Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'USB Server' = '"%ProgramFiles%\USB Server 2\USB Server.exe" /h'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\EST_BusEnum] 'ImagePath' = 'system32\DRIVERS\GenBus.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\NUS_Bus] 'ImagePath' = 'system32\DRIVERS\NUS_Bus.sys'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\IXP000.TMP\Install.exe
- %WINDIR%\Installer\3837d.msi
- %WINDIR%\Installer\{383986D5-3689-4C07-8F9E-4B517123EE14}\ARPPRODUCTICON.exe
- %WINDIR%\Installer\{383986D5-3689-4C07-8F9E-4B517123EE14}\USB_Server.exe_4F4F6C12247F48459955B5BE7109B5D4.exe
- %WINDIR%\Installer\{383986D5-3689-4C07-8F9E-4B517123EE14}\USB_Server.exe1_57463AC4160944019DBB991A479A2937.exe
- %WINDIR%\Installer\{383986D5-3689-4C07-8F9E-4B517123EE14}\1033.MST
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\setua123.rra
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\ISSea23c.rra
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\setua365.rra
- %TEMP%\_is1D.tmp
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\1034.mst
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\1028.mst
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x04a430.rra
- %TEMP%\_is1E.tmp
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\1031.mst
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x04a4dc.rra
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\1033a50b.rra
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x04a52a.rra
- %TEMP%\_is1F.tmp
- %ALLUSERSPROFILE%\Desktop\Launch USB Server.lnk
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x04a394.rra
- %ALLUSERSPROFILE%\Start Menu\Programs\USB Server 2\Launch USB Server.lnk
- %WINDIR%\inf\GenBus.cat
- %ProgramFiles%\USB Server 2\Driver\NUS_Bus.inf
- %ProgramFiles%\USB Server 2\Driver\NUS_Bus.sys
- %ProgramFiles%\USB Server 2\Driver\NUServerXP.inf
- %ProgramFiles%\USB Server 2\Driver\nuserverxp32.cat
- %ProgramFiles%\USB Server 2\Driver\NUServerXP32.sys
- <DRIVERS>\NUS_Bus.sys
- <DRIVERS>\GenBus.sys
- %WINDIR%\inf\NUS_Bus.inf
- %WINDIR%\inf\GenBus.inf
- <SYSTEM32>\DIFxAPI.dll
- %WINDIR%\inf\NUS_Bus.cat
- %ProgramFiles%\USB Server 2\USB Server.exe
- %ProgramFiles%\USB Server 2\DCPDLL.dll
- %ProgramFiles%\USB Server 2\ESTLogDLL.dll
- %ProgramFiles%\USB Server 2\PSMDLL.dll
- %ProgramFiles%\USB Server 2\UNTPDLL.dll
- %ProgramFiles%\USB Server 2\Driver\DIFxCmd.exe
- %ProgramFiles%\USB Server 2\Driver\DrvSetup.exe
- %ProgramFiles%\USB Server 2\CreateShortcut.exe
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x04aa99.rra
- %WINDIR%\inf\oem3.PNF
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\1036.mst
- %WINDIR%\Temp\OLD28.tmp
- <DRIVERS>\SET29.tmp
- %WINDIR%\inf\genbus.PNF
- <SYSTEM32>\DRVSTORE\GenHC_AF3BDE5753269D005AA19F53855B02E88913C467\GenHC.inf
- <SYSTEM32>\DRVSTORE\GenHC_AF3BDE5753269D005AA19F53855B02E88913C467\GenHC.cat
- <SYSTEM32>\DRVSTORE\GenHC_AF3BDE5753269D005AA19F53855B02E88913C467\GenHC.sys
- <SYSTEM32>\DRVSTORE\NUServerXP_C64B2209163E3639AC4085D8E3DEBE218CBAF8DE\NUServerXP.inf
