Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'McAfeeUpdaterUI' = '"%PROGRAM_FILES%\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\McAfee\Common Framework\FrameworkService.exe'
- '%PROGRAM_FILES%\McAfee\Common Framework\naPrdMgr.exe'
- '%PROGRAM_FILES%\McAfee\Common Framework\UdaterUI.exe'
- '%TEMP%\unz1.tmp\FrmInst.exe' /LOGDIR="%TEMP%\NAILogs" /Cleanup2="%TEMP%\unz1.tmp" /EmbeddedUsername="" /EmbeddedDomain="" /EmbeddedPassword="" /Install=Agent /OriginalCmdLine="|<Полный путь к вирусу>| "
- '%TEMP%\unz1.tmp\FramePkg.exe' /SignalComplete /LOGDIR="%TEMP%\NAILogs" /Cleanup2="%TEMP%\unz1.tmp" /WaitFor=2904 /CurrentFolder="<Текущая директория>" /Install=Agent /OriginalCmdLine="|<Полный путь к вирусу>| "
- '%WINDIR%\Temp\unz2.tmp\FrmInst.exe' /LOGDIR="%TEMP%\NAILogs" /Cleanup2="%TEMP%\unz1.tmp" /WaitFor=2904 /CurrentFolder="<Текущая директория>" /Install=Agent /OriginalCmdLine="|<Полный путь к вирусу>| " /FramePkg /Cleanup="%WINDIR%\TEMP\unz2.tmp" /LOGDIR="%TEMP%\NAILogs"
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\Agent.ini
- %PROGRAM_FILES%\McAfee\Common Framework\AgentPlugin.dll
- %WINDIR%\Temp\unz2.tmp\Mctray.exe
- %PROGRAM_FILES%\McAfee\Common Framework\Agent.dll
- %PROGRAM_FILES%\McAfee\Common Framework\CmdAgent.exe
- %PROGRAM_FILES%\McAfee\Common Framework\ComponentUserInterface.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0409\AgentRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Cleanup.exe
- %WINDIR%\Temp\unz2.tmp\JrMac.dll
- %WINDIR%\Temp\unz2.tmp\nailog2_64.dll
- %WINDIR%\Temp\unz2.tmp\msvcm80.dll
- %WINDIR%\Temp\unz2.tmp\naSPIPE64.dll
- %WINDIR%\Temp\unz2.tmp\naXML2_64.dll
- %WINDIR%\Temp\unz2.tmp\Microsoft.VC80.CRT.manifest
- %WINDIR%\Temp\unz2.tmp\McScanCheck.exe
- %WINDIR%\Temp\unz2.tmp\msvcp80.dll
- %WINDIR%\Temp\unz2.tmp\msvcr80.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naCmnLib2_71.dll
- %PROGRAM_FILES%\McAfee\Common Framework\nagshr32.dll
- %PROGRAM_FILES%\McAfee\Common Framework\McScript.exe
- %PROGRAM_FILES%\McAfee\Common Framework\mcurial.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naPolicyManager.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naPrdMgr.exe
- %PROGRAM_FILES%\McAfee\Common Framework\naInet.dll
- %PROGRAM_FILES%\McAfee\Common Framework\nailog2.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Management.dll
- %PROGRAM_FILES%\McAfee\Common Framework\FrmInst.exe
- %PROGRAM_FILES%\McAfee\Common Framework\FrmPlugin.dll
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\Db\FrameworkLog.xsl
- %PROGRAM_FILES%\McAfee\Common Framework\FrameworkService.exe
- %PROGRAM_FILES%\McAfee\Common Framework\ListenServer.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Logging.dll
