Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'McAfeeUpdaterUI' = '"%PROGRAM_FILES%\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\McAfeeFramework] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\NAIMServInst] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\Network Associates\Common Framework\FrameworkService.exe' /ServiceStart
- '%PROGRAM_FILES%\Network Associates\Common Framework\naPrdMgr.exe'
- '%PROGRAM_FILES%\Network Associates\Common Framework\UpdaterUI.exe'
- '%TEMP%\pskill.exe' UpdaterUI.exe
- '%WINDIR%\Temp\cle7.tmp\cleanup.exe' /LOGDIR=%TEMP%\NAILogs "%WINDIR%\TEMP\unz6.tmp" "%TEMP%\unz5.tmp"
- '%PROGRAM_FILES%\Network Associates\Common Framework\naPrdMgr.exe' Associates\Common Framework\naPrdMgr.exe -Embedding
- '%PROGRAM_FILES%\Network Associates\Common Framework\FrameworkService.exe'
- '%TEMP%\FramePkg.exe' /install=agent /silent
- '%TEMP%\pskill.exe' naimas32.exe
- '%TEMP%\pskill.exe' naimag32.exe
- '%WINDIR%\Temp\unz6.tmp\FrmInst.exe' /CLEANUP2="%TEMP%\unz5.tmp" /INSTALL="agent" /LOGDIR=%TEMP%\NAILogs /SILENT="" /Cleanup="%WINDIR%\TEMP\unz6.tmp" /LOGDIR=%TEMP%\NAILogs
- '%TEMP%\unz5.tmp\FramePkg.exe' /SignalComplete /CLEANUP2="%TEMP%\unz5.tmp" /INSTALL="agent" /LOGDIR=%TEMP%\NAILogs /SILENT=""
- '%TEMP%\unz5.tmp\FrmInst.exe' /silent /CreateService="%TEMP%\unz5.tmp\FramePkg.exe" /Cleanup2="%TEMP%\unz5.tmp" /LOGDIR=%TEMP%\NAILogs
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Network Associates\Common Framework\Scheduler.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Network Associates\Common Framework\ScriptSubSys.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Network Associates\Common Framework\Logging.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Network Associates\Common Framework\Management.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Network Associates\Common Framework\SecureFrameworkFactory.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Network Associates\Common Framework\UserSpace.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Network Associates\Common Framework\naPolicyManager.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Network Associates\Common Framework\UpdPlug.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Network Associates\Common Framework\UpdateSubSys.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Network Associates\Common Framework\Agent.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Network Associates\Common Framework\AgentPlugin.dll"
- '<SYSTEM32>\regsvr32.exe' /u /s "<SYSTEM32>\atl.dll"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\atl.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Network Associates\Common Framework\ComponentSubSystem.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Network Associates\Common Framework\InternetManager.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Network Associates\Common Framework\ListenServer.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Network Associates\Common Framework\ComponentUserInterface.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Network Associates\Common Framework\GenEvtInf.dll"
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\Network Associates\Common Framework\CmdAgent.exe
- %PROGRAM_FILES%\Network Associates\Common Framework\0409\CmaUIRes.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\ComponentSubSystem.dll
- %ALLUSERSPROFILE%\Application Data\Network Associates\Common Framework\Db\FrameworkLog.xsl
- %PROGRAM_FILES%\Network Associates\Common Framework\ComponentUserInterface.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\ClientUI.dll
- %ALLUSERSPROFILE%\Application Data\Network Associates\Common Framework\Agent.ini
- %PROGRAM_FILES%\Network Associates\Common Framework\Agent.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\AgentPlugin.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\Cleanup.exe
- %PROGRAM_FILES%\Network Associates\Common Framework\0409\AgentRes.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\ListenServer.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\InternetManager.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\Logging.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\McScript.exe
- %PROGRAM_FILES%\Network Associates\Common Framework\Management.dll
- %ALLUSERSPROFILE%\Application Data\Network Associates\Common Framework\InstallMain.McS
- %PROGRAM_FILES%\Network Associates\Common Framework\FrameworkService.exe
- %ALLUSERSPROFILE%\Application Data\Network Associates\Common Framework\FrameworkManifest.xml
- %PROGRAM_FILES%\Network Associates\Common Framework\FrmInst.exe
- %PROGRAM_FILES%\Network Associates\Common Framework\GenEvtInf.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\FrmPlugin.dll
- %WINDIR%\Temp\unz6.tmp\CmaUIRes.dll
- %WINDIR%\Temp\unz6.tmp\SecureFrameworkFactory.dll
- %WINDIR%\Temp\unz6.tmp\ScrptRes.dll
- %WINDIR%\Temp\unz6.tmp\Server.xml
- %WINDIR%\Temp\unz6.tmp\SrPubKey.bin
- %WINDIR%\Temp\unz6.tmp\SiteList.xml
- %WINDIR%\Temp\unz6.tmp\ScriptSubSys.dll
- %WINDIR%\Temp\unz6.tmp\PoEvtInf.dll
- %WINDIR%\Temp\unz6.tmp\patchw32.dll
- %WINDIR%\Temp\unz6.tmp\PcrPlug.dll
- %WINDIR%\Temp\unz6.tmp\Scheduler.dll
- %WINDIR%\Temp\unz6.tmp\PSAPI.dll
- %WINDIR%\Temp\unz6.tmp\UserSpace.dll
- %WINDIR%\Temp\unz6.tmp\UpdRes.dll
- %WINDIR%\Temp\unz6.tmp\XMLWrap.dll
- %WINDIR%\Temp\unz6.tmp\ClientUI.dll
