Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Adaptec Event Monitor] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Adaptec Event Monitor] 'ImagePath' = '%ProgramFiles%\Adaptec\Adaptec Event Monitor\EventMonitor.exe'
Creates the following services
- 'Adaptec Event Monitor' %ProgramFiles%\Adaptec\Adaptec Event Monitor\EventMonitor.exe
Modifies file system
Creates the following files
- %TEMP%\tempexe.exe
- %TEMP%\{0395d415-0ebe-4129-a985-fbd32442015e}\isconfig.ini
- %TEMP%\_is60b6.tmp
- %TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isbew64.exe
- %TEMP%\_is650b.tmp
- %TEMP%\{f35c2a23-728c-420a-87df-740904bf5a4e}\isconfig.ini
- %ProgramFiles%\adaptec\adaptec event monitor\afaapi.dll
- %ProgramFiles%\adaptec\adaptec event monitor\arcconf.exe
- %ProgramFiles%\adaptec\adaptec event monitor\driverupdate.exe
- %ProgramFiles%\adaptec\adaptec event monitor\msvcp110.dll
- %ProgramFiles%\adaptec\adaptec event monitor\msvcr110.dll
- %ProgramFiles%\adaptec\adaptec event monitor\storarc.dll
- %ProgramFiles%\adaptec\adaptec event monitor\miniagentlogmsg.dll
- %ProgramFiles%\adaptec\adaptec event monitor\nrmconfig.ini
- %ProgramFiles%\adaptec\adaptec event monitor\eventmonitor.exe
- %ProgramFiles%\adaptec\adaptec event monitor\raidnls.properties
- %ProgramFiles%\adaptec\adaptec event monitor\nrmfsa.dll
- %TEMP%\_is7283.tmp
- %TEMP%\{e826d1cc-cb2b-49e4-b1a0-3c35adbd2ceb}\isconfig.ini
- %TEMP%\_is7736.tmp
- %TEMP%\{41337259-0a23-4e78-9c69-fda74285ff01}\isconfig.ini
- %WINDIR%\installer\{50b11c9f-4717-43ae-90e5-941b90a558e1}\serveraid_manager_65002fb472c845f2a944d0f0c11d9b40.exe
- C:\pmcs\logs\nrmfsadebug.log
- C:\pmcs\logs\arcerror.txt
- C:\pmcs\logs\arcconfig.xml
- C:\pmcs\logs\raidmonitor_install.log
- %TEMP%\_is6086.tmp
- C:\pmcs\logs\adaptec.log
- %TEMP%\{50b11c9f-4717-43ae-90e5-941b90a558e1}\writeproperty.jar
- %TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\string1033.txt
- %TEMP%\_is4eac.tmp
- %TEMP%\{f266824b-a6aa-4db5-b6dc-770a2e342aa1}\setup.ini
- %TEMP%\{f266824b-a6aa-4db5-b6dc-770a2e342aa1}\_ismsidel.ini
- %TEMP%\_is4ff4.tmp
- %TEMP%\{f266824b-a6aa-4db5-b6dc-770a2e342aa1}\0x0409.ini
- %TEMP%\_is5341.tmp
- %TEMP%\~5330.tmp
- %TEMP%\_is5342.tmp
- %TEMP%\{f266824b-a6aa-4db5-b6dc-770a2e342aa1}\adaptec event monitor.msi
- %TEMP%\iss5a35.tmp
- %TEMP%\_is5a55.tmp
- %TEMP%\{ad84f42b-c01b-499a-8e16-7b1eda97983d}\isconfig.ini
- %TEMP%\_is5a66.tmp
- %TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\setup.inx
- %TEMP%\_is5aa5.tmp
- %TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isrt.dll
- %TEMP%\_is5ae5.tmp
- %TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isbewx64.exe
- %TEMP%\_is5b05.tmp
- %TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isbewi64.exe
- %TEMP%\_is5b25.tmp
- %TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\_isres_0x0409.dll
- %TEMP%\_is5b64.tmp
- %TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isconfig.ini
- %TEMP%\_is5b65.tmp
- %TEMP%\adaptec.log
- %ProgramFiles%\adaptec\adaptec event monitor\nrmfsaconfig.xml
Deletes the following files
- %TEMP%\_is4eac.tmp
- %TEMP%\_is7283.tmp
- %TEMP%\{e826d1cc-cb2b-49e4-b1a0-3c35adbd2ceb}\isconfig.ini
- %TEMP%\_is7736.tmp
- %TEMP%\{41337259-0a23-4e78-9c69-fda74285ff01}\isconfig.ini
- %TEMP%\{50b11c9f-4717-43ae-90e5-941b90a558e1}\writeproperty.jar
- %TEMP%\{f266824b-a6aa-4db5-b6dc-770a2e342aa1}\0x0409.ini
- %TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\_isres_0x0409.dll
- %TEMP%\{f266824b-a6aa-4db5-b6dc-770a2e342aa1}\adaptec event monitor.msi
- %TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isbewi64.exe
- %TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isbewx64.exe
- %TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isconfig.ini
- %TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isrt.dll
- %TEMP%\{f266824b-a6aa-4db5-b6dc-770a2e342aa1}\setup.ini
- %TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\setup.inx
- %TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\string1033.txt
- %TEMP%\{f35c2a23-728c-420a-87df-740904bf5a4e}\isconfig.ini
- %TEMP%\{f266824b-a6aa-4db5-b6dc-770a2e342aa1}\_ismsidel.ini
- %TEMP%\_is650b.tmp
- %TEMP%\{0395d415-0ebe-4129-a985-fbd32442015e}\isconfig.ini
- %TEMP%\_is4ff4.tmp
- %TEMP%\_is5341.tmp
- %TEMP%\~5330.tmp
- %TEMP%\_is5342.tmp
- %TEMP%\_is5a55.tmp
- %TEMP%\_is5a66.tmp
- %TEMP%\_is5aa5.tmp
- %TEMP%\_is5ae5.tmp
- %TEMP%\_is5b05.tmp
- %TEMP%\_is5b25.tmp
- %TEMP%\_is5b64.tmp
- %TEMP%\_is5b65.tmp
- %TEMP%\{ad84f42b-c01b-499a-8e16-7b1eda97983d}\isconfig.ini
- %TEMP%\iss5a35.tmp
- %TEMP%\_is6086.tmp
- %TEMP%\_is60b6.tmp
- %TEMP%\tempexe.exe
Miscellaneous
Searches for the following windows
- ClassName: 'MsiDialogCloseClass' WindowName: ''
- ClassName: '#32770' WindowName: ''
Creates and executes the following
- '%TEMP%\tempexe.exe' /s /v" /qn ADDLOCAL=all /log %TEMP%\adaptec.log INSTALLDIR=\"%ProgramFiles%\Adaptec\Adaptec Event Monitor\"
- '%TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7A0E7538-600D-4578-87F7-BCC99EF95B75}
- '%TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{45FD6222-82C9-49E5-85D1-E2433C262FE2}
- '%TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2C5E448F-AFEC-4479-8130-B08AE2729CC1}
- '%TEMP%\{faca7428-bf29-4232-9ae6-bde432924501}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{16EE7FCA-7AB9-4EBA-BF32-DF59D54FFC33}
- '%ProgramFiles%\adaptec\adaptec event monitor\eventmonitor.exe' -i
- '%ProgramFiles%\adaptec\adaptec event monitor\eventmonitor.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c MsiExec.exe /X{50B11C9F-4717-43AE-90E5-941B90A558E1} /qn
- '<SYSTEM32>\msiexec.exe' /X{50B11C9F-4717-43AE-90E5-941B90A558E1} /qn
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\{F266824B-A6AA-4DB5-B6DC-770A2E342AA1}\Adaptec Event Monitor.msi" /qn ADDLOCAL=all /log %TEMP%\adaptec.log INSTALLDIR="%ProgramFiles%\Adaptec\Adaptec Event Monitor" SETUPEXEDIR="%L...