Trojan.MulDrop8.25644

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\ffffffff-gggg-477e-b520-005419850605\setupcli.exe
%WINDIR%\syswow64\pclient\uimodules\~glh006b.tmp
%WINDIR%\syswow64\pclient\~glh006c.tmp
%WINDIR%\syswow64\pclient\uimodules\~glh006d.tmp
%WINDIR%\syswow64\pclient\uimodules\~glh006e.tmp
%WINDIR%\syswow64\pclient\uimodules\~glh006f.tmp
%WINDIR%\syswow64\pclient\~glh0070.tmp
%WINDIR%\syswow64\pclient\resource\~glh0071.tmp
%WINDIR%\syswow64\pclient\modules\~glh0069.tmp
%WINDIR%\syswow64\pclient\modules\~glh006a.tmp
%WINDIR%\syswow64\pclient\resource\~glh0072.tmp
%WINDIR%\syswow64\pclient\modules\~glh0075.tmp
%WINDIR%\syswow64\pclient\modules\~glh0076.tmp
%TEMP%\~glh0077.tmp
%WINDIR%\syswow64\msvcp90.dll
%TEMP%\~glh0078.tmp
%WINDIR%\syswow64\msvcr90.dll
%TEMP%\~glh0079.tmp
%WINDIR%\syswow64\pclient\~glh0073.tmp
%WINDIR%\syswow64\pclient\~glh0074.tmp
%WINDIR%\syswow64\pclient\modules\~glh0068.tmp
%WINDIR%\syswow64\pclient\modules\~glh0067.tmp
%WINDIR%\syswow64\pclient\modules\~glh0066.tmp
%WINDIR%\syswow64\pclient\modules\~glh0054.tmp
%WINDIR%\syswow64\pclient\modules\~glh0055.tmp
%WINDIR%\syswow64\pclient\modules\~glh0056.tmp
%WINDIR%\syswow64\pclient\modules\~glh0057.tmp
%WINDIR%\syswow64\pclient\modules\~glh0058.tmp
%WINDIR%\syswow64\pclient\modules\~glh0059.tmp
%WINDIR%\syswow64\pclient\modules\~glh005a.tmp
%WINDIR%\syswow64\pclient\modules\~glh005b.tmp
%WINDIR%\syswow64\pclient\modules\~glh0053.tmp
%WINDIR%\syswow64\pclient\modules\~glh005c.tmp
%WINDIR%\syswow64\pclient\modules\~glh005e.tmp
%WINDIR%\syswow64\pclient\modules\~glh005f.tmp
%WINDIR%\syswow64\pclient\modules\~glh0060.tmp
%WINDIR%\syswow64\pclient\modules\~glh0061.tmp
%WINDIR%\syswow64\pclient\modules\~glh0062.tmp
%WINDIR%\syswow64\pclient\modules\~glh0063.tmp
%WINDIR%\syswow64\pclient\modules\~glh0064.tmp
%WINDIR%\syswow64\pclient\modules\~glh0065.tmp
%WINDIR%\syswow64\pclient\modules\~glh005d.tmp
%WINDIR%\syswow64\pclient\msvcp80.dll
%TEMP%\~glh007a.tmp
%WINDIR%\syswow64\pclient\msvcr80.dll
%WINDIR%\~glh007b.tmp
%WINDIR%\syswow64\pclient\uimodules\~glh0094.tmp
%WINDIR%\syswow64\pclient\modules\~glh0095.tmp
%WINDIR%\syswow64\pclient\~glh0096.tmp
%WINDIR%\syswow64\pclient\modules\~glh0097.tmp
%WINDIR%\syswow64\pclient\~glh0098.tmp
%WINDIR%\syswow64\pclient\~glh0099.tmp
%WINDIR%\syswow64\pclient\modules\~glh009a.tmp
%WINDIR%\syswow64\pclient\uimodules\~glh009b.tmp
%WINDIR%\syswow64\pclient\~glh009c.tmp
%WINDIR%\syswow64\pclient\modules\~glh009d.tmp
%WINDIR%\syswow64\pclient\modules\~glh009e.tmp
%WINDIR%\syswow64\pclient\~glh009f.tmp
%WINDIR%\syswow64\pclient\~glh00a0.tmp
%WINDIR%\syswow64\pclient\~glh00a1.tmp
%TEMP%\~glh00a2.tmp
%WINDIR%\syswow64\pclient\dbghelp.dll
<DRIVERS>\~glh00a3.tmp
<DRIVERS>\~glh00a4.tmp
<SYSTEM32>\~glh00a5.tmp
%WINDIR%\syswow64\pclient\modules\~glh0093.tmp
%WINDIR%\syswow64\pclient\modules\~glh0091.tmp
%WINDIR%\syswow64\pclient\modules\~glh0092.tmp
%WINDIR%\syswow64\pclient\modules\~glh0090.tmp
%WINDIR%\syswow64\pclient\~glh007d.tmp
%WINDIR%\syswow64\pclient\modules\~glh007e.tmp
%WINDIR%\syswow64\pclient\~glh007f.tmp
%WINDIR%\syswow64\~glh0080.tmp
%WINDIR%\syswow64\pclient\modules\~glh0081.tmp
%WINDIR%\syswow64\pclient\modules\~glh0082.tmp
%WINDIR%\syswow64\pclient\~glh0083.tmp
%WINDIR%\syswow64\pclient\uimodules\~glh0084.tmp
%WINDIR%\syswow64\pclient\~glh0085.tmp
%WINDIR%\syswow64\pclient\modules\~glh0086.tmp
%WINDIR%\syswow64\pclient\uimodules\~glh0087.tmp
%WINDIR%\syswow64\pclient\uimodules\~glh0088.tmp
%WINDIR%\syswow64\pclient\~glh0089.tmp
%WINDIR%\syswow64\pclient\modules\~glh008a.tmp
%WINDIR%\syswow64\pclient\~glh008b.tmp
%WINDIR%\syswow64\pclient\modules\~glh008c.tmp
%WINDIR%\syswow64\pclient\~glh008d.tmp
%WINDIR%\syswow64\pclient\~glh008e.tmp
%WINDIR%\syswow64\pclient\~glh008f.tmp
<DRIVERS>\~glh00a6.tmp
%WINDIR%\syswow64\pclient\modules\~glh0052.tmp
%WINDIR%\syswow64\pclient\modules\~glh0051.tmp
%WINDIR%\syswow64\pclient\modules\~glh0050.tmp
C:\phenix_client\~glh0011.tmp
C:\phenix_client\~glh0012.tmp
%ProgramFiles(x86)%\gsc\install\phenixclient.log
%TEMP%\~glh0013.tmp
%ProgramFiles(x86)%\gsc\install\~glbs383.tmp
%TEMP%\~glh0014.tmp
%WINDIR%\~glh0015.tmp
C:\phenix_client\~glh000f.tmp
C:\phenix_client\~glh0010.tmp
%TEMP%\~glh0016.tmp
%WINDIR%\syswow64\pclient\~glh001a.tmp
%WINDIR%\syswow64\pclient\~glh001b.tmp
%WINDIR%\syswow64\pclient\~glh001c.tmp
%WINDIR%\syswow64\pclient\~glh001d.tmp
%WINDIR%\syswow64\pclient\~glh001e.tmp
%WINDIR%\syswow64\pclient\~glh001f.tmp
%WINDIR%\syswow64\pclient\~glh0020.tmp
%WINDIR%\~glh0018.tmp
%WINDIR%\syswow64\pclient\~glh0019.tmp
C:\phenix_client\~glh000e.tmp
C:\phenix_client\~glh000d.tmp
C:\phenix_client\~glh000c.tmp
%TEMP%\22c36d54-2b65-4a89-b62c-14a9e562383c\1mid.xml
%TEMP%\22c36d54-2b65-4a89-b62c-14a9e562383c\phenixcli.exe
%TEMP%\glcef7c.tmp
%TEMP%\gljef9c.tmp
%TEMP%\glkf1b0.tmp
%TEMP%\glg226.tmp
%TEMP%\~glh0000.tmp
C:\phenix_client\~glh0001.tmp
%TEMP%\22c36d54-2b65-4a89-b62c-14a9e562383c\setup.ini
C:\phenix_client\~glh0002.tmp
C:\phenix_client\~glh0004.tmp
C:\phenix_client\~glh0005.tmp
C:\phenix_client\~glh0006.tmp
C:\phenix_client\~glh0007.tmp
C:\phenix_client\~glh0008.tmp
C:\phenix_client\~glh0009.tmp
C:\phenix_client\~glh000a.tmp
C:\phenix_client\~glh000b.tmp
C:\phenix_client\~glh0003.tmp
%WINDIR%\syswow64\pclient\~glh0021.tmp
%WINDIR%\syswow64\pclient\~glh0022.tmp
%WINDIR%\syswow64\pclient\~glh0023.tmp
%WINDIR%\syswow64\pclient\~glh0024.tmp
%WINDIR%\syswow64\pclient\~glh003c.tmp
%WINDIR%\syswow64\pclient\languagedata\~glh003d.tmp
%WINDIR%\syswow64\pclient\browseclassinfo\~glh003e.tmp
%WINDIR%\syswow64\pclient\~glh003f.tmp
%WINDIR%\syswow64\pclient\~glh0040.tmp
%WINDIR%\syswow64\pclient\modules\~glh0041.tmp
%WINDIR%\syswow64\pclient\modules\~glh0042.tmp
%WINDIR%\syswow64\pclient\inf\~glh0043.tmp
%WINDIR%\syswow64\pclient\inf\~glh0044.tmp
%WINDIR%\syswow64\pclient\~glh0045.tmp
%WINDIR%\syswow64\pclient\~glh0046.tmp
%WINDIR%\syswow64\pclient\~glh0047.tmp
%WINDIR%\syswow64\pclient\~glh0048.tmp
%WINDIR%\syswow64\pclient\~glh0049.tmp
%WINDIR%\syswow64\pclient\~glh004a.tmp
%WINDIR%\syswow64\pclient\~glh004b.tmp
%WINDIR%\syswow64\pclient\~glh004c.tmp
