Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\mfe1.tmp\FrmInst.exe' /FramePkg /OriginalFramePkg="<Полный путь к вирусу>" /Cleanup="%TEMP%\mfe1.tmp" /LOGDIR="%TEMP%\McAfeeLogs" /EmbeddedUsername="" /EmbeddedDomain="" /EmbeddedPassword=""
Запускает на исполнение:
- '<SYSTEM32>\msiexec.exe' -Embedding 5C81862B7191AD20D099188117C24952
- '<SYSTEM32>\msiexec.exe' -Embedding 47DD5122A7AD4259DF15C0B671114603 M Global\MSI0000
- '<SYSTEM32>\msiexec.exe'
- '<SYSTEM32>\msiexec.exe' /V
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\McAfee\Common Framework\0804\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\041D\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0419\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\ccme_base.dll
- %PROGRAM_FILES%\McAfee\Common Framework\boost_thread-vc80-mt-1_32.dll
- %PROGRAM_FILES%\McAfee\Common Framework\AppLib.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0416\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0411\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0410\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\040C\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0415\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0413\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0412\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0412\CMAUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0411\CMAUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0410\CMAUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0416\CMAUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0415\CMAUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0413\CMAUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\040C\CMAUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0409\CMAUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\CMALib.dll
- %PROGRAM_FILES%\McAfee\Common Framework\ClientUI.dll
- %PROGRAM_FILES%\McAfee\Common Framework\040A\CMAUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0407\CMAUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0404\CMAUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\040A\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0407\McTrayRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0404\McTrayRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0409\McTrayRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0410\McTrayRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\040C\McTrayRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\040A\McTrayRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\McTrayLegacySupportPlugin.dll
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\tray_menu_okay.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\tray_menu_issue.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\trailer.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTrayInterfaceLib.dll
- %PROGRAM_FILES%\McAfee\Common Framework\McTrayInstSupp.dll
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\unchecked.png
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\agentDefault.ini
- %PROGRAM_FILES%\McAfee\Common Framework\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
- %PROGRAM_FILES%\McAfee\Common Framework\0804\McTrayRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0407\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0404\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0409\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\041D\McTrayRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0413\McTrayRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0412\McTrayRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0411\McTrayRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0419\McTrayRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0416\McTrayRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0415\McTrayRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0419\CMAUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0410\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\040C\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\040A\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0413\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0412\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0411\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0407\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Microsoft.VC80.CRT\msvcr80.dll
- %PROGRAM_FILES%\McAfee\Common Framework\msvcr71.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Microsoft.VC80.CRT\msvcp80.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0404\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0409\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Mue.exe
- %PROGRAM_FILES%\McAfee\Common Framework\naitcpp.inf
- %PROGRAM_FILES%\McAfee\Common Framework\Nainet.dll
- %PROGRAM_FILES%\McAfee\Common Framework\nailog3.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naxml3_71.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naSPIPE.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naPrdMgr.exe
- %PROGRAM_FILES%\McAfee\Common Framework\nagshr32.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0419\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0416\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0415\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naCmnLib3_71.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0804\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\041D\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\msvcp71.dll
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\FrameworkManifest.xml
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\DB\FrameworkLogFirefox.xsl
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\DB\FrameworkLog.xsl
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\gui_redirect.ini
- %PROGRAM_FILES%\McAfee\Common Framework\FrmInst.exe
- %PROGRAM_FILES%\McAfee\Common Framework\FrameworkService.exe
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\DB\FrameworkLog.js
- %PROGRAM_FILES%\McAfee\Common Framework\CmdAgent.exe
- %PROGRAM_FILES%\McAfee\Common Framework\0804\CMAUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\041D\CMAUIRes.dll
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\DB\FrameworkLog.html
- %PROGRAM_FILES%\McAfee\Common Framework\cryptocme2.sig
- %PROGRAM_FILES%\McAfee\Common Framework\cryptocme2.dll
- %PROGRAM_FILES%\McAfee\Common Framework\mfevtpa.dll
- %PROGRAM_FILES%\McAfee\Common Framework\mfelpc.dll
- %PROGRAM_FILES%\McAfee\Common Framework\mfecurl.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Microsoft.VC80.CRT\msvcm80.dll
- %PROGRAM_FILES%\McAfee\Common Framework\msaconfig.exe
- %PROGRAM_FILES%\McAfee\Common Framework\mfezlib.dll
- %PROGRAM_FILES%\McAfee\Common Framework\mfeCmnLib71.dll
- %PROGRAM_FILES%\McAfee\Common Framework\ipcchannel.dll
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\InstallMain.McS
- %PROGRAM_FILES%\McAfee\Common Framework\inetmgr.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Mcurial.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\McTray.exe
- %PROGRAM_FILES%\McAfee\Common Framework\McScanCheck.exe
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\system_status_warning_medium.png
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %WINDIR%\Installer\MSI5.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\drivetable.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
- C:\Config.Msi\2f74a.rbs
- %WINDIR%\Installer\MSI7.tmp
- %TEMP%\{B639A4DE-A375-47D3-89C3-DDCF98D992F7}\sitelist_reqseckey.bin
- %WINDIR%\Installer\MSIB.tmp
- %WINDIR%\Installer\MSIA.tmp
- %WINDIR%\Installer\MSI9.tmp
- %TEMP%\{B639A4DE-A375-47D3-89C3-DDCF98D992F7}\sitelist_srpubkey.bin
- %WINDIR%\Installer\MSI6.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %TEMP%\{B639A4DE-A375-47D3-89C3-DDCF98D992F7}\sitelist.xml
- %TEMP%\{B639A4DE-A375-47D3-89C3-DDCF98D992F7}\srpubkey.bin
- %TEMP%\{B639A4DE-A375-47D3-89C3-DDCF98D992F7}\reqseckey.bin
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- %TEMP%\McAfeeLogs\MFEagent.msi.2014.06.11.17.06.39.log
- %TEMP%\mfe1.tmp\srpubkey.bin
- %TEMP%\mfe1.tmp\SiteList.xml
- %TEMP%\{B639A4DE-A375-47D3-89C3-DDCF98D992F7}\main.txt
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\2f747.msi
- %TEMP%\mfe1.tmp\reqseckey.bin
- %TEMP%\mfe1.tmp\cabinet.dll
- %TEMP%\mfe1.tmp\__temp.zip
- %TEMP%\McAfeeLogs\FrmInst_CRNJEUFU.log
- %TEMP%\mfe1.tmp\MFEagent.msi
- %TEMP%\mfe1.tmp\FrmInst.exe
- %TEMP%\mfe1.tmp\cleanup.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI3.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %WINDIR%\Installer\MSIC.tmp
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\folder_open.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\folder_closed.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\document.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\gray_checked.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\gradated_background_with_mcafee_logo.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\gradated_background.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\disallow.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\details_close_normal.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\checkmark.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\checked.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\details_open_pressed.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\details_open_normal.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\details_close_pressed.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\rule_folder_closed.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\plus_sign.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\outbound.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\system_status_ok_medium.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\system_status_error_medium.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\splashscreen.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\no_symbol.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\inbound.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\group_folder_closed.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\grip.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\minus_sign.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\mcafee_m_small.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\main_window.ini
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\button_up.png
- %PROGRAM_FILES%\McAfee\Common Framework\SecureFrameworkFactory3.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Agent.dll
- %PROGRAM_FILES%\McAfee\Common Framework\AgentPlugin.dll
- %PROGRAM_FILES%\McAfee\Common Framework\UserSpace.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\ComponentSubsystem.dll
- %PROGRAM_FILES%\McAfee\Common Framework\UpdateSubSys.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\UdaterUI.exe
- %PROGRAM_FILES%\McAfee\Common Framework\naPolicyManager.dll
- %PROGRAM_FILES%\McAfee\Common Framework\UpdPlug.Dll
- %WINDIR%\Installer\MSID.tmp
- %PROGRAM_FILES%\McAfee\Common Framework\Genevtinf3.dll
- %PROGRAM_FILES%\McAfee\Common Framework\ComponentUserInterface.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Scheduler.dll
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\bidirectional.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\allow.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\advisory_dlg.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\button_hover.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\button_down.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\button_disabled.png
- %PROGRAM_FILES%\McAfee\Common Framework\McTray\Images\McAfee\advisory_dlg.ini
- %PROGRAM_FILES%\McAfee\Common Framework\Management.dll
- %PROGRAM_FILES%\McAfee\Common Framework\ListenServer.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Logging.dll
- %PROGRAM_FILES%\McAfee\Common Framework\McTrayEventLog.dll
- %PROGRAM_FILES%\McAfee\Common Framework\McTrayErrorLoggingPlugin.dll
- %PROGRAM_FILES%\McAfee\Common Framework\McAfeeWin32GUISupportDLL.dll
Удаляет следующие файлы:
- %WINDIR%\Installer\MSIA.tmp
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\Installer\MSIB.tmp
- %WINDIR%\Installer\MSID.tmp
- %WINDIR%\Installer\MSIC.tmp
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\MSI6.tmp
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
