Trojan.MulDrop5.34609

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Baidu PC Faster 3.7.0.0' = '"%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\PCFaster.exe" -auto -start'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\BprotectEx] 'Start' = '00000001'
[<HKLM>\SYSTEM\ControlSet001\Services\Bhbase] 'Start' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\PCFasterSvc_{PCFaster_3.7.0.0}] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Центр обеспечения безопасности (Security Center)

Создает и запускает на исполнение:

'%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\PCFasterSvc.exe'
'%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\ftex.exe' "%ALLUSERSPROFILE%\Application Data\Baidu Security\RpData" "http://sy##.##faster.baidu.com/cgi-bin-py/get_pcf_statistic_info.cgi"
'%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\LeakRepair.exe' /LeakDB /FileMapping=LeakRepair_LeakDB_LeakDB-x86-1033.dat_{PCFaster_3.7.0.0}
'<SYSTEM32>\PC_Faster_Setup_GL5.exe'
'<SYSTEM32>\c41.exe'
'%TEMP%\480.exe'

Запускает на исполнение:

'<SYSTEM32>\sc.exe' config wuauserv start= disabled
'<SYSTEM32>\sc.exe' stop wuauserv

Перехватывает следующие функции в SSDT (System Service Descriptor Table):

NtSetContextThread, драйвер-обработчик: Bhbase.sys
NtRestoreKey, драйвер-обработчик: Bhbase.sys
NtSetSecurityObject, драйвер-обработчик: Bhbase.sys
NtSetInformationFile, драйвер-обработчик: Bhbase.sys
NtRequestWaitReplyPort, драйвер-обработчик: Bhbase.sys
NtQueueApcThread, драйвер-обработчик: Bhbase.sys
NtQueryValueKey, драйвер-обработчик: Bhbase.sys
NtRenameKey, драйвер-обработчик: Bhbase.sys
NtReadVirtualMemory, драйвер-обработчик: Bhbase.sys
NtUnmapViewOfSection, драйвер-обработчик: Bhbase.sys
NtTerminateThread, драйвер-обработчик: Bhbase.sys
NtWriteVirtualMemory, драйвер-обработчик: Bhbase.sys
NtWriteFile, драйвер-обработчик: Bhbase.sys
NtTerminateProcess, драйвер-обработчик: Bhbase.sys
NtSetValueKey, драйвер-обработчик: Bhbase.sys
NtSetSystemInformation, драйвер-обработчик: Bhbase.sys
NtSystemDebugControl, драйвер-обработчик: Bhbase.sys
NtSuspendThread, драйвер-обработчик: Bhbase.sys
NtProtectVirtualMemory, драйвер-обработчик: Bhbase.sys
NtCreateSymbolicLinkObject, драйвер-обработчик: Bhbase.sys
NtCreateSection, драйвер-обработчик: Bhbase.sys
NtDeleteFile, драйвер-обработчик: Bhbase.sys
NtCreateThread, драйвер-обработчик: Bhbase.sys
NtCreateProcessEx, драйвер-обработчик: Bhbase.sys
NtCreateFile, драйвер-обработчик: Bhbase.sys
NtAssignProcessToJobObject, драйвер-обработчик: Bhbase.sys
NtCreateProcess, драйвер-обработчик: Bhbase.sys
NtCreateKey, драйвер-обработчик: Bhbase.sys
NtOpenProcess, драйвер-обработчик: Bhbase.sys
NtLoadDriver, драйвер-обработчик: Bhbase.sys
NtOpenThread, драйвер-обработчик: Bhbase.sys
NtOpenSection, драйвер-обработчик: Bhbase.sys
NtEnumerateValueKey, драйвер-обработчик: Bhbase.sys
NtDeleteValueKey, драйвер-обработчик: Bhbase.sys
NtDeleteKey, драйвер-обработчик: Bhbase.sys
NtDuplicateObject, драйвер-обработчик: Bhbase.sys
NtDeviceIoControlFile, драйвер-обработчик: Bhbase.sys

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\location_normal.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\location_down.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\location_disable.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\logo_bk2.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\logo_bk.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\location_over.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\language_over.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_normal_pu.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_hover_thai.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_hover_pu.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\language_normal.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\language_down.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_normal_thai.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\logo_install.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_down_thai.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_down_pu.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_down_eng.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_hover_thai.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_hover_pu.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_hover_eng.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_disable_thai.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\min_hover.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\min_down.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\logo_titlebar.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_disable_pu.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_disable_eng.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\min_normal.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_finishing_thai.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_uncheck_over.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_uncheck_normal.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_un_uninstall_over.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\close_hover_pu.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\close_down_thai.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\close_down.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_un_uninstall_normal.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_un_cancel_down.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_install_over.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_install_normal.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_un_uninstall_down.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_un_cancel_over.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_un_cancel_normal.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\close_hover_thai.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_down_pu.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_disable_thai.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_disable_pu.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_finishing_pu.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_finishing_eng.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_down_thai.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\install_disable.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\close_normal_thai.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\close_normal_pu.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\close_normal.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\cricle_animate.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\cricle.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\close_over.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_normal_eng.png
%ALLUSERSPROFILE%\Documents\Baidu Security\PC Faster\3.7.0.0\log\PCFasterSvc.log
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Facebook\res\res.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Facebook\Plugin_Facebook.dll
%WINDIR%\Temp\Plu6.tmp
%WINDIR%\Temp\Plu5.tmp
%WINDIR%\Temp\Plu4.tmp
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SysAndNetworkOpt\SysAndNetworkOpt.dll
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SystemCleaner\res\res.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SystemCleaner\t2.db
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SystemCleaner\t1.db
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Antivirus\res\res.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Antivirus\Plugin_Antivirus.dll
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SysRepair\SysRepair.dll
%HOMEPATH%\Start Menu\Programs\Baidu PC Faster\Baidu PC Faster.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Baidu PC Faster\Baidu PC Faster.lnk
%HOMEPATH%\Desktop\Baidu PC Faster.lnk
%HOMEPATH%\Start Menu\Programs\Baidu PC Faster\Uninstall.lnk
%WINDIR%\wininit.ini
%ALLUSERSPROFILE%\Start Menu\Programs\Baidu PC Faster\Uninstall.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Baidu PC Faster\Feedback.lnk
%ALLUSERSPROFILE%\Documents\Baidu Security\PC Faster\3.7.0.0\log\LeakRepair\LeakDB\LeakDB-x86-1033.dat.3.7.1.39149.log
%WINDIR%\Temp\Plu9.tmp
%WINDIR%\Temp\Plu8.tmp
%WINDIR%\Temp\Plu7.tmp
<DRIVERS>\BprotectEx.sys
<DRIVERS>\Bhbase.sys
%HOMEPATH%\Start Menu\Programs\Baidu PC Faster\Feedback.lnk
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SystemCleaner\CleanerEngine.dll
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\PluginHome\circle_progress.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\FasterNow\outer_circle.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\FasterNow\img_pop_percent_2.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Plugins\PluginConfig.xml
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\PluginOptimizer\img_circle.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\PluginHome\drag_disable.cur
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\FasterNow\img_pop_percent_1.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\FasterNow\img_percent_0.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_normal_thai.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\reinstall_normal_pu.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\FasterNow\img_pop_percent_0.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\FasterNow\img_percent_2.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\Scattered\FasterNow\img_percent_1.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Home\Plugin_Home.dll
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\SysOpt\optrec.6.0.def.db
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\SysOpt\optrec.5.1.def.db
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\SysOpt\optlist.dat
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.SystemCleaner\Plugin_SystemCleaner.dll
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\SysOpt\optrec.6.2.def.db
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\SysOpt\optrec.6.1.def.db
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\res\res.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.LeakRepair\LeakRepair.dll
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.LeakRepair\Plugin_LeakRepair.dll
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Home\res\res.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\SysOptEngine.dll
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.Optimizer\Plugin_Optimizer.dll
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Plugins\Plugin.LeakRepair\res\res.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_install_down.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\NSISInstall.exe
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\LeakRepair.exe
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\NewUpdater.exe
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\BProtectEx.sys
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Bhbase.sys
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\ftex.exe
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\PCFasterFeedback.exe
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\LogReporter.exe
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Communication.dll
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\update.dll
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\PCFasterHelper.dll
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\DataReport.dll
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\PopupTip.exe
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\BProtectEx64.sys
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\FasterNow.xml
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\ProgramFileList.xml
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\update_config.xml
%ALLUSERSPROFILE%\Documents\Baidu Security\PC Faster\3.7.0.0\Dump\BugReportConfig.ini
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\SdkConfig.ini
%ALLUSERSPROFILE%\Documents\Baidu Security\PC Faster\3.7.0.0\config.ini
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\version.xml
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\CrashUL.exe
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\CrashReport.exe
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\BHips.dll
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\url.ini
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\FasterNow.exe
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\PcfBSReport.exe
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Updater.exe
%TEMP%\nsj3.tmp\log.dll
%TEMP%\nsj3.tmp\InstallUtility.dll
%TEMP%\nsj3.tmp\DirectUI.dll
%TEMP%\nsj3.tmp\Communication.dll
%TEMP%\nsj3.tmp\config.ini
%TEMP%\nsj3.tmp\url.ini
%TEMP%\nsj3.tmp\NewFeatures.txt
%TEMP%\nso2.tmp
<SYSTEM32>\c41.exe
<SYSTEM32>\PC_Faster_Setup_GL5.exe
%TEMP%\nsj3.tmp\string.ini
%TEMP%\nsj3.tmp\InstallCheck.dll
%TEMP%\nsj3.tmp\System.dll
%TEMP%\nsj3.tmp\BHips.dll
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\PCFasterSvc.exe
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\BaiduStore.dll
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\PCFaster.exe
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\sqlite.dll
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\log.dll
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\DirectUI.dll
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new
%TEMP%\nsj3.tmp\skin\common\common.bskin
%TEMP%\480.exe
%TEMP%\nsj3.tmp\InstallUtility.log
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new
%TEMP%\2AE37.dmp
%TEMP%\dw.log
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\Uninstall.exe
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\skin_update\skin_update.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\skin_feedback\skin_feedback.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\common\common.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\10.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\1.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\0.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInstall\NSISInstall.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\skin_frame\skin_frame.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\skin_crashreporter\skin_crashreporter.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\skin_boottime\skin_boottime.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\FasterNow\FasterNow.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\skin_popup\skin_popup.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\skin_junkclean\skin_junkclean.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\2.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_exit_down.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_checked_over.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_checked_normal.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_install_disable.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_exit_normal.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\btn_exit_hover.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\9.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\5.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\4.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\3.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\8.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\7.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\tools\NSISInatsllSkin\6.png
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\confirm\confirm.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\tools\FasterNow\FasterNow.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\screensnpashot\screensnpashot.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\nsis_install\nsis_install.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\BugReporter\BugReporter.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\BaiduSafe\BaiduSafe.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\update\update.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\feedback\feedback.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\data\rl.dat
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\data\mn.dat
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\UninstCaller.exe
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\confirm\confirm.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\BugReporter\BugReporter.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\I18N\1033\BaiduSafe\BaiduSafe.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\confirm\confirm.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\nsis_install\nsis_install.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\feedback\feedback.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\confirm\confirm.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\skin\common\common.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\update\update.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\tools\FasterNow\FasterNow.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\BugReporter\BugReporter.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\nsis_install\nsis_install.bskin
%ALLUSERSPROFILE%\Application Data\Baidu Security\RpData\2014-06-11 16_33_32_0375RpData.dat
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\feedback\feedback.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\I18N\1054\BaiduSafe\BaiduSafe.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\update\update.bskin
%PROGRAM_FILES%\Baidu Security\PC Faster\3.7.0.0\I18N\1046\tools\FasterNow\FasterNow.bskin

Удаляет следующие файлы:

%ALLUSERSPROFILE%\Start Menu\Programs\Baidu PC Faster\Uninstall.lnk
%WINDIR%\Temp\Plu4.tmp
%TEMP%\nsj3.tmp\DirectUI.dll
%TEMP%\nsj3.tmp\InstallUtility.dll
%TEMP%\nsj3.tmp\InstallCheck.dll
%WINDIR%\Temp\Plu6.tmp
%WINDIR%\Temp\Plu5.tmp
%WINDIR%\Temp\Plu7.tmp
%WINDIR%\Temp\Plu9.tmp
%WINDIR%\Temp\Plu8.tmp

Перемещает следующие файлы:

%WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new в %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new в %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch

Сетевая активность:

UDP:

DNS ASK do######.pcfaster.baidu.com

Другое:

Ищет следующие окна:

ClassName: 'IPC_WINDOW_SERVER2_pcf_hips_ui_4F994BDF-5E33-4989-9AE5-E470E8444D08' WindowName: '(null)'
ClassName: 'IPC_WINDOW_CLIENT2_bd_krn_ui_D3152864-5AFF-42e3-9FB2-99ABF218961_{PCFaster_3.7.0.0}' WindowName: '(null)'
ClassName: 'IPC_WINDOW_SERVER2_bd_krn_ui_D3152864-5AFF-42e3-9FB2-99ABF218961_{PCFaster_3.7.0.0}' WindowName: '(null)'
ClassName: 'EDIT' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней