Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\gdihook5] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\Client32] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\PCISys] 'Start' = '00000001'
- '%PROGRAM_FILES%\NetSupport Manager\checkdvd.exe'
- '%PROGRAM_FILES%\NetSupport Manager\WINSTALL.EXE' /EA /EX /EC /Q /R"C:\TEMP" /V /Q /I *
- 'C:\TEMP\setup.exe' /s /m=SILENT.TXT
- '%PROGRAM_FILES%\NetSupport Manager\WINSTALL.EXE' /EC /Q /Q /R"C:\TEMP"
- %PROGRAM_FILES%\NetSupport Manager\~GLH0021.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH0020.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH001e.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH0022.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH0025.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH0024.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH0023.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH0019.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH0018.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH0017.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH001a.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH001d.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH001c.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH001b.TMP
- <SYSTEM32>\pcisys.ntk
- <SYSTEM32>\tempfile.$$$
- <SYSTEM32>\pcivdd.dll
- %WINDIR%\inf\oem3.inf
- <SYSTEM32>\SET9.tmp
- <DRIVERS>\SET8.tmp
- %WINDIR%\inf\oem3.PNF
- <SYSTEM32>\clhook4.dll
- %PROGRAM_FILES%\NetSupport Manager\~GLH0028.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH0026.TMP
- <SYSTEM32>\pcigina.dll
- <SYSTEM32>\pcimon.dll
- <DRIVERS>\pcisys.sys
- <SYSTEM32>\pcimsg.dll
- %PROGRAM_FILES%\NetSupport Manager\~GLH0016.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH0003.TMP
- %TEMP%\~GLH0002.TMP
- %TEMP%\~GLH0001.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH0004.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH0007.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH0006.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH0005.TMP
- C:\TEMP\Client32.ini
- C:\TEMP\SILENT.TXT
- C:\TEMP\setup.exe
- C:\TEMP\nsm.lic
- %TEMP%\~GLH0000.TMP
- %TEMP%\GLG3.tmp
- %TEMP%\GLC1.tmp
- %PROGRAM_FILES%\NetSupport Manager\~GLH0011.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH0010.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH000f.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH0012.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH0015.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH0014.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH0013.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH000a.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH0009.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH0008.TMP
- %PROGRAM_FILES%\NetSupport Manager\temp.000
- %PROGRAM_FILES%\NetSupport Manager\~GLH000e.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH000d.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH000c.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH0026.TMP
- %PROGRAM_FILES%\NetSupport Manager\checkdvd.exe
- %PROGRAM_FILES%\NetSupport Manager\~GLH000a.TMP
- %PROGRAM_FILES%\NetSupport Manager\~GLH001e.TMP
- from %PROGRAM_FILES%\NetSupport Manager\~GLH001c.TMP to %PROGRAM_FILES%\NetSupport Manager\gdihook5.sys
- from %PROGRAM_FILES%\NetSupport Manager\~GLH001b.TMP to %PROGRAM_FILES%\NetSupport Manager\gdihook5.inf
- from %PROGRAM_FILES%\NetSupport Manager\~GLH001d.TMP to %PROGRAM_FILES%\NetSupport Manager\Client32.ini
- from %PROGRAM_FILES%\NetSupport Manager\~GLH001f.TMP to %PROGRAM_FILES%\NetSupport Manager\CryptPak.dll
- from %PROGRAM_FILES%\NetSupport Manager\temp.000 to %PROGRAM_FILES%\NetSupport Manager\~GLH001f.TMP
- from %PROGRAM_FILES%\NetSupport Manager\~GLH0017.TMP to %PROGRAM_FILES%\NetSupport Manager\PCISYS.SYS
- from %PROGRAM_FILES%\NetSupport Manager\~GLH0016.TMP to %PROGRAM_FILES%\NetSupport Manager\PCIMON.DLL
- from %PROGRAM_FILES%\NetSupport Manager\~GLH0018.TMP to %PROGRAM_FILES%\NetSupport Manager\NTFSDB.EXE
- from %PROGRAM_FILES%\NetSupport Manager\~GLH001a.TMP to %PROGRAM_FILES%\NetSupport Manager\gdihook5.dll
- from %PROGRAM_FILES%\NetSupport Manager\~GLH0019.TMP to %PROGRAM_FILES%\NetSupport Manager\NTFSDB.MSG
- from %PROGRAM_FILES%\NetSupport Manager\~GLH0020.TMP to %PROGRAM_FILES%\NetSupport Manager\PCICHEK.DLL
- from %PROGRAM_FILES%\NetSupport Manager\~GLH0027.TMP to %PROGRAM_FILES%\NetSupport Manager\PCIinv.dll
- from %PROGRAM_FILES%\NetSupport Manager\temp.000 to %PROGRAM_FILES%\NetSupport Manager\~GLH0027.TMP
- from %PROGRAM_FILES%\NetSupport Manager\~GLH0028.TMP to %PROGRAM_FILES%\NetSupport Manager\checkdvd.exe
- from <SYSTEM32>\SET9.tmp to <SYSTEM32>\gdihook5.dll
- from <DRIVERS>\SET8.tmp to <DRIVERS>\gdihook5.sys
- from %PROGRAM_FILES%\NetSupport Manager\~GLH0022.TMP to %PROGRAM_FILES%\NetSupport Manager\nsm.lic
- from %PROGRAM_FILES%\NetSupport Manager\~GLH0021.TMP to %PROGRAM_FILES%\NetSupport Manager\DBI.EXE
- from %PROGRAM_FILES%\NetSupport Manager\~GLH0023.TMP to %PROGRAM_FILES%\NetSupport Manager\HTCTL32.DLL
- from %PROGRAM_FILES%\NetSupport Manager\~GLH0025.TMP to %PROGRAM_FILES%\NetSupport Manager\PCIIMAGE.DLL
- from %PROGRAM_FILES%\NetSupport Manager\~GLH0024.TMP to %PROGRAM_FILES%\NetSupport Manager\TCCTL32.DLL
- from %PROGRAM_FILES%\NetSupport Manager\~GLH0015.TMP to %PROGRAM_FILES%\NetSupport Manager\PCIGINA.DLL
- from %PROGRAM_FILES%\NetSupport Manager\~GLH0006.TMP to %PROGRAM_FILES%\NetSupport Manager\injlib.dll
- from %PROGRAM_FILES%\NetSupport Manager\~GLH0005.TMP to %PROGRAM_FILES%\NetSupport Manager\UNWISE.old
- from %PROGRAM_FILES%\NetSupport Manager\~GLH0007.TMP to %PROGRAM_FILES%\NetSupport Manager\pcimonhook.dll
- from %PROGRAM_FILES%\NetSupport Manager\~GLH0009.TMP to %PROGRAM_FILES%\NetSupport Manager\nsmexec.exe
- from %PROGRAM_FILES%\NetSupport Manager\~GLH0008.TMP to %PROGRAM_FILES%\NetSupport Manager\startlogo.bmp
- from %TEMP%\~GLH0001.TMP to %TEMP%\Licence.dll
- from %TEMP%\~GLH0000.TMP to %TEMP%\GLF4.tmp
- from %TEMP%\~GLH0002.TMP to %TEMP%\nsm.$$$
- from %PROGRAM_FILES%\NetSupport Manager\~GLH0004.TMP to %PROGRAM_FILES%\NetSupport Manager\Remove.EXE
- from %PROGRAM_FILES%\NetSupport Manager\~GLH0003.TMP to %PROGRAM_FILES%\NetSupport Manager\WINSTALL.EXE
- from %PROGRAM_FILES%\NetSupport Manager\temp.000 to %PROGRAM_FILES%\NetSupport Manager\~GLH000b.TMP
- from %PROGRAM_FILES%\NetSupport Manager\~GLH0011.TMP to %PROGRAM_FILES%\NetSupport Manager\PCIHOOKS.DLL
- from %PROGRAM_FILES%\NetSupport Manager\~GLH0010.TMP to %PROGRAM_FILES%\NetSupport Manager\PCIVDD.DLL
- from %PROGRAM_FILES%\NetSupport Manager\~GLH0012.TMP to %PROGRAM_FILES%\NetSupport Manager\PCIMSG.DLL
- from %PROGRAM_FILES%\NetSupport Manager\~GLH0014.TMP to %PROGRAM_FILES%\NetSupport Manager\GDIHOOK4.DLL
- from %PROGRAM_FILES%\NetSupport Manager\~GLH0013.TMP to %PROGRAM_FILES%\NetSupport Manager\clhook4.dll
- from %PROGRAM_FILES%\NetSupport Manager\~GLH000c.TMP to %PROGRAM_FILES%\NetSupport Manager\remcmdstub.exe
- from %PROGRAM_FILES%\NetSupport Manager\~GLH000b.TMP to %PROGRAM_FILES%\NetSupport Manager\client32.exe
- from %PROGRAM_FILES%\NetSupport Manager\~GLH000d.TMP to %PROGRAM_FILES%\NetSupport Manager\shfolder.dll
- from %PROGRAM_FILES%\NetSupport Manager\~GLH000f.TMP to %PROGRAM_FILES%\NetSupport Manager\pcicapi.DLL
- from %PROGRAM_FILES%\NetSupport Manager\~GLH000e.TMP to %PROGRAM_FILES%\NetSupport Manager\PCICL32.DLL
- ClassName: 'PCIVideoPlayer32' WindowName: '(null)'
- ClassName: 'NSSWControl32' WindowName: '(null)'
- ClassName: 'ScriptWClass' WindowName: '(null)'
- ClassName: 'NSMRunSCript' WindowName: '(null)'
- ClassName: 'PCISAClass' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: 'RUNPLUGIN' WindowName: 'PCIRUNPLUGIN'
- ClassName: 'PCIRemoteInstall' WindowName: '(null)'
- ClassName: 'NSMWControl32' WindowName: '(null)'