Trojan.DownLoader23.26724

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'egui' = '"%ProgramFiles%\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice'

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\EHttpSrv] 'ImagePath' = '"%ProgramFiles%\ESET\ESET NOD32 Antivirus\EHttpSrv.exe"'
[HKLM\System\CurrentControlSet\Services\ekrn] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\ekrn] 'ImagePath' = '"%ProgramFiles%\ESET\ESET NOD32 Antivirus\x86\ekrn.exe"'
[HKLM\System\CurrentControlSet\Services\ehdrv] 'Start' = '00000001'
[HKLM\System\CurrentControlSet\Services\ehdrv] 'ImagePath' = 'system32\DRIVERS\ehdrv.sys'
[HKLM\System\CurrentControlSet\Services\eamonm] 'ImagePath' = 'system32\DRIVERS\eamonm.sys'
[HKLM\System\CurrentControlSet\Services\epfwwfpr] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\epfwwfpr] 'ImagePath' = 'system32\DRIVERS\epfwwfpr.sys'
[HKLM\SYSTEM\CurrentControlSet\Services\eamonm] 'Start' = '00000002'

Creates the following services

'EHttpSrv' "%ProgramFiles%\ESET\ESET NOD32 Antivirus\EHttpSrv.exe"
'EHttpSrv' %ProgramFiles%\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
'ekrn' "%ProgramFiles%\ESET\ESET NOD32 Antivirus\x86\ekrn.exe"
'ekrn' %ProgramFiles%\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
'ehdrv' system32\DRIVERS\ehdrv.sys
'eamonm' system32\DRIVERS\eamonm.sys
'epfwwfpr' system32\DRIVERS\epfwwfpr.sys

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\000814251_video_01.avi
%HOMEPATH%\desktop\ituneshelpunavailable.htm
%HOMEPATH%\desktop\howto-index.html
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\desktop\cveuropeo.doc
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\weeklysheet1215.doc

Registers file system filter

[HKLM\System\CurrentControlSet\Services\eamonm] 'Group' = 'FSFilter Anti-Virus'