%WINDIR%\syswow64\pclient\modules\~glh004d.tmp
%WINDIR%\syswow64\pclient\modules\~glh004e.tmp
%WINDIR%\syswow64\pclient\~glh003b.tmp
%WINDIR%\syswow64\pclient\~glh0039.tmp
%WINDIR%\syswow64\pclient\~glh003a.tmp
%WINDIR%\syswow64\pclient\~glh0038.tmp
%WINDIR%\syswow64\pclient\~glh0025.tmp
%WINDIR%\syswow64\pclient\~glh0026.tmp
%WINDIR%\syswow64\pclient\~glh0027.tmp
%WINDIR%\syswow64\pclient\~glh0028.tmp
%WINDIR%\syswow64\pclient\~glh0029.tmp
%WINDIR%\syswow64\pclient\~glh002a.tmp
%WINDIR%\syswow64\pclient\~glh002b.tmp
%WINDIR%\syswow64\pclient\~glh002c.tmp
%WINDIR%\syswow64\pclient\~glh002d.tmp
%WINDIR%\syswow64\pclient\~glh002e.tmp
%WINDIR%\syswow64\pclient\~glh002f.tmp
%WINDIR%\syswow64\pclient\~glh0030.tmp
%WINDIR%\syswow64\pclient\~glh0031.tmp
%WINDIR%\syswow64\pclient\~glh0032.tmp
%WINDIR%\syswow64\pclient\~glh0033.tmp
%WINDIR%\syswow64\pclient\modules\~glh0034.tmp
%WINDIR%\syswow64\pclient\modules\~glh0035.tmp
%WINDIR%\syswow64\pclient\~glh0036.tmp
%WINDIR%\syswow64\pclient\~glh0037.tmp
%WINDIR%\syswow64\pclient\modules\~glh004f.tmp
<DRIVERS>\~glh00a7.tmp

Удаляет следующие файлы

%ProgramFiles(x86)%\gsc\install\phenixclient.log
%WINDIR%\bbclp.exe
%WINDIR%\syswow64\pclient\bllog.dll
%WINDIR%\syswow64\pclient\modules\equipmgr.dll

Перемещает следующие файлы

%TEMP%\~glh0000.tmp в %TEMP%\productinfo.dat
%WINDIR%\syswow64\pclient\~glh006c.tmp в %WINDIR%\syswow64\pclient\blui.dll
%WINDIR%\syswow64\pclient\uimodules\~glh006d.tmp в %WINDIR%\syswow64\pclient\uimodules\sendmessage.dll
%WINDIR%\syswow64\pclient\uimodules\~glh006e.tmp в %WINDIR%\syswow64\pclient\uimodules\shutdown.dll
%WINDIR%\syswow64\pclient\uimodules\~glh006f.tmp в %WINDIR%\syswow64\pclient\uimodules\patchui.dll
%WINDIR%\syswow64\pclient\~glh0070.tmp в %WINDIR%\syswow64\pclient\pureres.dll
%WINDIR%\syswow64\pclient\resource\~glh0071.tmp в %WINDIR%\syswow64\pclient\resource\pureres.en-us.dll
%WINDIR%\syswow64\pclient\modules\~glh006a.tmp в %WINDIR%\syswow64\pclient\modules\gscpolicy.dll
%WINDIR%\syswow64\pclient\uimodules\~glh006b.tmp в %WINDIR%\syswow64\pclient\uimodules\admindialog.dll
%WINDIR%\syswow64\pclient\resource\~glh0072.tmp в %WINDIR%\syswow64\pclient\resource\pureres.zh-tw.dll
%WINDIR%\syswow64\pclient\modules\~glh0075.tmp в %WINDIR%\syswow64\pclient\modules\ftpsvr.dll
%WINDIR%\syswow64\pclient\modules\~glh0076.tmp в %WINDIR%\syswow64\pclient\modules\ftpdown.dll
%TEMP%\~glh0077.tmp в %TEMP%\msvcp90.dll
%TEMP%\~glh0078.tmp в %TEMP%\msvcr90.dll
%TEMP%\~glh0079.tmp в %TEMP%\msvcp80.dll
%TEMP%\~glh007a.tmp в %TEMP%\msvcr80.dll
%WINDIR%\syswow64\pclient\~glh0073.tmp в %WINDIR%\syswow64\pclient\krnlmgr.dll
%WINDIR%\syswow64\pclient\~glh0074.tmp в %WINDIR%\syswow64\pclient\netmgr.dll
%WINDIR%\syswow64\pclient\modules\~glh007e.tmp в %WINDIR%\syswow64\pclient\modules\ipmcli.dll
%WINDIR%\syswow64\pclient\~glh007d.tmp в %WINDIR%\syswow64\pclient\ipmdll.dll
%WINDIR%\syswow64\pclient\modules\~glh0067.tmp в %WINDIR%\syswow64\pclient\modules\assetmgr.dll
%WINDIR%\syswow64\pclient\modules\~glh0059.tmp в %WINDIR%\syswow64\pclient\modules\ipbind.dll
%WINDIR%\syswow64\pclient\modules\~glh005a.tmp в %WINDIR%\syswow64\pclient\modules\offlinepolicy.dll
%WINDIR%\syswow64\pclient\modules\~glh005b.tmp в %WINDIR%\syswow64\pclient\modules\runproc.dll
%WINDIR%\syswow64\pclient\modules\~glh005c.tmp в %WINDIR%\syswow64\pclient\modules\setcpname.dll
%WINDIR%\syswow64\pclient\modules\~glh005d.tmp в %WINDIR%\syswow64\pclient\modules\website.dll
%WINDIR%\syswow64\pclient\modules\~glh0068.tmp в %WINDIR%\syswow64\pclient\modules\sysmanage.dll
%WINDIR%\syswow64\pclient\modules\~glh0056.tmp в %WINDIR%\syswow64\pclient\modules\baseinfo.dll
%WINDIR%\syswow64\pclient\modules\~glh0069.tmp в %WINDIR%\syswow64\pclient\modules\rmtast.dll
%WINDIR%\syswow64\pclient\modules\~glh005e.tmp в %WINDIR%\syswow64\pclient\modules\netsetup.dll
%WINDIR%\syswow64\pclient\modules\~glh0062.tmp в %WINDIR%\syswow64\pclient\modules\vaa.dll
%WINDIR%\syswow64\pclient\modules\~glh0063.tmp в %WINDIR%\syswow64\pclient\modules\dialmgr.dll
%WINDIR%\syswow64\pclient\modules\~glh0064.tmp в %WINDIR%\syswow64\pclient\modules\iospc.dll
%WINDIR%\syswow64\pclient\modules\~glh0065.tmp в %WINDIR%\syswow64\pclient\modules\netshare.dll
%WINDIR%\syswow64\pclient\modules\~glh0066.tmp в %WINDIR%\syswow64\pclient\modules\setuputl.dll
%WINDIR%\syswow64\pclient\modules\~glh005f.tmp в %WINDIR%\syswow64\pclient\modules\batchnet.dll
%WINDIR%\syswow64\pclient\modules\~glh0060.tmp в %WINDIR%\syswow64\pclient\modules\sysadmin.dll
%WINDIR%\syswow64\pclient\modules\~glh0061.tmp в %WINDIR%\syswow64\pclient\modules\saveret.dll
%WINDIR%\syswow64\pclient\~glh002a.tmp в %WINDIR%\syswow64\pclient\blproc.dll
%WINDIR%\syswow64\pclient\~glh007f.tmp в %WINDIR%\syswow64\pclient\block.exe
%WINDIR%\syswow64\pclient\~glh0096.tmp в %WINDIR%\syswow64\pclient\ulock.exe
%WINDIR%\syswow64\pclient\~glh0098.tmp в %WINDIR%\syswow64\pclient\buy.xml
%WINDIR%\syswow64\pclient\~glh0099.tmp в %WINDIR%\syswow64\pclient\gscukeybase.dll
%WINDIR%\syswow64\pclient\modules\~glh009a.tmp в %WINDIR%\syswow64\pclient\modules\fcscreen.dll
%WINDIR%\syswow64\pclient\uimodules\~glh009b.tmp в %WINDIR%\syswow64\pclient\uimodules\copyscreen.dll
%WINDIR%\syswow64\pclient\~glh009c.tmp в %WINDIR%\syswow64\pclient\wmvfile.dll
%WINDIR%\syswow64\pclient\modules\~glh0095.tmp в %WINDIR%\syswow64\pclient\modules\usbkeycontrol.dll
%WINDIR%\syswow64\pclient\modules\~glh009d.tmp в %WINDIR%\syswow64\pclient\modules\healthmoniter.dll
%WINDIR%\syswow64\pclient\modules\~glh0097.tmp в %WINDIR%\syswow64\pclient\modules\ukeyaudit.dll
%WINDIR%\syswow64\pclient\~glh009f.tmp в %WINDIR%\syswow64\pclient\gscinternetexplorer.exe
%WINDIR%\syswow64\pclient\~glh00a1.tmp в %WINDIR%\syswow64\pclient\uninst.exe
%TEMP%\~glh00a2.tmp в %TEMP%\dbghelp.dll
<DRIVERS>\~glh00a3.tmp в <DRIVERS>\devmgr.sys
<DRIVERS>\~glh00a4.tmp в <DRIVERS>\nmfmgr.sys
<SYSTEM32>\~glh00a5.tmp в <SYSTEM32>\schknmf.dll
%WINDIR%\syswow64\pclient\modules\~glh009e.tmp в %WINDIR%\syswow64\pclient\modules\serviceaudit.dll
%WINDIR%\syswow64\pclient\uimodules\~glh0094.tmp в %WINDIR%\syswow64\pclient\uimodules\regclientui.dll
