Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- [<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\CisUtMonitor] 'ImagePath' = 'system32\DRIVERS\CisUtMonitor.sys'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\1.tmp\2.bat
- %ProgramFiles%\Uninstall Tool\languages\is-UAJ4V.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-5T3QG.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-7K3LE.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-B298D.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-P5D4E.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-97G2T.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-F8KME.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-V310B.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-7UGR4.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-4F3FA.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-PRPRG.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-RBFSL.tmp
- %ProgramFiles%\Uninstall Tool\is-1N4NO.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-DHINC.tmp
- %ProgramFiles%\Uninstall Tool\is-C0M9G.tmp
- %ProgramFiles%\Uninstall Tool\is-2C5H4.tmp
- %ProgramFiles%\Uninstall Tool\is-IDET3.tmp
- %ProgramFiles%\Uninstall Tool\is-GDUV6.tmp
- %ProgramFiles%\Uninstall Tool\is-N0T8S.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Uninstall Tool\Unіnstall Tool.lnk
- %HOMEPATH%\Desktop\Uninstall Tool.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Uninstall Tool.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Uninstall Tool\Uninstall Tool on the Web.lnk
- %ProgramFiles%\Uninstall Tool\UninstallTool.url
- %ProgramFiles%\Uninstall Tool\unins000.msg
- %ProgramFiles%\Uninstall Tool\unins000.dat
- %WINDIR%\inf\oem3.inf
- %WINDIR%\inf\oem3.PNF
- %ProgramFiles%\Uninstall Tool\languages\is-V55RP.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-2NC53.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-ETMGC.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-FE61U.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-132AM.tmp
- %TEMP%\1.tmp\X64\UninstallTool.exe
- %TEMP%\1.tmp\X64\UninstallTool.exe.BAK
- %TEMP%\1.tmp\X86\UninstallTool.exe
- %TEMP%\is-3B395.tmp\uninstalltool_setup.tmp
- %ProgramFiles%\Uninstall Tool\is-3TJEB.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-FRTCV.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-J0C39.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-LSE55.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-IVR9N.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-07J8P.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-FG2DB.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-HKAIE.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-O19J5.tmp
- <DRIVERS>\SET6.tmp
- %ProgramFiles%\Uninstall Tool\is-BF4LC.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-K7RR0.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-UGIRE.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-MELNA.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-GAE42.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-RP2A2.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-C3I79.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-F60LI.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-KSBA8.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-4JKJT.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-DOFFE.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-BLRHE.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-K2SKK.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-E822O.tmp
