Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '%TEMP%\Windows\javaw.exe'
Modifies file system:
Creates the following files:
- %TEMP%\winupdate.exe
- %TEMP%\_av_iup.tm~a02884\servers.def.vpx.dld
- %TEMP%\_av_iup.tm~a02884\aswSetupConfig.ini
- %TEMP%\_av_iup.tm~a02884\instup.exe
- %TEMP%\_av_iup.tm~a02884\HTMLayout.dll
- %TEMP%\_av_iup.tm~a02884\setgui_ais-8a0.vpx
- %TEMP%\_av_iup.tm~a02884\servers.def.vpx
- %TEMP%\_av_iup.tm~a02884\servers.def
- %TEMP%\_av_iup.tm~a02884\prod-vps.vpx
- %TEMP%\_av_iup.tm~a02884\prod-ais.vpx
- %TEMP%\_av_iup.tm~a02884\part-vps_win32-14110700.vpx
- %TEMP%\_av_iup.tm~a02884\prod-ais.vpx.dld
- %TEMP%\_av_iup.tm~a02884\part-setup_ais-8a0.vpx
- %TEMP%\_av_iup.tm~a02884\part-jrog2-bde.vpx
- %TEMP%\_av_iup.tm~a02884\part-iex-2.vpx
- %TEMP%\_av_iup.tm~a02884\ngiodriver_x86_ais-8a0.vpx
- %TEMP%\_av_iup.tm~a02884\ngiodriver_x64_ais-8a0.vpx
- %TEMP%\_av_iup.tm~a02884\Instup.dll
- %TEMP%\_av_iup.tm~a02884\instup_ais-8a0.vpx
- %TEMP%\_av_iup.tm~a02884\instcont_ais-8a0.vpx
- %TEMP%\_av_iup.tm~a02884\avBugReport.exe
- %TEMP%\_av_iup.tm~a02884\avbugreport_ais-8a0.vpx
- %ALLUSERSPROFILE%\Application Data\AVAST Software\Persistent Data\Avast\Logs\Setup.log
- %TEMP%\_av_iup.tm~a02884\part-prg_ais-8a0.vpx
- %TEMP%\_av_iup.tm~a02884\~tmp_aswInstUpHttpGet
Deletes the following files:
- %TEMP%\_av_iup.tm~a02884\aswSetupConfig.ini
- %TEMP%\_av_iup.tm~a02884\servers.def.vpx.dld
- %TEMP%\_av_iup.tm~a02884\prod-ais.vpx.dld
- %TEMP%\_av_iup.tm~a02884\~tmp_aswInstUpHttpGet
Substitutes the following files:
- %TEMP%\_av_iup.tm~a02884\servers.def.vpx.dld
- %TEMP%\_av_iup.tm~a02884\prod-ais.vpx.dld
Network activity:
Connects to:
- 'se####ni.avast.com':80
- 'p3######.iavs9x.u.avast.com':80
- 'm9######.iavs9x.u.avast.com':80
- 'z5######.iavs9x.u.avast.com':80
- 'c6######.iavs9x.u.avast.com':80
- 'r6######.iavs9x.u.avast.com':80
- 'j7######.iavs9x.u.avast.com':80
- 'x1######.iavs9x.u.avast.com':80
- 'x7######.iavs9x.u.avast.com':80
- 'v1######.iavs9x.u.avast.com':80
- 'n6######.iavs9x.u.avast.com':80
- 'n2######.iavs9x.u.avast.com':80
- 'j0######.iavs9x.u.avast.com':80
- 'y6######.iavs9x.u.avast.com':80
- 'm8######.iavs9x.u.avast.com':80
- 't8######.iavs9x.u.avast.com':80
- 'j1######.iavs9x.u.avast.com':80
- 'go#####analytics.com':80
TCP:
HTTP GET requests:
- http://se####ni.avast.com/vers/setup_config.ini
- http://p3######.iavs9x.u.avast.com/iavs9x/prod-ais.vpx
- http://m9######.iavs9x.u.avast.com/iavs9x/prod-ais.vpx
- http://y6######.iavs9x.u.avast.com/iavs9x/prod-ais.vpx
- http://j0######.iavs9x.u.avast.com/iavs9x/prod-ais.vpx
- http://z5######.iavs9x.u.avast.com/iavs9x/prod-ais.vpx
- http://c6######.iavs9x.u.avast.com/iavs9x/prod-ais.vpx
- http://r6######.iavs9x.u.avast.com/iavs9x/prod-ais.vpx
- http://j7######.iavs9x.u.avast.com/iavs9x/prod-ais.vpx
- http://x1######.iavs9x.u.avast.com/iavs9x/servers.def.vpx
- http://x7######.iavs9x.u.avast.com/iavs9x/servers.def.vpx
- http://v1######.iavs9x.u.avast.com/iavs9x/servers.def.vpx
- http://n6######.iavs9x.u.avast.com/iavs9x/servers.def.vpx
- http://n2######.iavs9x.u.avast.com/iavs9x/servers.def.vpx
- http://j0######.iavs9x.u.avast.com/iavs9x/servers.def.vpx
- http://y6######.iavs9x.u.avast.com/iavs9x/servers.def.vpx
- http://m8######.iavs9x.u.avast.com/iavs9x/servers.def.vpx
- http://t8######.iavs9x.u.avast.com/iavs9x/servers.def.vpx
- http://j1######.iavs9x.u.avast.com/iavs9x/prod-ais.vpx
- http://www.go#####analytics.com/__utm.gif?ut#####################################################################################################################################################...
UDP:
- DNS ASK se####ni.avast.com
- DNS ASK p3######.iavs9x.u.avast.com
- DNS ASK m9######.iavs9x.u.avast.com
- DNS ASK z5######.iavs9x.u.avast.com
- DNS ASK c6######.iavs9x.u.avast.com
- DNS ASK r6######.iavs9x.u.avast.com
- DNS ASK j7######.iavs9x.u.avast.com
- DNS ASK x1######.iavs9x.u.avast.com
- DNS ASK x7######.iavs9x.u.avast.com
- DNS ASK v1######.iavs9x.u.avast.com
- DNS ASK n6######.iavs9x.u.avast.com
- DNS ASK n2######.iavs9x.u.avast.com
- DNS ASK j0######.iavs9x.u.avast.com
- DNS ASK y6######.iavs9x.u.avast.com
- DNS ASK m8######.iavs9x.u.avast.com
- DNS ASK t8######.iavs9x.u.avast.com
- DNS ASK j1######.iavs9x.u.avast.com
- DNS ASK www.go#####analytics.com
Miscellaneous:
Creates and executes the following:
- '%TEMP%\winupdate.exe'
- '%TEMP%\_av_iup.tm~a02884\instup.exe' /edition:3 /prod:ais /sfx:lite /sfxstorage:%TEMP%\_av_iup.tm~a02884