PUA.Win32.FusionCore.MB.component - Enciclopedia delle minacce (2024)

Analizzato da: Leidryn Saludez

FusionCore. (NAI)

Piattaforma:

Windows

Valutazione del rischio complessivo:

Potenziale dannoso: :

Potenziale di distribuzione: :

Reported Infection:

Panoramica e descrizione

Canale infezione: Eliminado por otro tipo de malware, Descargado de Internet

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Dettagli tecnici

Dimensione file: 55,770,968 bytes

Residente in memoria: No

Data di ricezione campioni iniziali: 08 luglio 2019

Carica distruttiva: Connects to URLs/IPs

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

%User Temp%\nslC3AE.tmp
%User Temp%\AVC_Setup\res\Down.png
%User Temp%\AVC_Setup\res\Down@2x.png
%User Temp%\AVC_Setup\res\bg1.png
%User Temp%\AVC_Setup\res\bg1@2x.png
%User Temp%\AVC_Setup\res\bg2.png
%User Temp%\AVC_Setup\res\bg2@2x.png
%User Temp%\AVC_Setup\res\bg3.png
%User Temp%\AVC_Setup\res\bg3@2x.png
%User Temp%\AVC_Setup\res\bg_fusion.png
%User Temp%\AVC_Setup\res\bg_fusion@2x.png
%User Temp%\AVC_Setup\res\bk_btn.png
%User Temp%\AVC_Setup\res\bk_btn@2x.png
%User Temp%\AVC_Setup\res\bk_btn_m.png
%User Temp%\AVC_Setup\res\bk_btn_m@2x.png
%User Temp%\AVC_Setup\res\bk_combo.png
%User Temp%\AVC_Setup\res\bk_combo@2x.png
%User Temp%\AVC_Setup\res\browse.png
%User Temp%\AVC_Setup\res\browse@2x.png
%User Temp%\AVC_Setup\res\checkbox.png
%User Temp%\AVC_Setup\res\checkbox@2x.png
%User Temp%\AVC_Setup\res\close.png
%User Temp%\AVC_Setup\res\close@2x.png
%User Temp%\AVC_Setup\res\custom.png
%User Temp%\AVC_Setup\res\custom@2x.png
%User Temp%\AVC_Setup\res\edit.png
%User Temp%\AVC_Setup\res\edit@2x.png
%User Temp%\AVC_Setup\res\express.png
%User Temp%\AVC_Setup\res\express@2x.png
%User Temp%\AVC_Setup\res\finish.png
%User Temp%\AVC_Setup\res\finish@2x.png
%User Temp%\AVC_Setup\res\icon.png
%User Temp%\AVC_Setup\res\icon@2x.png
%User Temp%\AVC_Setup\res\install.png
%User Temp%\AVC_Setup\res\install@2x.png
%User Temp%\AVC_Setup\res\logo.png
%User Temp%\AVC_Setup\res\logo@2x.png
%User Temp%\AVC_Setup\res\minimal.png
%User Temp%\AVC_Setup\res\minimal@2x.png
%User Temp%\AVC_Setup\res\ok.png
%User Temp%\AVC_Setup\res\ok@2x.png
%User Temp%\AVC_Setup\res\progress_background.png
%User Temp%\AVC_Setup\res\progress_background@2x.png
%User Temp%\AVC_Setup\res\progress_fore.png
%User Temp%\AVC_Setup\res\progress_fore@2x.png
%User Temp%\AVC_Setup\res\scrollbar.png
%User Temp%\AVC_Setup\res\scrollbar@2x.png
%User Temp%\AVC_Setup\res\setup-logo-avc.png
%User Temp%\AVC_Setup\res\setup-logo-avc@2x.png
%User Temp%\AVC_Setup\res\shadow.png
%User Temp%\AVC_Setup\res\shadow@2x.png
%User Temp%\AVC_Setup\res\slide00.png
%User Temp%\AVC_Setup\res\slide00@2x.png
%User Temp%\AVC_Setup\res\slide01.png
%User Temp%\AVC_Setup\res\slide01@2x.png
%User Temp%\AVC_Setup\res\slide02.png
%User Temp%\AVC_Setup\res\slide02@2x.png
%User Temp%\AVC_Setup\res\slide03.png
%User Temp%\AVC_Setup\res\slide03@2x.png
%User Temp%\AVC_Setup\res\skin.xml
%User Temp%\AVC_Setup\res\locales\language_lookup.ini
%User Temp%\AVC_Setup\res\locales\{2 random characters}\locale.xml
%User Temp%\AVC_Setup\res\locales\zh_cn\locale.xml
%User Temp%\AVC_Setup\res\locales\zh_tw\locale.xml
%User Temp%\nsgDDC4.tmp\nsProcess.dll
%User Temp%\nsgDDC4.tmp\modern-wizard.bmp
%User Temp%\nsgDDC4.tmp\System.dll
%User Temp%\nsgDDC4.tmp\AnvsoftNsisPlugin.dll
%User Temp%\nsgDDC4.tmp\Fusion.dll
%User Temp%\{Random}.log
%User Temp%\nsd{Random}\csshover3.htc
%User Temp%\nsd{Random}\css\ie6_main.css
%User Temp%\nsd{Random}\css\main.css
%User Temp%\nsd{Random}\css\sdk-ui\browse.css
%User Temp%\nsd{Random}\css\sdk-ui\button.css
%User Temp%\nsd{Random}\css\sdk-ui\checkbox.css
%User Temp%\nsd{Random}\css\sdk-ui\progress-bar.css
%User Temp%\nsd{Random}\css\sdk-ui\images\button-bg.png
%User Temp%\nsd{Random}\css\sdk-ui\images\progress-bg-corner.png
%User Temp%\nsd{Random}\css\sdk-ui\images\progress-bg.png
%User Temp%\nsd{Random}\css\sdk-ui\images\progress-bg2.png
%User Temp%\nsd{Random}\images\Loader.gif
%User Temp%\nsd{Random}\locale\{2 random characters}.locale
%User Temp%\ns68C3E40F\0707E08F.tmp
%User Temp%\nsd{Random}\bootstrap_14762.html
%Program Files%\{Random}.log
%User Temp%\nsgDDC4.tmp\Math.dll
%User Temp%\nslC3AE.tmp
%User Temp%\AVC_Setup\res\Down.png
%User Temp%\AVC_Setup\res\Down@2x.png
%User Temp%\AVC_Setup\res\bg1.png
%User Temp%\AVC_Setup\res\bg1@2x.png
%User Temp%\AVC_Setup\res\bg2.png
%User Temp%\AVC_Setup\res\bg2@2x.png
%User Temp%\AVC_Setup\res\bg3.png
%User Temp%\AVC_Setup\res\bg3@2x.png
%User Temp%\AVC_Setup\res\bg_fusion.png
%User Temp%\AVC_Setup\res\bg_fusion@2x.png
%User Temp%\AVC_Setup\res\bk_btn.png
%User Temp%\AVC_Setup\res\bk_btn@2x.png
%User Temp%\AVC_Setup\res\bk_btn_m.png
%User Temp%\AVC_Setup\res\bk_btn_m@2x.png
%User Temp%\AVC_Setup\res\bk_combo.png
%User Temp%\AVC_Setup\res\bk_combo@2x.png
%User Temp%\AVC_Setup\res\browse.png
%User Temp%\AVC_Setup\res\browse@2x.png
%User Temp%\AVC_Setup\res\checkbox.png
%User Temp%\AVC_Setup\res\checkbox@2x.png
%User Temp%\AVC_Setup\res\close.png
%User Temp%\AVC_Setup\res\close@2x.png
%User Temp%\AVC_Setup\res\custom.png
%User Temp%\AVC_Setup\res\custom@2x.png
%User Temp%\AVC_Setup\res\edit.png
%User Temp%\AVC_Setup\res\edit@2x.png
%User Temp%\AVC_Setup\res\express.png
%User Temp%\AVC_Setup\res\express@2x.png
%User Temp%\AVC_Setup\res\finish.png
%User Temp%\AVC_Setup\res\finish@2x.png
%User Temp%\AVC_Setup\res\icon.png
%User Temp%\AVC_Setup\res\icon@2x.png
%User Temp%\AVC_Setup\res\install.png
%User Temp%\AVC_Setup\res\install@2x.png
%User Temp%\AVC_Setup\res\logo.png
%User Temp%\AVC_Setup\res\logo@2x.png
%User Temp%\AVC_Setup\res\minimal.png
%User Temp%\AVC_Setup\res\minimal@2x.png
%User Temp%\AVC_Setup\res\ok.png
%User Temp%\AVC_Setup\res\ok@2x.png
%User Temp%\AVC_Setup\res\progress_background.png
%User Temp%\AVC_Setup\res\progress_background@2x.png
%User Temp%\AVC_Setup\res\progress_fore.png
%User Temp%\AVC_Setup\res\progress_fore@2x.png
%User Temp%\AVC_Setup\res\scrollbar.png
%User Temp%\AVC_Setup\res\scrollbar@2x.png
%User Temp%\AVC_Setup\res\setup-logo-avc.png
%User Temp%\AVC_Setup\res\setup-logo-avc@2x.png
%User Temp%\AVC_Setup\res\shadow.png
%User Temp%\AVC_Setup\res\shadow@2x.png
%User Temp%\AVC_Setup\res\slide00.png
%User Temp%\AVC_Setup\res\slide00@2x.png
%User Temp%\AVC_Setup\res\slide01.png
%User Temp%\AVC_Setup\res\slide01@2x.png
%User Temp%\AVC_Setup\res\slide02.png
%User Temp%\AVC_Setup\res\slide02@2x.png
%User Temp%\AVC_Setup\res\slide03.png
%User Temp%\AVC_Setup\res\slide03@2x.png
%User Temp%\AVC_Setup\res\skin.xml
%User Temp%\AVC_Setup\res\locales\language_lookup.ini
%User Temp%\AVC_Setup\res\locales\{2 random characters}\locale.xml
%User Temp%\AVC_Setup\res\locales\zh_cn\locale.xml
%User Temp%\AVC_Setup\res\locales\zh_tw\locale.xml
%User Temp%\nsgDDC4.tmp\nsProcess.dll
%User Temp%\nsgDDC4.tmp\modern-wizard.bmp
%User Temp%\nsgDDC4.tmp\System.dll
%User Temp%\nsgDDC4.tmp\AnvsoftNsisPlugin.dll
%User Temp%\nsgDDC4.tmp\Fusion.dll
%User Temp%\{Random}.log
%User Temp%\nsd{Random}\csshover3.htc
%User Temp%\nsd{Random}\css\ie6_main.css
%User Temp%\nsd{Random}\css\main.css
%User Temp%\nsd{Random}\css\sdk-ui\browse.css
%User Temp%\nsd{Random}\css\sdk-ui\button.css
%User Temp%\nsd{Random}\css\sdk-ui\checkbox.css
%User Temp%\nsd{Random}\css\sdk-ui\progress-bar.css
%User Temp%\nsd{Random}\css\sdk-ui\images\button-bg.png
%User Temp%\nsd{Random}\css\sdk-ui\images\progress-bg-corner.png
%User Temp%\nsd{Random}\css\sdk-ui\images\progress-bg.png
%User Temp%\nsd{Random}\css\sdk-ui\images\progress-bg2.png
%User Temp%\nsd{Random}\images\Loader.gif
%User Temp%\nsd{Random}\locale\{2 random characters}.locale
%User Temp%\ns68C3E40F\0707E08F.tmp
%User Temp%\nsd{Random}\bootstrap_14762.html
%Program Files%\{Random}.log
%User Temp%\nsgDDC4.tmp\Math.dll

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).

. %Program Files% es la carpeta Archivos de programa predeterminada, que suele estar en C:\Archivos de programa).)

Crea las carpetas siguientes:

%User Temp%\AVC_Setup
%User Temp%\AVC_Setup\res
%User Temp%\nsd{Random}
%User Temp%\nsd{Random}\css
%User Temp%\nsd{Random}\images
%User Temp%\nsd{Random}\locale
%User Temp%\nsd{Random}\css\sdk-ui
%User Temp%\ns68C3E40F

)

Otros detalles

It connects to the following possibly malicious URL:

http://{BLOCKED}asa.com/

Soluzioni

Motore di scansione minimo: 9.800

File di pattern SSAPI: 19.416.52

Data di pubblicazione del pattern SSAPI: 21 giugno 2024

Step 1

Los usuarios de Windows ME y XP, antes de llevar a cabo cualquier exploración, deben comprobar que tienen desactivada la opción Restaurar sistema para permitir la exploración completa del equipo.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Buscar y eliminar estas carpetas

[ learnMore ]

Asegúrese de que tiene activada la casilla Buscar archivos y carpetas ocultos en la opción Más opciones avanzadas para que el resultado de la búsqueda incluya todas las carpetas ocultas.

%User Temp%\AVC_Setup
%User Temp%\AVC_Setup\res
%User Temp%\nsd{Random}
%User Temp%\nsd{Random}\css
%User Temp%\nsd{Random}\images
%User Temp%\nsd{Random}\locale
%User Temp%\nsd{Random}\css\sdk-ui
%User Temp%\ns68C3E40F

Step 4

Buscar y eliminar este archivo

[ learnMore ]

Puede que algunos de los archivos del componente estén ocultos. Asegúrese de que tiene activada la casilla Buscar archivos y carpetas ocultos en la opción Más opciones avanzadas para que el resultado de la búsqueda incluya todos los archivos y carpetas ocultos.

%User Temp%\nslC3AE.tmp
%User Temp%\AVC_Setup\res\Down.png
%User Temp%\AVC_Setup\res\Down@2x.png
%User Temp%\AVC_Setup\res\bg1.png
%User Temp%\AVC_Setup\res\bg1@2x.png
%User Temp%\AVC_Setup\res\bg2.png
%User Temp%\AVC_Setup\res\bg2@2x.png
%User Temp%\AVC_Setup\res\bg3.png
%User Temp%\AVC_Setup\res\bg3@2x.png
%User Temp%\AVC_Setup\res\bg_fusion.png
%User Temp%\AVC_Setup\res\bg_fusion@2x.png
%User Temp%\AVC_Setup\res\bk_btn.png
%User Temp%\AVC_Setup\res\bk_btn@2x.png
%User Temp%\AVC_Setup\res\bk_btn_m.png
%User Temp%\AVC_Setup\res\bk_btn_m@2x.png
%User Temp%\AVC_Setup\res\bk_combo.png
%User Temp%\AVC_Setup\res\bk_combo@2x.png
%User Temp%\AVC_Setup\res\browse.png
%User Temp%\AVC_Setup\res\browse@2x.png
%User Temp%\AVC_Setup\res\checkbox.png
%User Temp%\AVC_Setup\res\checkbox@2x.png
%User Temp%\AVC_Setup\res\close.png
%User Temp%\AVC_Setup\res\close@2x.png
%User Temp%\AVC_Setup\res\custom.png
%User Temp%\AVC_Setup\res\custom@2x.png
%User Temp%\AVC_Setup\res\edit.png
%User Temp%\AVC_Setup\res\edit@2x.png
%User Temp%\AVC_Setup\res\express.png
%User Temp%\AVC_Setup\res\express@2x.png
%User Temp%\AVC_Setup\res\finish.png
%User Temp%\AVC_Setup\res\finish@2x.png
%User Temp%\AVC_Setup\res\icon.png
%User Temp%\AVC_Setup\res\icon@2x.png
%User Temp%\AVC_Setup\res\install.png
%User Temp%\AVC_Setup\res\install@2x.png
%User Temp%\AVC_Setup\res\logo.png
%User Temp%\AVC_Setup\res\logo@2x.png
%User Temp%\AVC_Setup\res\minimal.png
%User Temp%\AVC_Setup\res\minimal@2x.png
%User Temp%\AVC_Setup\res\ok.png
%User Temp%\AVC_Setup\res\ok@2x.png
%User Temp%\AVC_Setup\res\progress_background.png
%User Temp%\AVC_Setup\res\progress_background@2x.png
%User Temp%\AVC_Setup\res\progress_fore.png
%User Temp%\AVC_Setup\res\progress_fore@2x.png
%User Temp%\AVC_Setup\res\scrollbar.png
%User Temp%\AVC_Setup\res\scrollbar@2x.png
%User Temp%\AVC_Setup\res\setup-logo-avc.png
%User Temp%\AVC_Setup\res\setup-logo-avc@2x.png
%User Temp%\AVC_Setup\res\shadow.png
%User Temp%\AVC_Setup\res\shadow@2x.png
%User Temp%\AVC_Setup\res\slide00.png
%User Temp%\AVC_Setup\res\slide00@2x.png
%User Temp%\AVC_Setup\res\slide01.png
%User Temp%\AVC_Setup\res\slide01@2x.png
%User Temp%\AVC_Setup\res\slide02.png
%User Temp%\AVC_Setup\res\slide02@2x.png
%User Temp%\AVC_Setup\res\slide03.png
%User Temp%\AVC_Setup\res\slide03@2x.png
%User Temp%\AVC_Setup\res\skin.xml
%User Temp%\AVC_Setup\res\locales\language_lookup.ini
%User Temp%\AVC_Setup\res\locales\{2 random characters}\locale.xml
%User Temp%\AVC_Setup\res\locales\zh_cn\locale.xml
%User Temp%\AVC_Setup\res\locales\zh_tw\locale.xml
%User Temp%\nsgDDC4.tmp\nsProcess.dll
%User Temp%\nsgDDC4.tmp\modern-wizard.bmp
%User Temp%\nsgDDC4.tmp\System.dll
%User Temp%\nsgDDC4.tmp\AnvsoftNsisPlugin.dll
%User Temp%\nsgDDC4.tmp\Fusion.dll
%User Temp%\{Random}.log
%User Temp%\nsd{Random}\csshover3.htc
%User Temp%\nsd{Random}\css\ie6_main.css
%User Temp%\nsd{Random}\css\main.css
%User Temp%\nsd{Random}\css\sdk-ui\browse.css
%User Temp%\nsd{Random}\css\sdk-ui\button.css
%User Temp%\nsd{Random}\css\sdk-ui\checkbox.css
%User Temp%\nsd{Random}\css\sdk-ui\progress-bar.css
%User Temp%\nsd{Random}\css\sdk-ui\images\button-bg.png
%User Temp%\nsd{Random}\css\sdk-ui\images\progress-bg-corner.png
%User Temp%\nsd{Random}\css\sdk-ui\images\progress-bg.png
%User Temp%\nsd{Random}\css\sdk-ui\images\progress-bg2.png
%User Temp%\nsd{Random}\images\Loader.gif
%User Temp%\nsd{Random}\locale\{2 random characters}.locale
%User Temp%\ns68C3E40F\0707E08F.tmp
%User Temp%\nsd{Random}\bootstrap_14762.html
%Program Files%\{Random}.log
%User Temp%\nsgDDC4.tmp\Math.dll

Step 5

Explorar el equipo con su producto de Trend Micro para eliminar los archivos detectados como PUA.Win32.FusionCore.MB.component En caso de que el producto de Trend Micro ya haya limpiado, eliminado o puesto en cuarentena los archivos detectados, no serán necesarios más pasos. Puede optar simplemente por eliminar los archivos en cuarentena. Consulte esta página de Base de conocimientos para obtener más información.

Sondaggio

PUA.Win32.FusionCore.MB.component - Enciclopedia delle minacce (2024)

FAQs

What is pua Win32 FusionCore? ›

FusionCore is an adware bundler that attempts to secretly introduce undesirable elements (such as apps or browser extensions) to your system during software installation.

Show Me More ›

Is Pua Win32 A virus? ›

"PUA:Win32/Presenoker" is a detection name used by multiple security engines/tools, including the Microsoft Defender Antivirus, as an identifier for Potentially Unwanted Applications (PUAs). Software within this category typically appears genuine and useful yet seldom operates as promised by its promotional material.

Know More ›

How do I get rid of Win32 Pua? ›

Delete the Windows Defender History. Sometimes the PUA Win32 Vigua A item may be left behind in the Windows Defender History folder. To remove the virus, you can delete it in the DetectionHistory folder.

Read On ›

Is fusion core a virus? ›

Riskware/FusionCore is classified as a file infector. A file infector is a type of malware that has the capability to propagate by attaching its code to other programs or files. The Fortinet Antivirus Analyst Team is constantly updating our descriptions.

Learn More ›

How do I get rid of Win32 virus? ›

How to remove Win32 / Virut in 3 simple steps

Download. Download our free removal tool: rmvirut.exe.
Run the tool. To remove infected files, run the tool. ...
Update. After your computer has restarted, make sure your antivirus is up-to-date and then run a full computer scan.

Keep Reading ›

What is Pua on my computer? ›

Windows 10. Potentially unwanted applications (PUA) are a category of software that can cause your machine to run slowly, display unexpected ads, or at worst, install other software which may be more harmful or annoying.

Learn More Now ›

How do I disable Pua in Windows? ›

How do I get rid of PUAs?

Click the Start , then go to Settings > Apps > Apps & Features. You can also access it via the shortcut button below: Windows Apps & Features.
Select the program that matches the descriptions above, then click Uninstall.
Remove all PUAs on your Internet browsers.

Jun 14, 2022

Show Me More ›

What does Pua mean in antivirus? ›

Potentially Unwanted Applications (PUAs) are unwanted software programs that come bundled in legitimate free software programs as a package. These may also be called Potentially Unwanted Programs, or PUPs.

Show Me More ›

What is Fusion Core on my PC? ›

FusionCore are bundlers of adware and PUP applications that are typically offered as applications that users are looking for, like f.e. file converters, but include adware and potentially unwanted programs (PUPs) in the same installer. Adware. FusionCore bundlers typically are downloaded and run by users themselves.

How to remove PUABundler Win32 virus? ›

To remove the PUABundler:Win32/CandyOpen malware, follow these steps:

STEP 1: Uninstall malicious programs from Windows.
STEP 2: Reset browsers back to default settings.
STEP 3: Use Rkill to terminate suspicious programs.
STEP 4: Use Malwarebytes to remove for Trojans and Unwanted Programs.

More items...

Nov 26, 2023

Learn More ›

What is PUADlManager Win32 OfferCore? ›

What is PUADlManager:Win32/OfferCore? OfferCore is a bundling tool that is used to install additional apps along with the “main” one. While such solutions were initially created to make free software monetization easier, their main usage these days is spreading unwanted software.

Tell Me More ›

What is Win32 FusionCore? ›

PUA:Win32/FusionCore

This application is a bundling software that is known to install other potentially unwanted application (PUA), such as PUA:Win32/ByteFence. It may sometimes install unwanted software such as BrowserModifier:Win32/Prifou.

What does the Win32 virus do? ›

Virus:Win32/Expiro. U is the detection for a virus that infects EXE files in all drives and collects user credentials from an infected computer. It also allows backdoor access and control to the infected computer, and lowers Internet Explorer settings.

View Details ›

What does Win32 stand for? ›

(1) A 32-bit version of Windows. Many editions of Windows have come in both 32-bit and 64-bit versions. See 32-bit computing and x86/x64. (2) Win32 is the programming interface (API) for 32-bit and 64-bit Windows operating systems.

Explore More ›

What does Pua mean in Windows? ›

Windows 10. Potentially unwanted applications (PUA) are a category of software that can cause your machine to run slowly, display unexpected ads, or at worst, install other software which may be more harmful or annoying.

Read On ›

Is Puadimanager Win32 InstallCore a virus? ›

It is a malware that poses a serious threat to Windows users. Unlike simple unwanted programs, InstallCore combines the functions of a downloader and installer, automatically distributing many unwanted applications and potentially dangerous programs to infected devices.

Keep Reading ›

What is Fusion Core PC? ›

Read The Full Story ›