- %ProgramFiles%\Uninstall Tool\languages\is-3S50M.tmp
- %TEMP%\1.tmp\uninstalltool_setup.exe
- %ProgramFiles%\Uninstall Tool\languages\is-EBNFG.tmp
- %APPDATA%\CrystalIdea Software\Uninstall Tool\preferences.xml
Перемещает следующие файлы:
- %ProgramFiles%\Uninstall Tool\is-3TJEB.tmp в %ProgramFiles%\Uninstall Tool\unins000.exe
- %ProgramFiles%\Uninstall Tool\languages\is-V55RP.tmp в %ProgramFiles%\Uninstall Tool\languages\Persian.xml
- %ProgramFiles%\Uninstall Tool\languages\is-2NC53.tmp в %ProgramFiles%\Uninstall Tool\languages\Polish.xml
- %ProgramFiles%\Uninstall Tool\languages\is-UAJ4V.tmp в %ProgramFiles%\Uninstall Tool\languages\Portuguese.xml
- %ProgramFiles%\Uninstall Tool\languages\is-5T3QG.tmp в %ProgramFiles%\Uninstall Tool\languages\Portuguese_Brazilian.xml
- %ProgramFiles%\Uninstall Tool\languages\is-7K3LE.tmp в %ProgramFiles%\Uninstall Tool\languages\Romanian.xml
- %ProgramFiles%\Uninstall Tool\languages\is-B298D.tmp в %ProgramFiles%\Uninstall Tool\languages\Russian.xml
- %ProgramFiles%\Uninstall Tool\languages\is-P5D4E.tmp в %ProgramFiles%\Uninstall Tool\languages\Serbian_Cyrillic.xml
- %ProgramFiles%\Uninstall Tool\languages\is-97G2T.tmp в %ProgramFiles%\Uninstall Tool\languages\Serbian_Latin.xml
- %ProgramFiles%\Uninstall Tool\languages\is-F8KME.tmp в %ProgramFiles%\Uninstall Tool\languages\Slovak.xml
- %ProgramFiles%\Uninstall Tool\languages\is-UGIRE.tmp в %ProgramFiles%\Uninstall Tool\languages\English.xml
- %ProgramFiles%\Uninstall Tool\languages\is-V310B.tmp в %ProgramFiles%\Uninstall Tool\languages\Spanish.xml
- %ProgramFiles%\Uninstall Tool\languages\is-4F3FA.tmp в %ProgramFiles%\Uninstall Tool\languages\Turkish.xml
- %ProgramFiles%\Uninstall Tool\languages\is-PRPRG.tmp в %ProgramFiles%\Uninstall Tool\languages\Ukrainian.xml
- %ProgramFiles%\Uninstall Tool\languages\is-RBFSL.tmp в %ProgramFiles%\Uninstall Tool\languages\Vietnamese.xml
- %ProgramFiles%\Uninstall Tool\is-1N4NO.tmp в %ProgramFiles%\Uninstall Tool\UninstallTool.exe
- %ProgramFiles%\Uninstall Tool\is-C0M9G.tmp в %ProgramFiles%\Uninstall Tool\UninstallTool.cpl
- %ProgramFiles%\Uninstall Tool\is-BF4LC.tmp в %ProgramFiles%\Uninstall Tool\utshellext.dll
- %ProgramFiles%\Uninstall Tool\is-2C5H4.tmp в %ProgramFiles%\Uninstall Tool\UninstallToolHelper.exe
- %ProgramFiles%\Uninstall Tool\is-IDET3.tmp в %ProgramFiles%\Uninstall Tool\UninstallToolExec.exe
- %ProgramFiles%\Uninstall Tool\is-GDUV6.tmp в %ProgramFiles%\Uninstall Tool\CisUtMonitor.inf
- %ProgramFiles%\Uninstall Tool\languages\is-FE61U.tmp в %ProgramFiles%\Uninstall Tool\languages\Lithuanian.xml
- %ProgramFiles%\Uninstall Tool\languages\is-ETMGC.tmp в %ProgramFiles%\Uninstall Tool\languages\Norwegian.xml
- %ProgramFiles%\Uninstall Tool\languages\is-132AM.tmp в %ProgramFiles%\Uninstall Tool\languages\Latvian.xml
- %ProgramFiles%\Uninstall Tool\languages\is-3S50M.tmp в %ProgramFiles%\Uninstall Tool\languages\Korean.xml
- %ProgramFiles%\Uninstall Tool\languages\is-E822O.tmp в %ProgramFiles%\Uninstall Tool\languages\Japanese.xml
- %ProgramFiles%\Uninstall Tool\languages\is-J0C39.tmp в %ProgramFiles%\Uninstall Tool\languages\Armenian.xml
- %ProgramFiles%\Uninstall Tool\languages\is-LSE55.tmp в %ProgramFiles%\Uninstall Tool\languages\Azerbaijani.xml
- %ProgramFiles%\Uninstall Tool\languages\is-IVR9N.tmp в %ProgramFiles%\Uninstall Tool\languages\Belarusian.xml
- %ProgramFiles%\Uninstall Tool\languages\is-07J8P.tmp в %ProgramFiles%\Uninstall Tool\languages\Bulgarian.xml
- %ProgramFiles%\Uninstall Tool\languages\is-FG2DB.tmp в %ProgramFiles%\Uninstall Tool\languages\Chinese_Simplified.xml
- %ProgramFiles%\Uninstall Tool\languages\is-HKAIE.tmp в %ProgramFiles%\Uninstall Tool\languages\Chinese_Traditional.xml
- %ProgramFiles%\Uninstall Tool\languages\is-O19J5.tmp в %ProgramFiles%\Uninstall Tool\languages\Croatian.xml
- %ProgramFiles%\Uninstall Tool\languages\is-K7RR0.tmp в %ProgramFiles%\Uninstall Tool\languages\Czech.xml
- %ProgramFiles%\Uninstall Tool\languages\is-DHINC.tmp в %ProgramFiles%\Uninstall Tool\languages\Danish.xml
- %ProgramFiles%\Uninstall Tool\is-N0T8S.tmp в %ProgramFiles%\Uninstall Tool\CisUtMonitor.sys
- %ProgramFiles%\Uninstall Tool\languages\is-7UGR4.tmp в %ProgramFiles%\Uninstall Tool\languages\Swedish.xml
- %ProgramFiles%\Uninstall Tool\languages\is-EBNFG.tmp в %ProgramFiles%\Uninstall Tool\languages\Dutch.xml
- %ProgramFiles%\Uninstall Tool\languages\is-GAE42.tmp в %ProgramFiles%\Uninstall Tool\languages\French.xml
- %ProgramFiles%\Uninstall Tool\languages\is-RP2A2.tmp в %ProgramFiles%\Uninstall Tool\languages\Georgian.xml
- %ProgramFiles%\Uninstall Tool\languages\is-C3I79.tmp в %ProgramFiles%\Uninstall Tool\languages\German.xml
- %ProgramFiles%\Uninstall Tool\languages\is-F60LI.tmp в %ProgramFiles%\Uninstall Tool\languages\Greek.xml
- %ProgramFiles%\Uninstall Tool\languages\is-KSBA8.tmp в %ProgramFiles%\Uninstall Tool\languages\Hebrew.xml
- %ProgramFiles%\Uninstall Tool\languages\is-4JKJT.tmp в %ProgramFiles%\Uninstall Tool\languages\Hindi.xml
- %ProgramFiles%\Uninstall Tool\languages\is-DOFFE.tmp в %ProgramFiles%\Uninstall Tool\languages\Hungarian.xml
- %ProgramFiles%\Uninstall Tool\languages\is-BLRHE.tmp в %ProgramFiles%\Uninstall Tool\languages\Indonesian.xml
- %ProgramFiles%\Uninstall Tool\languages\is-K2SKK.tmp в %ProgramFiles%\Uninstall Tool\languages\Italian.xml
- %ProgramFiles%\Uninstall Tool\languages\is-FRTCV.tmp в %ProgramFiles%\Uninstall Tool\languages\Arabic.xml
- %ProgramFiles%\Uninstall Tool\languages\is-MELNA.tmp в %ProgramFiles%\Uninstall Tool\languages\Estonian.xml
- <DRIVERS>\SET6.tmp в <DRIVERS>\CisUtMonitor.sys
Другое:
Создает и запускает на исполнение:
- '%TEMP%\1.tmp\uninstalltool_setup.exe' /INSTALL /SILENT, /VERYSILENT /NORESTART
- '%TEMP%\is-3B395.tmp\uninstalltool_setup.tmp' /SL5="$100E0,3207127,185856,%TEMP%\1.tmp\uninstalltool_setup.exe" /INSTALL /SILENT, /VERYSILENT /NORESTART
- '%ProgramFiles%\Uninstall Tool\UninstallTool.exe' /install_service_silent
- '%ProgramFiles%\Uninstall Tool\UninstallTool.exe' /init
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\2.bat" <Полный путь к файлу>"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Uninstall Tool\utshellext.dll"
- '<SYSTEM32>\rundll32.exe' setupapi.dll, InstallHinfSection DefaultInstall 132 .\CisUtMonitor.inf
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\grpconv.exe' -o