%WINDIR%\syswow64\pclient\~glh00a0.tmp в %WINDIR%\syswow64\pclient\clientscript.xml
%WINDIR%\syswow64\pclient\modules\~glh0093.tmp в %WINDIR%\syswow64\pclient\modules\cdwmgr.dll
%WINDIR%\syswow64\pclient\modules\~glh0092.tmp в %WINDIR%\syswow64\pclient\modules\admtcmgr.dll
%WINDIR%\syswow64\pclient\modules\~glh0081.tmp в %WINDIR%\syswow64\pclient\modules\prtmgm.dll
%WINDIR%\syswow64\pclient\~glh0083.tmp в %WINDIR%\syswow64\pclient\safedisk.dll
%WINDIR%\syswow64\pclient\uimodules\~glh0084.tmp в %WINDIR%\syswow64\pclient\uimodules\safetray.dll
%WINDIR%\syswow64\pclient\~glh0085.tmp в %WINDIR%\syswow64\pclient\devhelper.dll
%WINDIR%\syswow64\pclient\modules\~glh0086.tmp в %WINDIR%\syswow64\pclient\modules\scanweb.dll
%WINDIR%\syswow64\pclient\uimodules\~glh0087.tmp в %WINDIR%\syswow64\pclient\uimodules\scanwebu.dll
%WINDIR%\syswow64\pclient\uimodules\~glh0088.tmp в %WINDIR%\syswow64\pclient\uimodules\repairospatch.dll
%WINDIR%\syswow64\pclient\~glh0089.tmp в %WINDIR%\syswow64\pclient\tcmtddl.dll
%WINDIR%\syswow64\pclient\modules\~glh0082.tmp в %WINDIR%\syswow64\pclient\modules\syssafe.dll
%WINDIR%\syswow64\pclient\modules\~glh008a.tmp в %WINDIR%\syswow64\pclient\modules\limvisit.dll
%WINDIR%\syswow64\pclient\modules\~glh008c.tmp в %WINDIR%\syswow64\pclient\modules\sysreslist.dll
%WINDIR%\syswow64\pclient\~glh008d.tmp в %WINDIR%\syswow64\pclient\wm_hooks.dll
%WINDIR%\syswow64\pclient\~glh008e.tmp в %WINDIR%\syswow64\pclient\svctrl.exe
%WINDIR%\syswow64\pclient\~glh008f.tmp в %WINDIR%\syswow64\pclient\schook.dll
%WINDIR%\syswow64\pclient\modules\~glh0090.tmp в %WINDIR%\syswow64\pclient\modules\osevent.dll
%WINDIR%\syswow64\pclient\modules\~glh0091.tmp в %WINDIR%\syswow64\pclient\modules\sysuser.dll
%WINDIR%\syswow64\pclient\modules\~glh0055.tmp в %WINDIR%\syswow64\pclient\modules\appmgr.dll
%WINDIR%\syswow64\pclient\~glh008b.tmp в %WINDIR%\syswow64\pclient\sql2ksp4setup.iss
%WINDIR%\syswow64\pclient\modules\~glh0057.tmp в %WINDIR%\syswow64\pclient\modules\equipmgr.dll
%WINDIR%\syswow64\pclient\modules\~glh0054.tmp в %WINDIR%\syswow64\pclient\modules\deskmgr.dll
%WINDIR%\syswow64\pclient\modules\~glh0053.tmp в %WINDIR%\syswow64\pclient\modules\ieconfig.dll
%WINDIR%\syswow64\pclient\modules\~glh0052.tmp в %WINDIR%\syswow64\pclient\modules\tranfile.dll
%WINDIR%\syswow64\pclient\~glh001a.tmp в %WINDIR%\syswow64\pclient\pcit.exe
%WINDIR%\syswow64\pclient\~glh001b.tmp в %WINDIR%\syswow64\pclient\loaddllinfo.xml
%WINDIR%\syswow64\pclient\~glh001c.tmp в %WINDIR%\syswow64\pclient\bldev_x64.dll
%WINDIR%\syswow64\pclient\~glh001d.tmp в %WINDIR%\syswow64\pclient\blfile_x64.dll
%WINDIR%\syswow64\pclient\~glh001e.tmp в %WINDIR%\syswow64\pclient\blnet_x64.dll
%WINDIR%\~glh0015.tmp в %WINDIR%\bbclp.exe
%TEMP%\~glh0013.tmp в %TEMP%\iospc.dll
%WINDIR%\syswow64\pclient\~glh0019.tmp в %WINDIR%\syswow64\pclient\bllog.dll
%WINDIR%\syswow64\pclient\~glh001f.tmp в %WINDIR%\syswow64\pclient\blproc_x64.dll
%WINDIR%\syswow64\pclient\~glh0023.tmp в %WINDIR%\syswow64\pclient\scrtobj_x64.dll