Modifies file system

Creates the following files

%TEMP%\nod32\x86\setup.msi
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em009_32_l0.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em006_32_l2.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em006_32_l1.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em005_32_l2.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em006_32_l0.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em005_32_l1.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em004_32_l2.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em005_32_l0.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em004_32_l1.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em000_64_l0.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em004_32_l0.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em003_32_l1.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em002_32_l2.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em003_32_l0.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em002_32_l1.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em001_32_l2.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em002_32_l0.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em001_32_l1.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em001_32_l0.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em000_32_l0.nup
%ProgramFiles%\eset\eset nod32 antivirus\ekrnlang.dll
%ProgramFiles%\eset\eset nod32 antivirus\eguiscanlang.dll
%ProgramFiles%\eset\eset nod32 antivirus\eguiupdatelang.dll
%ProgramFiles%\eset\eset nod32 antivirus\eset.chm
%ProgramFiles%\eset\eset nod32 antivirus\eguilang.dll
%ProgramFiles%\eset\eset nod32 antivirus\shellextlang.dll
%ProgramFiles%\eset\eset nod32 antivirus\eclslang.dll
%ProgramFiles%\eset\eset nod32 antivirus\sysrescuelang.dll
%ProgramFiles%\eset\eset nod32 antivirus\eplgoutlookemonlang.dll
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em013_64_l0.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em009_32_l1.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em013_64_l1.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em006_64_l0.nup
%TEMP%\nsf3741.tmp
%TEMP%\nsf3731.tmp
%TEMP%\nsf3720.tmp
%TEMP%\nsf3710.tmp
%TEMP%\nsf36ff.tmp
%TEMP%\nsf36ee.tmp
%TEMP%\nsf36ce.tmp
%TEMP%\nsf3650.tmp
%TEMP%\nsf3630.tmp
%TEMP%\nsf3610.tmp
%TEMP%\nsf360f.tmp
%TEMP%\nsf35fe.tmp
%TEMP%\nsf35ee.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\eset\eset nod32 antivirus\eset sysrescue.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\eset\eset nod32 antivirus\лицензионное соглашение.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\eset\eset nod32 antivirus\удаление.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\eset\eset nod32 antivirus\eset sysinspector.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\eset\eset nod32 antivirus\eset nod32 antivirus.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\eset\eset nod32 antivirus\документация.lnk
%WINDIR%\installer\{bd236ab3-136c-4db7-b24c-cfb68b197e17}\egui.exe
%WINDIR%\installer\{bd236ab3-136c-4db7-b24c-cfb68b197e17}\callmsi.exe
%ProgramFiles%\eset\eset nod32 antivirus\eguiproduct.dll
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em009_64_l1.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em009_64_l0.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em015_64_l2.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em006_64_l2.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em015_64_l1.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em006_64_l1.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em015_64_l0.nup
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\updfiles\em013_64_l2.nup
%TEMP%\nsf3752.tmp
%ProgramFiles%\eset\eset nod32 antivirus\ekrnepfwlang.dll
%ProgramFiles%\eset\eset nod32 antivirus\eplgtblang.dll
%ProgramFiles%\eset\eset nod32 antivirus\ekrndmonlang.dll
%ProgramFiles%\eset\eset nod32 antivirus\x86\ekrnepfw.dll
%ProgramFiles%\eset\eset nod32 antivirus\eeclnt.exe
%ProgramFiles%\eset\eset nod32 antivirus\drivers\eamonm\eamonm.sys
%ProgramFiles%\eset\eset nod32 antivirus\x86\ekrnemon.dll
%ProgramFiles%\eset\eset nod32 antivirus\ecmd.exe
%ProgramFiles%\eset\eset nod32 antivirus\mfc80.dll
%ProgramFiles%\eset\eset nod32 antivirus\mozilla thunderbird\components\eplgtb.dll
%ProgramFiles%\eset\eset nod32 antivirus\x86\ekrndmon.dll
%ProgramFiles%\eset\eset nod32 antivirus\x86\dmon.dll
%ProgramFiles%\eset\eset nod32 antivirus\dmon.dll
%ProgramFiles%\eset\eset nod32 antivirus\eh64.exe
%ProgramFiles%\eset\eset nod32 antivirus\x86\eplgoe.dll
%ProgramFiles%\eset\eset nod32 antivirus\drivers\ehdrv\ehdrv.sys
%ProgramFiles%\eset\eset nod32 antivirus\eguiepfw.dll
%ProgramFiles%\eset\eset nod32 antivirus\http_dll.dll
%ProgramFiles%\eset\eset nod32 antivirus\x86\eplgoeemon.dll
%ProgramFiles%\eset\eset nod32 antivirus\x86\ekrnamon.dll
%ProgramFiles%\eset\eset nod32 antivirus\x86\shellext.dll
%ProgramFiles%\eset\eset nod32 antivirus\shellext.dll
%ProgramFiles%\eset\eset nod32 antivirus\eguiemon.dll
%ProgramFiles%\eset\eset nod32 antivirus\drivers\eamonm\eamonm.inf
%ProgramFiles%\eset\eset nod32 antivirus\drivers\eamonm\eamonm.cat
%ProgramFiles%\eset\eset nod32 antivirus\mozilla thunderbird\chrome.manifest
%ProgramFiles%\eset\eset nod32 antivirus\eguidmon.dll
%ProgramFiles%\eset\eset nod32 antivirus\microsoft.vc80.crt.manifest
%ProgramFiles%\eset\eset nod32 antivirus\microsoft.vc80.mfc.manifest
%ProgramFiles%\eset\eset nod32 antivirus\mozilla thunderbird\install.rdf
%ProgramFiles%\eset\eset nod32 antivirus\x86\ekrn.exe
%ProgramFiles%\eset\eset nod32 antivirus\x86\updater.dll
%ProgramFiles%\eset\eset nod32 antivirus\microsoft.vc80.mfcloc.manifest