- %PROGRAM_FILES%\McAfee\Common Framework\GenEvtInf.dll
- %PROGRAM_FILES%\McAfee\Common Framework\InternetManager.dll
- %WINDIR%\Temp\unz2.tmp\cmalib.dll
- %WINDIR%\Temp\unz2.tmp\naitcpp.dll
- %WINDIR%\Temp\unz2.tmp\CmaUIRes.dll
- %WINDIR%\Temp\unz2.tmp\applib.dll
- %WINDIR%\Temp\unz2.tmp\msvcr71.dll
- %WINDIR%\Temp\unz2.tmp\epoPGPsdk.dll
- %WINDIR%\Temp\unz2.tmp\naitcpp.inf
- %WINDIR%\Temp\unz2.tmp\msvcp71.dll
- %WINDIR%\Temp\unz2.tmp\ClientUI.dll
- %WINDIR%\Temp\unz2.tmp\UdaterUI.exe
- %WINDIR%\Temp\unz2.tmp\UpdPlug.dll
- %WINDIR%\Temp\unz2.tmp\TCSubSys.dll
- %WINDIR%\Temp\unz2.tmp\TCHelper.dll
- %WINDIR%\Temp\unz2.tmp\XMLWrap.dll
- %WINDIR%\Temp\unz2.tmp\ComponentSubSystem.dll
- %WINDIR%\Temp\unz2.tmp\UpdRes.dll
- %WINDIR%\Temp\unz2.tmp\UserSpace.dll
- %WINDIR%\Temp\unz2.tmp\cmalib64.dll
- %WINDIR%\Temp\unz2.tmp\GenEvtInf64.dll
- %WINDIR%\Temp\unz2.tmp\SecureFrameworkFactory64.dll
- %WINDIR%\Temp\unz2.tmp\applib64.dll
- %WINDIR%\Temp\unz2.tmp\naPolicyManager64.dll
- %WINDIR%\Temp\unz2.tmp\naPrdMgr64.exe
- %WINDIR%\Temp\unz2.tmp\naCmnLib2_64.dll
- %WINDIR%\Temp\unz2.tmp\naInet64.dll
- %WINDIR%\Temp\unz2.tmp\Scheduler64.dll
- %WINDIR%\Temp\unz2.tmp\ComponentFrameworkCallback64.dll
- %WINDIR%\Temp\unz2.tmp\ComponentPolicyEnforcement64.dll
- %WINDIR%\Temp\unz2.tmp\Agent64.dll
- %WINDIR%\Temp\unz2.tmp\AgentRes64.dll
- %WINDIR%\Temp\unz2.tmp\Logging64.dll
- %WINDIR%\Temp\unz2.tmp\Management64.dll
- %WINDIR%\Temp\unz2.tmp\ComponentSubSystem64.dll
- %WINDIR%\Temp\unz2.tmp\InternetManager64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\applib64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\cmalib64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Scheduler64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\SecureFrameworkFactory64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naInet64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naPolicyManager64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\GenEvtInf64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naCmnLib2_64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Management64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0409\AgentRes64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\ComponentFrameworkCallback64.dll
- <SYSTEM32>\epoPGPsdk.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Agent64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\InternetManager64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Logging64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\ComponentPolicyEnforcement64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\ComponentSubSystem64.dll
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\FrameworkManifest.xml
- %PROGRAM_FILES%\McAfee\Common Framework\naicrt32.dll
- %PROGRAM_FILES%\McAfee\Common Framework\JrMac.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Mctray.exe
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\Db\Agent_CRNJEUFU.xml
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\Db\PrdMgr_CRNJEUFU.log
- %PROGRAM_FILES%\McAfee\Common Framework\nmcomn32.dll
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\Db\Agent_CRNJEUFU.log
- %PROGRAM_FILES%\McAfee\Common Framework\McScanCheck.exe
- %PROGRAM_FILES%\McAfee\Common Framework\naXML2_64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\nailog2_64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naPrdMgr64.exe
- %PROGRAM_FILES%\McAfee\Common Framework\naSPIPE64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Microsoft.VC80.CRT\msvcr80.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
- %PROGRAM_FILES%\McAfee\Common Framework\Microsoft.VC80.CRT\msvcm80.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Microsoft.VC80.CRT\msvcp80.dll
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\Server.xml
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\SrPubKey.bin
- %PROGRAM_FILES%\McAfee\Common Framework\SecureFrameworkFactory.dll
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\serverDefault.xml
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\InstallMain.McS
- %PROGRAM_FILES%\McAfee\Common Framework\UpdateSubSys.dll
- %PROGRAM_FILES%\McAfee\Common Framework\unicows.dll
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\UpdateMain.McS
- %PROGRAM_FILES%\McAfee\Common Framework\0409\ScrptRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naisign2.dll
- %PROGRAM_FILES%\McAfee\Common Framework\patchw32.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naSPIPE.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naXML2_71.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Scheduler.dll
- %PROGRAM_FILES%\McAfee\Common Framework\ScriptSubSys.dll
- %PROGRAM_FILES%\McAfee\Common Framework\PoEvtInf.dll
- %PROGRAM_FILES%\McAfee\Common Framework\PcrPlug.dll
- %PROGRAM_FILES%\McAfee\Common Framework\cmalib.dll
- %CommonProgramFiles%\Cisco Systems\CiscoTrustAgent\Plugins\Install\naitcpp.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0409\CmaUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\applib.dll
- %PROGRAM_FILES%\McAfee\Common Framework\msvcp71.dll
- %PROGRAM_FILES%\McAfee\Common Framework\msvcr71.dll
- %CommonProgramFiles%\Cisco Systems\CiscoTrustAgent\Plugins\Install\naitcpp.inf
- %PROGRAM_FILES%\McAfee\Common Framework\naitcpp.dll
- %PROGRAM_FILES%\McAfee\Common Framework\ClientUI.dll
- %PROGRAM_FILES%\McAfee\Common Framework\UdaterUI.exe
- %PROGRAM_FILES%\McAfee\Common Framework\UpdPlug.dll
- %PROGRAM_FILES%\McAfee\Common Framework\TCSubSys.dll
- %PROGRAM_FILES%\McAfee\Common Framework\TCHelper.dll
- %PROGRAM_FILES%\McAfee\Common Framework\XMLWrap.dll
- %PROGRAM_FILES%\McAfee\Common Framework\ComponentSubSystem.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0409\UpdRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\UserSpace.dll
- %TEMP%\unz1.tmp\UpdateSubSys.dll
- %TEMP%\unz1.tmp\TCSubSys.dll
- %TEMP%\unz1.tmp\UpdateMain.McS
- %TEMP%\unz1.tmp\InstallMain.McS
- %TEMP%\unz1.tmp\UpdPlug.dll
- %TEMP%\unz1.tmp\UpdRes.dll
- %TEMP%\unz1.tmp\TCHelper.dll
- %TEMP%\unz1.tmp\UdaterUI.exe
- %TEMP%\unz1.tmp\unicows.dll
- %TEMP%\unz1.tmp\ScriptSubSys.dll
- %TEMP%\unz1.tmp\ScrptRes.dll
- %TEMP%\unz1.tmp\PSAPI.dll
- %TEMP%\unz1.tmp\Scheduler.dll
- %TEMP%\unz1.tmp\SiteList.xml
- %TEMP%\unz1.tmp\SrPubKey.bin
- %TEMP%\unz1.tmp\SecureFrameworkFactory.dll
- %TEMP%\unz1.tmp\Server.xml
- %TEMP%\unz1.tmp\epoPGPsdk.dll
- %TEMP%\unz1.tmp\Agent64.dll
- %TEMP%\unz1.tmp\msvcp71.dll
- %TEMP%\unz1.tmp\msvcr71.dll
- %TEMP%\unz1.tmp\ComponentPolicyEnforcement64.dll
- %TEMP%\unz1.tmp\ComponentSubSystem64.dll
- %TEMP%\unz1.tmp\AgentRes64.dll
- %TEMP%\unz1.tmp\ComponentFrameworkCallback64.dll
- %TEMP%\unz1.tmp\naitcpp.inf
- %TEMP%\unz1.tmp\ComponentSubSystem.dll
- %TEMP%\unz1.tmp\ClientUI.dll
- %TEMP%\unz1.tmp\UserSpace.dll
- %TEMP%\unz1.tmp\XMLWrap.dll
- %TEMP%\unz1.tmp\cmalib.dll
- %TEMP%\unz1.tmp\naitcpp.dll
- %TEMP%\unz1.tmp\CmaUIRes.dll
- %TEMP%\unz1.tmp\applib.dll
- %TEMP%\unz1.tmp\FrameworkManifest.xml
- %TEMP%\unz1.tmp\FrameworkService.exe
- %TEMP%\unz1.tmp\ComponentUserInterface.dll
- %TEMP%\unz1.tmp\FrameworkLog.xsl
- %TEMP%\unz1.tmp\GenEvtInf.dll
- %TEMP%\unz1.tmp\InternetManager.dll
- %TEMP%\unz1.tmp\FrmInst.exe
- %TEMP%\unz1.tmp\FrmPlugin.dll
- %TEMP%\unz1.tmp\CmdAgent.exe
- %TEMP%\unz1.tmp\cabinet.dll
- %TEMP%\unz1.tmp\Agent.dll
- %TEMP%\NAILogs\FrmInst_CRNJEUFU.log
- %TEMP%\unz1.tmp\__temp.zip
- %TEMP%\unz1.tmp\AgentRes.dll
- %TEMP%\unz1.tmp\Cleanup.exe
- %TEMP%\unz1.tmp\Agent.ini
- %TEMP%\unz1.tmp\AgentPlugin.dll
- %TEMP%\unz1.tmp\naSPIPE.dll
- %TEMP%\unz1.tmp\naXML2_71.dll
- %TEMP%\unz1.tmp\naPolicyManager.dll
- %TEMP%\unz1.tmp\naPrdMgr.exe
- %TEMP%\unz1.tmp\PoEvtInf.dll
- %TEMP%\unz1.tmp\PcrPlug.dll
- %TEMP%\unz1.tmp\naisign2.dll
- %TEMP%\unz1.tmp\patchw32.dll
- %TEMP%\unz1.tmp\nailog2.dll
- %TEMP%\unz1.tmp\Management.dll
- %TEMP%\unz1.tmp\McScript.exe
- %TEMP%\unz1.tmp\ListenServer.dll
- %TEMP%\unz1.tmp\Logging.dll
- %TEMP%\unz1.tmp\nagshr32.dll
- %TEMP%\unz1.tmp\naInet.dll
- %TEMP%\unz1.tmp\mcurial.dll
- %TEMP%\unz1.tmp\naCmnLib2_71.dll
- %WINDIR%\Temp\unz2.tmp\nagshr32.dll
- %WINDIR%\Temp\unz2.tmp\naInet.dll
- %WINDIR%\Temp\unz2.tmp\mcurial.dll
- %WINDIR%\Temp\unz2.tmp\naCmnLib2_71.dll
- %WINDIR%\Temp\unz2.tmp\naPrdMgr.exe
- %WINDIR%\Temp\unz2.tmp\naSPIPE.dll
- %WINDIR%\Temp\unz2.tmp\nailog2.dll
- %WINDIR%\Temp\unz2.tmp\naPolicyManager.dll
- %WINDIR%\Temp\unz2.tmp\McScript.exe
- %WINDIR%\Temp\unz2.tmp\FrmPlugin.dll
- %WINDIR%\Temp\unz2.tmp\GenEvtInf.dll
- %WINDIR%\Temp\unz2.tmp\FrameworkService.exe
- %WINDIR%\Temp\unz2.tmp\FrmInst.exe
- %WINDIR%\Temp\unz2.tmp\Logging.dll
- %WINDIR%\Temp\unz2.tmp\Management.dll
- %WINDIR%\Temp\unz2.tmp\InternetManager.dll
- %WINDIR%\Temp\unz2.tmp\ListenServer.dll
- %WINDIR%\Temp\unz2.tmp\SiteList.xml
- %WINDIR%\Temp\unz2.tmp\SrPubKey.bin
- %WINDIR%\Temp\unz2.tmp\SecureFrameworkFactory.dll
- %WINDIR%\Temp\unz2.tmp\Server.xml
- %WINDIR%\Temp\unz2.tmp\InstallMain.McS
- %WINDIR%\Temp\unz2.tmp\UpdateSubSys.dll
- %WINDIR%\Temp\unz2.tmp\unicows.dll
- %WINDIR%\Temp\unz2.tmp\UpdateMain.McS
- %WINDIR%\Temp\unz2.tmp\ScrptRes.dll
- %WINDIR%\Temp\unz2.tmp\patchw32.dll
- %WINDIR%\Temp\unz2.tmp\PoEvtInf.dll
- %WINDIR%\Temp\unz2.tmp\naXML2_71.dll
- %WINDIR%\Temp\unz2.tmp\naisign2.dll
- %WINDIR%\Temp\unz2.tmp\Scheduler.dll
- %WINDIR%\Temp\unz2.tmp\ScriptSubSys.dll
- %WINDIR%\Temp\unz2.tmp\PcrPlug.dll
- %WINDIR%\Temp\unz2.tmp\PSAPI.dll
- %TEMP%\unz1.tmp\naPrdMgr64.exe
- %TEMP%\unz1.tmp\naSPIPE64.dll
- %TEMP%\unz1.tmp\naInet64.dll
- %TEMP%\unz1.tmp\naPolicyManager64.dll
- %TEMP%\unz1.tmp\msvcm80.dll
- %TEMP%\unz1.tmp\msvcp80.dll
- %TEMP%\unz1.tmp\naXML2_64.dll
- %TEMP%\unz1.tmp\nailog2_64.dll
- %TEMP%\unz1.tmp\naCmnLib2_64.dll
- %TEMP%\unz1.tmp\Management64.dll
- %TEMP%\unz1.tmp\Scheduler64.dll
- %TEMP%\unz1.tmp\InternetManager64.dll
- %TEMP%\unz1.tmp\Logging64.dll
- %TEMP%\unz1.tmp\cmalib64.dll
- %TEMP%\unz1.tmp\GenEvtInf64.dll
- %TEMP%\unz1.tmp\SecureFrameworkFactory64.dll
- %TEMP%\unz1.tmp\applib64.dll
- %WINDIR%\Temp\unz2.tmp\AgentRes.dll
- %WINDIR%\Temp\unz2.tmp\Cleanup.exe
- %WINDIR%\Temp\unz2.tmp\Agent.ini
- %WINDIR%\Temp\unz2.tmp\AgentPlugin.dll
- %WINDIR%\Temp\unz2.tmp\FrameworkLog.xsl
- %WINDIR%\Temp\unz2.tmp\FrameworkManifest.xml
- %WINDIR%\Temp\unz2.tmp\CmdAgent.exe
- %WINDIR%\Temp\unz2.tmp\ComponentUserInterface.dll
- %WINDIR%\Temp\unz2.tmp\Agent.dll
- %TEMP%\unz1.tmp\McScanCheck.exe
- %TEMP%\unz1.tmp\JrMac.dll
- %TEMP%\unz1.tmp\msvcr80.dll
- %TEMP%\unz1.tmp\Microsoft.VC80.CRT.manifest
- %WINDIR%\Temp\unz2.tmp\__temp.zip
- %WINDIR%\Temp\unz2.tmp\cabinet.dll
- %TEMP%\unz1.tmp\Mctray.exe
- %TEMP%\unz1.tmp\FramePkg.exe