- %WINDIR%\Temp\unz6.tmp\ComponentSubSystem.dll
- %WINDIR%\Temp\unz6.tmp\UpdPlug.dll
- %WINDIR%\Temp\unz6.tmp\UpdateMain.McS
- %WINDIR%\Temp\unz6.tmp\unicows.dll
- %WINDIR%\Temp\unz6.tmp\InstallMain.McS
- %WINDIR%\Temp\unz6.tmp\UpdaterUI.exe
- %WINDIR%\Temp\unz6.tmp\UpdateSubSys.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\naisign.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\nailog.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\patchw32.dll
- %ALLUSERSPROFILE%\Application Data\Network Associates\Common Framework\Db\Agent_CRNJEUFU.log
- %PROGRAM_FILES%\Network Associates\Common Framework\unicows.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\nmcomn32.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\naSPIPE.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\naPrdMgr.exe
- %PROGRAM_FILES%\Network Associates\Common Framework\naXML.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\naicrt32.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\nagshr32.dll
- %ALLUSERSPROFILE%\Application Data\Network Associates\Common Framework\SiteMapList.xml
- %WINDIR%\randseed.rnd
- %WINDIR%\Temp\cle7.tmp\cleanup.exe
- <SYSTEM32>\PtchScan.dll
- <SYSTEM32>\PatchScanInstaller.exe
- %ALLUSERSPROFILE%\Application Data\Network Associates\Common Framework\Db\PrdMgr_CRNJEUFU.log
- %ALLUSERSPROFILE%\Application Data\Network Associates\Common Framework\Db\Agent_CRNJEUFU.xml
- %ALLUSERSPROFILE%\Application Data\Network Associates\Common Framework\Compiled.xml
- %ALLUSERSPROFILE%\Application Data\Network Associates\Common Framework\Precompiled.xml
- %ALLUSERSPROFILE%\Application Data\Network Associates\Common Framework\Local.xml
- %PROGRAM_FILES%\Network Associates\Common Framework\naPolicyManager.dll
- %ALLUSERSPROFILE%\Application Data\Network Associates\Common Framework\Server.xml
- %PROGRAM_FILES%\Network Associates\Common Framework\SecureFrameworkFactory.dll
- %ALLUSERSPROFILE%\Application Data\Network Associates\Common Framework\SiteList.xml
- %ALLUSERSPROFILE%\Application Data\Network Associates\Common Framework\UpdateHistory.ini
- %ALLUSERSPROFILE%\Application Data\Network Associates\Common Framework\ServerSiteList.xml
- %PROGRAM_FILES%\Network Associates\Common Framework\0409\ScrptRes.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\PcrPlug.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\PSAPI.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\PoEvtInf.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\ScriptSubSys.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\Scheduler.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\XMLWrap.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\UserSpace.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\mcurial.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\naInet.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\naCmnLib.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\UpdaterUI.exe
