Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'McAfeeUpdaterUI' = '"%ProgramFiles%\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey'
Создает следующие сервисы
- [<HKLM>\System\CurrentControlSet\Services\NAIMServInst] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\NAIMServInst] 'ImagePath' = '"%TEMP%\unz1.tmp\FramePkg.exe" /SignalComplete /CLEANUP2="%TEMP%\unz1.tmp" /INSTALL="Agent" /LOGDIR=%TEMP%\NAILogs'
- [<HKLM>\System\CurrentControlSet\Services\McAfeeFramework] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\McAfeeFramework] 'ImagePath' = '%ProgramFiles%\Network Associates\Common Framework\FrameworkService.exe /ServiceStart'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\nailogs\frminst_vzuelrzdfapv.log
- %ALLUSERSPROFILE%\application data\network associates\common framework\agent.ini
- %ProgramFiles%\network associates\common framework\agentplugin.dll
- %ProgramFiles%\network associates\common framework\0409\agentres.dll
- %ProgramFiles%\network associates\common framework\cleanup.exe
- %ProgramFiles%\network associates\common framework\clientui.dll
- %ProgramFiles%\network associates\common framework\0409\cmauires.dll
- %ProgramFiles%\network associates\common framework\cmdagent.exe
- %ProgramFiles%\network associates\common framework\listenserver.dll
- %ProgramFiles%\network associates\common framework\componentsubsystem.dll
- %ALLUSERSPROFILE%\application data\network associates\common framework\db\frameworklog.xsl
- %ALLUSERSPROFILE%\application data\network associates\common framework\frameworkmanifest.xml
- %ProgramFiles%\network associates\common framework\frameworkservice.exe
- %ProgramFiles%\network associates\common framework\frminst.exe
- %ProgramFiles%\network associates\common framework\frmplugin.dll
- %ProgramFiles%\network associates\common framework\genevtinf.dll
- %ALLUSERSPROFILE%\application data\network associates\common framework\installmain.mcs
- %WINDIR%\temp\unz2.tmp\cmauires.dll
- %ProgramFiles%\network associates\common framework\agent.dll
- %ProgramFiles%\network associates\common framework\componentuserinterface.dll
- %ProgramFiles%\network associates\common framework\internetmanager.dll
- %WINDIR%\temp\unz2.tmp\xmlwrap.dll
- %WINDIR%\temp\unz2.tmp\scheduler.dll
- %WINDIR%\temp\unz2.tmp\scriptsubsys.dll
- %WINDIR%\temp\unz2.tmp\scrptres.dll
- %WINDIR%\temp\unz2.tmp\secureframeworkfactory.dll
- %WINDIR%\temp\unz2.tmp\server.xml
- %WINDIR%\temp\unz2.tmp\sitelist.xml
- %WINDIR%\temp\unz2.tmp\srpubkey.bin
- %WINDIR%\temp\unz2.tmp\unicows.dll
- %WINDIR%\temp\unz2.tmp\updatemain.mcs
- %WINDIR%\temp\unz2.tmp\installmain.mcs
- %WINDIR%\temp\unz2.tmp\updatesubsys.dll
- %WINDIR%\temp\unz2.tmp\updaterui.exe
- %WINDIR%\temp\unz2.tmp\updplug.dll
- %WINDIR%\temp\unz2.tmp\updres.dll
- %WINDIR%\temp\unz2.tmp\userspace.dll
- %WINDIR%\temp\unz2.tmp\componentsubsystem.dll
- %WINDIR%\temp\unz2.tmp\pcrplug.dll
- %WINDIR%\temp\unz2.tmp\clientui.dll
- %TEMP%\unz1.tmp\cmauires.dll
- %ProgramFiles%\network associates\common framework\logging.dll
- %ProgramFiles%\network associates\common framework\nainet.dll
- %ProgramFiles%\network associates\common framework\naprdmgr.exe
- %ProgramFiles%\network associates\common framework\naspipe.dll
- %ProgramFiles%\network associates\common framework\naxml.dll
- %ProgramFiles%\network associates\common framework\nagshr32.dll
- %ProgramFiles%\network associates\common framework\naicrt32.dll
- %ProgramFiles%\network associates\common framework\nmcomn32.dll
- %ProgramFiles%\network associates\common framework\nailog.dll
- %ProgramFiles%\network associates\common framework\management.dll
- %ProgramFiles%\network associates\common framework\naisign.dll
- %ProgramFiles%\network associates\common framework\unicows.dll
- %ALLUSERSPROFILE%\application data\network associates\common framework\db\agent_vzuelrzdfapv.log
- %ALLUSERSPROFILE%\application data\network associates\common framework\db\agent_vzuelrzdfapv.xml
- %ALLUSERSPROFILE%\application data\network associates\common framework\compiled.xml
- %ALLUSERSPROFILE%\application data\network associates\common framework\local.xml
- %ALLUSERSPROFILE%\application data\network associates\common framework\precompiled.xml
- %ProgramFiles%\network associates\common framework\nacmnlib.dll
- %ProgramFiles%\network associates\common framework\mcurial.dll
- %ProgramFiles%\network associates\common framework\napolicymanager.dll
- %ProgramFiles%\network associates\common framework\xmlwrap.dll
- %ProgramFiles%\network associates\common framework\userspace.dll
- %ProgramFiles%\network associates\common framework\mcscript.exe
- %ProgramFiles%\network associates\common framework\pcrplug.dll
- %ProgramFiles%\network associates\common framework\poevtinf.dll
- %ProgramFiles%\network associates\common framework\scheduler.dll
- %ProgramFiles%\network associates\common framework\scriptsubsys.dll
- %ProgramFiles%\network associates\common framework\0409\scrptres.dll
- %ProgramFiles%\network associates\common framework\secureframeworkfactory.dll
- %WINDIR%\temp\unz2.tmp\poevtinf.dll
- %ALLUSERSPROFILE%\application data\network associates\common framework\server.xml
- %WINDIR%\temp\unz2.tmp\psapi.dll
- %ALLUSERSPROFILE%\application data\network associates\common framework\serversitelist.xml
- %ALLUSERSPROFILE%\application data\network associates\common framework\srpubkey.bin
- %ProgramFiles%\network associates\common framework\updplug.dll
- %ProgramFiles%\network associates\common framework\0409\updres.dll
- %ALLUSERSPROFILE%\application data\network associates\common framework\updatemain.mcs
- %ProgramFiles%\network associates\common framework\updatesubsys.dll
- %ProgramFiles%\network associates\common framework\updaterui.exe
- %ALLUSERSPROFILE%\application data\network associates\common framework\sitelist.xml
- %ProgramFiles%\network associates\common framework\psapi.dll
- %ALLUSERSPROFILE%\application data\network associates\common framework\updatehistory.ini
- %WINDIR%\temp\unz2.tmp\patchw32.dll
- %WINDIR%\temp\unz2.tmp\naxml.dll
- %WINDIR%\temp\unz2.tmp\naspipe.dll
- %TEMP%\unz1.tmp\naisign.dll
- %TEMP%\unz1.tmp\nailog.dll
- %TEMP%\unz1.tmp\napolicymanager.dll
- %TEMP%\unz1.tmp\naprdmgr.exe
- %TEMP%\unz1.tmp\naspipe.dll
- %TEMP%\unz1.tmp\naxml.dll
- %TEMP%\unz1.tmp\patchw32.dll
- %TEMP%\unz1.tmp\poevtinf.dll
- %TEMP%\unz1.tmp\pcrplug.dll
- %TEMP%\unz1.tmp\psapi.dll
- %TEMP%\unz1.tmp\scheduler.dll
- %TEMP%\unz1.tmp\scriptsubsys.dll
- %TEMP%\unz1.tmp\scrptres.dll
- %TEMP%\unz1.tmp\secureframeworkfactory.dll
- %TEMP%\unz1.tmp\server.xml
- %TEMP%\unz1.tmp\nacmnlib.dll
- %TEMP%\unz1.tmp\mcscript.exe
- %TEMP%\unz1.tmp\nainet.dll
- %TEMP%\unz1.tmp\mcurial.dll
- %TEMP%\unz1.tmp\management.dll
- %TEMP%\unz1.tmp\frameworklog.xsl
- %TEMP%\unz1.tmp\cabinet.dll
- %TEMP%\unz1.tmp\agent.dll
- %TEMP%\unz1.tmp\agent.ini
- %TEMP%\unz1.tmp\agentplugin.dll
- %TEMP%\unz1.tmp\agentres.dll
- %TEMP%\unz1.tmp\cleanup.exe
- %TEMP%\unz1.tmp\cmdagent.exe
- %TEMP%\unz1.tmp\sitelist.xml
- %WINDIR%\randseed.rnd
- %TEMP%\unz1.tmp\componentuserinterface.dll
- %TEMP%\unz1.tmp\frameworkservice.exe
- %TEMP%\unz1.tmp\frminst.exe
- %TEMP%\unz1.tmp\frmplugin.dll
- %TEMP%\unz1.tmp\genevtinf.dll
- %TEMP%\unz1.tmp\internetmanager.dll
- %TEMP%\unz1.tmp\listenserver.dll
- %TEMP%\unz1.tmp\logging.dll
- %TEMP%\unz1.tmp\__temp.zip
- %TEMP%\unz1.tmp\frameworkmanifest.xml
- %ProgramFiles%\network associates\common framework\patchw32.dll
- %TEMP%\unz1.tmp\srpubkey.bin
- %TEMP%\unz1.tmp\updatesubsys.dll
- %WINDIR%\temp\unz2.tmp\frmplugin.dll
- %WINDIR%\temp\unz2.tmp\genevtinf.dll
- %WINDIR%\temp\unz2.tmp\internetmanager.dll
- %WINDIR%\temp\unz2.tmp\listenserver.dll
- %WINDIR%\temp\unz2.tmp\logging.dll
- %WINDIR%\temp\unz2.tmp\management.dll
- %TEMP%\unz1.tmp\nagshr32.dll
- %WINDIR%\temp\unz2.tmp\mcscript.exe
- %WINDIR%\temp\unz2.tmp\nacmnlib.dll
- %WINDIR%\temp\unz2.tmp\nagshr32.dll
- %WINDIR%\temp\unz2.tmp\nainet.dll
- %WINDIR%\temp\unz2.tmp\naisign.dll
- %WINDIR%\temp\unz2.tmp\nailog.dll
- %WINDIR%\temp\unz2.tmp\napolicymanager.dll
- %WINDIR%\temp\unz2.tmp\naprdmgr.exe
- %WINDIR%\temp\unz2.tmp\frameworkmanifest.xml
- %WINDIR%\temp\unz2.tmp\mcurial.dll
- %WINDIR%\temp\unz2.tmp\frminst.exe
- %WINDIR%\temp\unz2.tmp\frameworkservice.exe
- %WINDIR%\temp\unz2.tmp\frameworklog.xsl
- %WINDIR%\temp\unz2.tmp\componentuserinterface.dll
- %TEMP%\unz1.tmp\updaterui.exe
- %TEMP%\unz1.tmp\updplug.dll
- %TEMP%\unz1.tmp\updres.dll
- %TEMP%\unz1.tmp\userspace.dll
- %TEMP%\unz1.tmp\xmlwrap.dll
- %TEMP%\unz1.tmp\componentsubsystem.dll
- %TEMP%\unz1.tmp\unicows.dll
- %TEMP%\unz1.tmp\clientui.dll
- %TEMP%\unz1.tmp\updatemain.mcs
- %TEMP%\unz1.tmp\framepkg.exe
- %WINDIR%\temp\unz2.tmp\cabinet.dll
- %WINDIR%\temp\unz2.tmp\agent.dll
- %WINDIR%\temp\unz2.tmp\agent.ini
- %WINDIR%\temp\unz2.tmp\agentplugin.dll
- %WINDIR%\temp\unz2.tmp\agentres.dll
- %WINDIR%\temp\unz2.tmp\cleanup.exe
- %TEMP%\unz1.tmp\installmain.mcs
- %WINDIR%\temp\unz2.tmp\cmdagent.exe
- %WINDIR%\temp\unz2.tmp\__temp.zip
- %ALLUSERSPROFILE%\application data\network associates\common framework\sitemaplist.xml
Сетевая активность
Подключается к
- '<LOCALNET>.10.5':81
Другое
Ищет следующие окна
- ClassName: 'McAfee Fire Application Window Class' WindowName: ''
- ClassName: 'McAfeeCommonUpdaterUIMainWindow' WindowName: ''
- ClassName: 'McAfee_FrameworkServiceClass' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\unz1.tmp\frminst.exe' /CreateService="%TEMP%\unz1.tmp\FramePkg.exe" /Cleanup2="%TEMP%\unz1.tmp" /LOGDIR=%TEMP%\NAILogs
- '%TEMP%\unz1.tmp\framepkg.exe' /SignalComplete /CLEANUP2="%TEMP%\unz1.tmp" /INSTALL="Agent" /LOGDIR=%TEMP%\NAILogs
- '%WINDIR%\temp\unz2.tmp\frminst.exe' /CLEANUP2="%TEMP%\unz1.tmp" /INSTALL="Agent" /LOGDIR=%TEMP%\NAILogs /Cleanup="%WINDIR%\TEMP\unz2.tmp" /LOGDIR=%TEMP%\NAILogs
- '%ProgramFiles%\network associates\common framework\frameworkservice.exe'
- '%ProgramFiles%\network associates\common framework\updaterui.exe'
- '%ProgramFiles%\network associates\common framework\naprdmgr.exe'
- '%ProgramFiles%\network associates\common framework\frameworkservice.exe' /ServiceStart
- '%ProgramFiles%\network associates\common framework\naprdmgr.exe' associates\common framework\naPrdMgr.exe -Embedding
Запускает на исполнение
- '<SYSTEM32>\regsvr32.exe' /u /s "<SYSTEM32>\atl.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Network Associates\Common Framework\UpdateSubSys.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Network Associates\Common Framework\UpdPlug.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Network Associates\Common Framework\SecureFrameworkFactory.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Network Associates\Common Framework\ScriptSubSys.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Network Associates\Common Framework\Scheduler.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Network Associates\Common Framework\Management.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Network Associates\Common Framework\Logging.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Network Associates\Common Framework\ListenServer.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Network Associates\Common Framework\InternetManager.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Network Associates\Common Framework\GenEvtInf.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Network Associates\Common Framework\ComponentUserInterface.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Network Associates\Common Framework\ComponentSubSystem.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Network Associates\Common Framework\AgentPlugin.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Network Associates\Common Framework\Agent.dll"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\atl.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Network Associates\Common Framework\UserSpace.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Network Associates\Common Framework\naPolicyManager.dll"
