PUA.Win32.DriverUpdater.AM
Windows
Tipo de malware
Potentially Unwanted Application
Destructivo?
No
Cifrado
In the Wild:
Sí
Resumen y descripción
It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Elimina archivos para impedir la ejecución correcta de programas y aplicaciones.
Detalles técnicos
Detalles de entrada
It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Instalación
Agrega los procesos siguientes:
- "%User Temp%\is-UTKTV.tmp\10033863f6a3a984e467c73213bd979bcf168bf5.tmp" /SL5="$3015E,1825371,139264,{malware file path and name}"
- taskkill.exe /f /im DriverUpdaterM.exe
- "schtasks" /Create /F /SC HOURLY /MO 3 /TN "dupVersionUpdate" /RL HIGHEST /TR "\"%Program Files%\Monterix\Driver Updater\DriverUpdaterM.exe\" /checkupdates
- "powershell" -Command "Set-ScheduledTask -TaskName 'dupVersionUpdate' -Trigger (New-JobTrigger -AtLogon -RandomDelay 00:10:00),(New-JobTrigger -Once -RepetitionInterval 03:00:00 -RepeatIndefinitely -At (Get-Date))"
- "schtasks" /Run /TN "dupVersionUpdate"
- http://www.{BLOCKED}updater.software/install/00000000/
- "%Program Files%\Monterix\Driver Updater\DriverUpdaterM.exe" /as /waitpar
- "%User Temp%\is-N9I5I.tmp\PCCleanerInst_00000000.exe" /VERYSILENT /DENYINSP /INSTOFFERRUN
- "%Program Files%\Internet Explorer\IEXPLORE.EXE" SCODEF:2324 CREDAT:275457 /prefetch:2
- "%User Temp%\is-5KF0L.tmp\PCCleanerInst_00000000.tmp" /SL5="$50206,3142640,139264,%User Temp%\is-N9I5I.tmp\PCCleanerInst_00000000.exe" /VERYSILENT /DENYINSP /INSTOFFERRUN
- taskkill.exe /f /im PCCleanerM.exe
- "schtasks" /Create /F /SC HOURLY /MO 3 /TN "skpVersionUpdate" /RL HIGHEST /TR "\"%Program Files%\Monterix\PC Cleaner\PCCleanerM.exe\" /checkupdates
- "powershell" -Command "Set-ScheduledTask -TaskName 'skpVersionUpdate' -Trigger (New-JobTrigger -AtLogon -RandomDelay 00:10:00),(New-JobTrigger -Once -RepetitionInterval 03:00:00 -RepeatIndefinitely -At (Get-Date))"
- "%Program Files%\Monterix\PC Cleaner\PCCleanerM.exe" /ot /ofr /as /waitpar
Crea las carpetas siguientes:
- %User Temp%\dup
- %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Active
- %User Temp%\is-EH2GG.tmp\_isetup
- %User Temp%\skp
- %Program Files%\Monterix
- %Application Data%\Microsoft\Windows\IECompatUACache
- %Program Files%\Monterix\PC Cleaner
- %Program Files%\Monterix\Driver Updater
- %Application Data%\Microsoft\Windows\IECompatCache
- %Application Data%\Microsoft\Windows\DNTException
- %Application Data%\Microsoft\Windows\PrivacIE
- %User Temp%\is-N9I5I.tmp\_isetup
- %Application Data%\skp
(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).
. %Program Files% es la carpeta Archivos de programa predeterminada, que suele estar en C:\Archivos de programa).. %Application Data% es la carpeta Application Data del usuario activo, que en el caso de Windows 98 y ME suele estar ubicada en C:\Windows\Profiles\{nombre de usuario}\Application Data, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Application Data, en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) en C:\Documents and Settings\{nombre de usuario}\Local Settings\Application Data y en el caso de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Roaming.).)Otras modificaciones del sistema
Elimina los archivos siguientes:
- %System Root%\Users\Public\Desktop\PC Cleaner.url
- %Start Menu%\Driver Updater.url
- %System Root%\Users\Public\Desktop\Driver Updater.pif
- %System Root%\Users\Public\Desktop\PC Cleaner.pif
- %System Root%\Users\Public\Desktop\Driver Updater.url
- %Start Menu%\PC Cleaner.pif
- %Start Menu%\PC Cleaner.url
- %Start Menu%\Driver Updater.pif
(Nota: %System Root% es la carpeta raíz, normalmente C:\. También es la ubicación del sistema operativo).
. %Start Menu% es la carpeta Menú Inicio del usuario activo, que en el caso de Windows 98 y ME suele estar ubicada en C:\Windows\Profiles\{nombre de usuario}\Menú Inicio, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Menú Inicio, en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) en C:\Documents and Settings\{nombre de usuario}\Menú Inicio en el caso de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Roaming\Microsoft\Windows\Start Menu).)Agrega las siguientes entradas de registro:
HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
Owner = "d\x01\x00\x00\x8a\xb4\xa1\x9ca\xd5\x01"
HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
SessionHash = "{random characters}"
HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
Sequence = "1"
HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
RegFiles0000 = "\x00"
HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
RegFilesHash = "{random characters}"
HKEY_CURRENT_USER\Software\Monterix\
DriverUpdaterEx
Partner = "00000000"
HKEY_CURRENT_USER\Software\Monterix\
DriverUpdaterEx
AffSubId = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
Inno Setup: Setup Version = "5.5.9 (u)"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
Inno Setup: App Path = "%Program Files%\Monterix\Driver Updater"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
InstallLocation = "%Program Files%\Monterix\Driver Updater"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
Inno Setup: Icon Group = "Monterix\Driver Updater"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
Inno Setup: User = "{username}"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
Inno Setup: Language = "english"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
DisplayName = "Driver Updater"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
DisplayIcon = "%Program Files%\Monterix\Driver Updater\unins000.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
UninstallString = "%Program Files%\Monterix\Driver Updater\unins000.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
QuietUninstallString = "%Program Files%\Monterix\Driver Updater\unins000.exe /SILENT"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
DisplayVersion = "11.2.0.64"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
Publisher = "Monterix Software LLC"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
URLInfoAbout = "http://www.{BLOCKED}updater.software"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
HelpLink = "http://www.{BLOCKED}updater.software"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
URLUpdateInfo = "http://www.{BLOCKED}updater.software"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
NoModify = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
NoRepair = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
InstallDate = "20190902"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
MajorVersion = "11"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
MinorVersion = "2"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
VersionMajor = "11"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
VersionMinor = "2"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
EstimatedSize = "7328"
HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
Owner = "\x8c\x03\x00\x00WDS\xb1\x9ca\xd5\x01"
HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
SessionHash = "8G}\x8f2\xd6z\xba\xf5\xcedTU\xafU/\x04\xd4yTk\xe9\xe5\xce\x1a\xd14\xd9\x95S\x92"
HKEY_CURRENT_USER\Software\Monterix\
SystemKeeperEx
Partner = "00000000"
HKEY_CURRENT_USER\Software\Monterix\
SystemKeeperEx
AffSubId = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
Inno Setup: Setup Version = "5.5.9 (u)"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
Inno Setup: App Path = "%Program Files%\Monterix\PC Cleaner"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
InstallLocation = "%Program Files%\Monterix\PC Cleaner"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
Inno Setup: Icon Group = "Monterix\PC Cleaner"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
Inno Setup: User = "{username}"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
Inno Setup: Language = "english"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
DisplayName = "PC Cleaner"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
DisplayIcon = "%Program Files%\Monterix\PC Cleaner\unins000.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
UninstallString = "%Program Files%\Monterix\PC Cleaner\unins000.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
QuietUninstallString = "%Program Files%\Monterix\PC Cleaner\unins000.exe /SILENT"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
DisplayVersion = "12.4.0.18"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
Publisher = "Monterix Software LLC"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
URLInfoAbout = "http://www.{BLOCKED}ner.software"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
HelpLink = "http://www.{BLOCKED}ner.software"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
URLUpdateInfo = "http://www.{BLOCKED}ner.software"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
NoModify = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
NoRepair = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
InstallDate = "20190902"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
MajorVersion = "12"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
MinorVersion = "4"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
VersionMajor = "12"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
VersionMinor = "4"
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
EstimatedSize = "10688"
Elimina las siguientes claves de registro:
HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000\RegFilesHash
HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000\RegFiles0000
HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000\Sequence
HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000\SessionHash
HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000\Owner
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Ext\
Settings\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\NewInstallPromptCount
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Ext\
Settings\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\CompatBlockPromptCount
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Ext\
Settings\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NewInstallPromptCount
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Ext\
Settings\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\CompatBlockPromptCount
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Ext\
Settings\{DBC80044-A445-435B-BC74-9C25C1C588A9}\NewInstallPromptCount
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Ext\
Settings\{DBC80044-A445-435B-BC74-9C25C1C588A9}\CompatBlockPromptCount
Rutina de infiltración
Infiltra los archivos siguientes:
- %Program Files%\Monterix\PC Cleaner\unins000.dat
- %Program Files%\Monterix\PC Cleaner\is-4MIQO.tmp
- %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EB349DC8-CD8F-11E9-B7A0-005056BC5B9B}.dat
- %Program Files%\Monterix\Driver Updater\unins000.dat
- %Start Menu%\Driver Updater.lnk
- %Start Menu%\PC Cleaner.lnk
- %User Temp%\is-EH2GG.tmp\offer_ico.bmp
- %Program Files%\Monterix\Driver Updater\is-2SJHU.tmp
- %Program Files%\Monterix\Driver Updater\unins000.msg
- %Program Files%\Monterix\Driver Updater\is-6KPL8.tmp
- %Program Files%\Monterix\PC Cleaner\is-NJIVC.tmp
- %User Temp%\is-N9I5I.tmp\offer_ico.bmp
- %Program Files%\Monterix\PC Cleaner\unins000.msg
- %Program Files%\Monterix\Driver Updater\DriverUpdaterM.exe
- %Program Files%\Monterix\PC Cleaner\aff.txt
- %Program Files%\Monterix\PC Cleaner\PCCleanerM.exe
- %Program Files%\Monterix\PC Cleaner\is-CAA4L.tmp
- %Program Files%\Monterix\Driver Updater\unins000.exe
- %User Temp%\is-N9I5I.tmp\PCCleanerInst_00000000.exe
- %Program Files%\Monterix\Driver Updater\aff.txt
- %Program Files%\Monterix\Driver Updater\is-5QOBV.tmp
- %System Root%\Users\Public\Desktop\Driver Updater.lnk
- %Program Files%\Monterix\PC Cleaner\unins000.exe
- %System Root%\Users\Public\Desktop\PC Cleaner.lnk
(Nota: %Program Files% es la carpeta Archivos de programa predeterminada, que suele estar en C:\Archivos de programa).
. %Start Menu% es la carpeta Menú Inicio del usuario activo, que en el caso de Windows 98 y ME suele estar ubicada en C:\Windows\Profiles\{nombre de usuario}\Menú Inicio, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Menú Inicio, en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) en C:\Documents and Settings\{nombre de usuario}\Menú Inicio en el caso de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Roaming\Microsoft\Windows\Start Menu).. %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).. %System Root% es la carpeta raíz, normalmente C:\. También es la ubicación del sistema operativo).)Otros detalles
It connects to the following possibly malicious URL:
- http://dl.{BLOCKED}ner.software/distr/skp/00000000/PCCleanerInst_00000000.exe
- http://{BLOCKED}s.com/rt/capi/getvers?{random characters}
- http://go.{BLOCKED}oft.com
- http://www.{BLOCKED}updater.software
Soluciones
Step 1
Los usuarios de Windows ME y XP, antes de llevar a cabo cualquier exploración, deben comprobar que tienen desactivada la opción Restaurar sistema para permitir la exploración completa del equipo.
Step 2
Identificar y terminar los archivos detectados como PUA.Win32.DriverUpdater.AM
- Para los usuarios de Windows 98 y ME, puede que el Administrador de tareas de Windows no muestre todos los procesos en ejecución. En tal caso, utilice un visor de procesos de una tercera parte (preferiblemente, el Explorador de procesos) para terminar el archivo de malware/grayware/spyware. Puede descargar la herramienta en cuestión aquí.
- Si el archivo detectado aparece en el Administrador de tareas o en el Explorador de procesos, pero no puede eliminarlo, reinicie el equipo en modo seguro. Para ello, consulte este enlace para obtener todos los pasos necesarios.
- Si el archivo detectado no se muestra en el Administrador de tareas o el Explorador de procesos, prosiga con los pasos que se indican a continuación.
Step 3
Eliminar este valor del Registro
Importante: si modifica el Registro de Windows incorrectamente, podría hacer que el sistema funcione mal de manera irreversible. Lleve a cabo este paso solo si sabe cómo hacerlo o si puede contar con ayuda de su administrador del sistema. De lo contrario, lea este artículo de Microsoft antes de modificar el Registro del equipo.
- In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
- Owner = "d\x01\x00\x00\x8a\xb4\xa1\x9ca\xd5\x01"
- In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
- SessionHash = "{random characters}"
- In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
- Sequence = "1"
- In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
- RegFiles0000 = "\x00"
- In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
- RegFilesHash = "{random characters}"
- In HKEY_CURRENT_USER\Software\Monterix\DriverUpdaterEx
- Partner = "00000000"
- In HKEY_CURRENT_USER\Software\Monterix\DriverUpdaterEx
- AffSubId = ""
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
- Inno Setup: Setup Version = "5.5.9 (u)"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
- Inno Setup: App Path = "%Program Files%\Monterix\Driver Updater"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
- InstallLocation = "%Program Files%\Monterix\Driver Updater"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
- Inno Setup: Icon Group = "Monterix\Driver Updater"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
- Inno Setup: User = "{username}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
- Inno Setup: Language = "english"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
- DisplayName = "Driver Updater"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
- DisplayIcon = "%Program Files%\Monterix\Driver Updater\unins000.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
- UninstallString = "%Program Files%\Monterix\Driver Updater\unins000.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
- QuietUninstallString = "%Program Files%\Monterix\Driver Updater\unins000.exe /SILENT"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
- DisplayVersion = "11.2.0.64"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
- Publisher = "Monterix Software LLC"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
- URLInfoAbout = "http://www.{BLOCKED}updater.software"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
- HelpLink = "http://www.{BLOCKED}updater.software"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
- URLUpdateInfo = "http://www.{BLOCKED}updater.software"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
- NoModify = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
- NoRepair = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
- InstallDate = "20190902"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
- MajorVersion = "11"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
- MinorVersion = "2"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
- VersionMajor = "11"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
- VersionMinor = "2"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2329B0B1-00B8-459B-9F68-66831E4FFF47}_is1
- EstimatedSize = "7328"
- In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
- Owner = "\x8c\x03\x00\x00WDS\xb1\x9ca\xd5\x01"
- In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
- SessionHash = "8G}\x8f2\xd6z\xba\xf5\xcedTU\xafU/\x04\xd4yTk\xe9\xe5\xce\x1a\xd14\xd9\x95S\x92"
- In HKEY_CURRENT_USER\Software\Monterix\SystemKeeperEx
- Partner = "00000000"
- In HKEY_CURRENT_USER\Software\Monterix\SystemKeeperEx
- AffSubId = ""
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
- Inno Setup: Setup Version = "5.5.9 (u)"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
- Inno Setup: App Path = "%Program Files%\Monterix\PC Cleaner"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
- InstallLocation = "%Program Files%\Monterix\PC Cleaner"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
- Inno Setup: Icon Group = "Monterix\PC Cleaner"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
- Inno Setup: User = "{username}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
- Inno Setup: Language = "english"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
- DisplayName = "PC Cleaner"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
- DisplayIcon = "%Program Files%\Monterix\PC Cleaner\unins000.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
- UninstallString = "%Program Files%\Monterix\PC Cleaner\unins000.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
- QuietUninstallString = "%Program Files%\Monterix\PC Cleaner\unins000.exe /SILENT"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
- DisplayVersion = "12.4.0.18"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
- Publisher = "Monterix Software LLC"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
- URLInfoAbout = "http://www.{BLOCKED}ner.software"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
- HelpLink = "http://www.{BLOCKED}ner.software"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
- URLUpdateInfo = "http://www.{BLOCKED}ner.software"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
- NoModify = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
- NoRepair = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
- InstallDate = "20190902"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
- MajorVersion = "12"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
- MinorVersion = "4"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
- VersionMajor = "12"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
- VersionMinor = "4"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE5D9FC-B286-4C02-B5DA-B14E26EFC9A6}_is1
- EstimatedSize = "10688"
Step 4
Buscar y eliminar estos archivos
- %Program Files%\Monterix\PC Cleaner\unins000.dat
- %Program Files%\Monterix\PC Cleaner\is-4MIQO.tmp
- %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EB349DC8-CD8F-11E9-B7A0-005056BC5B9B}.dat
- %Program Files%\Monterix\Driver Updater\unins000.dat
- %Start Menu%\Driver Updater.lnk
- %Start Menu%\PC Cleaner.lnk
- %User Temp%\is-EH2GG.tmp\offer_ico.bmp
- %Program Files%\Monterix\Driver Updater\is-2SJHU.tmp
- %Program Files%\Monterix\Driver Updater\unins000.msg
- %Program Files%\Monterix\Driver Updater\is-6KPL8.tmp
- %Program Files%\Monterix\PC Cleaner\is-NJIVC.tmp
- %User Temp%\is-N9I5I.tmp\offer_ico.bmp
- %Program Files%\Monterix\PC Cleaner\unins000.msg
- %Program Files%\Monterix\Driver Updater\DriverUpdaterM.exe
- %Program Files%\Monterix\PC Cleaner\aff.txt
- %Program Files%\Monterix\PC Cleaner\PCCleanerM.exe
- %Program Files%\Monterix\PC Cleaner\is-CAA4L.tmp
- %Program Files%\Monterix\Driver Updater\unins000.exe
- %User Temp%\is-N9I5I.tmp\PCCleanerInst_00000000.exe
- %Program Files%\Monterix\Driver Updater\aff.txt
- %Program Files%\Monterix\Driver Updater\is-5QOBV.tmp
- %System Root%\Users\Public\Desktop\Driver Updater.lnk
- %Program Files%\Monterix\PC Cleaner\unins000.exe
- %System Root%\Users\Public\Desktop\PC Cleaner.lnk
Step 5
Buscar y eliminar estas carpetas
- %User Temp%\dup
- %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Active
- %User Temp%\is-EH2GG.tmp\_isetup
- %User Temp%\skp
- %Program Files%\Monterix
- %Application Data%\Microsoft\Windows\IECompatUACache
- %Program Files%\Monterix\PC Cleaner
- %Program Files%\Monterix\Driver Updater
- %Application Data%\Microsoft\Windows\IECompatCache
- %Application Data%\Microsoft\Windows\DNTException
- %Application Data%\Microsoft\Windows\PrivacIE
- %User Temp%\is-N9I5I.tmp\_isetup
- %Application Data%\skp
Step 6
Explorar el equipo con su producto de Trend Micro para eliminar los archivos detectados como PUA.Win32.DriverUpdater.AM En caso de que el producto de Trend Micro ya haya limpiado, eliminado o puesto en cuarentena los archivos detectados, no serán necesarios más pasos. Puede optar simplemente por eliminar los archivos en cuarentena. Consulte esta página de Base de conocimientos para obtener más información.
Step 7
Restore this file from backup only Microsoft-related files will be restored. If this malware/grayware also deleted files related to programs that are not from Microsoft, please reinstall those programs on you computer again.
- %System Root%\Users\Public\Desktop\PC Cleaner.url
- %Start Menu%\Driver Updater.url
- %System Root%\Users\Public\Desktop\Driver Updater.pif
- %System Root%\Users\Public\Desktop\PC Cleaner.pif
- %System Root%\Users\Public\Desktop\Driver Updater.url
- %Start Menu%\PC Cleaner.pif
- %Start Menu%\PC Cleaner.url
- %Start Menu%\Driver Updater.pif
Step 8
Restore these deleted registry keys/values from backup
*Note: Only Microsoft-related keys/values will be restored. If the malware/grayware also deleted registry keys/values related to programs that are not from Microsoft, please reinstall those programs on your computer.
- In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
- RegFilesHash
- In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
- RegFiles0000
- In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
- Sequence
- In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
- SessionHash
- In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
- Owner
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}
- NewInstallPromptCount
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}
- CompatBlockPromptCount
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
- NewInstallPromptCount
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
- CompatBlockPromptCount
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DBC80044-A445-435B-BC74-9C25C1C588A9}
- NewInstallPromptCount
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DBC80044-A445-435B-BC74-9C25C1C588A9}
- CompatBlockPromptCount
Rellene nuestra encuesta!