- %PROGRAM_FILES%\Network Associates\Common Framework\UpdPlug.dll
- %ALLUSERSPROFILE%\Application Data\Network Associates\Common Framework\SrPubKey.bin
- %PROGRAM_FILES%\Network Associates\Common Framework\0409\UpdRes.dll
- %PROGRAM_FILES%\Network Associates\Common Framework\UpdateSubSys.dll
- %ALLUSERSPROFILE%\Application Data\Network Associates\Common Framework\UpdateMain.McS
- %WINDIR%\Temp\unz6.tmp\naXML.dll
- %TEMP%\unz5.tmp\naInet.dll
- %TEMP%\unz5.tmp\nagshr32.dll
- %TEMP%\unz5.tmp\naisign.dll
- %TEMP%\unz5.tmp\naPolicyManager.dll
- %TEMP%\unz5.tmp\nailog.dll
- %TEMP%\unz5.tmp\naCmnLib.dll
- %TEMP%\unz5.tmp\Logging.dll
- %TEMP%\unz5.tmp\ListenServer.dll
- %TEMP%\unz5.tmp\Management.dll
- %TEMP%\unz5.tmp\mcurial.dll
- %TEMP%\unz5.tmp\McScript.exe
- %TEMP%\unz5.tmp\Scheduler.dll
- %TEMP%\unz5.tmp\PSAPI.dll
- %TEMP%\unz5.tmp\ScriptSubSys.dll
- %TEMP%\unz5.tmp\SecureFrameworkFactory.dll
- %TEMP%\unz5.tmp\ScrptRes.dll
- %TEMP%\unz5.tmp\PcrPlug.dll
- %TEMP%\unz5.tmp\naSPIPE.dll
- %TEMP%\unz5.tmp\naPrdMgr.exe
- %TEMP%\unz5.tmp\naXML.dll
- %TEMP%\unz5.tmp\PoEvtInf.dll
- %TEMP%\unz5.tmp\patchw32.dll
- %TEMP%\unz5.tmp\InternetManager.dll
- %TEMP%\unz5.tmp\__temp.zip
- %TEMP%\NAILogs\FrmInst_CRNJEUFU.log
- %TEMP%\unz5.tmp\cabinet.dll
- %TEMP%\unz5.tmp\Agent.ini
- %TEMP%\unz5.tmp\Agent.dll
- %TEMP%\~GLH0003.TMP
- %TEMP%\GLK2.tmp
- %TEMP%\GLC1.tmp
- %TEMP%\~GLH0000.TMP
- %TEMP%\~GLH0002.TMP
- %TEMP%\~GLH0001.TMP
- %TEMP%\unz5.tmp\FrameworkService.exe
- %TEMP%\unz5.tmp\FrameworkManifest.xml
- %TEMP%\unz5.tmp\FrmInst.exe
- %TEMP%\unz5.tmp\GenEvtInf.dll
- %TEMP%\unz5.tmp\FrmPlugin.dll
- %TEMP%\unz5.tmp\FrameworkLog.xsl
- %TEMP%\unz5.tmp\AgentRes.dll
- %TEMP%\unz5.tmp\AgentPlugin.dll
- %TEMP%\unz5.tmp\Cleanup.exe
- %TEMP%\unz5.tmp\ComponentUserInterface.dll
- %TEMP%\unz5.tmp\CmdAgent.exe
- %WINDIR%\Temp\unz6.tmp\GenEvtInf.dll
- %WINDIR%\Temp\unz6.tmp\FrmPlugin.dll
- %WINDIR%\Temp\unz6.tmp\InternetManager.dll
- %WINDIR%\Temp\unz6.tmp\Logging.dll
- %WINDIR%\Temp\unz6.tmp\ListenServer.dll
- %WINDIR%\Temp\unz6.tmp\FrmInst.exe
- %WINDIR%\Temp\unz6.tmp\ComponentUserInterface.dll
- %WINDIR%\Temp\unz6.tmp\CmdAgent.exe
- %WINDIR%\Temp\unz6.tmp\FrameworkLog.xsl
- %WINDIR%\Temp\unz6.tmp\FrameworkService.exe
- %WINDIR%\Temp\unz6.tmp\FrameworkManifest.xml
- %WINDIR%\Temp\unz6.tmp\nailog.dll
- %WINDIR%\Temp\unz6.tmp\naisign.dll
- %WINDIR%\Temp\unz6.tmp\naPolicyManager.dll
- %WINDIR%\Temp\unz6.tmp\naSPIPE.dll