%ProgramFiles%\eset\eset nod32 antivirus\x86\msvcr80.dll
%ProgramFiles%\eset\eset nod32 antivirus\eguiproductrcd.dll
%ProgramFiles%\eset\eset nod32 antivirus\x86\eplgoutlookemon.dll
%ProgramFiles%\eset\eset nod32 antivirus\eguiepfwlang.dll
%ProgramFiles%\eset\eset nod32 antivirus\eguiemonlang.dll
%ProgramFiles%\eset\eset nod32 antivirus\eguidmonlang.dll
%ProgramFiles%\eset\eset nod32 antivirus\sysinspectorlang.dll
%ProgramFiles%\eset\eset nod32 antivirus\eula.rtf
%ProgramFiles%\eset\eset nod32 antivirus\eplgoutlooklang.dll
%ProgramFiles%\eset\eset nod32 antivirus\ekrnscanlang.dll
%ProgramFiles%\eset\eset nod32 antivirus\ekrnmailpluginslang.dll
%ProgramFiles%\eset\eset nod32 antivirus\eguiamonlang.dll
%ProgramFiles%\eset\eset nod32 antivirus\ekrnupdatelang.dll
%ProgramFiles%\eset\eset nod32 antivirus\eguimailpluginslang.dll
%ProgramFiles%\eset\eset nod32 antivirus\drivers\epfwwfpr\epfwwfpr.inf
%ProgramFiles%\eset\eset nod32 antivirus\x86\msvcp80.dll
%ProgramFiles%\eset\eset nod32 antivirus\egui.exe
%ProgramFiles%\eset\eset nod32 antivirus\eguimailplugins.dll
%ProgramFiles%\eset\eset nod32 antivirus\eguiscan.dll
%ProgramFiles%\eset\eset nod32 antivirus\x86\eplgtbemon.dll
%ProgramFiles%\eset\eset nod32 antivirus\drivers\epfwwfpr\epfwwfpr.cat
%ProgramFiles%\eset\eset nod32 antivirus\eguiupdate.dll
%ProgramFiles%\eset\eset nod32 antivirus\ecls.exe
%ProgramFiles%\eset\eset nod32 antivirus\sysrescue.exe
%ProgramFiles%\eset\eset nod32 antivirus\sysinspector.exe
%ProgramFiles%\eset\eset nod32 antivirus\eplgoe.dll
%ProgramFiles%\eset\eset nod32 antivirus\eplghooks.dll
%ProgramFiles%\eset\eset nod32 antivirus\eplgoeemon.dll
%ProgramFiles%\eset\eset nod32 antivirus\callmsi.exe
%ProgramFiles%\eset\eset nod32 antivirus\x86\microsoft.vc80.crt.manifest
%ProgramFiles%\eset\eset nod32 antivirus\ehttpsrv.exe
%ProgramFiles%\eset\eset nod32 antivirus\updater.dll
%ProgramFiles%\eset\eset nod32 antivirus\eplgoutlook.dll
%ProgramFiles%\eset\eset nod32 antivirus\eplgoelang.dll
%TEMP%\nsf662f.tmp
%ProgramFiles%\eset\config.xml
%TEMP%\nsf3774.tmp
%TEMP%\nsf6f5e.tmp
%TEMP%\nup6f4b.tmp
%TEMP%\nsf6f4c.tmp
%ProgramFiles%\eset\eset nod32 antivirus\em009_64.dat
%TEMP%\nup6cf9.tmp
%TEMP%\nup6cb9.tmp
%TEMP%\nsf6cc9.tmp
%TEMP%\nup6c88.tmp
%TEMP%\nsf6c89.tmp
%ProgramFiles%\eset\eset nod32 antivirus\em009_32.dat
%TEMP%\nup6b01.tmp
%TEMP%\nup6ae0.tmp
%TEMP%\nsf6ae1.tmp
%TEMP%\nup6aaf.tmp
%TEMP%\nsf6ab0.tmp
%ProgramFiles%\eset\eset nod32 antivirus\em006_64.dat
%TEMP%\nup6a60.tmp
%TEMP%\nup6a30.tmp
%TEMP%\nup69e0.tmp
%TEMP%\nsf69e1.tmp
%TEMP%\nup69bf.tmp
%TEMP%\nsf69c0.tmp
%TEMP%\nup69ad.tmp
%TEMP%\nsf69ae.tmp
%ProgramFiles%\eset\eset nod32 antivirus\em006_32.dat
%TEMP%\nup696e.tmp
%TEMP%\nup692f.tmp
%TEMP%\nup690d.tmp
%TEMP%\nsf690e.tmp
%TEMP%\nup6f5d.tmp
%TEMP%\nsf6f7f.tmp
%TEMP%\nup6f7e.tmp
%TEMP%\nup6f9f.tmp
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\installer\1fa7.msi
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\charon\cache.ndb
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\epfwuser.dat
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\logs\warnlog.dat
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\logs\virlog.dat
%WINDIR%\temp\uddef40.tmp
<DRIVERS>\seteb0b.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem4.cat
%TEMP%\{074e44ce-22d5-5d77-d92a-365c77d18971}\setdd39.tmp
%TEMP%\{074e44ce-22d5-5d77-d92a-365c77d18971}\setdc8d.tmp
%WINDIR%\temp\udddbbf.tmp
<DRIVERS>\setd78a.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem3.cat
%TEMP%\{0dd0fc2a-9efa-40e2-39cf-cd1d0839d11e}\setc988.tmp
<DRIVERS>\setc16a.tmp
%TEMP%\{0dd0fc2a-9efa-40e2-39cf-cd1d0839d11e}\setc8fb.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
%TEMP%\{5e113cd0-f5c9-44dd-2616-286ef81db715}\setb2ac.tmp
%TEMP%\{5e113cd0-f5c9-44dd-2616-286ef81db715}\setb20f.tmp
%ProgramFiles%\eset\eset nod32 antivirus\em015_64.dat
%TEMP%\nup7092.tmp
%TEMP%\nup7062.tmp
%TEMP%\nup7051.tmp
%TEMP%\nsf7052.tmp
%TEMP%\nup702f.tmp
%TEMP%\nsf7030.tmp
%TEMP%\nup700e.tmp
%TEMP%\nsf700f.tmp
%ProgramFiles%\eset\eset nod32 antivirus\em013_64.dat
%TEMP%\nup6fcf.tmp
%TEMP%\nsf3764.tmp
%ProgramFiles%\eset\eset nod32 antivirus\x86\eplgoutlook.dll
%TEMP%\nsf68ed.tmp
%TEMP%\nup68db.tmp
%TEMP%\nup39a2.tmp
%TEMP%\nup3933.tmp
%TEMP%\nup3912.tmp
%TEMP%\nsf3923.tmp
%TEMP%\nup38e1.tmp
%TEMP%\nsf38e2.tmp
%TEMP%\nup38b1.tmp
%TEMP%\nsf38b2.tmp
%ProgramFiles%\eset\eset nod32 antivirus\em000_32.dat
%TEMP%\nup388f.tmp
%TEMP%\nsf38a0.tmp
%ProgramFiles%\eset\eset nod32 antivirus\em000_64.dat
%TEMP%\nup386e.tmp
%TEMP%\nsf386f.tmp
%TEMP%\nsf386d.tmp
%TEMP%\nsf384d.tmp
%TEMP%\nsf384c.tmp
%TEMP%\nsf383b.tmp
%TEMP%\nsf382b.tmp
%TEMP%\nsf381a.tmp
%TEMP%\nsf380a.tmp
%TEMP%\nsf37f9.tmp
%TEMP%\nsf37e8.tmp
%TEMP%\nsf37d8.tmp
%TEMP%\nsf37c7.tmp
%TEMP%\nsf37b7.tmp
%TEMP%\nsf37a6.tmp
%TEMP%\nsf37a5.tmp
%TEMP%\nsf3785.tmp
%ProgramFiles%\eset\eset nod32 antivirus\em001_32.dat
%TEMP%\nsf3a40.tmp
%TEMP%\nup3a2f.tmp
%TEMP%\nsf3c06.tmp
%ProgramFiles%\eset\eset nod32 antivirus\em005_32.dat
%TEMP%\nup688c.tmp
%TEMP%\nup684c.tmp
%TEMP%\nup682b.tmp
%TEMP%\nsf682c.tmp
%TEMP%\nup6819.tmp
%TEMP%\nsf681a.tmp
%TEMP%\nup6808.tmp
%TEMP%\nsf6809.tmp
%ProgramFiles%\eset\eset nod32 antivirus\em004_32.dat
%TEMP%\nup66ee.tmp
%TEMP%\nup6661.tmp
%TEMP%\nup663f.tmp
%TEMP%\nsf6640.tmp
%TEMP%\nsf3763.tmp
%TEMP%\nup662e.tmp
%TEMP%\nup660d.tmp
%TEMP%\nsf660e.tmp
%ProgramFiles%\eset\eset nod32 antivirus\em003_32.dat
%TEMP%\nup6512.tmp
%TEMP%\nup64f1.tmp
%TEMP%\nsf64f2.tmp
%TEMP%\nup64d0.tmp
%TEMP%\nsf64d1.tmp
%ProgramFiles%\eset\eset nod32 antivirus\em002_32.dat
%TEMP%\nup481b.tmp
%TEMP%\nup3c95.tmp
%TEMP%\nup3c65.tmp
%TEMP%\nsf3c66.tmp
%TEMP%\nup3c05.tmp
%TEMP%\nsf68dc.tmp
%TEMP%\nup68ec.tmp
%ProgramFiles%\eset\eset nod32 antivirus\x86\ekrnscan.dll
%TEMP%\nod32\x64\appdatadir\updfiles\em001_32_l2.nup
%TEMP%\nod32\x86\ekrnmailpluginslang.dll
%TEMP%\nod32\x64\ekrnmailpluginslang.dll
%TEMP%\nod32\x86\ekrnmailplugins.dll
%TEMP%\nod32\x64\x86\ekrnmailplugins.dll
%TEMP%\nod32\x86\ekrnlang.dll
%TEMP%\nod32\x64\ekrnlang.dll
%TEMP%\nod32\x86\ekrnepfwlang.dll
%TEMP%\nod32\x64\ekrnepfwlang.dll
%TEMP%\nod32\x64\x86\ekrnepfw.dll
%TEMP%\nod32\x86\ekrnepfw.dll
%TEMP%\nod32\x86\ekrnemon.dll
%TEMP%\nod32\x64\x86\ekrnemon.dll
%TEMP%\nod32\x86\ekrndmonlang.dll
%TEMP%\nod32\x64\ekrndmonlang.dll
%TEMP%\nod32\x86\ekrndmon.dll
%TEMP%\nod32\x64\x86\ekrndmon.dll
%TEMP%\nod32\x86\ekrnamon.dll
%TEMP%\nod32\x64\x86\ekrnamon.dll
%TEMP%\nod32\x86\eguiupdatelang.dll
%TEMP%\nod32\x64\eguiupdatelang.dll
%TEMP%\nod32\x64\eguiupdate.dll
%TEMP%\nod32\x86\eguiupdate.dll
%TEMP%\nod32\x86\eguiscanlang.dll
%TEMP%\nod32\x64\eguiscanlang.dll
%TEMP%\nod32\x64\eguiscan.dll
%TEMP%\nod32\x86\eguiscan.dll
%TEMP%\nod32\x86\eguiproductrcd.dll
%TEMP%\nod32\x64\eguiproductrcd.dll
%TEMP%\nod32\x86\eguiproduct.dll
%TEMP%\nod32\x64\x86\ekrnscan.dll
%TEMP%\nod32\x86\ekrnscan.dll
%TEMP%\nod32\x64\ekrnscanlang.dll
%TEMP%\nod32\x86\ekrnscanlang.dll
%TEMP%\nod32\x86\eplgtblang.dll
%TEMP%\nod32\x64\eplgtblang.dll
%TEMP%\nod32\x86\eplgtbemon.dll
%TEMP%\nod32\x64\x86\eplgtbemon.dll
%TEMP%\nod32\x86\mozilla thunderbird\components\eplgtb.dll
%TEMP%\nod32\x64\mozilla thunderbird\components\eplgtb.dll
%TEMP%\nod32\x86\eplgoutlooklang.dll
%TEMP%\nod32\x64\eplgoutlooklang.dll
%TEMP%\nod32\x86\eplgoutlookemonlang.dll
%TEMP%\nod32\x64\eplgoutlookemonlang.dll
%TEMP%\nod32\x64\eplgoutlookemon.dll
%TEMP%\nod32\x86\eplgoutlookemon.dll
%TEMP%\nod32\x64\x86\eplgoutlookemon.dll
%TEMP%\nod32\x64\eplgoutlook.dll
%TEMP%\nod32\x64\x86\eplgoutlook.dll
%TEMP%\nod32\x86\eplgoutlook.dll
%TEMP%\nod32\x86\eplgoelang.dll
%TEMP%\nod32\x64\eplgoelang.dll
%TEMP%\nod32\x64\eplgoeemon.dll
%TEMP%\nod32\x86\eplgoeemon.dll
%TEMP%\nod32\x64\x86\eplgoeemon.dll
%TEMP%\nod32\x64\eplgoe.dll
%TEMP%\nod32\x86\eplgoe.dll
%TEMP%\nod32\x64\x86\eplgoe.dll
%TEMP%\nod32\x64\eplghooks.dll
%TEMP%\nod32\x86\eplghooks.dll
%TEMP%\nod32\x86\ekrnupdatelang.dll
%TEMP%\nod32\x64\ekrnupdatelang.dll
%TEMP%\nod32\x86\ekrnupdate.dll
%TEMP%\nod32\x64\x86\ekrnupdate.dll
%TEMP%\nod32\x86\http_dll.dll
%TEMP%\nod32\x64\eguiproduct.dll
%TEMP%\nod32\x86\eguimailpluginslang.dll
%TEMP%\nod32\x64\eguimailpluginslang.dll
%TEMP%\nod32\x64\eh64.exe
%TEMP%\nod32\x64\egui.exe
%TEMP%\nod32\x86\egui.exe
%TEMP%\nod32\x86\eeclnt.exe
%TEMP%\nod32\x64\eeclnt.exe
%TEMP%\nod32\x86\ecmd.exe
%TEMP%\nod32\x64\ecmd.exe
%TEMP%\nod32\x86\ecls.exe
%TEMP%\nod32\x64\ecls.exe
%TEMP%\nod32\x86\callmsi.exe
%TEMP%\nod32\x64\callmsi.exe
%TEMP%\nod32\x86\eula.rtf
%TEMP%\nod32\x64\eula.rtf
%TEMP%\nod32\esetstpt.txt
%TEMP%\nod32\x86\appdatadir\ehttpsrv.xml
%TEMP%\nod32\x64\appdatadir\ehttpsrv.xml
%TEMP%\nod32\config.xml
%TEMP%\nod32\x86\microsoft.vc80.mfcloc.manifest
%TEMP%\nod32\x64\microsoft.vc80.mfcloc.manifest
%TEMP%\nod32\x86\microsoft.vc80.mfc.manifest
%TEMP%\nod32\x64\microsoft.vc80.mfc.manifest
%TEMP%\nod32\x86\microsoft.vc80.crt.manifest
%TEMP%\nod32\x64\x86\microsoft.vc80.crt.manifest
%TEMP%\nod32\x64\microsoft.vc80.crt.manifest
%TEMP%\nod32\x86\mozilla thunderbird\chrome.manifest
%TEMP%\nod32\x64\mozilla thunderbird\chrome.manifest
%TEMP%\nod32\x86\eset.chm
%TEMP%\nod32\x64\eset.chm
%TEMP%\nod32\x64\setup.msi
%TEMP%\nod32\x86\ehttpsrv.exe
%TEMP%\nod32\x64\ehttpsrv.exe
%TEMP%\nod32\x64\x86\ekrn.exe
%TEMP%\nod32\x86\ekrn.exe
%TEMP%\nod32\x86\eguimailplugins.dll
%TEMP%\nod32\x86\eguilang.dll
%TEMP%\nod32\x64\eguilang.dll
%TEMP%\nod32\x86\eguiepfwlang.dll
%TEMP%\nod32\x64\eguiepfwlang.dll
%TEMP%\nod32\x64\eguiepfw.dll
%TEMP%\nod32\x86\eguiepfw.dll
%TEMP%\nod32\x86\eguiemonlang.dll
%TEMP%\nod32\x64\eguiemonlang.dll
%TEMP%\nod32\x64\eguiemon.dll
%TEMP%\nod32\x86\eguiemon.dll
%TEMP%\nod32\x86\eguidmonlang.dll
%TEMP%\nod32\x64\eguidmonlang.dll
%TEMP%\nod32\x64\eguidmon.dll
%TEMP%\nod32\x86\eguiamonlang.dll
%TEMP%\nod32\x86\eguidmon.dll
%TEMP%\nod32\x64\eguiamonlang.dll
%TEMP%\nod32\x64\eguiamon.dll
%TEMP%\nod32\x86\eguiamon.dll
%TEMP%\nod32\x86\eclslang.dll
%TEMP%\nod32\x64\eclslang.dll
%TEMP%\nod32\x64\dmon.dll
%TEMP%\nod32\x86\dmon.dll
%TEMP%\nod32\x64\x86\dmon.dll
%TEMP%\nod32\x64\sysrescue.exe
%TEMP%\nod32\x86\sysrescue.exe
%TEMP%\nod32\x64\sysinspector.exe
%TEMP%\nod32\x86\sysinspector.exe
%TEMP%\nod32\esetstptuni.exe
%TEMP%\nod32\esetstpt.exe
%TEMP%\nod32\x64\eguimailplugins.dll
%TEMP%\nod32\x86\drivers\eamon4\eamon4.inf
%ALLUSERSPROFILE%\eset\eset nod32 antivirus\ehttpsrv.xml
%TEMP%\nod32\x86\mfc80.dll
%TEMP%\nod32\x86\appdatadir\updfiles\em006_32_l2.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em006_32_l2.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em006_32_l1.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em006_32_l1.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em006_32_l0.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em006_32_l0.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em005_32_l2.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em005_32_l2.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em005_32_l1.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em005_32_l1.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em005_32_l0.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em005_32_l0.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em004_32_l2.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em004_32_l2.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em004_32_l1.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em004_32_l1.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em004_32_l0.