Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\mv2] 'Start' = '00000001'
- '%TEMP%\VNC\driver\xp\setupdrv.exe' install
- '%TEMP%\VNC\cert\CertMgr.Exe' -add vnc_cer.cer -c -s -r localMachine TrustedPublisher
- '<SYSTEM32>\secedit.exe' /configure /db %TEMP%\secedit.sdb /cfg %TEMP%\VNC\secedit.inf /quiet
- %TEMP%\VNC\driver\vista64\setupdrv.exe
- %TEMP%\aut54.tmp
- %TEMP%\VNC\driver\vista\driver\mv2.sys
- %TEMP%\aut55.tmp
- %TEMP%\VNC\driver\vista64\driver\mv2.dll
- %TEMP%\aut56.tmp
- %TEMP%\VNC\driver\vista64\driver\mv2.cat
- %TEMP%\aut51.tmp
- %TEMP%\VNC\driver\vista\driver\mv2.cat
- %TEMP%\aut50.tmp
- %TEMP%\VNC\driver\vista\driver\mv2.dll
- %TEMP%\aut53.tmp
- %TEMP%\VNC\driver\vista\driver\mv2.inf
- %TEMP%\aut52.tmp
- %TEMP%\VNC\driver\w2K\driver\mv2.dll
- %TEMP%\aut5B.tmp
- %TEMP%\VNC\driver\w2K\driver\mv2.cat
- %TEMP%\aut5C.tmp
- %TEMP%\VNC\driver\w2K\driver\mv2.sys
- %TEMP%\aut5D.tmp
- %TEMP%\VNC\driver\w2K\driver\mv2.inf
- %TEMP%\aut58.tmp
- %TEMP%\VNC\driver\vista64\driver\mv2.inf
- %TEMP%\aut57.tmp
- %TEMP%\VNC\driver\vista64\driver\mv2.sys
- %TEMP%\aut5A.tmp
- %TEMP%\VNC\driver\w2K\setupdrv.exe
- %TEMP%\aut59.tmp
- %TEMP%\VNC\driver\vista\setupdrv.exe
- %TEMP%\aut45.tmp
- %TEMP%\VNC\Install_win8_x86\ldapauth.dll
- %TEMP%\aut44.tmp
- %TEMP%\VNC\Install_win8_x86\logging.dll
- %TEMP%\aut47.tmp
- %TEMP%\VNC\Install_win8_x86\logmessages.dll
- %TEMP%\aut46.tmp
- %TEMP%\aut41.tmp
- %TEMP%\VNC\Install_win8_x86\MSLogonACL.exe
- %TEMP%\aut40.tmp
- %TEMP%\aut42.tmp
- %TEMP%\VNC\Install_win8_x86\authSSP.dll
- %TEMP%\aut43.tmp
- %TEMP%\VNC\Install_win8_x86\authadmin.dll
- %TEMP%\aut4D.tmp
- %TEMP%\VNC\Install_win8_x86\repeater.exe
- %TEMP%\aut4B.tmp
- %TEMP%\VNC\cert\CertMgr.Exe
- %TEMP%\aut4F.tmp
- %TEMP%\VNC\cert\vnc_cer.cer
- %TEMP%\aut4E.tmp
- %TEMP%\VNC\Install_win8_x86\vnchooks.dll
- %TEMP%\aut48.tmp
- %TEMP%\VNC\Install_win8_x86\SCHook.dll
- %TEMP%\aut49.tmp
- %TEMP%\VNC\Install_win8_x86\SecureVNCPlugin.dsm
- %TEMP%\aut4A.tmp
- %TEMP%\VNC\Install_win8_x86\workgrpdomnt4.dll
- %WINDIR%\security\tmp.edb
- %WINDIR%\security\edb.log
- %WINDIR%\security\res1.log
- %WINDIR%\security\edb.chk
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %TEMP%\secedit.sdb
- %PROGRAM_FILES%\UltraVNC\vnchooks.dll
- %PROGRAM_FILES%\UltraVNC\setcad.exe
- %PROGRAM_FILES%\UltraVNC\SecureVNCPlugin.dsm
- %PROGRAM_FILES%\UltraVNC\winvnc.exe
