x -q
- '%ProgramFiles%\Proxy Switcher Standard\ProxySwitcher.exe' -set -x -fast