%WINDIR%\syswow64\pclient\~glh0024.tmp в %WINDIR%\syswow64\pclient\blbase.dll
%WINDIR%\syswow64\pclient\~glh0025.tmp в %WINDIR%\syswow64\pclient\bldev.dll
%WINDIR%\syswow64\pclient\~glh0026.tmp в %WINDIR%\syswow64\pclient\blscr.dll
%WINDIR%\syswow64\pclient\~glh0027.tmp в %WINDIR%\syswow64\pclient\scrtobj.dll
%WINDIR%\syswow64\pclient\~glh0020.tmp в %WINDIR%\syswow64\pclient\blreg_x64.dll
%WINDIR%\syswow64\pclient\~glh0021.tmp в %WINDIR%\syswow64\pclient\blsys_x64.dll
%WINDIR%\syswow64\pclient\~glh0022.tmp в %WINDIR%\syswow64\pclient\fmlib_x64.dll
%TEMP%\~glh0014.tmp в %TEMP%\bllog.dll
C:\phenix_client\~glh0012.tmp в C:\phenix_client\fmlib.dll
%WINDIR%\syswow64\pclient\~glh0028.tmp в %WINDIR%\syswow64\pclient\blfile.dll
C:\phenix_client\~glh0002.tmp в C:\phenix_client\instwse.dll
C:\phenix_client\~glh0003.tmp в C:\phenix_client\pcit.exe
C:\phenix_client\~glh0004.tmp в C:\phenix_client\setuputl.dll
C:\phenix_client\~glh0005.tmp в C:\phenix_client\iospc.dll
C:\phenix_client\~glh0006.tmp в C:\phenix_client\pfmdb.dll
C:\phenix_client\~glh0007.tmp в C:\phenix_client\engsync.dll
C:\phenix_client\~glh0008.tmp в C:\phenix_client\blbase.dll
C:\phenix_client\~glh0001.tmp в C:\phenix_client\bllog.dll
C:\phenix_client\~glh0009.tmp в C:\phenix_client\bldev.dll
C:\phenix_client\~glh000b.tmp в C:\phenix_client\scrtobj.dll
C:\phenix_client\~glh000c.tmp в C:\phenix_client\blfile.dll
C:\phenix_client\~glh000d.tmp в C:\phenix_client\blnet.dll
C:\phenix_client\~glh000e.tmp в C:\phenix_client\blproc.dll
C:\phenix_client\~glh000f.tmp в C:\phenix_client\blreg.dll
C:\phenix_client\~glh0010.tmp в C:\phenix_client\blsys.dll
C:\phenix_client\~glh0011.tmp в C:\phenix_client\blalgo.dll
C:\phenix_client\~glh000a.tmp в C:\phenix_client\blscr.dll
<DRIVERS>\~glh00a6.tmp в <DRIVERS>\netmgr.sys
%WINDIR%\syswow64\~glh0080.tmp в %WINDIR%\syswow64\schk.dll
%WINDIR%\syswow64\pclient\~glh0029.tmp в %WINDIR%\syswow64\pclient\blnet.dll
%WINDIR%\syswow64\pclient\~glh002d.tmp в %WINDIR%\syswow64\pclient\blalgo.dll
%WINDIR%\syswow64\pclient\inf\~glh0044.tmp в %WINDIR%\syswow64\pclient\inf\nmfmgr_m.inf
%WINDIR%\syswow64\pclient\~glh0045.tmp в %WINDIR%\syswow64\pclient\ats.xml
%WINDIR%\syswow64\pclient\~glh0046.tmp в %WINDIR%\syswow64\pclient\lpst.xml
%WINDIR%\syswow64\pclient\~glh0047.tmp в %WINDIR%\syswow64\pclient\init.xml
%WINDIR%\syswow64\pclient\~glh0048.tmp в %WINDIR%\syswow64\pclient\specialapp.xml
%WINDIR%\syswow64\pclient\modules\~glh0041.tmp в %WINDIR%\syswow64\pclient\modules\gnaccltmgr.dll
%WINDIR%\syswow64\pclient\~glh0049.tmp в %WINDIR%\syswow64\pclient\ftdump.xml
%WINDIR%\syswow64\pclient\inf\~glh0043.tmp в %WINDIR%\syswow64\pclient\inf\nmfmgr.inf
%WINDIR%\syswow64\pclient\~glh004b.tmp в %WINDIR%\syswow64\pclient\mid.xml
%WINDIR%\syswow64\pclient\modules\~glh004d.tmp в %WINDIR%\syswow64\pclient\modules\pfmdata.dll
%WINDIR%\syswow64\pclient\modules\~glh004e.tmp в %WINDIR%\syswow64\pclient\modules\softmanage.dll
%WINDIR%\syswow64\pclient\modules\~glh004f.tmp в %WINDIR%\syswow64\pclient\modules\registry.dll
%WINDIR%\syswow64\pclient\modules\~glh0050.tmp в %WINDIR%\syswow64\pclient\modules\fluxmgr.dll
%WINDIR%\syswow64\pclient\modules\~glh0051.tmp в %WINDIR%\syswow64\pclient\modules\patchmgr.dll
%WINDIR%\syswow64\pclient\~glh004a.tmp в %WINDIR%\syswow64\pclient\lps.xml
%TEMP%\~glh0016.tmp в %TEMP%\pcit.exe
%WINDIR%\syswow64\pclient\~glh004c.tmp в %WINDIR%\syswow64\pclient\nethelptools_sc.dll
%WINDIR%\syswow64\pclient\modules\~glh0042.tmp в %WINDIR%\syswow64\pclient\modules\pluginmgr.dll
%WINDIR%\syswow64\pclient\~glh0040.tmp в %WINDIR%\syswow64\pclient\nmfmgr.dll
%WINDIR%\syswow64\pclient\~glh003f.tmp в %WINDIR%\syswow64\pclient\findandsendmessage.exe
%WINDIR%\syswow64\pclient\~glh002e.tmp в %WINDIR%\syswow64\pclient\fmlib.dll
%WINDIR%\syswow64\pclient\~glh002f.tmp в %WINDIR%\syswow64\pclient\pfmcomm.dll
%WINDIR%\syswow64\pclient\~glh0030.tmp в %WINDIR%\syswow64\pclient\pfmscript.dll
%WINDIR%\syswow64\pclient\~glh0031.tmp в %WINDIR%\syswow64\pclient\pfmtask.dll
%WINDIR%\syswow64\pclient\~glh0032.tmp в %WINDIR%\syswow64\pclient\pfmtransmit.dll
%WINDIR%\syswow64\pclient\~glh0033.tmp в %WINDIR%\syswow64\pclient\pnpmgr.dll
%WINDIR%\syswow64\pclient\~glh002c.tmp в %WINDIR%\syswow64\pclient\blsys.dll
%WINDIR%\syswow64\pclient\modules\~glh0034.tmp в %WINDIR%\syswow64\pclient\modules\cltmgr.dll
%WINDIR%\syswow64\pclient\~glh0036.tmp в %WINDIR%\syswow64\pclient\devmgr.dll
%WINDIR%\syswow64\pclient\~glh0038.tmp в %WINDIR%\syswow64\pclient\scclient.exe
%WINDIR%\syswow64\pclient\~glh0039.tmp в %WINDIR%\syswow64\pclient\iobios.dll
%WINDIR%\syswow64\pclient\~glh003a.tmp в %WINDIR%\syswow64\pclient\iobios125.dll
%WINDIR%\syswow64\pclient\~glh003b.tmp в %WINDIR%\syswow64\pclient\scguardc.exe
%WINDIR%\syswow64\pclient\~glh003c.tmp в %WINDIR%\syswow64\pclient\sccltui.exe
%WINDIR%\syswow64\pclient\languagedata\~glh003d.tmp в %WINDIR%\syswow64\pclient\languagedata\languagetranslate.xml
%WINDIR%\syswow64\pclient\modules\~glh0035.tmp в %WINDIR%\syswow64\pclient\modules\pfmtimer.dll
%WINDIR%\syswow64\pclient\browseclassinfo\~glh003e.tmp в %WINDIR%\syswow64\pclient\browseclassinfo\cookiesinfo.xml
%WINDIR%\syswow64\pclient\~glh002b.tmp в %WINDIR%\syswow64\pclient\blreg.dll
<DRIVERS>\~glh00a7.tmp в <DRIVERS>\krnlmgr.sys

Подменяет следующие файлы

%ProgramFiles(x86)%\gsc\install\phenixclient.log
%ProgramFiles(x86)%\gsc\install\~glbs383.tmp
%WINDIR%\bbclp.exe
%WINDIR%\syswow64\pclient\bllog.dll
%WINDIR%\syswow64\pclient\modules\equipmgr.dll

Другое

Создает и запускает на исполнение

'%TEMP%\ffffffff-gggg-477e-b520-005419850605\setupcli.exe'
'%WINDIR%\syswow64\pclient\pcit.exe' -SetReg "HKEY_LOCAL_MACHINE" "SOFTWARE\Microsoft\Windows\CurrentVersion" "PhenixCltSetupFlag" 1 "1"
'%WINDIR%\syswow64\pclient\pcit.exe' -SetReg "HKEY_LOCAL_MACHINE" "SOFTWARE\Lenovo\GscPhenix" "InstallDir" "<SYSTEM32>\Pclient" "0"
'%WINDIR%\syswow64\pclient\pcit.exe' -SetReg "HKEY_LOCAL_MACHINE" "SOFTWARE\Lenovo\GscPhenix" "DisplayName" "SmartConfig Phenix Client" "0"
'%WINDIR%\syswow64\pclient\pcit.exe' -SetReg "HKEY_LOCAL_MACHINE" "SOFTWARE\Lenovo\GscPhenix" "DisplayVersion" "62300" "1"