- %WINDIR%\security\res2.log
- %WINDIR%\security\edbtmp.log
- %PROGRAM_FILES%\UltraVNC\workgrpdomnt4.dll
- %WINDIR%\inf\oem3.inf
- %TEMP%\Cab76.tmp
- %TEMP%\Cab74.tmp
- %WINDIR%\inf\oem3.PNF
- %TEMP%\Cab7A.tmp
- <SYSTEM32>\SET79.tmp
- <DRIVERS>\SET78.tmp
- %TEMP%\Cab68.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %TEMP%\Cab6A.tmp
- %TEMP%\Cab72.tmp
- %TEMP%\Cab70.tmp
- %TEMP%\Cab6C.tmp
- %PROGRAM_FILES%\UltraVNC\SCHook.dll
- %TEMP%\VNC\driver\xp\driver\mv2.sys
- %TEMP%\aut62.tmp
- %TEMP%\VNC\driver\xp\driver\mv2.inf
- %TEMP%\aut63.tmp
- %TEMP%\VNC\driver\xp64\driver\mv2.cat
- %TEMP%\aut64.tmp
- %TEMP%\VNC\driver\xp64\setupdrv.exe
- %TEMP%\aut5F.tmp
- %TEMP%\VNC\driver\xp\setupdrv.exe
- %TEMP%\aut5E.tmp
- %TEMP%\VNC\driver\xp\driver\mv2.cat
- %TEMP%\aut61.tmp
- %TEMP%\VNC\driver\xp\driver\mv2.dll
- %TEMP%\aut60.tmp
- %PROGRAM_FILES%\UltraVNC\logging.dll
- %PROGRAM_FILES%\UltraVNC\ldapauth.dll
- %PROGRAM_FILES%\UltraVNC\authSSP.dll
- %PROGRAM_FILES%\UltraVNC\logmessages.dll
- %PROGRAM_FILES%\UltraVNC\sas.dll
- %PROGRAM_FILES%\UltraVNC\repeater.exe
- %PROGRAM_FILES%\UltraVNC\MSLogonACL.exe
- %TEMP%\aut66.tmp
- %TEMP%\VNC\driver\xp64\driver\mv2.dll
- %TEMP%\aut65.tmp
- %TEMP%\VNC\driver\xp64\driver\mv2.inf
- %PROGRAM_FILES%\UltraVNC\authadmin.dll
- %TEMP%\VNC\driver\xp64\driver\mv2.sys
- %TEMP%\aut67.tmp
- %TEMP%\aut16.tmp
- %TEMP%\VNC\Install_2000\authSSP.dll
- %TEMP%\aut15.tmp
- %TEMP%\VNC\Install_2000\ldapauth.dll
- %TEMP%\aut18.tmp
- %TEMP%\VNC\Install_2000\logging.dll
- %TEMP%\aut17.tmp
- %TEMP%\VNC\Install_2000\winvnc.exe
- %TEMP%\aut12.tmp
- %TEMP%\VNC\Install\repeater.exe
- %TEMP%\aut13.tmp
- %TEMP%\VNC\Install_2000\authadmin.dll
- %TEMP%\aut14.tmp
- %TEMP%\VNC\Install_2000\MSLogonACL.exe
- %TEMP%\aut1E.tmp
- %TEMP%\VNC\Install_2000\SecureVNCPlugin.dsm
- %TEMP%\aut1C.tmp
- %TEMP%\VNC\Install_2000\repeater.exe
- %TEMP%\aut20.tmp
- %TEMP%\VNC\Install_x64\winvnc.exe
- %TEMP%\aut1F.tmp
- %TEMP%\VNC\Install_2000\SCHook.dll
- %TEMP%\aut19.tmp
- %TEMP%\VNC\Install_2000\logmessages.dll
- %TEMP%\aut1A.tmp
- %TEMP%\VNC\Install_2000\workgrpdomnt4.dll
- %TEMP%\aut1B.tmp
- %TEMP%\VNC\Install_2000\vnchooks.dll
- %TEMP%\aut11.tmp
- %TEMP%\VNC\Install\winvnc.exe
- %TEMP%\aut6.tmp
- %TEMP%\VNC\Install\sas.dll
- %TEMP%\aut7.tmp
- %TEMP%\VNC\Install\authSSP.dll
- %TEMP%\aut8.tmp
- %TEMP%\VNC\Install\authadmin.dll
- %TEMP%\aut3.tmp
- %TEMP%\VNC\secedit.inf
- %TEMP%\aut2.tmp
- %TEMP%\VNC\Install\MSLogonACL.exe
- %TEMP%\aut5.tmp
- %TEMP%\VNC\Install\setcad.exe
- %TEMP%\aut4.tmp
- %TEMP%\VNC\Install\vnchooks.dll
- %TEMP%\autD.tmp
- %TEMP%\VNC\Install\SCHook.dll
- %TEMP%\autE.tmp
- %TEMP%\VNC\Install\SecureVNCPlugin.dsm
- %TEMP%\autF.tmp
- %TEMP%\VNC\Install\workgrpdomnt4.dll
- %TEMP%\autA.tmp
- %TEMP%\VNC\Install\ldapauth.dll
- %TEMP%\aut9.tmp
- %TEMP%\VNC\Install\logging.dll
- %TEMP%\autC.tmp
- %TEMP%\VNC\Install\logmessages.dll
- %TEMP%\autB.tmp
- %TEMP%\VNC\Install_win8_x64\ldapauth.dll
- %TEMP%\aut35.tmp
- %TEMP%\VNC\Install_win8_x64\authSSP.dll
- %TEMP%\aut36.tmp
- %TEMP%\VNC\Install_win8_x64\logmessages.dll
- %TEMP%\aut37.tmp
- %TEMP%\VNC\Install_win8_x64\logging.dll
- %TEMP%\VNC\Install_win8_x64\MSLogonACL.exe
- %TEMP%\aut31.tmp
- %TEMP%\VNC\Install_win8_x64\setcad.exe
- %TEMP%\aut32.tmp
- %TEMP%\aut34.tmp
- %TEMP%\VNC\Install_win8_x64\authadmin.dll
- %TEMP%\aut33.tmp
- %TEMP%\VNC\Install_win8_x64\repeater.exe
- %TEMP%\aut3C.tmp
- %TEMP%\VNC\Install_win8_x64\SecureVNCPlugin64.dsm
- %TEMP%\aut3E.tmp
- %TEMP%\VNC\Install_win8_x86\setcad.exe
- %TEMP%\aut3F.tmp
- %TEMP%\VNC\Install_win8_x86\winvnc.exe
- %TEMP%\aut39.tmp
- %TEMP%\VNC\Install_win8_x64\SCHook64.dll
- %TEMP%\aut38.tmp
- %TEMP%\VNC\Install_win8_x64\vnchooks.dll
- %TEMP%\aut3B.tmp
- %TEMP%\VNC\Install_win8_x64\workgrpdomnt4.dll
- %TEMP%\aut3A.tmp
- %TEMP%\aut30.tmp
- %TEMP%\VNC\Install_x64\authSSP.dll
- %TEMP%\aut25.tmp
- %TEMP%\VNC\Install_x64\authadmin.dll
- %TEMP%\aut26.tmp
- %TEMP%\VNC\Install_x64\logging.dll
- %TEMP%\aut27.tmp
- %TEMP%\VNC\Install_x64\ldapauth.dll
- %TEMP%\VNC\Install_x64\setcad.exe
- %TEMP%\aut21.tmp
- %TEMP%\VNC\Install_x64\MSLogonACL.exe
- %TEMP%\aut22.tmp
- %TEMP%\aut24.tmp
- %TEMP%\aut23.tmp
- %TEMP%\VNC\Install_x64\sas.dll
- %TEMP%\VNC\Install_x64\SecureVNCPlugin64.dsm
- %TEMP%\aut2C.tmp
- %TEMP%\VNC\Install_x64\workgrpdomnt4.dll
- %TEMP%\aut2D.tmp
- %TEMP%\VNC\Install_win8_x64\winvnc.exe
- %TEMP%\aut2F.tmp
- %TEMP%\VNC\Install_x64\repeater.exe
- %TEMP%\aut29.tmp
- %TEMP%\VNC\Install_x64\logmessages.dll
- %TEMP%\aut28.tmp
- %TEMP%\VNC\Install_x64\SCHook64.dll
- %TEMP%\aut2B.tmp
- %TEMP%\VNC\Install_x64\vnchooks.dll
- %TEMP%\aut2A.tmp
- %TEMP%\aut4B.tmp
- %TEMP%\aut4D.tmp
- %TEMP%\aut4E.tmp
- %TEMP%\aut48.tmp
- %TEMP%\aut49.tmp
- %TEMP%\aut4A.tmp
- %TEMP%\aut4F.tmp
- %TEMP%\aut53.tmp
- %TEMP%\aut54.tmp
- %TEMP%\aut55.tmp
- %TEMP%\aut50.tmp
- %TEMP%\aut51.tmp
- %TEMP%\aut52.tmp
- %TEMP%\aut3E.tmp
- %TEMP%\aut3F.tmp
- %TEMP%\aut40.tmp
- %TEMP%\aut3A.tmp
- %TEMP%\aut3B.tmp
- %TEMP%\aut3C.tmp
- %TEMP%\aut41.tmp
- %TEMP%\aut45.tmp
- %TEMP%\aut46.tmp
- %TEMP%\aut47.tmp
- %TEMP%\aut42.tmp
- %TEMP%\aut43.tmp
- %TEMP%\aut44.tmp
- %TEMP%\aut56.tmp
- %TEMP%\aut67.tmp
- %TEMP%\secedit.sdb
- %TEMP%\Cab68.tmp
- %TEMP%\aut64.tmp
- %TEMP%\aut65.tmp
- %TEMP%\aut66.tmp
- %TEMP%\Cab6A.tmp
- %TEMP%\Cab74.tmp
- %TEMP%\Cab76.tmp
- %TEMP%\Cab7A.tmp
- %TEMP%\Cab6C.tmp
- %TEMP%\Cab70.tmp
- %TEMP%\Cab72.tmp
- %TEMP%\aut5A.tmp
- %TEMP%\aut5B.tmp
- %TEMP%\aut5C.tmp
- %TEMP%\aut57.tmp
- %TEMP%\aut58.tmp
- %TEMP%\aut59.tmp
- %TEMP%\aut5D.tmp
- %TEMP%\aut61.tmp
- %TEMP%\aut62.tmp
- %TEMP%\aut63.tmp
- %TEMP%\aut5E.tmp
- %TEMP%\aut5F.tmp
- %TEMP%\aut60.tmp
- %TEMP%\aut13.tmp
- %TEMP%\aut14.tmp
- %TEMP%\aut15.tmp
- %TEMP%\autF.tmp
- %TEMP%\aut11.tmp
- %TEMP%\aut12.tmp
- %TEMP%\aut16.tmp
- %TEMP%\aut1A.tmp
- %TEMP%\aut1B.tmp
- %TEMP%\aut1C.tmp
- %TEMP%\aut17.tmp
- %TEMP%\aut18.tmp
- %TEMP%\aut19.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut6.tmp
- %TEMP%\aut7.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut3.tmp
- %TEMP%\aut4.tmp
- %TEMP%\aut8.tmp
- %TEMP%\autC.tmp
- %TEMP%\autD.tmp
- %TEMP%\autE.tmp
- %TEMP%\aut9.tmp
- %TEMP%\autA.tmp
- %TEMP%\autB.tmp
- %TEMP%\aut1E.tmp
- %TEMP%\aut30.tmp
- %TEMP%\aut31.tmp
- %TEMP%\aut32.tmp
- %TEMP%\aut2C.tmp
- %TEMP%\aut2D.tmp
- %TEMP%\aut2F.tmp
- %TEMP%\aut33.tmp
- %TEMP%\aut37.tmp
- %TEMP%\aut38.tmp
- %TEMP%\aut39.tmp
- %TEMP%\aut34.tmp
- %TEMP%\aut35.tmp
- %TEMP%\aut36.tmp
- %TEMP%\aut22.tmp
- %TEMP%\aut23.tmp
- %TEMP%\aut24.tmp
- %TEMP%\aut1F.tmp
- %TEMP%\aut20.tmp
- %TEMP%\aut21.tmp
- %TEMP%\aut25.tmp
- %TEMP%\aut29.tmp
- %TEMP%\aut2A.tmp
- %TEMP%\aut2B.tmp
- %TEMP%\aut26.tmp
- %TEMP%\aut27.tmp
- %TEMP%\aut28.tmp
- from <SYSTEM32>\SET79.tmp to <SYSTEM32>\mv2.dll
- from <DRIVERS>\SET78.tmp to <DRIVERS>\mv2.sys
- from %WINDIR%\security\edbtmp.log to %WINDIR%\security\edb.log
- 'www.download.windowsupdate.com':80
- 'wp#d':80
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- wp#d/wpad.dat
- DNS ASK www.download.windowsupdate.com
- DNS ASK wp#d
- ClassName: '' WindowName: 'Software Installation'
- ClassName: '' WindowName: 'Hardware Installation'
- ClassName: 'Shell_TrayWnd' WindowName: ''