Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'McAfeeUpdaterUI' = '"%ProgramFiles(x86)%\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey'
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\NAIMServInst] 'ImagePath' = '%TEMP%\unz6C3A.tmp\FramePkg.exe /SignalComplete /LOGDIR="%TEMP%\NAILogs" /Cleanup2="%TEMP%\unz6C3A.tmp" /WaitFor=3584 /Curre...
- [HKLM\System\CurrentControlSet\Services\McAfeeFramework] 'ImagePath' = '"%ProgramFiles(x86)%\McAfee\Common Framework\FrameworkService.exe" /ServiceStart'
- [HKLM\System\CurrentControlSet\Services\McAfeeFramework] 'Start' = '00000002'
Creates the following services
- 'NAIMServInst' %TEMP%\unz6C3A.tmp\FramePkg.exe /SignalComplete /LOGDIR="%TEMP%\NAILogs" /Cleanup2="%TEMP%\unz6C3A.tmp" /WaitFor=3584 /CurrentFolder="<Current directory>" /Install=Agent /OriginalCmdLine=
- 'McAfeeFramework' "%ProgramFiles(x86)%\McAfee\Common Framework\FrameworkService.exe" /ServiceStart
Modifies file system
Creates the following files
- %TEMP%\nailogs\frminst_cpwzzymvna.log
- %ProgramFiles(x86)%\mcafee\common framework\frminst.exe
- %ProgramFiles(x86)%\mcafee\common framework\frameworkservice.exe
- %ALLUSERSPROFILE%\mcafee\common framework\db\frameworklog.xsl
- %ProgramFiles(x86)%\mcafee\common framework\componentuserinterface.dll
- %ProgramFiles(x86)%\mcafee\common framework\internetmanager.dll
- %ProgramFiles(x86)%\mcafee\common framework\cmdagent.exe
- %ProgramFiles(x86)%\mcafee\common framework\0409\agentres.dll
- %ProgramFiles(x86)%\mcafee\common framework\agentplugin.dll
- %ALLUSERSPROFILE%\mcafee\common framework\agent.ini
- %ProgramFiles(x86)%\mcafee\common framework\agent.dll
- %WINDIR%\temp\unz7d3a.tmp\mctray.exe
- %WINDIR%\temp\unz7d3a.tmp\jrmac.dll
- %ProgramFiles(x86)%\mcafee\common framework\cleanup.exe
- %WINDIR%\temp\unz7d3a.tmp\nacmnlib2_64.dll
- %ProgramFiles(x86)%\mcafee\common framework\listenserver.dll
- %ProgramFiles(x86)%\mcafee\common framework\poevtinf.dll
- %ProgramFiles(x86)%\mcafee\common framework\nailog2.dll
- %ProgramFiles(x86)%\mcafee\common framework\napolicymanager.dll
- %ProgramFiles(x86)%\mcafee\common framework\patchw32.dll
- %ProgramFiles(x86)%\mcafee\common framework\naisign2.dll
- %ProgramFiles(x86)%\mcafee\common framework\naxml2_71.dll
- %ProgramFiles(x86)%\mcafee\common framework\naspipe.dll
- %ProgramFiles(x86)%\mcafee\common framework\naprdmgr.exe
- %ProgramFiles(x86)%\mcafee\common framework\frmplugin.dll
- %WINDIR%\temp\unz7d3a.tmp\mcscancheck.exe
- %ProgramFiles(x86)%\mcafee\common framework\logging.dll
- %ProgramFiles(x86)%\mcafee\common framework\nagshr32.dll
- %ProgramFiles(x86)%\mcafee\common framework\nacmnlib2_71.dll
- %ProgramFiles(x86)%\mcafee\common framework\mcurial.dll
- %ProgramFiles(x86)%\mcafee\common framework\mcscript.exe
- %ProgramFiles(x86)%\mcafee\common framework\management.dll
- %ProgramFiles(x86)%\mcafee\common framework\nainet.dll
- %ProgramFiles(x86)%\mcafee\common framework\genevtinf.dll
- %WINDIR%\temp\unz7d3a.tmp\microsoft.vc80.crt.manifest
- %WINDIR%\temp\unz7d3a.tmp\msvcr80.dll
- %ProgramFiles(x86)%\mcafee\common framework\pcrplug.dll
- %WINDIR%\temp\unz7d3a.tmp\naitcpp.inf
- %WINDIR%\temp\unz7d3a.tmp\componentsubsystem.dll
- %WINDIR%\temp\unz7d3a.tmp\clientui.dll
- %WINDIR%\temp\unz7d3a.tmp\cmauires.dll
- %WINDIR%\temp\unz7d3a.tmp\applib.dll
- %WINDIR%\temp\unz7d3a.tmp\componentsubsystem64.dll
- %WINDIR%\temp\unz7d3a.tmp\cmalib.dll
- %WINDIR%\temp\unz7d3a.tmp\msvcp71.dll
- %WINDIR%\temp\unz7d3a.tmp\componentpolicyenforcement64.dll
- %WINDIR%\temp\unz7d3a.tmp\msvcr71.dll
- %WINDIR%\temp\unz7d3a.tmp\epopgpsdk.dll
- %WINDIR%\temp\unz7d3a.tmp\epopgpsdk.dll.sig
- %WINDIR%\temp\unz7d3a.tmp\agent64.dll
- %WINDIR%\temp\unz7d3a.tmp\naitcpp.dll
- %WINDIR%\temp\unz7d3a.tmp\xmlwrap.dll
- %WINDIR%\temp\unz7d3a.tmp\logging64.dll
- %WINDIR%\temp\unz7d3a.tmp\scheduler64.dll
- %WINDIR%\temp\unz7d3a.tmp\msvcp80.dll
- %WINDIR%\temp\unz7d3a.tmp\internetmanager64.dll
- %WINDIR%\temp\unz7d3a.tmp\msvcm80.dll
- %WINDIR%\temp\unz7d3a.tmp\nailog2_64.dll
- %WINDIR%\temp\unz7d3a.tmp\naxml2_64.dll
- %WINDIR%\temp\unz7d3a.tmp\naspipe64.dll
- %WINDIR%\temp\unz7d3a.tmp\management64.dll
- %WINDIR%\temp\unz7d3a.tmp\naprdmgr64.exe
- %WINDIR%\temp\unz7d3a.tmp\nainet64.dll
- %WINDIR%\temp\unz7d3a.tmp\componentframeworkcallback64.dll
- %WINDIR%\temp\unz7d3a.tmp\genevtinf64.dll
- %WINDIR%\temp\unz7d3a.tmp\cmalib64.dll
- %WINDIR%\temp\unz7d3a.tmp\applib64.dll
- %WINDIR%\temp\unz7d3a.tmp\secureframeworkfactory64.dll
- %WINDIR%\temp\unz7d3a.tmp\napolicymanager64.dll
- %WINDIR%\temp\unz7d3a.tmp\agentres64.dll
- %ProgramFiles(x86)%\mcafee\common framework\scheduler.dll
- %ALLUSERSPROFILE%\mcafee\common framework\installmain.mcs
- %ProgramFiles(x86)%\mcafee\common framework\nailog2_64.dll
- %ProgramFiles(x86)%\mcafee\common framework\naxml2_64.dll
- %ProgramFiles(x86)%\mcafee\common framework\naspipe64.dll
- %ProgramFiles(x86)%\mcafee\common framework\naprdmgr64.exe
- %ProgramFiles(x86)%\mcafee\common framework\napolicymanager64.dll
- %ProgramFiles(x86)%\mcafee\common framework\microsoft.vc80.crt\msvcp80.dll
- %ProgramFiles(x86)%\mcafee\common framework\nainet64.dll
- %ProgramFiles(x86)%\mcafee\common framework\genevtinf64.dll
- %ProgramFiles(x86)%\mcafee\common framework\cmalib64.dll
- %ProgramFiles(x86)%\mcafee\common framework\applib64.dll
- %ProgramFiles(x86)%\mcafee\common framework\secureframeworkfactory64.dll
- %ProgramFiles(x86)%\mcafee\common framework\scheduler64.dll
- %ProgramFiles(x86)%\mcafee\common framework\management64.dll
- %ProgramFiles(x86)%\mcafee\common framework\nacmnlib2_64.dll
- %ProgramFiles(x86)%\mcafee\common framework\componentsubsystem64.dll
- %ProgramFiles(x86)%\mcafee\common framework\microsoft.vc80.crt\msvcr80.dll
- %ALLUSERSPROFILE%\mcafee\common framework\precompiled.xml
- %ALLUSERSPROFILE%\mcafee\common framework\compiled.xml
- %ALLUSERSPROFILE%\mcafee\common framework\updatehistory.ini
- %ALLUSERSPROFILE%\mcafee\common framework\serversitelist.xml
- %ALLUSERSPROFILE%\mcafee\common framework\sitelist.xml
- %ALLUSERSPROFILE%\mcafee\common framework\db\prdmgr_cpwzzymvna.log
- %ProgramFiles(x86)%\mcafee\common framework\logging64.dll
- %ProgramFiles(x86)%\mcafee\common framework\microsoft.vc80.crt\msvcm80.dll
- %ProgramFiles(x86)%\mcafee\common framework\nmcomn32.dll
- %ProgramFiles(x86)%\mcafee\common framework\naicrt32.dll
- %ALLUSERSPROFILE%\mcafee\common framework\frameworkmanifest.xml
- %ProgramFiles(x86)%\mcafee\common framework\mctray.exe
- %ProgramFiles(x86)%\mcafee\common framework\jrmac.dll
- %ProgramFiles(x86)%\mcafee\common framework\mcscancheck.exe
- %ALLUSERSPROFILE%\mcafee\common framework\db\agent_cpwzzymvna.log
- %ProgramFiles(x86)%\mcafee\common framework\microsoft.vc80.crt\microsoft.vc80.crt.manifest
- %ProgramFiles(x86)%\mcafee\common framework\internetmanager64.dll
- %ProgramFiles(x86)%\mcafee\common framework\componentpolicyenforcement64.dll
- %WINDIR%\temp\unz7d3a.tmp\agentplugin.dll
- %ProgramFiles(x86)%\mcafee\common framework\updatesubsys.dll
- %ProgramFiles(x86)%\mcafee\common framework\0409\updres.dll
- %ProgramFiles(x86)%\mcafee\common framework\updplug.dll
- %ProgramFiles(x86)%\mcafee\common framework\udaterui.exe
- %ProgramFiles(x86)%\mcafee\common framework\tchelper.dll
- %ProgramFiles(x86)%\mcafee\common framework\tcsubsys.dll
- %ProgramFiles(x86)%\mcafee\common framework\userspace.dll
- %ProgramFiles(x86)%\mcafee\common framework\xmlwrap.dll
- %ProgramFiles(x86)%\mcafee\common framework\scriptsubsys.dll
- %ProgramFiles(x86)%\mcafee\common framework\unicows.dll
- %ALLUSERSPROFILE%\mcafee\common framework\srpubkey.bin
- %ALLUSERSPROFILE%\mcafee\common framework\server.xml
- %ALLUSERSPROFILE%\mcafee\common framework\serverdefault.xml
- %ProgramFiles(x86)%\mcafee\common framework\secureframeworkfactory.dll
- %ALLUSERSPROFILE%\mcafee\common framework\updatemain.mcs
- %ProgramFiles(x86)%\mcafee\common framework\0409\scrptres.dll
- %ProgramFiles(x86)%\mcafee\common framework\componentsubsystem.dll
- %ProgramFiles(x86)%\mcafee\common framework\msvcp71.dll
- %WINDIR%\syswow64\msvcr71.dll
- %ProgramFiles(x86)%\mcafee\common framework\0409\agentres64.dll
- %ProgramFiles(x86)%\mcafee\common framework\agent64.dll
- %WINDIR%\syswow64\epopgpsdk.dll.sig
- %WINDIR%\syswow64\epopgpsdk.dll
- %ProgramFiles(x86)%\mcafee\common framework\msvcr71.dll
- %ProgramFiles(x86)%\mcafee\common framework\componentframeworkcallback64.dll
- %ProgramFiles(x86)%\mcafee\common framework\clientui.dll
- %ProgramFiles(x86)%\mcafee\common framework\0409\cmauires.dll
- %ProgramFiles(x86)%\mcafee\common framework\naitcpp.dll
- %CommonProgramFiles(x86)%\cisco systems\ciscotrustagent\plugins\install\naitcpp.inf
- %CommonProgramFiles(x86)%\cisco systems\ciscotrustagent\plugins\install\naitcpp.dll
- %ProgramFiles(x86)%\mcafee\common framework\cmalib.dll
- %ProgramFiles(x86)%\mcafee\common framework\applib.dll
- %WINDIR%\syswow64\msvcp71.dll
- %WINDIR%\temp\unz7d3a.tmp\userspace.dll
- %WINDIR%\temp\unz7d3a.tmp\updres.dll
- %WINDIR%\temp\unz7d3a.tmp\updplug.dll
- %TEMP%\unz6c3a.tmp\updres.dll
- %TEMP%\unz6c3a.tmp\updplug.dll
- %TEMP%\unz6c3a.tmp\udaterui.exe
- %TEMP%\unz6c3a.tmp\tchelper.dll
- %TEMP%\unz6c3a.tmp\tcsubsys.dll
- %TEMP%\unz6c3a.tmp\xmlwrap.dll
- %TEMP%\unz6c3a.tmp\updatesubsys.dll
- %TEMP%\unz6c3a.tmp\updatemain.mcs
- %TEMP%\unz6c3a.tmp\unicows.dll
- %TEMP%\unz6c3a.tmp\srpubkey.bin
- %TEMP%\unz6c3a.tmp\sitelist.xml
- %TEMP%\unz6c3a.tmp\server.xml
- %TEMP%\unz6c3a.tmp\secureframeworkfactory.dll
- %TEMP%\unz6c3a.tmp\installmain.mcs
- %TEMP%\unz6c3a.tmp\internetmanager64.dll
- %TEMP%\unz6c3a.tmp\componentsubsystem.dll
- %TEMP%\unz6c3a.tmp\componentframeworkcallback64.dll
- %TEMP%\unz6c3a.tmp\agentres64.dll
- %TEMP%\unz6c3a.tmp\agent64.dll
- %TEMP%\unz6c3a.tmp\epopgpsdk.dll.sig
- %TEMP%\unz6c3a.tmp\epopgpsdk.dll
- %TEMP%\unz6c3a.tmp\scriptsubsys.dll
- %TEMP%\unz6c3a.tmp\msvcr71.dll
- %TEMP%\unz6c3a.tmp\userspace.dll
- %TEMP%\unz6c3a.tmp\naitcpp.dll
- %TEMP%\unz6c3a.tmp\cmalib.dll
- %TEMP%\unz6c3a.tmp\applib.dll
- %TEMP%\unz6c3a.tmp\cmauires.dll
- %TEMP%\unz6c3a.tmp\clientui.dll
- %TEMP%\unz6c3a.tmp\msvcp71.dll
- %TEMP%\unz6c3a.tmp\scheduler.dll
- %TEMP%\unz6c3a.tmp\componentpolicyenforcement64.dll
- %TEMP%\unz6c3a.tmp\psapi.dll
- %TEMP%\unz6c3a.tmp\pcrplug.dll
- %TEMP%\unz6c3a.tmp\frmplugin.dll
- %TEMP%\unz6c3a.tmp\componentsubsystem64.dll
- %TEMP%\unz6c3a.tmp\cleanup.exe
- %TEMP%\unz6c3a.tmp\__temp.zip
- %TEMP%\unz6c3a.tmp\cabinet.dll
- %TEMP%\unz6c3a.tmp\agent.dll
- %TEMP%\unz6c3a.tmp\agent.ini
- %TEMP%\unz6c3a.tmp\internetmanager.dll
- %TEMP%\unz6c3a.tmp\agentplugin.dll
- %TEMP%\unz6c3a.tmp\cmdagent.exe
- %TEMP%\unz6c3a.tmp\genevtinf.dll
- %TEMP%\unz6c3a.tmp\componentuserinterface.dll
- %TEMP%\unz6c3a.tmp\frameworklog.xsl
- %TEMP%\unz6c3a.tmp\frameworkmanifest.xml
- %TEMP%\unz6c3a.tmp\frameworkservice.exe
- %TEMP%\unz6c3a.tmp\agentres.dll
- %TEMP%\unz6c3a.tmp\naitcpp.inf
- %TEMP%\unz6c3a.tmp\logging.dll
- %TEMP%\unz6c3a.tmp\nailog2.dll
- %TEMP%\unz6c3a.tmp\napolicymanager.dll
- %TEMP%\unz6c3a.tmp\patchw32.dll
- %TEMP%\unz6c3a.tmp\naisign2.dll
- %TEMP%\unz6c3a.tmp\naxml2_71.dll
- %TEMP%\unz6c3a.tmp\naspipe.dll
- %TEMP%\unz6c3a.tmp\naprdmgr.exe
- %TEMP%\unz6c3a.tmp\poevtinf.dll
- %TEMP%\unz6c3a.tmp\listenserver.dll
- %TEMP%\unz6c3a.tmp\frminst.exe
- %TEMP%\unz6c3a.tmp\nagshr32.dll
- %TEMP%\unz6c3a.tmp\nacmnlib2_71.dll
- %TEMP%\unz6c3a.tmp\mcurial.dll
- %TEMP%\unz6c3a.tmp\mcscript.exe
- %TEMP%\unz6c3a.tmp\management.dll
- %TEMP%\unz6c3a.tmp\nainet.dll
- %TEMP%\unz6c3a.tmp\scrptres.dll
- %TEMP%\unz6c3a.tmp\logging64.dll
- %WINDIR%\temp\unz7d3a.tmp\naisign2.dll
- %WINDIR%\temp\unz7d3a.tmp\nainet.dll
- %WINDIR%\temp\unz7d3a.tmp\naxml2_71.dll
- %WINDIR%\temp\unz7d3a.tmp\naspipe.dll
- %WINDIR%\temp\unz7d3a.tmp\naprdmgr.exe
- %WINDIR%\temp\unz7d3a.tmp\napolicymanager.dll
- %WINDIR%\temp\unz7d3a.tmp\nailog2.dll
- %TEMP%\unz6c3a.tmp\management64.dll
- %WINDIR%\temp\unz7d3a.tmp\patchw32.dll
- %WINDIR%\temp\unz7d3a.tmp\internetmanager.dll
- %WINDIR%\temp\unz7d3a.tmp\mcurial.dll
- %WINDIR%\temp\unz7d3a.tmp\mcscript.exe
- %WINDIR%\temp\unz7d3a.tmp\management.dll
- %WINDIR%\temp\unz7d3a.tmp\logging.dll
- %WINDIR%\temp\unz7d3a.tmp\listenserver.dll
- %WINDIR%\temp\unz7d3a.tmp\nacmnlib2_71.dll
- %WINDIR%\temp\unz7d3a.tmp\nagshr32.dll
- %WINDIR%\temp\unz7d3a.tmp\poevtinf.dll
- %WINDIR%\temp\unz7d3a.tmp\srpubkey.bin
- %WINDIR%\temp\unz7d3a.tmp\unicows.dll
- %WINDIR%\temp\unz7d3a.tmp\tchelper.dll
- %WINDIR%\temp\unz7d3a.tmp\tcsubsys.dll
- %WINDIR%\temp\unz7d3a.tmp\updatesubsys.dll
- %WINDIR%\temp\unz7d3a.tmp\installmain.mcs
- %WINDIR%\temp\unz7d3a.tmp\updatemain.mcs
- %WINDIR%\temp\unz7d3a.tmp\udaterui.exe
- %WINDIR%\temp\unz7d3a.tmp\pcrplug.dll
- %WINDIR%\temp\unz7d3a.tmp\psapi.dll
- %WINDIR%\temp\unz7d3a.tmp\server.xml
- %WINDIR%\temp\unz7d3a.tmp\secureframeworkfactory.dll
- %WINDIR%\temp\unz7d3a.tmp\scrptres.dll
- %WINDIR%\temp\unz7d3a.tmp\scriptsubsys.dll
- %WINDIR%\temp\unz7d3a.tmp\scheduler.dll
- %WINDIR%\temp\unz7d3a.tmp\sitelist.xml
- %ALLUSERSPROFILE%\mcafee\common framework\db\agent_cpwzzymvna.xml
- %WINDIR%\temp\clefad3.tmp\cleanup.exe
- %WINDIR%\temp\unz7d3a.tmp\frminst.exe
- %TEMP%\unz6c3a.tmp\nainet64.dll
- %TEMP%\unz6c3a.tmp\scheduler64.dll
- %TEMP%\unz6c3a.tmp\secureframeworkfactory64.dll
- %TEMP%\unz6c3a.tmp\applib64.dll
- %TEMP%\unz6c3a.tmp\cmalib64.dll
- %TEMP%\unz6c3a.tmp\genevtinf64.dll
- %WINDIR%\temp\unz7d3a.tmp\frmplugin.dll
- %TEMP%\unz6c3a.tmp\nacmnlib2_64.dll
- %TEMP%\unz6c3a.tmp\msvcr80.dll
- %TEMP%\unz6c3a.tmp\naprdmgr64.exe
- %TEMP%\unz6c3a.tmp\naspipe64.dll
- %TEMP%\unz6c3a.tmp\naxml2_64.dll
- %TEMP%\unz6c3a.tmp\nailog2_64.dll
- %TEMP%\unz6c3a.tmp\msvcm80.dll
- %TEMP%\unz6c3a.tmp\napolicymanager64.dll
- %WINDIR%\temp\unz7d3a.tmp\genevtinf.dll
- %TEMP%\unz6c3a.tmp\microsoft.vc80.crt.manifest
- %TEMP%\unz6c3a.tmp\mctray.exe
- %TEMP%\unz6c3a.tmp\mcscancheck.exe
- %WINDIR%\temp\unz7d3a.tmp\frameworkservice.exe
- %WINDIR%\temp\unz7d3a.tmp\frameworkmanifest.xml
- %WINDIR%\temp\unz7d3a.tmp\frameworklog.xsl
- %WINDIR%\temp\unz7d3a.tmp\componentuserinterface.dll
- %WINDIR%\temp\unz7d3a.tmp\cmdagent.exe
- %TEMP%\unz6c3a.tmp\jrmac.dll
- %WINDIR%\temp\unz7d3a.tmp\cleanup.exe
- %TEMP%\unz6c3a.tmp\msvcp80.dll
- %WINDIR%\temp\unz7d3a.tmp\agent.ini
- %WINDIR%\temp\unz7d3a.tmp\agent.dll
- %WINDIR%\temp\unz7d3a.tmp\cabinet.dll
- %WINDIR%\temp\unz7d3a.tmp\__temp.zip
- %TEMP%\unz6c3a.tmp\framepkg.exe
- %WINDIR%\temp\unz7d3a.tmp\agentres.dll
- %TEMP%\nailogs\updaterui_cpwzzymvna.log
Deletes the following files
- %ALLUSERSPROFILE%\mcafee\common framework\precompiled.xml
Miscellaneous
Searches for the following windows
- ClassName: 'McAfee_FrameworkServiceClass' WindowName: ''
Creates and executes the following
- '%TEMP%\unz6c3a.tmp\frminst.exe' /LOGDIR="%TEMP%\NAILogs" /Cleanup2="%TEMP%\unz6C3A.tmp" /EmbeddedUsername="" /EmbeddedDomain="" /EmbeddedPassword="" /Install=Agent /OriginalCmdLine="|<Full path to file>| "
- '%TEMP%\unz6c3a.tmp\framepkg.exe' /SignalComplete /LOGDIR="%TEMP%\NAILogs" /Cleanup2="%TEMP%\unz6C3A.tmp" /WaitFor=3584 /CurrentFolder="<Current directory>" /Install=Agent /OriginalCmdLine="|<Full path to file>| "
- '%WINDIR%\temp\unz7d3a.tmp\frminst.exe' /LOGDIR="%TEMP%\NAILogs" /Cleanup2="%TEMP%\unz6C3A.tmp" /WaitFor=3584 /CurrentFolder="<Current directory>" /Install=Agent /OriginalCmdLine="|<Full path to file>| " /FramePkg /Cleanup="%WINDIR%\...
- '%ProgramFiles(x86)%\mcafee\common framework\frameworkservice.exe'
- '%ProgramFiles(x86)%\mcafee\common framework\naprdmgr.exe'
- '%ProgramFiles(x86)%\mcafee\common framework\udaterui.exe'
- '%ProgramFiles(x86)%\mcafee\common framework\naprdmgr64.exe'
- '%ProgramFiles(x86)%\mcafee\common framework\frameworkservice.exe' /ServiceStart
- '%ProgramFiles(x86)%\mcafee\common framework\naprdmgr.exe' -Embedding
- '%WINDIR%\temp\clefad3.tmp\cleanup.exe' 3584 /LOGDIR="%TEMP%\NAILogs" "%WINDIR%\TEMP\unz7D3A.tmp" "%TEMP%\unz6C3A.tmp"
- '%ProgramFiles(x86)%\mcafee\common framework\udaterui.exe' /EventName=UPDATER_UI_EVENT101b2d
- '%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq explorer.exe" /FO CSV /NH' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /u /s "%WINDIR%\SysWOW64\atl.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\Agent64.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\ComponentSubSystem64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\ComponentSubSystem64.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\InternetManager64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\InternetManager64.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\Logging64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\Logging64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\Management64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\naPolicyManager64.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\Scheduler64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\Scheduler64.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\SecureFrameworkFactory64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\SecureFrameworkFactory64.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\GenEvtInf64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\GenEvtInf64.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\naPolicyManager64.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\Agent64.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\Management64.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\ComponentSubSystem.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\Logging.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\SysWOW64\atl.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\Agent.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\AgentPlugin.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\ComponentUserInterface.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\GenEvtInf.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\InternetManager.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\ListenServer.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\Management.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\UpdPlug.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\naPolicyManager.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\Scheduler.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\ScriptSubSys.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\SecureFrameworkFactory.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\UpdateSubSys.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\TCSubSys.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\TCHelper.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\McAfee\Common Framework\UserSpace.dll"
- '%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq explorer.exe" /FO CSV /NH