- %WINDIR%\Temp\unz6.tmp\naPrdMgr.exe
- %WINDIR%\Temp\unz6.tmp\naInet.dll
- %WINDIR%\Temp\unz6.tmp\McScript.exe
- %WINDIR%\Temp\unz6.tmp\Management.dll
- %WINDIR%\Temp\unz6.tmp\mcurial.dll
- %WINDIR%\Temp\unz6.tmp\nagshr32.dll
- %WINDIR%\Temp\unz6.tmp\naCmnLib.dll
- %WINDIR%\Temp\unz6.tmp\Cleanup.exe
- %TEMP%\unz5.tmp\UpdaterUI.exe
- %TEMP%\unz5.tmp\UpdateSubSys.dll
- %TEMP%\unz5.tmp\UpdPlug.dll
- %TEMP%\unz5.tmp\UserSpace.dll
- %TEMP%\unz5.tmp\UpdRes.dll
- %TEMP%\unz5.tmp\InstallMain.McS
- %TEMP%\unz5.tmp\SiteList.xml
- %TEMP%\unz5.tmp\Server.xml
- %TEMP%\unz5.tmp\SrPubKey.bin
- %TEMP%\unz5.tmp\UpdateMain.McS
- %TEMP%\unz5.tmp\unicows.dll
- %WINDIR%\Temp\unz6.tmp\Agent.dll
- %WINDIR%\Temp\unz6.tmp\cabinet.dll
- %WINDIR%\Temp\unz6.tmp\Agent.ini
- %WINDIR%\Temp\unz6.tmp\AgentRes.dll
- %WINDIR%\Temp\unz6.tmp\AgentPlugin.dll
- %WINDIR%\Temp\unz6.tmp\__temp.zip
- %TEMP%\unz5.tmp\ComponentSubSystem.dll
- %TEMP%\unz5.tmp\XMLWrap.dll
- %TEMP%\unz5.tmp\ClientUI.dll
- %TEMP%\unz5.tmp\FramePkg.exe
- %TEMP%\unz5.tmp\CmaUIRes.dll
Удаляет следующие файлы:
- %TEMP%\unz5.tmp\GenEvtInf.dll
- %TEMP%\unz5.tmp\InstallMain.McS
- %TEMP%\unz5.tmp\InternetManager.dll
- %TEMP%\unz5.tmp\FrameworkService.exe
- %TEMP%\unz5.tmp\FrmInst.exe
- %TEMP%\unz5.tmp\FrmPlugin.dll
- %TEMP%\unz5.tmp\ListenServer.dll
- %TEMP%\unz5.tmp\mcurial.dll
- %TEMP%\unz5.tmp\naCmnLib.dll
- %TEMP%\unz5.tmp\nagshr32.dll
- %TEMP%\unz5.tmp\Logging.dll
- %TEMP%\unz5.tmp\Management.dll
- %TEMP%\unz5.tmp\McScript.exe
- %TEMP%\unz5.tmp\cabinet.dll
- %TEMP%\unz5.tmp\Cleanup.exe
- %TEMP%\unz5.tmp\ClientUI.dll
- %TEMP%\unz5.tmp\Agent.ini
- %TEMP%\unz5.tmp\AgentPlugin.dll
- %TEMP%\unz5.tmp\AgentRes.dll
- %TEMP%\unz5.tmp\CmaUIRes.dll
- %TEMP%\unz5.tmp\FramePkg.exe
- %TEMP%\unz5.tmp\FrameworkLog.xsl
- %TEMP%\unz5.tmp\FrameworkManifest.xml
- %TEMP%\unz5.tmp\CmdAgent.exe
- %TEMP%\unz5.tmp\ComponentSubSystem.dll
- %TEMP%\unz5.tmp\ComponentUserInterface.dll
- %TEMP%\unz5.tmp\nailog.dll
- %TEMP%\unz5.tmp\SrPubKey.bin
- %TEMP%\unz5.tmp\unicows.dll
- %TEMP%\unz5.tmp\UpdateMain.McS
- %TEMP%\unz5.tmp\SecureFrameworkFactory.dll
- %TEMP%\unz5.tmp\Server.xml
- %TEMP%\unz5.tmp\SiteList.xml
- %TEMP%\unz5.tmp\UpdaterUI.exe
- %TEMP%\unz5.tmp\UserSpace.dll
- %TEMP%\unz5.tmp\XMLWrap.dll
- %TEMP%\unz5.tmp\__temp.zip
- %TEMP%\unz5.tmp\UpdateSubSys.dll
- %TEMP%\unz5.tmp\UpdPlug.dll
- %TEMP%\unz5.tmp\UpdRes.dll
- %TEMP%\unz5.tmp\naPrdMgr.exe
- %TEMP%\unz5.tmp\naSPIPE.dll
- %TEMP%\unz5.tmp\naXML.dll
- %TEMP%\unz5.tmp\naInet.dll
- %TEMP%\unz5.tmp\naisign.dll
- %TEMP%\unz5.tmp\naPolicyManager.dll
- %TEMP%\unz5.tmp\patchw32.dll
- %TEMP%\unz5.tmp\Scheduler.dll
- %TEMP%\unz5.tmp\ScriptSubSys.dll
- %TEMP%\unz5.tmp\ScrptRes.dll
- %TEMP%\unz5.tmp\PcrPlug.dll
- %TEMP%\unz5.tmp\PoEvtInf.dll
- %TEMP%\unz5.tmp\PSAPI.dll
- %TEMP%\unz5.tmp\Agent.dll
- %WINDIR%\Temp\unz6.tmp\GenEvtInf.dll
- %WINDIR%\Temp\unz6.tmp\InstallMain.McS
- %WINDIR%\Temp\unz6.tmp\InternetManager.dll
- %WINDIR%\Temp\unz6.tmp\FrameworkService.exe
- %WINDIR%\Temp\unz6.tmp\FrmInst.exe
- %WINDIR%\Temp\unz6.tmp\FrmPlugin.dll
- %WINDIR%\Temp\unz6.tmp\ListenServer.dll
- %WINDIR%\Temp\unz6.tmp\mcurial.dll
- %WINDIR%\Temp\unz6.tmp\naCmnLib.dll
- %WINDIR%\Temp\unz6.tmp\nagshr32.dll
- %WINDIR%\Temp\unz6.tmp\Logging.dll
- %WINDIR%\Temp\unz6.tmp\Management.dll
- %WINDIR%\Temp\unz6.tmp\McScript.exe
- %WINDIR%\Temp\unz6.tmp\AgentRes.dll
- %WINDIR%\Temp\unz6.tmp\cabinet.dll
- %WINDIR%\Temp\unz6.tmp\Cleanup.exe
- %WINDIR%\Temp\unz6.tmp\Agent.dll
- %WINDIR%\Temp\unz6.tmp\Agent.ini
- %WINDIR%\Temp\unz6.tmp\AgentPlugin.dll
- %WINDIR%\Temp\unz6.tmp\ClientUI.dll
- %WINDIR%\Temp\unz6.tmp\ComponentUserInterface.dll
- %WINDIR%\Temp\unz6.tmp\FrameworkLog.xsl
- %WINDIR%\Temp\unz6.tmp\FrameworkManifest.xml
- %WINDIR%\Temp\unz6.tmp\CmaUIRes.dll
- %WINDIR%\Temp\unz6.tmp\CmdAgent.exe
- %WINDIR%\Temp\unz6.tmp\ComponentSubSystem.dll
- %WINDIR%\Temp\unz6.tmp\nailog.dll
- %WINDIR%\Temp\unz6.tmp\SrPubKey.bin
- %WINDIR%\Temp\unz6.tmp\unicows.dll
- %WINDIR%\Temp\unz6.tmp\UpdateMain.McS
- %WINDIR%\Temp\unz6.tmp\SecureFrameworkFactory.dll
- %WINDIR%\Temp\unz6.tmp\Server.xml
- %WINDIR%\Temp\unz6.tmp\SiteList.xml
- %WINDIR%\Temp\unz6.tmp\UpdaterUI.exe
- %WINDIR%\Temp\unz6.tmp\UserSpace.dll
- %WINDIR%\Temp\unz6.tmp\XMLWrap.dll
- %WINDIR%\Temp\unz6.tmp\__temp.zip
- %WINDIR%\Temp\unz6.tmp\UpdateSubSys.dll
- %WINDIR%\Temp\unz6.tmp\UpdPlug.dll
- %WINDIR%\Temp\unz6.tmp\UpdRes.dll
- %WINDIR%\Temp\unz6.tmp\naPrdMgr.exe
- %WINDIR%\Temp\unz6.tmp\naSPIPE.dll
- %WINDIR%\Temp\unz6.tmp\naXML.dll
- %WINDIR%\Temp\unz6.tmp\naInet.dll
- %WINDIR%\Temp\unz6.tmp\naisign.dll
- %WINDIR%\Temp\unz6.tmp\naPolicyManager.dll
- %WINDIR%\Temp\unz6.tmp\patchw32.dll
- %WINDIR%\Temp\unz6.tmp\Scheduler.dll
- %WINDIR%\Temp\unz6.tmp\ScriptSubSys.dll
- %WINDIR%\Temp\unz6.tmp\ScrptRes.dll
- %WINDIR%\Temp\unz6.tmp\PcrPlug.dll
- %WINDIR%\Temp\unz6.tmp\PoEvtInf.dll
- %WINDIR%\Temp\unz6.tmp\PSAPI.dll
Перемещает следующие файлы:
- %TEMP%\~GLH0002.TMP в %TEMP%\FramePkg.exe
- %TEMP%\~GLH0003.TMP в %TEMP%\PatchScanInstaller.exe
- %TEMP%\~GLH0000.TMP в %TEMP%\GLF4.tmp
- %TEMP%\~GLH0001.TMP в %TEMP%\pskill.exe
Сетевая активность:
Подключается к:
- '13#.#27.216.109':80
Другое:
Ищет следующие окна:
- ClassName: 'McAfeeCommonUpdaterUIMainWindow' WindowName: '(null)'
- ClassName: 'McAfee_FrameworkServiceClass' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'McAfee Fire Application Window Class' WindowName: '(null)'