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em004_32_l0.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em003_32_l1.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em003_32_l1.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em003_32_l0.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em003_32_l0.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em002_32_l2.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em002_32_l2.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em002_32_l1.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em002_32_l1.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em002_32_l0.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em002_32_l0.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em001_32_l2.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em006_64_l0.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em006_64_l1.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em006_64_l2.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em009_32_l0.nup
%ProgramFiles%\eset\eset nod32 antivirus\drivers\ehdrv\ehdrv.inf
%ProgramFiles%\eset\eset nod32 antivirus\drivers\ehdrv\ehdrv.cat
%ProgramFiles%\eset\eset nod32 antivirus\eguiamon.dll
%ProgramFiles%\eset\eset nod32 antivirus\eplgoutlookemon.dll
%ProgramFiles%\eset\eset nod32 antivirus\drivers\epfwwfpr\epfwwfpr.sys
%ProgramFiles%\eset\eset nod32 antivirus\msvcr80.dll
%ProgramFiles%\eset\eset nod32 antivirus\mfc80u.dll
%ProgramFiles%\eset\eset nod32 antivirus\x86\ekrnupdate.dll
%ProgramFiles%\eset\eset nod32 antivirus\x86\ppeset.inf
%ProgramFiles%\eset\eset nod32 antivirus\x86\ppeset.dll
%TEMP%\inxffe1.tmp
%TEMP%\nod32\x86\mozilla thunderbird\install.rdf
%TEMP%\nod32\x64\mozilla thunderbird\install.rdf
%TEMP%\nod32\x64\appdatadir\updfiles\em015_64_l2.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em015_64_l0.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em015_64_l1.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em015_32_l2.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em015_32_l1.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em015_32_l0.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em013_64_l2.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em013_64_l1.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em013_64_l0.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em013_32_l2.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em013_32_l1.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em013_32_l0.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em009_64_l1.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em009_64_l0.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em009_32_l1.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em009_32_l1.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em009_32_l0.nup
%TEMP%\nod32\x64\mfc80.dll
%ProgramFiles%\eset\eset nod32 antivirus\x86\ekrnmailplugins.dll
%TEMP%\nod32\x86\appdatadir\updfiles\em001_32_l1.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em001_32_l1.nup
%TEMP%\nod32\x86\drivers\epfwtdir\epfwtdir.sys
%TEMP%\nod32\x64\drivers\ehdrv\ehdrv.sys
%TEMP%\nod32\x86\drivers\ehdrv\ehdrv.sys
%TEMP%\nod32\x64\drivers\eamonm\eamonm.sys
%TEMP%\nod32\x86\drivers\eamonm\eamonm.sys
%TEMP%\nod32\x86\drivers\eamon4\eamon4.sys
%TEMP%\nod32\x64\drivers\eamon\eamon.sys
%TEMP%\nod32\x86\drivers\eamon\eamon.sys
%TEMP%\nod32\x64\updater.dll
%TEMP%\nod32\x86\updater.dll
%TEMP%\nod32\x64\x86\updater.dll
%TEMP%\nod32\x86\sysrescuelang.dll
%TEMP%\nod32\x64\sysrescuelang.dll
%TEMP%\nod32\x86\sysinspectorlang.dll
%TEMP%\nod32\x64\sysinspectorlang.dll
%TEMP%\nod32\x86\shellextlang.dll
%TEMP%\nod32\x64\shellextlang.dll
%TEMP%\nod32\x64\shellext.dll
%TEMP%\nod32\x86\shellext.dll
%TEMP%\nod32\x64\x86\shellext.dll
%TEMP%\nod32\x86\ppeset.dll
%TEMP%\nod32\x64\x86\ppeset.dll
%TEMP%\nod32\x86\msvcr80.dll
%TEMP%\nod32\x64\x86\msvcr80.dll
%TEMP%\nod32\x64\msvcr80.dll
%TEMP%\nod32\x86\msvcp80.dll
%TEMP%\nod32\x64\x86\msvcp80.dll
%TEMP%\nod32\x64\mfc80u.dll
%TEMP%\nod32\x86\mfc80u.dll
%TEMP%\nod32\x64\drivers\epfwtdir\epfwtdir.sys
%TEMP%\nod32\x86\drivers\epfwtdr4\epfwtdr4.sys
%TEMP%\nod32\x86\drivers\epfwwfpr\epfwwfpr.sys
%TEMP%\nod32\x64\drivers\epfwwfpr\epfwwfpr.sys
%TEMP%\nod32\x64\appdatadir\updfiles\em001_32_l0.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em000_64_l0.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em000_32_l0.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em000_32_l0.nup
%TEMP%\nod32\x86\ppeset.inf
%TEMP%\nod32\x64\x86\ppeset.inf
%TEMP%\nod32\x86\drivers\epfwwfpr\epfwwfpr.inf
%TEMP%\nod32\x64\drivers\epfwwfpr\epfwwfpr.inf
%TEMP%\nod32\x86\drivers\epfwtdr4\epfwtdr4.inf
%TEMP%\nod32\x86\drivers\epfwtdir\epfwtdir.inf
%TEMP%\nod32\x64\drivers\epfwtdir\epfwtdir.inf
%TEMP%\nod32\x86\drivers\ehdrv\ehdrv.inf
%TEMP%\nod32\x64\drivers\ehdrv\ehdrv.inf
%TEMP%\nod32\x86\drivers\eamonm\eamonm.inf
%TEMP%\nod32\x64\http_dll.dll
%TEMP%\nod32\x64\drivers\eamonm\eamonm.inf
%TEMP%\nod32\x86\drivers\eamon\eamon.inf
%TEMP%\nod32\x64\drivers\eamon\eamon.inf
%TEMP%\nod32\x64\drivers\epfwwfpr\epfwwfpr.cat
%TEMP%\nod32\x86\drivers\epfwwfpr\epfwwfpr.cat
%TEMP%\nod32\x86\drivers\epfwtdr4\epfwtdr4.cat
%TEMP%\nod32\x64\drivers\epfwtdir\epfwtdir.cat
%TEMP%\nod32\x86\drivers\epfwtdir\epfwtdir.cat
%TEMP%\nod32\x64\drivers\ehdrv\ehdrv.cat
%TEMP%\nod32\x86\drivers\ehdrv\ehdrv.cat
%TEMP%\nod32\x64\drivers\eamonm\eamonm.cat
%TEMP%\nod32\x86\drivers\eamonm\eamonm.cat
%TEMP%\nod32\x86\drivers\eamon4\eamon4.cat
%TEMP%\nod32\x64\drivers\eamon\eamon.cat
%TEMP%\nod32\x86\drivers\eamon\eamon.cat
%TEMP%\nod32\x86\appdatadir\updfiles\em001_32_l0.nup
%ProgramFiles%\eset\esetstpt.exe

Sets the 'hidden' attribute to the following files

<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem3.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem4.cat

Deletes the following files

%TEMP%\nsf35ee.tmp
%TEMP%\nod32\x64\x86\shellext.dll
%TEMP%\nod32\x64\x86\ppeset.inf
%TEMP%\nod32\x64\x86\ppeset.dll
%TEMP%\nod32\x64\x86\msvcr80.dll
%TEMP%\nod32\x64\x86\msvcp80.dll
%TEMP%\nod32\x64\x86\microsoft.vc80.crt.manifest
%TEMP%\nod32\x64\x86\eplgtbemon.dll
%TEMP%\nod32\x64\x86\eplgoutlookemon.dll
%TEMP%\nod32\x64\x86\eplgoutlook.dll
%TEMP%\nod32\x64\x86\eplgoe.dll
%TEMP%\nod32\x86\appdatadir\ehttpsrv.xml
%TEMP%\nod32\x64\x86\ekrnupdate.dll
%TEMP%\nod32\x64\x86\ekrnscan.dll
%TEMP%\nod32\x64\x86\ekrnmailplugins.dll
%TEMP%\nod32\x64\x86\ekrnepfw.dll
%TEMP%\nod32\x64\x86\ekrnemon.dll
%TEMP%\nod32\x64\x86\ekrndmon.dll
%TEMP%\nod32\x64\x86\ekrnamon.dll
%TEMP%\nod32\x64\x86\ekrn.exe
%TEMP%\nod32\x64\x86\eplgoeemon.dll
%TEMP%\nod32\x86\appdatadir\updfiles\em015_32_l0.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em000_32_l0.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em013_32_l1.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em013_32_l0.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em009_32_l1.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em009_32_l0.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em006_32_l2.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em006_32_l1.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em006_32_l0.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em005_32_l2.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em005_32_l1.nup
%TEMP%\nod32\x64\x86\dmon.dll
%TEMP%\nod32\x64\x86\updater.dll
%TEMP%\nod32\x86\appdatadir\updfiles\em004_32_l1.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em004_32_l0.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em003_32_l1.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em003_32_l0.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em002_32_l2.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em002_32_l1.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em002_32_l0.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em001_32_l2.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em001_32_l1.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em004_32_l2.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em001_32_l0.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em005_32_l0.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em013_32_l2.nup
%TEMP%\nod32\x64\sysrescue.exe
%TEMP%\nod32\x64\eplgoelang.dll
%TEMP%\nod32\x64\eplghooks.dll
%TEMP%\nod32\x64\ekrnupdatelang.dll
%TEMP%\nod32\x64\ekrnscanlang.dll
%TEMP%\nod32\x64\ekrnmailpluginslang.dll
%TEMP%\nod32\x64\ekrnlang.dll
%TEMP%\nod32\x64\ekrnepfwlang.dll
%TEMP%\nod32\x64\ekrndmonlang.dll
%TEMP%\nod32\x64\ehttpsrv.exe
%TEMP%\nod32\x64\eh64.exe
%TEMP%\nod32\x64\eguiupdatelang.dll
%TEMP%\nod32\x64\eguiupdate.dll
%TEMP%\nod32\x64\eguiscanlang.dll
%TEMP%\nod32\x64\eguiscan.dll
%TEMP%\nod32\x64\eguiproductrcd.dll
%TEMP%\nod32\x64\eguiproduct.dll
%TEMP%\nod32\x64\eguimailpluginslang.dll
%TEMP%\nod32\x64\eguimailplugins.dll
%TEMP%\nod32\x64\eguilang.dll
%TEMP%\nod32\x64\eplgoutlook.dll
%TEMP%\nod32\x64\eplgoutlookemon.dll
%TEMP%\nod32\x64\sysinspectorlang.dll
%TEMP%\nod32\x64\microsoft.vc80.mfc.manifest
%TEMP%\nod32\x64\microsoft.vc80.mfcloc.manifest
%TEMP%\nod32\x64\sysinspector.exe
%TEMP%\nod32\x64\shellextlang.dll
%TEMP%\nod32\x64\shellext.dll
%TEMP%\nod32\x64\setup.msi
%TEMP%\nod32\x64\msvcr80.dll
%TEMP%\nod32\x64\mozilla thunderbird\install.rdf
%TEMP%\nod32\x64\mozilla thunderbird\components\eplgtb.dll
%TEMP%\nod32\x64\mozilla thunderbird\chrome.manifest
%TEMP%\nod32\x64\updater.dll
%TEMP%\nod32\x64\sysrescuelang.dll
%TEMP%\nod32\x64\eplgoe.dll
%TEMP%\nod32\x64\mfc80u.dll
%TEMP%\nod32\x64\mfc80.dll
%TEMP%\nod32\x64\http_dll.dll
%TEMP%\nod32\x64\eula.rtf
%TEMP%\nod32\x64\eset.chm
%TEMP%\nod32\x64\eplgtblang.dll
%TEMP%\nod32\x64\eplgoutlooklang.dll
%TEMP%\nod32\x64\eplgoutlookemonlang.dll
%TEMP%\nod32\x64\microsoft.vc80.crt.manifest
%TEMP%\nod32\x64\appdatadir\updfiles\em000_32_l0.nup
%TEMP%\nod32\x86\appdatadir\updfiles\em015_32_l1.nup
%TEMP%\nod32\x86\eplgoutlookemonlang.dll
%TEMP%\nod32\x86\eplgoutlookemon.dll
%TEMP%\nod32\x86\eplgoutlook.dll
%TEMP%\nod32\x86\eplgoelang.dll
%TEMP%\nod32\x86\eplgoeemon.dll
%TEMP%\nod32\x86\eplgoe.dll
%TEMP%\nod32\x86\eplghooks.dll
%TEMP%\nod32\x86\ekrnupdatelang.dll
%TEMP%\nod32\x86\ekrnupdate.dll
%TEMP%\nod32\x86\ekrnscanlang.dll
%TEMP%\nod32\x86\ekrnmailpluginslang.dll
%TEMP%\nod32\x86\eplgtblang.dll
%TEMP%\nod32\x86\ekrnmailplugins.dll
%TEMP%\nod32\x86\ekrnlang.dll
%TEMP%\nod32\x86\ekrnepfwlang.dll
%TEMP%\nod32\x86\ekrnepfw.dll
%TEMP%\nod32\x86\ekrnemon.dll
%TEMP%\nod32\x86\ekrndmonlang.dll
%TEMP%\nod32\x86\ekrndmon.dll
%TEMP%\nod32\x86\eplgoutlooklang.dll
%TEMP%\nod32\x86\ekrnscan.dll
%TEMP%\nod32\x86\appdatadir\updfiles\em015_32_l2.nup
%TEMP%\nod32\x86\eset.chm
%TEMP%\nod32\x86\sysinspectorlang.dll
%TEMP%\nod32\x86\sysinspector.exe
%TEMP%\nod32\x86\shellextlang.dll
%TEMP%\nod32\x86\shellext.dll
%TEMP%\nod32\x86\setup.msi
%TEMP%\nod32\x86\ppeset.inf
%TEMP%\nod32\x86\ppeset.dll
%TEMP%\nod32\x86\msvcr80.dll
%TEMP%\nod32\x86\ekrnamon.dll
%TEMP%\nod32\x86\msvcp80.dll
%TEMP%\nod32\x86\eplgtbemon.dll
%TEMP%\nod32\x86\mozilla thunderbird\chrome.manifest
%TEMP%\nod32\x86\microsoft.vc80.mfcloc.manifest
%TEMP%\nod32\x86\microsoft.vc80.mfc.manifest
%TEMP%\nod32\x86\microsoft.vc80.crt.manifest
%TEMP%\nod32\x86\mfc80u.dll
%TEMP%\nod32\x86\mfc80.dll
%TEMP%\nod32\x86\http_dll.dll
%TEMP%\nod32\x86\eula.rtf
%TEMP%\nod32\x86\mozilla thunderbird\install.rdf
%TEMP%\nod32\x86\ekrn.exe
%TEMP%\nod32\x86\sysrescue.exe
%TEMP%\nod32\x86\ehttpsrv.exe
%TEMP%\nod32\x86\eguiupdatelang.dll
%TEMP%\nod32\x86\drivers\epfwtdr4\epfwtdr4.sys
%TEMP%\nod32\x64\eguiepfwlang.dll
%TEMP%\nod32\x86\drivers\epfwtdr4\epfwtdr4.cat
%TEMP%\nod32\x86\drivers\epfwtdir\epfwtdir.sys
%TEMP%\nod32\x86\drivers\epfwtdir\epfwtdir.inf
%TEMP%\nod32\x86\drivers\epfwtdir\epfwtdir.cat
%TEMP%\nod32\x86\drivers\ehdrv\ehdrv.sys
%TEMP%\nod32\x86\drivers\ehdrv\ehdrv.inf
%TEMP%\nod32\x86\drivers\ehdrv\ehdrv.cat
%TEMP%\nod32\x86\drivers\epfwwfpr\epfwwfpr.cat
%TEMP%\nod32\x86\drivers\epfwwfpr\epfwwfpr.inf
%TEMP%\nod32\x86\drivers\eamonm\eamonm.sys
%TEMP%\nod32\x86\drivers\eamon4\eamon4.sys
%TEMP%\nod32\x86\drivers\eamon4\eamon4.inf
%TEMP%\nod32\x86\drivers\eamon4\eamon4.cat
%TEMP%\nod32\x86\drivers\eamon\eamon.sys
%TEMP%\nod32\x86\drivers\eamon\eamon.inf
%TEMP%\nod32\x86\drivers\eamon\eamon.cat
%TEMP%\nod32\x86\dmon.dll
%TEMP%\nod32\x86\callmsi.exe
%TEMP%\nod32\x86\drivers\eamonm\eamonm.inf
