Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\amwrtdrv] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\amwrtdrv] 'ImagePath' = '<SYSTEM32>\amwrtdrv.sys'
Modifies file system:
Creates the following files:
- %TEMP%\2k10\A_BackUpper\2Gpt_BCD
- %TEMP%\2k10\A_BackUpper\msvcm90.dll
- %TEMP%\2k10\A_BackUpper\msvcm80.dll
- %TEMP%\2k10\A_BackUpper\mfcm80u.dll
- %TEMP%\2k10\A_BackUpper\mfcm80.dll
- %TEMP%\2k10\A_BackUpper\mfc80u.dll
- %TEMP%\2k10\A_BackUpper\mfc80.dll
- %TEMP%\2k10\A_BackUpper\MakeDisc.exe
- %TEMP%\2k10\A_BackUpper\LoadDrv.exe
- %TEMP%\2k10\A_BackUpper\libeay32.dll
- %TEMP%\2k10\A_BackUpper\Ldm.dll
- %TEMP%\2k10\A_BackUpper\ImgFile.dll
- %TEMP%\2k10\A_BackUpper\GptBcd.dll
- %TEMP%\2k10\A_BackUpper\FuncLogic.dll
- %TEMP%\2k10\A_BackUpper\FlBackup.dll
- %TEMP%\2k10\A_BackUpper\EnumFolder.dll
- %TEMP%\2k10\A_BackUpper\Encrypt.dll
- %TEMP%\2k10\A_BackUpper\driver\LoadDrv_x64.exe
- %TEMP%\2k10\A_BackUpper\msvcp80.dll
- %TEMP%\2k10\A_BackUpper\msvcr80.dll
- %TEMP%\2k10\A_BackUpper\vss.dll
- %TEMP%\2k10\A_BackUpper\msvcr90.dll
- %TEMP%\2k10\A_BackUpper\vcomp.dll
- %TEMP%\2k10\A_BackUpper\ValidCheck.exe
- %TEMP%\2k10\A_BackUpper\UiLogic.dll
- %TEMP%\2k10\A_BackUpper\TipInfo.exe
- %TEMP%\2k10\A_BackUpper\TFTP.dll
- %TEMP%\2k10\A_BackUpper\Sync.dll
- %TEMP%\2k10\A_BackUpper\ssleay32.dll
- %TEMP%\2k10\A_BackUpper\ShowPage.exe
- %TEMP%\2k10\A_BackUpper\SFX-Exec.exe
- %TEMP%\2k10\A_BackUpper\QtXml4.dll
- %TEMP%\2k10\A_BackUpper\QtGui4.dll
- %TEMP%\2k10\A_BackUpper\QtCore4.dll
- %TEMP%\2k10\A_BackUpper\PxeUi.exe
- %TEMP%\2k10\A_BackUpper\plugins\imageformats\qgif4.dll
- %TEMP%\2k10\A_BackUpper\PeLoadDrv.exe
- %TEMP%\2k10\A_BackUpper\PE.dll
- %TEMP%\2k10\A_BackUpper\NotDPIAware.dll
- %TEMP%\2k10\A_BackUpper\driver\LoadDrv_Win32.exe
- %TEMP%\2k10\A_BackUpper\msvcp90.dll
- %TEMP%\2k10\A_BackUpper\driver\i386\msahci.sys
- %TEMP%\2k10\A_BackUpper\Backup.dll
- %TEMP%\2k10\A_BackUpper\Version.ini
- %TEMP%\2k10\A_BackUpper\UserManual.pdf
- %TEMP%\2k10\A_BackUpper\other.ini
- %TEMP%\2k10\A_BackUpper\Microsoft.VC90.CRT.manifest
- %TEMP%\2k10\A_BackUpper\Microsoft.VC80.OpenMP.manifest
- %TEMP%\2k10\A_BackUpper\Microsoft.VC80.MFC.manifest
- %TEMP%\2k10\A_BackUpper\Microsoft.VC80.CRT.manifest
- %TEMP%\2k10\A_BackUpper\lang\fr.txt
- %TEMP%\2k10\A_BackUpper\lang\en.txt
- %TEMP%\2k10\A_BackUpper\Dev.dat
- %TEMP%\2k10\A_BackUpper\Crash.dmp
- %TEMP%\2k10\A_BackUpper\Color.xml
- %TEMP%\2k10\A_BackUpper\cfg.ini
- %TEMP%\2k10\A_BackUpper\BackupRecovery.ini
- %TEMP%\2k10\A_BackUpper\amldr.mbr
- %TEMP%\2k10\A_BackUpper\amldr
- %TEMP%\2k10\A_BackUpper\2Mbr_BCD
- %TEMP%\2k10\A_BackUpper\AmCore.dll
- %TEMP%\2k10\A_BackUpper\Backupper.exe
- %TEMP%\2k10\A_BackUpper\driver\i386\ammntdrv.sys
- %TEMP%\2k10\A_BackUpper\botva2.dll
- %TEMP%\2k10\A_BackUpper\driver\i386\ambakdrv.sys
- %TEMP%\2k10\A_BackUpper\driver\amd64\msahci.sys
- %TEMP%\2k10\A_BackUpper\driver\amd64\amwrtdrv.sys
- %TEMP%\2k10\A_BackUpper\driver\amd64\ammntdrv.sys
- %TEMP%\2k10\A_BackUpper\driver\amd64\ambakdrv.sys
- %TEMP%\2k10\A_BackUpper\Download.dll
- %TEMP%\2k10\A_BackUpper\DiskMgr.dll
- %TEMP%\2k10\A_BackUpper\DeviceMgr.dll
- %TEMP%\2k10\A_BackUpper\Device.dll
- %TEMP%\2k10\A_BackUpper\Compress.dll
- %TEMP%\2k10\A_BackUpper\Comn.dll
- %TEMP%\2k10\A_BackUpper\Clone.dll
- %TEMP%\2k10\A_BackUpper\CallbackCtrl.dll
- %TEMP%\2k10\A_BackUpper\BrVol.dll
- %TEMP%\2k10\A_BackUpper\BrNtfs.dll
- %TEMP%\2k10\A_BackUpper\BrLog.dll
- %TEMP%\2k10\A_BackUpper\BrFat.dll
- %TEMP%\2k10\A_BackUpper\driver\i386\amwrtdrv.sys
- %TEMP%\2k10\A_BackUpper\vsscom.exe
Deletes the following files:
- %TEMP%\2k10\A_BackUpper\Color.xml
Substitutes the following files:
- %TEMP%\2k10\A_BackUpper\Color.xml
Miscellaneous:
Creates and executes the following:
- '%TEMP%\2k10\A_BackUpper\LoadDrv.exe'
- '%TEMP%\2k10\A_BackUpper\Backupper.exe'
