Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'McAfeeUpdaterUI' = '"%PROGRAM_FILES%\McAfee\Common Framework\udaterui.exe" /StartedFromRunKey'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\McAfee\Common Framework\FrameworkService.exe' = '%PROGRAM_FILES%\McAfee\Common Framework\FrameworkService.exe:*:Enabled:McAfee Framework Service'
- '%PROGRAM_FILES%\McAfee\Common Framework\FrameworkService.exe' /Service
- '%PROGRAM_FILES%\McAfee\Common Framework\msaconfig.exe'
- '%PROGRAM_FILES%\McAfee\Common Framework\UdaterUI.exe' /RegServer
- '%TEMP%\mfe1.tmp\FrmInst.exe' /FramePkg /OriginalFramePkg="<Полный путь к вирусу>" /Cleanup="%TEMP%\mfe1.tmp" /LOGDIR="%TEMP%\McAfeeLogs" /EmbeddedUsername="" /EmbeddedDomain="" /EmbeddedPassword=""
- '%PROGRAM_FILES%\McAfee\Common Framework\naPrdMgr.exe' /RegServer
- '<SYSTEM32>\msiexec.exe' -Embedding 5127A3C1C451A7D0D40C52894ECEB6DB
- '<SYSTEM32>\msiexec.exe' -Embedding 91AD039F36EEF8D7220081E815FCAA7D M Global\MSI0000
- '<SYSTEM32>\msiexec.exe'
- '<SYSTEM32>\msiexec.exe' /V
- %PROGRAM_FILES%\McAfee\Common Framework\0409\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Mue.exe
- %PROGRAM_FILES%\McAfee\Common Framework\0404\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\040A\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0407\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Microsoft.VC80.CRT\msvcr80.dll
- %PROGRAM_FILES%\McAfee\Common Framework\mfezlib.dll
- %PROGRAM_FILES%\McAfee\Common Framework\mfecurl.dll
- %PROGRAM_FILES%\McAfee\Common Framework\msaconfig.exe
- %PROGRAM_FILES%\McAfee\Common Framework\Microsoft.VC80.CRT\msvcp80.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Microsoft.VC80.CRT\msvcm80.dll
- %PROGRAM_FILES%\McAfee\Common Framework\041D\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0416\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0804\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\nagshr32.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naCmnLib3_71.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0415\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0410\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\040C\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0411\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0413\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0412\MueRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\mfeCmnLib71.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0804\CMAUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\041D\CMAUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\CmdAgent.exe
- %PROGRAM_FILES%\McAfee\Common Framework\cryptocme2.sig
- %PROGRAM_FILES%\McAfee\Common Framework\cryptocme2.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0416\CMAUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0411\CMAUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0410\CMAUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0412\CMAUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0415\CMAUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0413\CMAUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\JrMac.dll
- %PROGRAM_FILES%\McAfee\Common Framework\ipcchannel.dll
- %PROGRAM_FILES%\McAfee\Common Framework\McScanCheck.exe
- %PROGRAM_FILES%\McAfee\Common Framework\Mcurial.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\McTray.exe
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\InstallMain.McS
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\FrameworkManifest.xml
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\DB\FrameworkLog.xsl
- %PROGRAM_FILES%\McAfee\Common Framework\FrameworkService.exe
- %PROGRAM_FILES%\McAfee\Common Framework\inetmgr.dll
- %PROGRAM_FILES%\McAfee\Common Framework\FrmInst.exe
- %CommonProgramFiles%\Cisco Systems\CiscoTrustAgent\Plugins\Install\naitcpp.dll
- %WINDIR%\Installer\MSIE.tmp
- %CommonProgramFiles%\Cisco Systems\CiscoTrustAgent\Plugins\Install\naitcpp.inf
- %TEMP%\McAfeeLogs\UpdaterUI_CRNJEUFU.log
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\DB\PrdMgr_CRNJEUFU.log
- %PROGRAM_FILES%\McAfee\Common Framework\XMLWrap.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0415\UpdRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0413\UpdRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0416\UpdRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0804\UpdRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\041D\UpdRes.Dll
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\SiteList.xml
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\srpubkey.bin
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\Server.xml
- %WINDIR%\Installer\MSI12.tmp
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\Agent.ini
- %WINDIR%\Installer\MSI11.tmp
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\DB\Agent_CRNJEUFU.xml
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\DB\Agent_CRNJEUFU.log
- %WINDIR%\Installer\MSIF.tmp
- %WINDIR%\Installer\MSI10.tmp
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\FrameworkManifest.xml_rollback
- %PROGRAM_FILES%\McAfee\Common Framework\0412\UpdRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\naziplib.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naxml3_71.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Patchw32.dll
- %PROGRAM_FILES%\McAfee\Common Framework\PoEvtInf.dll
- %PROGRAM_FILES%\McAfee\Common Framework\PcrPlug.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naSPIPE.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Nainet.dll
- %PROGRAM_FILES%\McAfee\Common Framework\nailog3.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naitcpp.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naPrdMgr.exe
- %PROGRAM_FILES%\McAfee\Common Framework\naitcpp.inf
- %PROGRAM_FILES%\McAfee\Common Framework\040A\UpdRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0407\UpdRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\040C\UpdRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0411\UpdRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0410\UpdRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0404\UpdRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\UdaterUI.exe
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\serverDefault.xml
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\UpdateMain.McS
- %PROGRAM_FILES%\McAfee\Common Framework\0409\UpdRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\updater.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\040C\CMAUIRes.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- %TEMP%\{F2969393-2D4D-4977-8166-B1251B08EF12}\srpubkey.bin
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- %TEMP%\{F2969393-2D4D-4977-8166-B1251B08EF12}\sitelist.xml
- %WINDIR%\Installer\MSI7.tmp
- %TEMP%\{F2969393-2D4D-4977-8166-B1251B08EF12}\sitelist_srpubkey.bin
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %WINDIR%\Installer\MSI6.tmp
- %WINDIR%\Installer\MSI5.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- %TEMP%\mfe1.tmp\srpubkey.bin
- %TEMP%\mfe1.tmp\SiteList.xml
- %TEMP%\McAfeeLogs\MFEagent.msi.log
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\2964a.msi
- %TEMP%\mfe1.tmp\MFEagent.msi
- %TEMP%\mfe1.tmp\__temp.zip
- %TEMP%\McAfeeLogs\FrmInst_CRNJEUFU.log
- %TEMP%\mfe1.tmp\cabinet.dll
- %TEMP%\mfe1.tmp\FrmInst.exe
- %TEMP%\mfe1.tmp\cleanup.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- %WINDIR%\Installer\MSI3.tmp
- %TEMP%\{F2969393-2D4D-4977-8166-B1251B08EF12}\main.txt
- %WINDIR%\Installer\MSI4.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- %PROGRAM_FILES%\McAfee\Common Framework\0411\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0410\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0412\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0415\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0413\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\040C\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0409\AgentRes.Dll
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\agentDefault.ini
- %PROGRAM_FILES%\McAfee\Common Framework\0404\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\040A\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0407\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0409\CMAUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\CMALib.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0404\CMAUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\040A\CMAUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0407\CMAUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\ClientUI.dll
- %PROGRAM_FILES%\McAfee\Common Framework\041D\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0416\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\0804\AgentRes.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\boost_thread-vc71-mt-1_32.dll
- %PROGRAM_FILES%\McAfee\Common Framework\AppLib.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
- %PROGRAM_FILES%\McAfee\Common Framework\naPolicyManager.dll
- %PROGRAM_FILES%\McAfee\Common Framework\UpdPlug.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\Scheduler.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Genevtinf3.dll
- %PROGRAM_FILES%\McAfee\Common Framework\ComponentUserInterface.dll
- %WINDIR%\Installer\MSID.tmp
- %WINDIR%\Installer\MSI9.tmp
- C:\Config.Msi\2964d.rbs
- %WINDIR%\Installer\MSIA.tmp
- %WINDIR%\Installer\MSIC.tmp
- %WINDIR%\Installer\MSIB.tmp
- %PROGRAM_FILES%\McAfee\Common Framework\TCSubSys.dll
- %PROGRAM_FILES%\McAfee\Common Framework\UserSpace.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\Logging.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Management.dll
- %PROGRAM_FILES%\McAfee\Common Framework\ListenServer.dll
- %PROGRAM_FILES%\McAfee\Common Framework\ComponentSubsystem.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Agent.dll
- %PROGRAM_FILES%\McAfee\Common Framework\AgentPlugin.dll
- %PROGRAM_FILES%\McAfee\Common Framework\TCHelper.dll
- %PROGRAM_FILES%\McAfee\Common Framework\UpdateSubSys.Dll
- %PROGRAM_FILES%\McAfee\Common Framework\SecureFrameworkFactory3.dll
- %WINDIR%\Installer\MSID.tmp
- %WINDIR%\Installer\MSIC.tmp
- %WINDIR%\Installer\MSIB.tmp
- %WINDIR%\Installer\MSIE.tmp
- %WINDIR%\Installer\MSI11.tmp
- %WINDIR%\Installer\MSI10.tmp
- %WINDIR%\Installer\MSIF.tmp
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI6.tmp
- %WINDIR%\Installer\MSIA.tmp
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\Installer\MSI7.tmp
- ClassName: 'Shell_TrayWnd' WindowName: ''