Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'McAfeeUpdaterUI' = '"%PROGRAM_FILES%\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\McAfeeFramework] 'Start' = '00000002'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\McAfee\Common Framework\FrameworkService.exe' = '%PROGRAM_FILES%\McAfee\Common Framework\FrameworkService.exe:*:Enabled:McAfee Framework Service'
Creates and executes the following:
- '%PROGRAM_FILES%\McAfee\Common Framework\naPrdMgr.exe' -Embedding
- '%PROGRAM_FILES%\McAfee\Common Framework\FrameworkService.exe' /ServiceStart
- '%PROGRAM_FILES%\McAfee\Common Framework\UdaterUI.exe'
- '%PROGRAM_FILES%\McAfee\Common Framework\Mctray.exe'
- '%PROGRAM_FILES%\McAfee\Common Framework\UdaterUI.exe' /EventName=UPDATER_UI_EVENT444c6
- '%WINDIR%\Temp\cle3.tmp\cleanup.exe' 2872 /LOGDIR="%TEMP%\NAILogs" "%WINDIR%\TEMP\unz2.tmp" "%TEMP%\unz1.tmp"
- '%TEMP%\unz1.tmp\FramePkg.exe' /SignalComplete /LOGDIR="%TEMP%\NAILogs" /Cleanup2="%TEMP%\unz1.tmp" /WaitFor=2872 /CurrentFolder="%TEMP%\RarSFX0" /Install=Agent /ForceInstall /SiteInfo=SiteList.xml /OriginalCmdLine="|%TEMP%\RarSFX0\FramePkg.exe| /Install=Agent /ForceInstall /SiteInfo=SiteList.xml"
- '%TEMP%\unz1.tmp\FrmInst.exe' /LOGDIR="%TEMP%\NAILogs" /Cleanup2="%TEMP%\unz1.tmp" /EmbeddedUsername="" /EmbeddedDomain="" /EmbeddedPassword="" /Install=Agent /ForceInstall /SiteInfo=SiteList.xml /OriginalCmdLine="|%TEMP%\RarSFX0\FramePkg.exe| /Install=Agent /ForceInstall /SiteInfo=SiteList.xml"
- '%TEMP%\RarSFX0\FramePkg.exe' /Install=Agent /ForceInstall /SiteInfo=SiteList.xml
- '%PROGRAM_FILES%\McAfee\Common Framework\naPrdMgr.exe'
- '%PROGRAM_FILES%\McAfee\Common Framework\FrameworkService.exe'
- '%WINDIR%\Temp\unz2.tmp\FrmInst.exe' /LOGDIR="%TEMP%\NAILogs" /Cleanup2="%TEMP%\unz1.tmp" /WaitFor=2872 /CurrentFolder="%TEMP%\RarSFX0" /Install=Agent /ForceInstall /SiteInfo=SiteList.xml /OriginalCmdLine="|%TEMP%\RarSFX0\FramePkg.exe| /Install=Agent /ForceInstall /SiteInfo=SiteList.xml" /FramePkg /Cleanup="%WINDIR%\TEMP\unz2.tmp" /LOGDIR="%TEMP%\NAILogs"
Executes the following:
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
- '<SYSTEM32>\regsvr32.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\Setup.bat" "
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\McAfee\Common Framework\Cleanup.exe
- %PROGRAM_FILES%\McAfee\Common Framework\CmdAgent.exe
- %PROGRAM_FILES%\McAfee\Common Framework\AgentPlugin.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0409\AgentRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\FrameworkService.exe
- %PROGRAM_FILES%\McAfee\Common Framework\FrmInst.exe
- %PROGRAM_FILES%\McAfee\Common Framework\ComponentUserInterface.dll
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\Db\FrameworkLog.xsl
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\Agent.ini
- %WINDIR%\Temp\unz2.tmp\msvcr80.dll
- %WINDIR%\Temp\unz2.tmp\Microsoft.VC80.CRT.manifest
- %WINDIR%\Temp\unz2.tmp\msvcm80.dll
- %WINDIR%\Temp\unz2.tmp\msvcp80.dll
- %WINDIR%\Temp\unz2.tmp\Mctray.exe
- %PROGRAM_FILES%\McAfee\Common Framework\Agent.dll
- %WINDIR%\Temp\unz2.tmp\McScanCheck.exe
- %WINDIR%\Temp\unz2.tmp\JrMac.dll
- %PROGRAM_FILES%\McAfee\Common Framework\FrmPlugin.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naPolicyManager.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naPrdMgr.exe
- %PROGRAM_FILES%\McAfee\Common Framework\naInet.dll
- %PROGRAM_FILES%\McAfee\Common Framework\nailog2.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naisign2.dll
- %PROGRAM_FILES%\McAfee\Common Framework\patchw32.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naSPIPE.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naXML2_71.dll
- %PROGRAM_FILES%\McAfee\Common Framework\nagshr32.dll
- %PROGRAM_FILES%\McAfee\Common Framework\ListenServer.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Logging.dll
- %PROGRAM_FILES%\McAfee\Common Framework\GenEvtInf.dll
- %PROGRAM_FILES%\McAfee\Common Framework\InternetManager.dll
- %PROGRAM_FILES%\McAfee\Common Framework\mcurial.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naCmnLib2_71.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Management.dll
- %PROGRAM_FILES%\McAfee\Common Framework\McScript.exe
- %WINDIR%\Temp\unz2.tmp\naitcpp.inf
- %WINDIR%\Temp\unz2.tmp\msvcp71.dll
- %WINDIR%\Temp\unz2.tmp\cmalib.dll
- %WINDIR%\Temp\unz2.tmp\naitcpp.dll
- %WINDIR%\Temp\unz2.tmp\Agent64.dll
- %WINDIR%\Temp\unz2.tmp\AgentRes64.dll
- %WINDIR%\Temp\unz2.tmp\msvcr71.dll
- %WINDIR%\Temp\unz2.tmp\epoPGPsdk.dll
- %WINDIR%\Temp\unz2.tmp\applib.dll
- %WINDIR%\Temp\unz2.tmp\UpdRes.dll
- %WINDIR%\Temp\unz2.tmp\UserSpace.dll
- %WINDIR%\Temp\unz2.tmp\UdaterUI.exe
- %WINDIR%\Temp\unz2.tmp\UpdPlug.dll
- %WINDIR%\Temp\unz2.tmp\ClientUI.dll
- %WINDIR%\Temp\unz2.tmp\CmaUIRes.dll
- %WINDIR%\Temp\unz2.tmp\XMLWrap.dll
- %WINDIR%\Temp\unz2.tmp\ComponentSubSystem.dll
- %WINDIR%\Temp\unz2.tmp\ComponentFrameworkCallback64.dll
- %WINDIR%\Temp\unz2.tmp\naInet64.dll
- %WINDIR%\Temp\unz2.tmp\naPolicyManager64.dll
- %WINDIR%\Temp\unz2.tmp\GenEvtInf64.dll
- %WINDIR%\Temp\unz2.tmp\naCmnLib2_64.dll
- %WINDIR%\Temp\unz2.tmp\naXML2_64.dll
- %WINDIR%\Temp\unz2.tmp\nailog2_64.dll
- %WINDIR%\Temp\unz2.tmp\naPrdMgr64.exe
- %WINDIR%\Temp\unz2.tmp\naSPIPE64.dll
- %WINDIR%\Temp\unz2.tmp\cmalib64.dll
- %WINDIR%\Temp\unz2.tmp\InternetManager64.dll
- %WINDIR%\Temp\unz2.tmp\Logging64.dll
- %WINDIR%\Temp\unz2.tmp\ComponentPolicyEnforcement64.dll
- %WINDIR%\Temp\unz2.tmp\ComponentSubSystem64.dll
- %WINDIR%\Temp\unz2.tmp\SecureFrameworkFactory64.dll
- %WINDIR%\Temp\unz2.tmp\applib64.dll
- %WINDIR%\Temp\unz2.tmp\Management64.dll
- %WINDIR%\Temp\unz2.tmp\Scheduler64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\PoEvtInf.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naPrdMgr64.exe
- %PROGRAM_FILES%\McAfee\Common Framework\naSPIPE64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naInet64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naPolicyManager64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Microsoft.VC80.CRT\msvcm80.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Microsoft.VC80.CRT\msvcp80.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naXML2_64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\nailog2_64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naCmnLib2_64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Management64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Scheduler64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\InternetManager64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Logging64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\cmalib64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\GenEvtInf64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\SecureFrameworkFactory64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\applib64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Microsoft.VC80.CRT\msvcr80.dll
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\ServerSiteList.xml
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\UpdateHistory.ini
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\Db\PrdMgr_CRNJEUFU.log
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\SiteList.xml
- %WINDIR%\Temp\cle3.tmp\cleanup.exe
- %TEMP%\NAILogs\UpdaterUI_CRNJEUFU.log
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\Compiled.xml
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\Precompiled.xml
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\Db\Agent_CRNJEUFU.xml
- %PROGRAM_FILES%\McAfee\Common Framework\JrMac.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Mctray.exe
- %PROGRAM_FILES%\McAfee\Common Framework\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
- %PROGRAM_FILES%\McAfee\Common Framework\McScanCheck.exe
- %PROGRAM_FILES%\McAfee\Common Framework\nmcomn32.dll
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\Db\Agent_CRNJEUFU.log
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\FrameworkManifest.xml
- %PROGRAM_FILES%\McAfee\Common Framework\naicrt32.dll
- %PROGRAM_FILES%\McAfee\Common Framework\UpdateSubSys.dll
- %PROGRAM_FILES%\McAfee\Common Framework\TCSubSys.dll
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\UpdateMain.McS
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\InstallMain.McS
- %PROGRAM_FILES%\McAfee\Common Framework\UpdPlug.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0409\UpdRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\TCHelper.dll
- %PROGRAM_FILES%\McAfee\Common Framework\UdaterUI.exe
- %PROGRAM_FILES%\McAfee\Common Framework\unicows.dll
- %PROGRAM_FILES%\McAfee\Common Framework\ScriptSubSys.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0409\ScrptRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\PcrPlug.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Scheduler.dll
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\Server.xml
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\SrPubKey.bin
- %PROGRAM_FILES%\McAfee\Common Framework\SecureFrameworkFactory.dll
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\serverDefault.xml
- %PROGRAM_FILES%\McAfee\Common Framework\UserSpace.dll
- <SYSTEM32>\epoPGPsdk.dll
- %PROGRAM_FILES%\McAfee\Common Framework\Agent64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\msvcp71.dll
- %PROGRAM_FILES%\McAfee\Common Framework\msvcr71.dll
- %PROGRAM_FILES%\McAfee\Common Framework\ComponentPolicyEnforcement64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\ComponentSubSystem64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0409\AgentRes64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\ComponentFrameworkCallback64.dll
- %PROGRAM_FILES%\McAfee\Common Framework\naitcpp.dll
- %PROGRAM_FILES%\McAfee\Common Framework\ClientUI.dll
- %PROGRAM_FILES%\McAfee\Common Framework\0409\CmaUIRes.dll
- %PROGRAM_FILES%\McAfee\Common Framework\XMLWrap.dll
- %PROGRAM_FILES%\McAfee\Common Framework\ComponentSubSystem.dll
- %CommonProgramFiles%\Cisco Systems\CiscoTrustAgent\Plugins\Install\naitcpp.dll
- %CommonProgramFiles%\Cisco Systems\CiscoTrustAgent\Plugins\Install\naitcpp.inf
- %PROGRAM_FILES%\McAfee\Common Framework\applib.dll
- %PROGRAM_FILES%\McAfee\Common Framework\cmalib.dll
- %TEMP%\unz1.tmp\UpdateMain.McS
- %TEMP%\unz1.tmp\InstallMain.McS
- %TEMP%\unz1.tmp\SrPubKey.bin
- %TEMP%\unz1.tmp\unicows.dll
- %TEMP%\unz1.tmp\TCHelper.dll
- %TEMP%\unz1.tmp\UdaterUI.exe
- %TEMP%\unz1.tmp\UpdateSubSys.dll
- %TEMP%\unz1.tmp\TCSubSys.dll
- %TEMP%\unz1.tmp\SiteList.xml
- %TEMP%\unz1.tmp\PSAPI.dll
- %TEMP%\unz1.tmp\Scheduler.dll
- %TEMP%\unz1.tmp\PoEvtInf.dll
- %TEMP%\unz1.tmp\PcrPlug.dll
- %TEMP%\unz1.tmp\SecureFrameworkFactory.dll
- %TEMP%\unz1.tmp\Server.xml
- %TEMP%\unz1.tmp\ScriptSubSys.dll
- %TEMP%\unz1.tmp\ScrptRes.dll
- %TEMP%\unz1.tmp\UpdPlug.dll
- %TEMP%\unz1.tmp\msvcr71.dll
- %TEMP%\unz1.tmp\epoPGPsdk.dll
- %TEMP%\unz1.tmp\naitcpp.inf
- %TEMP%\unz1.tmp\msvcp71.dll
- %TEMP%\unz1.tmp\ComponentFrameworkCallback64.dll
- %TEMP%\unz1.tmp\ComponentPolicyEnforcement64.dll
- %TEMP%\unz1.tmp\Agent64.dll
- %TEMP%\unz1.tmp\AgentRes64.dll
- %TEMP%\unz1.tmp\naitcpp.dll
- %TEMP%\unz1.tmp\XMLWrap.dll
- %TEMP%\unz1.tmp\ComponentSubSystem.dll
- %TEMP%\unz1.tmp\UpdRes.dll
- %TEMP%\unz1.tmp\UserSpace.dll
- %TEMP%\unz1.tmp\applib.dll
- %TEMP%\unz1.tmp\cmalib.dll
- %TEMP%\unz1.tmp\ClientUI.dll
- %TEMP%\unz1.tmp\CmaUIRes.dll
- %TEMP%\unz1.tmp\CmdAgent.exe
- %TEMP%\unz1.tmp\ComponentUserInterface.dll
- %TEMP%\unz1.tmp\AgentRes.dll
- %TEMP%\unz1.tmp\Cleanup.exe
- %TEMP%\unz1.tmp\FrameworkService.exe
- %TEMP%\unz1.tmp\FrmInst.exe
- %TEMP%\unz1.tmp\FrameworkLog.xsl
- %TEMP%\unz1.tmp\FrameworkManifest.xml
- %TEMP%\unz1.tmp\AgentPlugin.dll
- %TEMP%\RarSFX0\SiteList.xml
- %TEMP%\NAILogs\FrmInst_CRNJEUFU.log
- %TEMP%\RarSFX0\FramePkg.exe
- %TEMP%\RarSFX0\Setup.bat
- %TEMP%\unz1.tmp\Agent.dll
- %TEMP%\unz1.tmp\Agent.ini
- %TEMP%\unz1.tmp\__temp.zip
- %TEMP%\unz1.tmp\cabinet.dll
- %TEMP%\unz1.tmp\FrmPlugin.dll
- %TEMP%\unz1.tmp\naPolicyManager.dll
- %TEMP%\unz1.tmp\naPrdMgr.exe
- %TEMP%\unz1.tmp\naInet.dll
- %TEMP%\unz1.tmp\nailog2.dll
- %TEMP%\unz1.tmp\naisign2.dll
- %TEMP%\unz1.tmp\patchw32.dll
- %TEMP%\unz1.tmp\naSPIPE.dll
- %TEMP%\unz1.tmp\naXML2_71.dll
- %TEMP%\unz1.tmp\nagshr32.dll
- %TEMP%\unz1.tmp\ListenServer.dll
- %TEMP%\unz1.tmp\Logging.dll
- %TEMP%\unz1.tmp\GenEvtInf.dll
- %TEMP%\unz1.tmp\InternetManager.dll
- %TEMP%\unz1.tmp\mcurial.dll
- %TEMP%\unz1.tmp\naCmnLib2_71.dll
- %TEMP%\unz1.tmp\Management.dll
- %TEMP%\unz1.tmp\McScript.exe
- %TEMP%\unz1.tmp\ComponentSubSystem64.dll
- %WINDIR%\Temp\unz2.tmp\naInet.dll
- %WINDIR%\Temp\unz2.tmp\nailog2.dll
- %WINDIR%\Temp\unz2.tmp\naCmnLib2_71.dll
- %WINDIR%\Temp\unz2.tmp\nagshr32.dll
- %WINDIR%\Temp\unz2.tmp\naSPIPE.dll
- %WINDIR%\Temp\unz2.tmp\naXML2_71.dll
- %WINDIR%\Temp\unz2.tmp\naPolicyManager.dll
- %WINDIR%\Temp\unz2.tmp\naPrdMgr.exe
- %WINDIR%\Temp\unz2.tmp\mcurial.dll
- %WINDIR%\Temp\unz2.tmp\GenEvtInf.dll
- %WINDIR%\Temp\unz2.tmp\InternetManager.dll
- %WINDIR%\Temp\unz2.tmp\FrmInst.exe
- %WINDIR%\Temp\unz2.tmp\FrmPlugin.dll
- %WINDIR%\Temp\unz2.tmp\Management.dll
- %WINDIR%\Temp\unz2.tmp\McScript.exe
- %WINDIR%\Temp\unz2.tmp\ListenServer.dll
- %WINDIR%\Temp\unz2.tmp\Logging.dll
- %WINDIR%\Temp\unz2.tmp\naisign2.dll
- %WINDIR%\Temp\unz2.tmp\unicows.dll
- %WINDIR%\Temp\unz2.tmp\UpdateMain.McS
- %WINDIR%\Temp\unz2.tmp\SiteList.xml
- %WINDIR%\Temp\unz2.tmp\SrPubKey.bin
- %WINDIR%\Temp\unz2.tmp\TCSubSys.dll
- %WINDIR%\Temp\unz2.tmp\TCHelper.dll
- %WINDIR%\Temp\unz2.tmp\InstallMain.McS
- %WINDIR%\Temp\unz2.tmp\UpdateSubSys.dll
- %WINDIR%\Temp\unz2.tmp\Server.xml
- %WINDIR%\Temp\unz2.tmp\PcrPlug.dll
- %WINDIR%\Temp\unz2.tmp\PSAPI.dll
- %WINDIR%\Temp\unz2.tmp\patchw32.dll
- %WINDIR%\Temp\unz2.tmp\PoEvtInf.dll
- %WINDIR%\Temp\unz2.tmp\ScrptRes.dll
- %WINDIR%\Temp\unz2.tmp\SecureFrameworkFactory.dll
- %WINDIR%\Temp\unz2.tmp\Scheduler.dll
- %WINDIR%\Temp\unz2.tmp\ScriptSubSys.dll
- %TEMP%\unz1.tmp\naPrdMgr64.exe
- %TEMP%\unz1.tmp\naSPIPE64.dll
- %TEMP%\unz1.tmp\naInet64.dll
- %TEMP%\unz1.tmp\naPolicyManager64.dll
- %TEMP%\unz1.tmp\msvcm80.dll
- %TEMP%\unz1.tmp\msvcp80.dll
- %TEMP%\unz1.tmp\naXML2_64.dll
- %TEMP%\unz1.tmp\nailog2_64.dll
- %TEMP%\unz1.tmp\naCmnLib2_64.dll
- %TEMP%\unz1.tmp\Management64.dll
- %TEMP%\unz1.tmp\Scheduler64.dll
- %TEMP%\unz1.tmp\InternetManager64.dll
- %TEMP%\unz1.tmp\Logging64.dll
- %TEMP%\unz1.tmp\cmalib64.dll
- %TEMP%\unz1.tmp\GenEvtInf64.dll
- %TEMP%\unz1.tmp\SecureFrameworkFactory64.dll
- %TEMP%\unz1.tmp\applib64.dll
- %TEMP%\unz1.tmp\msvcr80.dll
- %WINDIR%\Temp\unz2.tmp\Cleanup.exe
- %WINDIR%\Temp\unz2.tmp\CmdAgent.exe
- %WINDIR%\Temp\unz2.tmp\AgentPlugin.dll
- %WINDIR%\Temp\unz2.tmp\AgentRes.dll
- %WINDIR%\Temp\unz2.tmp\FrameworkManifest.xml
- %WINDIR%\Temp\unz2.tmp\FrameworkService.exe
- %WINDIR%\Temp\unz2.tmp\ComponentUserInterface.dll
- %WINDIR%\Temp\unz2.tmp\FrameworkLog.xsl
- %WINDIR%\Temp\unz2.tmp\Agent.ini
- %TEMP%\unz1.tmp\JrMac.dll
- %TEMP%\unz1.tmp\Mctray.exe
- %TEMP%\unz1.tmp\Microsoft.VC80.CRT.manifest
- %TEMP%\unz1.tmp\McScanCheck.exe
- %WINDIR%\Temp\unz2.tmp\cabinet.dll
- %WINDIR%\Temp\unz2.tmp\Agent.dll
- %TEMP%\unz1.tmp\FramePkg.exe
- %WINDIR%\Temp\unz2.tmp\__temp.zip
Deletes the following files:
- <SYSTEM32>\PerfStringBackup.TMP
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- %ALLUSERSPROFILE%\Application Data\McAfee\Common Framework\Precompiled.xml
Miscellaneous:
Searches for the following windows:
- ClassName: 'FireTray_Hidden_Window' WindowName: ''
- ClassName: 'McAfeeCommonUpdaterUIMainWindow' WindowName: ''
- ClassName: 'McNetShieldStat' WindowName: ''
- ClassName: 'McAfee_McTrayWindowClass' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'McAfee_FrameworkServiceClass' WindowName: ''
