PUA_MYPCBACKUP.GC

This Potentially Unwanted Application may arrive bundled with malware packages as a malware component. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be manually installed by a user.

Arrival Details

This Potentially Unwanted Application may arrive bundled with malware packages as a malware component.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be manually installed by a user.

Installation

This Potentially Unwanted Application adds the following folders:

• %Program Files%\MyPC Backup

(Note: %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.)

It drops the following file(s)/component(s):

• %Program Files%\MyPC Backup\AlphaVSS.51.x86.dll
• %Program Files%\MyPC Backup\AlphaVSS.52.x64.dll
• %Program Files%\MyPC Backup\AlphaVSS.52.x86.dll
• %Program Files%\MyPC Backup\AlphaVSS.60.x64.dll
• %Program Files%\MyPC Backup\AlphaVSS.60.x86.dll
• %Program Files%\MyPC Backup\AlphaVSS.Common.dll
• %Program Files%\MyPC Backup\LogicNP.EZShellExtensions.dll
• %Program Files%\MyPC Backup\RegisterExtensionDotNet20_x64.exe
• %Program Files%\MyPC Backup\RegisterExtensionDotNet20_x86.exe
• %Program Files%\MyPC Backup\Configuration Updater.exe
• %Program Files%\MyPC Backup\RestartExplorer.exe
• %Program Files%\MyPC Backup\syncicon.ico
• %Program Files%\MyPC Backup\syncing.ico
• %Program Files%\MyPC Backup\tick.ico
• %Program Files%\MyPC Backup\x64\System.Data.SQLite.dll
• %Program Files%\MyPC Backup\x86\System.Data.SQLite.dll
• %Program Files%\MyPC Backup\BackupStack.exe
• %Program Files%\MyPC Backup\MPCBClient.dll
• %Program Files%\MyPC Backup\AWSSDK.dll
• %Program Files%\MyPC Backup\MPCBContextMenu.dll
• %Program Files%\MyPC Backup\MPCBIconOverlays.dll
• %Program Files%\MyPC Backup\Service Start.exe
• %Program Files%\MyPC Backup\Shared Stack.dll
• %Program Files%\MyPC Backup\Signup Wizard.exe
• %Program Files%\MyPC Backup\UnRegisterExtensions.exe
• %Program Files%\MyPC Backup\Updater.exe
• %Program Files%\MyPC Backup\MyPC Backup.exe
• %Program Files%\MyPC Backup\mypcbackup.ico
• %Program Files%\MyPC Backup\diffstack.dll
• %Program Files%\MyPC Backup\Crypto32.dll
• %Program Files%\MyPC Backup\Crypto64.dll
• %Program Files%\MyPC Backup\GetText.dll
• %Program Files%\MyPC Backup\fr_FR.mo
• %Program Files%\MyPC Backup\de_DE.mo
• %Program Files%\MyPC Backup\it_IT.mo
• %Program Files%\MyPC Backup\es_ES.mo
• %Program Files%\MyPC Backup\pt_PT.mo
• %Program Files%\MyPC Backup\Database\mpcb_backup_conf.db
• %Program Files%\MyPC Backup\Database\mpcb_file_cache.db
• %Program Files%\MyPC Backup\Database\mpcb_queues.db
• %Program Files%\MyPC Backup\Database\mpcb_settings.db
• %Program Files%\MyPC Backup\Database\mpcb_sig_cache.db
• %Program Files%\MyPC Backup\uninst.exe
• %Start Menu%\Programs\MyPC Backup\MyPC Backup.lnk
• %Desktop%\MyPC Backup.lnk
• %User Startup%\MyPC Backup.lnk
• %Start Menu%\Programs\MyPC Backup\Uninstall.lnk

(Note: %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %Start Menu% is the Start Menu folder, where it usually is C:\Documents and Settings\{user name}\Start Menu on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Startup% is the current user's Startup folder, which is usually C:\Documents and Settings\{user}\Start Menu\Programs\Startup on Windows 2000 and XP, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows Vista, 7, and 8.)

Other System Modifications

This Potentially Unwanted Application adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
MyPC Backup

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
MyPC Backup
DisplayName = "MyPC Backup"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
MyPC Backup
UninstallString = "%Program Files%\MyPC Backup\uninst.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
MyPC Backup
DisplayIcon = "%Program Files%\MyPC Backup\MyPC Backup.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
MyPC Backup
DisplayVersion = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
MyPC Backup
URLInfoAbout = {URL}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
MyPC Backup
Publisher = MyPC Backup

Other Details

This Potentially Unwanted Application connects to the following possibly malicious URL:

• http://track.{BLOCKED}ckup.com/aadebc4830c51c2794a960fe5a9e11df.php