%TEMP%\nod32\x86\drivers\eamonm\eamonm.cat
%TEMP%\nod32\x64\eplgoeemon.dll
%TEMP%\nod32\x86\ecls.exe
%TEMP%\nod32\x86\eguiemonlang.dll
%TEMP%\nod32\x86\eguiepfw.dll
%TEMP%\nod32\x86\eguiscanlang.dll
%TEMP%\nod32\x86\eguiscan.dll
%TEMP%\nod32\x86\eguiproductrcd.dll
%TEMP%\nod32\x86\eguiproduct.dll
%TEMP%\nod32\x86\eguimailpluginslang.dll
%TEMP%\nod32\x86\eguimailplugins.dll
%TEMP%\nod32\x86\eguilang.dll
%TEMP%\nod32\x86\eguiepfwlang.dll
%TEMP%\nod32\x86\eguiupdate.dll
%TEMP%\nod32\x86\drivers\epfwwfpr\epfwwfpr.sys
%TEMP%\nod32\x86\drivers\epfwtdr4\epfwtdr4.inf
%TEMP%\nod32\x86\eguidmonlang.dll
%TEMP%\nod32\x86\eguidmon.dll
%TEMP%\nod32\x86\eguiamonlang.dll
%TEMP%\nod32\x86\eguiamon.dll
%TEMP%\nod32\x86\egui.exe
%TEMP%\nod32\x86\eeclnt.exe
%TEMP%\nod32\x86\ecmd.exe
%TEMP%\nod32\x86\eclslang.dll
%TEMP%\nod32\x86\eguiemon.dll
%TEMP%\nod32\x64\eguiepfw.dll
%TEMP%\nod32\x64\eguiemonlang.dll
%TEMP%\nod32\x64\eguiemon.dll
%TEMP%\nsf681a.tmp
%TEMP%\nup684c.tmp
%TEMP%\nup6808.tmp
%TEMP%\nsf6640.tmp
%TEMP%\nup66ee.tmp
%TEMP%\nup663f.tmp
%TEMP%\nsf662f.tmp
%TEMP%\nup662e.tmp
%TEMP%\nsf660e.tmp
%TEMP%\nup6661.tmp
%TEMP%\nup660d.tmp
%TEMP%\nsf64f2.tmp
%TEMP%\nup6512.tmp
%TEMP%\nup64f1.tmp
%TEMP%\nsf64d1.tmp
%TEMP%\nup64d0.tmp
%TEMP%\nsf3c66.tmp
%TEMP%\nup481b.tmp
%TEMP%\nup3c65.tmp
%TEMP%\nup682b.tmp
%TEMP%\nup688c.tmp
%TEMP%\nup6ae0.tmp
%TEMP%\nup69ad.tmp
%TEMP%\nup6a30.tmp
%TEMP%\nsf6ab0.tmp
%TEMP%\nup6aaf.tmp
%TEMP%\nsf69e1.tmp
%TEMP%\nup6a60.tmp
%TEMP%\nup69e0.tmp
%TEMP%\nsf69c0.tmp
%TEMP%\nup69bf.tmp
%TEMP%\nsf69ae.tmp
%TEMP%\nup6819.tmp
%TEMP%\nsf3c06.tmp
%TEMP%\nsf3a40.tmp
%TEMP%\nup696e.tmp
%TEMP%\nup690d.tmp
%TEMP%\nsf68ed.tmp
%TEMP%\nup68ec.tmp
%TEMP%\nsf68dc.tmp
%TEMP%\nup692f.tmp
%TEMP%\nup68db.tmp
%TEMP%\nsf682c.tmp
%TEMP%\nsf690e.tmp
%TEMP%\nup3c05.tmp
%TEMP%\nup3c95.tmp
%TEMP%\nup388f.tmp
%TEMP%\nsf3720.tmp
%TEMP%\nsf37a6.tmp
%TEMP%\nsf37a5.tmp
%TEMP%\nsf3785.tmp
%TEMP%\nsf3774.tmp
%TEMP%\nsf3764.tmp
%TEMP%\nsf3763.tmp
%TEMP%\nsf3752.tmp
%TEMP%\nsf3741.tmp
%TEMP%\nup6b01.tmp
%TEMP%\nsf37c7.tmp
%TEMP%\nsf3710.tmp
%TEMP%\nsf36ff.tmp
%TEMP%\nsf36ee.tmp
%TEMP%\nsf36ce.tmp
%TEMP%\nsf3650.tmp
%TEMP%\nsf3630.tmp
%TEMP%\nsf3610.tmp
%TEMP%\nsf360f.tmp
%TEMP%\nsf35fe.tmp
%TEMP%\nsf3731.tmp
%TEMP%\nod32\x86\sysrescuelang.dll
%TEMP%\nsf37d8.tmp
%TEMP%\nsf380a.tmp
%TEMP%\nsf37e8.tmp
%TEMP%\nup3a2f.tmp
%TEMP%\nsf3923.tmp
%TEMP%\nup39a2.tmp
%TEMP%\nup3912.tmp
%TEMP%\nsf38e2.tmp
%TEMP%\nup38e1.tmp
%TEMP%\nsf38b2.tmp
%TEMP%\nup3933.tmp
%TEMP%\nsf37f9.tmp
%TEMP%\nup38b1.tmp
%TEMP%\nsf37b7.tmp
%TEMP%\nsf386f.tmp
%TEMP%\nup386e.tmp
%TEMP%\nsf386d.tmp
%TEMP%\nsf384d.tmp
%TEMP%\nsf384c.tmp
%TEMP%\nsf383b.tmp
%TEMP%\nsf382b.tmp
%TEMP%\nsf381a.tmp
%TEMP%\nsf38a0.tmp
%TEMP%\nod32\x86\mozilla thunderbird\components\eplgtb.dll
%TEMP%\nsf6ae1.tmp
%TEMP%\nup6cb9.tmp
%TEMP%\nod32\x64\appdatadir\updfiles\em009_64_l0.nup
%TEMP%\nod32\x64\dmon.dll
%TEMP%\nod32\x64\callmsi.exe
%TEMP%\nod32\x64\appdatadir\updfiles\em015_64_l2.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em015_64_l1.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em015_64_l0.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em013_64_l2.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em013_64_l1.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em013_64_l0.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em009_64_l1.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em009_32_l1.nup
%TEMP%\nod32\x64\drivers\eamon\eamon.inf
%TEMP%\nod32\x64\appdatadir\updfiles\em009_32_l0.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em006_64_l2.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em006_64_l1.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em006_64_l0.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em006_32_l2.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em006_32_l1.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em006_32_l0.nup
%TEMP%\nsf6809.tmp
%TEMP%\nod32\x64\drivers\eamon\eamon.sys
%TEMP%\nod32\x64\eguidmonlang.dll
%TEMP%\nod32\x64\drivers\epfwwfpr\epfwwfpr.inf
%TEMP%\nod32\x64\drivers\epfwwfpr\epfwwfpr.sys
%TEMP%\nod32\x64\eguidmon.dll
%TEMP%\nod32\x64\eguiamonlang.dll
%TEMP%\nod32\x64\eguiamon.dll
%TEMP%\nod32\x64\egui.exe
%TEMP%\nod32\x64\eeclnt.exe
%TEMP%\nod32\x64\ecmd.exe
%TEMP%\nod32\x64\eclslang.dll
%TEMP%\nod32\x64\ecls.exe
%TEMP%\nod32\x64\appdatadir\updfiles\em005_32_l2.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em005_32_l1.nup
%TEMP%\nod32\x64\drivers\eamonm\eamonm.cat
%TEMP%\nod32\x64\drivers\epfwtdir\epfwtdir.sys
%TEMP%\nod32\x64\drivers\epfwtdir\epfwtdir.inf
%TEMP%\nod32\x64\drivers\epfwtdir\epfwtdir.cat
%TEMP%\nod32\x64\drivers\ehdrv\ehdrv.sys
%TEMP%\nod32\x64\drivers\ehdrv\ehdrv.inf
%TEMP%\nod32\x64\drivers\ehdrv\ehdrv.cat
%TEMP%\nod32\x64\drivers\eamonm\eamonm.sys
%TEMP%\nod32\x64\drivers\eamonm\eamonm.inf
%TEMP%\nod32\x64\drivers\epfwwfpr\epfwwfpr.cat
%TEMP%\nod32\x64\drivers\eamon\eamon.cat
%TEMP%\nod32\x64\appdatadir\updfiles\em005_32_l0.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em004_32_l2.nup
%TEMP%\nup6c88.tmp
%TEMP%\nup6fcf.tmp
%TEMP%\nsf7052.tmp
%TEMP%\nup7092.tmp
%TEMP%\nup7051.tmp
%TEMP%\nsf7030.tmp
%TEMP%\nup702f.tmp
%TEMP%\nsf700f.tmp
%TEMP%\nup7062.tmp
%TEMP%\{0dd0fc2a-9efa-40e2-39cf-cd1d0839d11e}\eamonm.cat
%TEMP%\nup700e.tmp
%TEMP%\nsf6f7f.tmp
%TEMP%\nup6f7e.tmp
%TEMP%\nsf6f5e.tmp
%TEMP%\nup6f5d.tmp
%TEMP%\nsf6f4c.tmp
%TEMP%\nup6f9f.tmp
%TEMP%\nup6f4b.tmp
%TEMP%\nsf6cc9.tmp
%TEMP%\nup6cf9.tmp
%TEMP%\{5e113cd0-f5c9-44dd-2616-286ef81db715}\ehdrv.inf
%TEMP%\nsf6c89.tmp
%WINDIR%\temp\udddbbf.tmp
%TEMP%\{074e44ce-22d5-5d77-d92a-365c77d18971}\epfwwfpr.inf
%TEMP%\nod32\x64\appdatadir\updfiles\em004_32_l1.nup
%TEMP%\{0dd0fc2a-9efa-40e2-39cf-cd1d0839d11e}\eamonm.inf
%TEMP%\nod32\x64\appdatadir\updfiles\em004_32_l0.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em003_32_l1.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em003_32_l0.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em002_32_l2.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em002_32_l1.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em002_32_l0.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em001_32_l2.nup
%TEMP%\{074e44ce-22d5-5d77-d92a-365c77d18971}\epfwwfpr.cat
%TEMP%\nod32\x64\appdatadir\updfiles\em001_32_l1.nup
%TEMP%\nod32\x64\appdatadir\updfiles\em000_64_l0.nup
%TEMP%\{5e113cd0-f5c9-44dd-2616-286ef81db715}\ehdrv.cat
%TEMP%\nod32\x64\appdatadir\ehttpsrv.xml
%TEMP%\nod32\esetstptuni.exe
%TEMP%\nod32\esetstpt.txt
%TEMP%\nod32\esetstpt.exe
%TEMP%\nod32\config.xml
%TEMP%\inxffe1.tmp
%WINDIR%\temp\uddef40.tmp
%TEMP%\nod32\x64\appdatadir\updfiles\em001_32_l0.nup
%TEMP%\nod32\x86\updater.dll

Moves the following files

from %TEMP%\{5e113cd0-f5c9-44dd-2616-286ef81db715}\setb20f.tmp to %TEMP%\{5e113cd0-f5c9-44dd-2616-286ef81db715}\ehdrv.cat
from %TEMP%\{5e113cd0-f5c9-44dd-2616-286ef81db715}\setb2ac.tmp to %TEMP%\{5e113cd0-f5c9-44dd-2616-286ef81db715}\ehdrv.inf
from <DRIVERS>\setc16a.tmp to <DRIVERS>\ehdrv.sys
from %TEMP%\{0dd0fc2a-9efa-40e2-39cf-cd1d0839d11e}\setc8fb.tmp to %TEMP%\{0dd0fc2a-9efa-40e2-39cf-cd1d0839d11e}\eamonm.cat
from %TEMP%\{0dd0fc2a-9efa-40e2-39cf-cd1d0839d11e}\setc988.tmp to %TEMP%\{0dd0fc2a-9efa-40e2-39cf-cd1d0839d11e}\eamonm.inf
from <DRIVERS>\setd78a.tmp to <DRIVERS>\eamonm.sys
from %TEMP%\{074e44ce-22d5-5d77-d92a-365c77d18971}\setdc8d.tmp to %TEMP%\{074e44ce-22d5-5d77-d92a-365c77d18971}\epfwwfpr.cat
from %TEMP%\{074e44ce-22d5-5d77-d92a-365c77d18971}\setdd39.tmp to %TEMP%\{074e44ce-22d5-5d77-d92a-365c77d18971}\epfwwfpr.inf
from <DRIVERS>\seteb0b.tmp to <DRIVERS>\epfwwfpr.sys

Modifies the following files

Network activity

Connects to

'up###e.eset.com':80

TCP

HTTP GET requests

http://up###e.eset.com/eset_upd/v4/update.ver

UDP

DNS ASK up###e.eset.com

Miscellaneous

Searches for the following windows

ClassName: 'ESET Client Frame' WindowName: ''
ClassName: 'TrayNotifyWnd' WindowName: ''
ClassName: 'SysPager' WindowName: ''
ClassName: 'ToolbarWindow32' WindowName: ''
ClassName: 'NotifyIconOverflowWindow' WindowName: ''

Creates and executes the following

'%ProgramFiles%\eset\eset nod32 antivirus\x86\ekrn.exe'
'%ProgramFiles%\eset\eset nod32 antivirus\egui.exe' /hide

Executes the following

'%WINDIR%\syswow64\reg.exe' Add "HKCU\Software\Eset\ESET Security\CurrentVersion\Client" /v "AnimateControls" /t REG_DWORD /d "1" /f
'<SYSTEM32>\rundll32.exe' "%ProgramFiles%\ESET\ESET NOD32 Antivirus\eplgOE.dll",CallFnc Global\EMH:00000b44:00000bec
'<SYSTEM32>\cmd.exe' /c xcopy /y Esetstptuni.exe "%ProgramFiles%\ESET\"
'<SYSTEM32>\xcopy.exe' /y Esetstpt.txt "%ProgramFiles%\ESET\"
'<SYSTEM32>\cmd.exe' /c xcopy /y Esetstpt.txt "%ProgramFiles%\ESET\"
'<SYSTEM32>\cmd.exe' /c xcopy /y Esetstpt.exe "%ProgramFiles%\ESET\"
'<SYSTEM32>\xcopy.exe' /y config.xml "%ProgramFiles%\ESET\"
'<SYSTEM32>\xcopy.exe' /y Esetstpt.exe "%ProgramFiles%\ESET\"
'<SYSTEM32>\cmd.exe' /c xcopy /y config.xml "%ProgramFiles%\ESET\"
'%WINDIR%\syswow64\msiexec.exe' /Y "%ProgramFiles%\ESET\ESET NOD32 Antivirus\x86\PPESET.dll"
'<SYSTEM32>\msiexec.exe' /I "x64\setup.msi" /qb REBOOT=ReallySuppress
'%WINDIR%\syswow64\reg.exe' Add "HKCU\Software\Eset\ESET Security\CurrentVersion\Client" /v "PageMode" /t REG_DWORD /d "1" /f
'%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles%\ESET\ESET NOD32 Antivirus\eplgOE.dll",CallFnc Global\EMH:00000b44:00000bec
'<SYSTEM32>\xcopy.exe' /y Esetstptuni.exe "%ProgramFiles%\ESET\"
'%WINDIR%\syswow64\msiexec.exe' /Y "%ProgramFiles%\ESET\ESET NOD32 Antivirus\x86\DMON.dll"
'%WINDIR%\syswow64\reg.exe' Add "HKCU\Software\Eset\ESET Security\CurrentVersion\Client" /v "PageMode" /t REG_DWORD /d "1" /f' (with hidden window)
'<SYSTEM32>\cmd.exe' /c xcopy /y Esetstpt.txt "%ProgramFiles%\ESET\"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c xcopy /y Esetstptuni.exe "%ProgramFiles%\ESET\"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c xcopy /y config.xml "%ProgramFiles%\ESET\"' (with hidden window)
'<SYSTEM32>\msiexec.exe' /I "x64\setup.msi" /qb REBOOT=ReallySuppress' (with hidden window)
'<SYSTEM32>\cmd.exe' /c xcopy /y Esetstpt.exe "%ProgramFiles%\ESET\"' (with hidden window)
'%WINDIR%\syswow64\reg.exe' Add "HKCU\Software\Eset\ESET Security\CurrentVersion\Client" /v "AnimateControls" /t REG_DWORD /d "1" /f' (with hidden window)

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней