Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'BlueSoft' = '%PROGRAM_FILES%\BlueSoft\BlueSoft.exe silent'
- [<HKLM>\SYSTEM\ControlSet001\Services\Brmas] 'Start' = '00000001'
- '%PROGRAM_FILES%\Brmas\bin\Brmas.exe'
- '%APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\blueview_silent[bsrtex].exe' /norestart
- '%TEMP%\is-9T88F.tmp\blueview_silent[bsrtex].tmp' /SL5="$30106,663518,83456,%APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\blueview_silent[bsrtex].exe" /norestart
- '%WINDIR%\Temp\bluesoft_gho_bsrtex_inst.exe'
- '%PROGRAM_FILES%\BlueSoft\BlueSoft.exe' autoinstall
- '%APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\brmas_pc[bsrtex].exe'
- NtQuerySystemInformation, handler: Brmas.sys
- NtQueryInformationProcess, handler: Brmas.sys
- NtOpenProcess, handler: Brmas.sys
- NtSetValueKey, handler: Brmas.sys
- NtReadFile, handler: Brmas.sys
- NtQueryValueKey, handler: Brmas.sys
- NtDeleteValueKey, handler: Brmas.sys
- NtDeleteKey, handler: Brmas.sys
- NtCreateKey, handler: Brmas.sys
- NtOpenKey, handler: Brmas.sys
- NtEnumerateValueKey, handler: Brmas.sys
- NtEnumerateKey, handler: Brmas.sys
- %APPDATA%\BlueView\icon\is-KI32D.tmp
- %APPDATA%\BlueView\icon\is-GCR3E.tmp
- %APPDATA%\BlueView\icon\is-41H8R.tmp
- %APPDATA%\BlueView\icon\is-HRM5B.tmp
- %APPDATA%\BlueView\icon\is-KVFTC.tmp
- %APPDATA%\BlueView\icon\is-DGKKV.tmp
- %APPDATA%\BlueView\icon\is-VF2HH.tmp
- %APPDATA%\BlueView\icon\is-41QSG.tmp
- %APPDATA%\BlueView\icon\is-U3MEQ.tmp
- %APPDATA%\BlueView\icon\is-SPN72.tmp
- %APPDATA%\BlueView\icon\is-DKCS6.tmp
- %APPDATA%\BlueView\is-K3OSH.tmp
- %APPDATA%\BlueView\icon\is-L1TB9.tmp
- %PROGRAM_FILES%\BlueView\is-HHRGD.tmp
- %TEMP%\is-JN6J5.tmp\setup_btn2.bmp
- %PROGRAM_FILES%\BlueView\is-IBM0L.tmp
- %APPDATA%\BlueView\icon\is-LPEBE.tmp
- %APPDATA%\BlueView\icon\is-PO4O6.tmp
- %APPDATA%\BlueView\icon\is-MB43U.tmp
- %APPDATA%\BlueView\icon\is-69JGC.tmp
- %APPDATA%\BlueView\icon\is-A89I3.tmp
- %APPDATA%\BlueView\icon\is-PNHBK.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\А¶№вдЇААЖч\А¶№вдЇААЖч.lnk
- %ALLUSERSPROFILE%\Start Menu\А¶№вдЇААЖч.lnk
- %PROGRAM_FILES%\BlueView\uninstall\is-6JG0L.tmp
- %PROGRAM_FILES%\BlueView\uninstall\is-3VG2N.tmp
- %PROGRAM_FILES%\BlueView\uninstall\is-75OIR.tmp
- %PROGRAM_FILES%\BlueView\unins000.msg
- %PROGRAM_FILES%\BlueView\unins000.dat
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\А¶№вдЇААЖч.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\А¶№вдЇААЖч\Р¶ФШ А¶№вдЇААЖч.lnk
- %ALLUSERSPROFILE%\Desktop\А¶№вдЇААЖч.lnk
- %PROGRAM_FILES%\BlueView\uninstall\is-BV9EO.tmp
- %APPDATA%\BlueView\icon\is-VIT38.tmp
- %APPDATA%\BlueView\icon\is-ESJVD.tmp
- %APPDATA%\BlueView\icon\is-NGER8.tmp
- %APPDATA%\BlueView\icon\is-86I68.tmp
- %APPDATA%\BlueView\icon\is-R9G4N.tmp
- %PROGRAM_FILES%\BlueView\uninstall\is-PPMBM.tmp
- %PROGRAM_FILES%\BlueView\uninstall\is-BJ0DQ.tmp
- %PROGRAM_FILES%\BlueView\uninstall\is-NO0EM.tmp
- %APPDATA%\BlueView\icon\is-5SSHD.tmp
- %PROGRAM_FILES%\BlueView\uninstall\is-SPU5O.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\А¶№вИнјюѕ«СЎ\Р¶ФШ А¶№вИнјюѕ«СЎ.lnk
- %TEMP%\nsm4.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\А¶№вИнјюѕ«СЎ\А¶№вИнјюѕ«СЎ.lnk
- %PROGRAM_FILES%\BlueSoft\Uninstall.exe
- %APPDATA%\BlueSoft\setting.ini
- %PROGRAM_FILES%\Brmas\bin\Brmas.sys
- %PROGRAM_FILES%\Brmas\bin\Brmas.dll
- %PROGRAM_FILES%\Brmas\bin\Brmas.exe
- %TEMP%\CheckList.dll
- %TEMP%\nsa5.tmp\System.dll
- %APPDATA%\BlueSoft\ExeIcon\taobao.ico
- %APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\blueview_silent.exe
- %APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\brmas_pc.exe
- %APPDATA%\BlueSoft\softlist.xml
- %WINDIR%\Temp\bluesoft_gho_bsrtex_inst.exe
- %PROGRAM_FILES%\BlueSoft\BlueSoft.exe
- %APPDATA%\BlueSoft\ExeIcon\hao123.ico
- %APPDATA%\BlueSoft\ExeIcon\jingdong.ico
- %APPDATA%\BlueSoft\ExeIcon\brmas.ico
- %APPDATA%\BlueSoft\ExeIcon\baidu.ico
- %APPDATA%\BlueSoft\ExeIcon\blueview.ico
- %PROGRAM_FILES%\Brmas\bin\BrowserMgr.dll
- %TEMP%\is-JN6J5.tmp\mainbk.bmp
- %TEMP%\is-JN6J5.tmp\setup_logo.bmp
- %TEMP%\is-JN6J5.tmp\install.ico
- %TEMP%\is-JN6J5.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-JN6J5.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-JN6J5.tmp\StretchLine.bmp
- %TEMP%\is-JN6J5.tmp\changeDir_btn.bmp
- %TEMP%\is-JN6J5.tmp\top_bk.bmp
- %TEMP%\is-JN6J5.tmp\setup_logo2.bmp
- %TEMP%\is-JN6J5.tmp\setup_btn.bmp
- %TEMP%\is-9T88F.tmp\blueview_silent[bsrtex].tmp
- %PROGRAM_FILES%\Brmas\bin\brmas\db3.brmas
- %PROGRAM_FILES%\Brmas\bin\uninst.exe
- %PROGRAM_FILES%\Brmas\bin\brmas\db1.brmas
- %PROGRAM_FILES%\Brmas\bin\stat.dll
- %PROGRAM_FILES%\Brmas\bin\brmas\db0.brmas
- %PROGRAM_FILES%\Brmas\bin\iexplore.lnk
- %PROGRAM_FILES%\Brmas\bin\ProtConfig.dat
- %HOMEPATH%\Start Menu\Programs\浏览器修复大师\卸载 浏览器修复大师.lnk
- %PROGRAM_FILES%\Brmas\setting.ini
- %HOMEPATH%\Start Menu\Programs\浏览器修复大师\浏览器修复大师.lnk
- %TEMP%\nsa5.tmp\System.dll
- %TEMP%\CheckList.dll
- from %APPDATA%\BlueView\icon\is-NGER8.tmp to %APPDATA%\BlueView\icon\www.taobao.com.ico
- from %APPDATA%\BlueView\icon\is-R9G4N.tmp to %APPDATA%\BlueView\icon\www.sohu.com.ico
- from %APPDATA%\BlueView\icon\is-ESJVD.tmp to %APPDATA%\BlueView\icon\www.vancl.com.ico
- from %APPDATA%\BlueView\icon\is-VIT38.tmp to %APPDATA%\BlueView\icon\www.tmall.com.ico
- from %APPDATA%\BlueView\icon\is-86I68.tmp to %APPDATA%\BlueView\icon\www.sina.com.cn.ico
- from %APPDATA%\BlueView\icon\is-DGKKV.tmp to %APPDATA%\BlueView\icon\www.meituan.com.ico
- from %APPDATA%\BlueView\icon\is-41QSG.tmp to %APPDATA%\BlueView\icon\www.kaixin001.com.ico
- from %APPDATA%\BlueView\icon\is-PNHBK.tmp to %APPDATA%\BlueView\icon\www.qq.com.ico
- from %APPDATA%\BlueView\icon\is-VF2HH.tmp to %APPDATA%\BlueView\icon\www.microsoft.com.ico
- from %PROGRAM_FILES%\BlueView\uninstall\is-3VG2N.tmp to %PROGRAM_FILES%\BlueView\uninstall\close_btn.bmp
- from %PROGRAM_FILES%\BlueView\uninstall\is-BV9EO.tmp to %PROGRAM_FILES%\BlueView\uninstall\cancel_btn.bmp
- from %PROGRAM_FILES%\BlueView\uninstall\is-6JG0L.tmp to %PROGRAM_FILES%\BlueView\uninstall\unsetup_logo2.bmp
- from %PROGRAM_FILES%\BlueView\uninstall\is-75OIR.tmp to %PROGRAM_FILES%\BlueView\uninstall\unsetup_logo.bmp
- from %PROGRAM_FILES%\BlueView\uninstall\is-BJ0DQ.tmp to %PROGRAM_FILES%\BlueView\uninstall\unsetup_btn.bmp
- from %PROGRAM_FILES%\BlueView\uninstall\is-SPU5O.tmp to %PROGRAM_FILES%\BlueView\uninstall\mainbk.bmp
- from %APPDATA%\BlueView\icon\is-5SSHD.tmp to %APPDATA%\BlueView\icon\www.youku.com.ico
- from %PROGRAM_FILES%\BlueView\uninstall\is-PPMBM.tmp to %PROGRAM_FILES%\BlueView\uninstall\StretchLine.bmp
- from %PROGRAM_FILES%\BlueView\uninstall\is-NO0EM.tmp to %PROGRAM_FILES%\BlueView\uninstall\top_bk.bmp
- from %APPDATA%\BlueView\icon\is-SPN72.tmp to %APPDATA%\BlueView\icon\www.jd.com.ico
- from %APPDATA%\BlueView\icon\is-69JGC.tmp to %APPDATA%\BlueView\icon\baidu.iblueview.com.ico
- from %APPDATA%\BlueView\icon\is-L1TB9.tmp to %APPDATA%\BlueView\icon\baidu.gsie.cn.ico
- from %APPDATA%\BlueView\icon\is-MB43U.tmp to %APPDATA%\BlueView\icon\game.gsie.cn.ico
- from %APPDATA%\BlueView\icon\is-A89I3.tmp to %APPDATA%\BlueView\icon\baidu.lvseie.com.ico
- from %APPDATA%\BlueView\is-K3OSH.tmp to %APPDATA%\BlueView\setting.ini
- from %APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\brmas_pc.exe to %APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\brmas_pc[bsrtex].exe
- from %APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\blueview_silent.exe to %APPDATA%\BlueSoft\C86DA4AD-186C-4dc2-A540-02E7B075F714\blueview_silent[bsrtex].exe
- from %PROGRAM_FILES%\BlueView\is-HHRGD.tmp to %PROGRAM_FILES%\BlueView\BlueView.exe
- from %PROGRAM_FILES%\BlueView\is-IBM0L.tmp to %PROGRAM_FILES%\BlueView\unins000.exe
- from %APPDATA%\BlueView\icon\is-KI32D.tmp to %APPDATA%\BlueView\icon\www.dianping.com.ico
- from %APPDATA%\BlueView\icon\is-41H8R.tmp to %APPDATA%\BlueView\icon\www.dangdang.com.ico
- from %APPDATA%\BlueView\icon\is-U3MEQ.tmp to %APPDATA%\BlueView\icon\www.hao123.com.ico
- from %APPDATA%\BlueView\icon\is-GCR3E.tmp to %APPDATA%\BlueView\icon\www.google.com.hk.ico
- from %APPDATA%\BlueView\icon\is-KVFTC.tmp to %APPDATA%\BlueView\icon\www.baidu.com.ico
- from %APPDATA%\BlueView\icon\is-PO4O6.tmp to %APPDATA%\BlueView\icon\weibo.com.ico
- from %APPDATA%\BlueView\icon\is-LPEBE.tmp to %APPDATA%\BlueView\icon\pindao.huoban.taobao.com.ico
- from %APPDATA%\BlueView\icon\is-HRM5B.tmp to %APPDATA%\BlueView\icon\www.2345.com.ico
- from %APPDATA%\BlueView\icon\is-DKCS6.tmp to %APPDATA%\BlueView\icon\www.163.com.ico
- 'localhost':1044
- 'localhost':1047
- '12#.#25.114.144':80
- 'localhost':1041
- DNS ASK up####.safe.my.iedun.cn
- DNS ASK www.ib###view.com
- DNS ASK up####.iblueview.com
- DNS ASK www.ba##u.com
- DNS ASK up####.u.gsie.cn
- DNS ASK www.download.windowsupdate.com
- ClassName: '85AD02CF-F95D-4f2c-8BCA-BDA546A35E63' WindowName: '(null)'
- ClassName: 'BVIE_MainWnd' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'BlueSoft_MainWnd' WindowName: '(null)'