- <SYSTEM32>\DRVSTORE\NUServerXP_C64B2209163E3639AC4085D8E3DEBE218CBAF8DE\NUServerXP32.cat
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem4.CAT
- %TEMP%\_is20.tmp
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nus_bus.CAT
- %WINDIR%\inf\oem4.inf
- %WINDIR%\LastGood\TMP2E.tmp
- %WINDIR%\Temp\OLD2F.tmp
- %WINDIR%\inf\oem4.PNF
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- <DRIVERS>\SET30.tmp
- %WINDIR%\inf\oem3.inf
- %WINDIR%\LastGood\TMP27.tmp
- %ProgramFiles%\USB Server 2\Driver\NUS_Bus.cat
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\genbus.CAT
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\1045.mst
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x04a77c.rra
- %TEMP%\_is21.tmp
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\1040.mst
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x04a895.rra
- %TEMP%\_is22.tmp
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\1041.mst
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x04a98f.rra
- %TEMP%\_is23.tmp
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x04a643.rra
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\setup.ini
- %TEMP%\_is24.tmp
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\1049.mst
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x08ab93.rra
- %TEMP%\_is25.tmp
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\2052.mst
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x08ac6e.rra
- %TEMP%\_is26.tmp
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\2070.mst
- %TEMP%\33347.mst
- <SYSTEM32>\DRVSTORE\NUServerXP_C64B2209163E3639AC4085D8E3DEBE218CBAF8DE\NUServerXP32.sys
- %ProgramFiles%\USB Server 2\Driver\GenHC.cat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %TEMP%\{C556AECA-3E36-4B64-AF43-A0550229A809}\0x0411.ini
- %TEMP%\_is9.tmp
- %TEMP%\{C556AECA-3E36-4B64-AF43-A0550229A809}\0x0415.ini
- %TEMP%\_isA.tmp
- %TEMP%\{C556AECA-3E36-4B64-AF43-A0550229A809}\0x0419.ini
- %TEMP%\_isB.tmp
- %TEMP%\{C556AECA-3E36-4B64-AF43-A0550229A809}\0x0804.ini
- %TEMP%\_isC.tmp
- %TEMP%\_isE.tmp
- %TEMP%\{1B8E96D3-DAE1-42DB-B30B-D68AC0D1BC9B}\setup.inx
- %TEMP%\~D.tmp
- %TEMP%\_isF.tmp
- %TEMP%\{C556AECA-3E36-4B64-AF43-A0550229A809}\1033.MST
- %TEMP%\_is10.tmp
- %TEMP%\{C556AECA-3E36-4B64-AF43-A0550229A809}\USB Server.msi
- %TEMP%\_is11.tmp
- %TEMP%\{C556AECA-3E36-4B64-AF43-A0550229A809}\ISSetup.dll
- %TEMP%\_is12.tmp
- %TEMP%\_is8.tmp
- %TEMP%\{C556AECA-3E36-4B64-AF43-A0550229A809}\0x0816.ini
- %TEMP%\{C556AECA-3E36-4B64-AF43-A0550229A809}\0x0410.ini
- %TEMP%\{C556AECA-3E36-4B64-AF43-A0550229A809}\_ISMSIDEL.INI
- %TEMP%\IXP000.TMP\XP64_Setup.exe
- %TEMP%\IXP000.TMP\XP_Setup.exe
- %TEMP%\IXP000.TMP\VS_Setup.exe
- %TEMP%\IXP000.TMP\VS_64_Setup.exe
- %TEMP%\IXP000.TMP\W7_Setup.exe
- %TEMP%\IXP000.TMP\W7_64_Setup.exe
- %TEMP%\_is1.tmp
- %TEMP%\{C556AECA-3E36-4B64-AF43-A0550229A809}\Setup.INI
- %TEMP%\_is2.tmp
- %TEMP%\{C556AECA-3E36-4B64-AF43-A0550229A809}\0x040c.ini
- %TEMP%\{C556AECA-3E36-4B64-AF43-A0550229A809}\0x0404.ini
- %TEMP%\_is3.tmp
- %TEMP%\{C556AECA-3E36-4B64-AF43-A0550229A809}\0x0407.ini
- %TEMP%\_is4.tmp
- %TEMP%\{C556AECA-3E36-4B64-AF43-A0550229A809}\0x0409.ini
- %TEMP%\_is5.tmp
- %TEMP%\{C556AECA-3E36-4B64-AF43-A0550229A809}\0x040a.ini
- %TEMP%\_is6.tmp
- %TEMP%\_is7.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %ProgramFiles%\USB Server 2\Driver\GenHC.inf
- %TEMP%\_is14.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %WINDIR%\Installer\38379.msi
- %TEMP%\{1B8E96D3-DAE1-42DB-B30B-D68AC0D1BC9B}\ISRT.dll
- %WINDIR%\Installer\3837a.mst
- %WINDIR%\Installer\MSI19.tmp
- %WINDIR%\Installer\3837b.ipi
- %WINDIR%\Installer\MSI1A.tmp
- C:\Config.Msi\3837c.rbs
- %ProgramFiles%\USB Server 2\Driver\GenBus.cat
- %ProgramFiles%\USB Server 2\Driver\GenBus.inf
- %ProgramFiles%\USB Server 2\Driver\GenBus.sys
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- %ProgramFiles%\USB Server 2\Driver\GenHC.sys
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- %TEMP%\398f.rra
- %TEMP%\{1B8E96D3-DAE1-42DB-B30B-D68AC0D1BC9B}\setup.exe
- %TEMP%\_is15.tmp
- %TEMP%\{1B8E96D3-DAE1-42DB-B30B-D68AC0D1BC9B}\_isres_0x0409.dll
- %TEMP%\_is16.tmp
- %TEMP%\{1B8E96D3-DAE1-42DB-B30B-D68AC0D1BC9B}\String1033.txt
- %TEMP%\_is17.tmp
- %TEMP%\{1B8E96D3-DAE1-42DB-B30B-D68AC0D1BC9B}\_isuser_0x0409.dll
- %TEMP%\MSI18.tmp
- %TEMP%\_is13.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- %WINDIR%\inf\nus_bus.PNF
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\genbus.CAT
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem4.CAT
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nus_bus.CAT
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
Удаляет следующие файлы:
- %TEMP%\_is1.tmp
- %TEMP%\_is17.tmp
- %TEMP%\MSI18.tmp
- %WINDIR%\Installer\MSI19.tmp
- %WINDIR%\Installer\MSI1A.tmp
- C:\Config.Msi\3837c.rbs
- %WINDIR%\Installer\3837a.mst
- %WINDIR%\Installer\38379.msi
- %WINDIR%\Installer\3837b.ipi
- %TEMP%\_is1D.tmp
- %TEMP%\_isE.tmp
- %TEMP%\_is1E.tmp
- %TEMP%\_is20.tmp
- %TEMP%\_is21.tmp
- %TEMP%\_is22.tmp
- %TEMP%\_is23.tmp
- %TEMP%\_is24.tmp
- %TEMP%\_is25.tmp
- %TEMP%\_is26.tmp
- <DRIVERS>\GenBus.sys
- %WINDIR%\Temp\OLD28.tmp
- %TEMP%\_is15.tmp
- %TEMP%\_is16.tmp
- %TEMP%\_is14.tmp
- %TEMP%\_is13.tmp
- %TEMP%\_is12.tmp
- %TEMP%\_is3.tmp
- %TEMP%\_is4.tmp
- %TEMP%\_is5.tmp
- %TEMP%\_is6.tmp
- %TEMP%\_is7.tmp
- %TEMP%\_is8.tmp
- %TEMP%\_is9.tmp
- %TEMP%\_isA.tmp
- %TEMP%\_isB.tmp
- <DRIVERS>\NUS_Bus.sys
- %TEMP%\_is1F.tmp
- %TEMP%\_isC.tmp
- %TEMP%\_isF.tmp
- %TEMP%\_is10.tmp
- %TEMP%\_is11.tmp
- %TEMP%\IXP000.TMP\W7_64_Setup.exe
- %TEMP%\IXP000.TMP\W7_Setup.exe
- %TEMP%\IXP000.TMP\VS_64_Setup.exe
- %TEMP%\IXP000.TMP\VS_Setup.exe
- %TEMP%\IXP000.TMP\XP64_Setup.exe
- %TEMP%\IXP000.TMP\Install.exe
- %TEMP%\_is2.tmp
- %TEMP%\~D.tmp
- %WINDIR%\Temp\OLD2F.tmp
Перемещает следующие файлы:
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\setua123.rra в %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\setup.exe
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x08ac6e.rra в %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x0816.ini
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x08ab93.rra в %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x0804.ini
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x04aa99.rra в %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x0419.ini
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x04a98f.rra в %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x0415.ini
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x04a895.rra в %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x0411.ini
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x04a77c.rra в %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x0410.ini
- %WINDIR%\LastGood\TMP27.tmp в %WINDIR%\LastGood\system32\DRIVERS\GenBus.sys
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x04a643.rra в %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x040c.ini
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\1033a50b.rra в %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\1033.mst
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x04a4dc.rra в %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x0409.ini
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x04a430.rra в %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x0407.ini
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x04a394.rra в %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x0404.ini
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\setua365.rra в %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\setup.ini
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\ISSea23c.rra в %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\ISSetup.dll
- %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x04a52a.rra в %ProgramFiles%\InstallShield Installation Information\{383986D5-3689-4C07-8F9E-4B517123EE14}\0x040a.ini
- %WINDIR%\LastGood\TMP2E.tmp в %WINDIR%\LastGood\system32\DRIVERS\NUS_Bus.sys
Подменяет следующие файлы:
- <DRIVERS>\GenBus.sys
- <DRIVERS>\NUS_Bus.sys
Сетевая активность:
Подключается к:
- 'wp#d':80
- '20#.#6.232.182':80
TCP:
Запросы HTTP GET:
- http://11#.#11.111.1/wpad.dat via wp#d
- http://crl.microsoft.com/pki/crl/products/MicWinHarComPCA_2008-01-08.crl via 20#.#6.232.182
- http://crl.microsoft.com/pki/crl/products/tspca.crl via 20#.#6.232.182
UDP:
- DNS ASK wp#d
- DNS ASK crl.microsoft.com
Другое:
Создает и запускает на исполнение:
- '%TEMP%\IXP000.TMP\Install.exe'
- '%TEMP%\IXP000.TMP\XP_Setup.exe'
- '%ProgramFiles%\USB Server 2\Driver\DrvSetup.exe' install Driver\GenBus.inf root\EST_Bus
- '%ProgramFiles%\USB Server 2\Driver\DIFxCmd.exe' /p Driver\GenHC.inf
- '%ProgramFiles%\USB Server 2\Driver\DIFxCmd.exe' /i Driver\GenHC.inf
- '%ProgramFiles%\USB Server 2\Driver\DrvSetup.exe' install Driver\NUS_Bus.inf root\NUS_Bus 16
- '%ProgramFiles%\USB Server 2\Driver\DIFxCmd.exe' /p Driver\NUServerXP.inf 16
- '%ProgramFiles%\USB Server 2\Driver\DIFxCmd.exe' /i Driver\NUServerXP.inf 16
Запускает на исполнение:
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding 96246EFC27B7D0DC8630F1DDE9F8C234 C
- '<SYSTEM32>\msiexec.exe' -Embedding 3C15A824B1038EC920E95181D4F50E49
- '<SYSTEM32>\runonce.exe' -r