'%WINDIR%\syswow64\pclient\pcit.exe' -findfile <DRIVERS>\devmgr.sys
'%WINDIR%\syswow64\pclient\pcit.exe' -userpswchanage
'%WINDIR%\syswow64\pclient\pcit.exe' -cuthook
'C:\phenix_client\pcit.exe' -osis64
'%WINDIR%\syswow64\pclient\pcit.exe' -SetReg HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\SafeBoot\Network\IpFilterDriver "" "Driver Group" 0
'%WINDIR%\syswow64\pclient\pcit.exe' -StartProcess -hw <SYSTEM32>\Pclient\pcit.exe "-SetReg "HKEY_LOCAL_MACHINE" "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\IpFilterDriver" \"\" \"Driver Group\" "0""
'%WINDIR%\syswow64\pclient\pcit.exe' -v 52
'%WINDIR%\syswow64\pclient\pcit.exe' -v 70
'%WINDIR%\syswow64\pclient\pcit.exe' -v 61
'%WINDIR%\syswow64\pclient\pcit.exe' -v 60
'%WINDIR%\syswow64\pclient\pcit.exe' -v 51
'C:\phenix_client\pcit.exe' -cltbadpnpdlls 0
'C:\phenix_client\pcit.exe' -k "<SYSTEM32>\Pclient\Block.exe"
'C:\phenix_client\pcit.exe' -k "<SYSTEM32>\Pclient\Svctrl.exe"
'C:\phenix_client\pcit.exe' -k "<SYSTEM32>\Pclient\sccltui.exe"
'C:\phenix_client\pcit.exe' -k "<SYSTEM32>\Pclient\scclient.exe"
'C:\phenix_client\pcit.exe' -k "<SYSTEM32>\Pclient\scguardc.exe"
'C:\phenix_client\pcit.exe' -virtual
'%WINDIR%\bbclp.exe'
'C:\phenix_client\pcit.exe' -xpe
'C:\phenix_client\pcit.exe' -DelReg "HKEY_LOCAL_MACHINE" "SOFTWARE\Microsoft\Windows\CurrentVersion" "DomainSetup"
'C:\phenix_client\pcit.exe' -ChkUsr
'%TEMP%\22c36d54-2b65-4a89-b62c-14a9e562383c\phenixcli.exe'
'%WINDIR%\syswow64\pclient\pcit.exe' -SetReg "HKEY_LOCAL_MACHINE" "SOFTWARE\Microsoft\Windows\CurrentVersion" "nmfflag" 1 "1"
'%WINDIR%\syswow64\pclient\pcit.exe' -installinf nmfmgr.inf nmfmgr_m.inf "GSC nmfmgr Driver" "%WINDIR%\SysWOW64\schknmf.dll"

Запускает на исполнение

'C:\phenix_client\pcit.exe' -ChkUsr (со скрытым окном)
'%WINDIR%\bbclp.exe' (со скрытым окном)
'C:\phenix_client\pcit.exe' -virtual (со скрытым окном)
'C:\phenix_client\pcit.exe' -cltbadpnpdlls 0 (со скрытым окном)
'%WINDIR%\syswow64\pclient\pcit.exe' -StartProcess -hw <SYSTEM32>\Pclient\pcit.exe "-SetReg "HKEY_LOCAL_MACHINE" "SYSTEM\CurrentControlSet\Control\SafeBoot\Network\IpFilterDriver" \"\" \"Driver Group\" "0"" (со скрытым окном)
'%WINDIR%\syswow64\pclient\pcit.exe' -SetReg HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Control\SafeBoot\Network\IpFilterDriver "" "Driver Group" 0 (со скрытым окном)
'C:\phenix_client\pcit.exe' -osis64 (со скрытым окном)
'%WINDIR%\syswow64\pclient\pcit.exe' -cuthook (со скрытым окном)
'%WINDIR%\syswow64\pclient\pcit.exe' -userpswchanage (со скрытым окном)
'%WINDIR%\syswow64\pclient\pcit.exe' -SetReg "HKEY_LOCAL_MACHINE" "SOFTWARE\Microsoft\Windows\CurrentVersion" "nmfflag" 1 "1" (со скрытым окном)
'%WINDIR%\syswow64\pclient\pcit.exe' -installinf nmfmgr.inf nmfmgr_m.inf "GSC nmfmgr Driver" "%WINDIR%\SysWOW64\schknmf.dll" (со скрытым окном)
'%WINDIR%\syswow64\pclient\instdrv.exe' -uninstall gsc_nmfmgr (со скрытым окном)
'%WINDIR%\syswow64\pclient\instdrv.exe' -install %WINDIR%\inf\nmfmgr.inf gsc_nmfmgr (со скрытым окном)

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней