Trojan.DownLoader.64567

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\taorar\Shell\Open\command] '' = '"%PROGRAM_FILES%\Taorar\taorar.exe" "%1"'

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\Taorar\TAORAR.exe ""

Запускает на исполнение:

<SYSTEM32>\regsvr32.exe /s <SYSTEM32>\taorar.ocx

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Taorar\webframe\silver\is-NEUGS.tmp
%PROGRAM_FILES%\Taorar\webframe\silver\is-5DCP2.tmp
%PROGRAM_FILES%\Taorar\webframe\silver\is-HL7B2.tmp
%PROGRAM_FILES%\Taorar\webframe\silver\is-GD7CG.tmp
%PROGRAM_FILES%\Taorar\webframe\silver\is-HD0T6.tmp
%PROGRAM_FILES%\Taorar\webframe\silver\is-BTN23.tmp
%PROGRAM_FILES%\Taorar\webframe\silver\is-HSCHC.tmp
%PROGRAM_FILES%\Taorar\webframe\silver\is-8JDQ2.tmp
%PROGRAM_FILES%\Taorar\webframe\silver\is-PCVJM.tmp
%PROGRAM_FILES%\Taorar\webframe\manager\images\is-AJ05H.tmp
%PROGRAM_FILES%\Taorar\webframe\manager\images\is-4VE04.tmp
%PROGRAM_FILES%\Taorar\webframe\manager\images\is-35D71.tmp
%PROGRAM_FILES%\Taorar\webframe\manager\images\is-07TE2.tmp
%PROGRAM_FILES%\Taorar\webframe\ProgressBar\is-3JRV9.tmp
%PROGRAM_FILES%\Taorar\webframe\ProgressBar\is-5JIJ9.tmp
%PROGRAM_FILES%\Taorar\webframe\ProgressBar\is-SU2Q1.tmp
%PROGRAM_FILES%\Taorar\webframe\ProgressBar\is-9BLU9.tmp
%PROGRAM_FILES%\Taorar\webframe\ProgressBar\is-G649I.tmp
%PROGRAM_FILES%\Taorar\webframe\silver\is-PS120.tmp
%PROGRAM_FILES%\Taorar\webframe\silver\is-2H9HM.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Taorar(淘文件)\taorar(淘文件).lnk
%PROGRAM_FILES%\Taorar\webframe\silver\is-C7HEP.tmp
%PROGRAM_FILES%\Taorar\webframe\silver\is-PRC5T.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Taorar(淘文件)\卸载 taorar.lnk
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\taorar[1].ocx
<SYSTEM32>\taorar.ocx
%PROGRAM_FILES%\Taorar\unins000.dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\isupdate[1].txt
%PROGRAM_FILES%\Taorar\webframe\silver\is-U4KOC.tmp
%PROGRAM_FILES%\Taorar\webframe\silver\is-2MDO3.tmp
%PROGRAM_FILES%\Taorar\webframe\silver\is-65TAE.tmp
%PROGRAM_FILES%\Taorar\webframe\silver\is-OEUUS.tmp
%PROGRAM_FILES%\Taorar\webframe\silver\is-IIENT.tmp
%PROGRAM_FILES%\Taorar\webframe\silver\is-5B1K2.tmp
%PROGRAM_FILES%\Taorar\webframe\silver\is-BCGIQ.tmp
%PROGRAM_FILES%\Taorar\webframe\silver\is-ONFT7.tmp
%PROGRAM_FILES%\Taorar\webframe\silver\is-FRAMV.tmp
%PROGRAM_FILES%\Taorar\webframe\ico\is-M77N8.tmp
%PROGRAM_FILES%\Taorar\webframe\ico\is-G11VO.tmp
%PROGRAM_FILES%\Taorar\is-4N1OP.tmp
%PROGRAM_FILES%\Taorar\webframe\ico\is-69B5Q.tmp
%PROGRAM_FILES%\Taorar\webframe\ico\is-KH70D.tmp
%PROGRAM_FILES%\Taorar\webframe\ico\is-9VQ6N.tmp
%PROGRAM_FILES%\Taorar\webframe\ico\is-H6QEA.tmp
%PROGRAM_FILES%\Taorar\webframe\ico\is-OBGIV.tmp
%PROGRAM_FILES%\Taorar\webframe\ico\is-1LQS2.tmp
%PROGRAM_FILES%\Taorar\is-1JQAF.tmp
<SYSTEM32>\is-5AIOJ.tmp
%TEMP%\is-JH5F6.tmp\<Имя вируса>.tmp
%TEMP%\is-H5DPA.tmp\_isetup\_shfoldr.dll
<SYSTEM32>\is-56LOD.tmp
%PROGRAM_FILES%\Taorar\is-4QP3B.tmp
%PROGRAM_FILES%\Taorar\is-S2CT7.tmp
%PROGRAM_FILES%\Taorar\is-T7OLL.tmp
%PROGRAM_FILES%\Taorar\is-6QIV7.tmp
%PROGRAM_FILES%\Taorar\webframe\ico\is-3DLFF.tmp
%PROGRAM_FILES%\Taorar\webframe\manager\images\is-SBR4D.tmp
%PROGRAM_FILES%\Taorar\webframe\manager\images\is-OC8V5.tmp
%PROGRAM_FILES%\Taorar\webframe\manager\images\is-VAK5S.tmp
%PROGRAM_FILES%\Taorar\webframe\manager\images\is-BHIB3.tmp
%PROGRAM_FILES%\Taorar\webframe\manager\images\is-E3VI6.tmp
%PROGRAM_FILES%\Taorar\webframe\manager\images\is-PLTOL.tmp
%PROGRAM_FILES%\Taorar\webframe\manager\images\is-MT6GL.tmp
%PROGRAM_FILES%\Taorar\webframe\manager\images\is-TRFJI.tmp
%PROGRAM_FILES%\Taorar\webframe\manager\images\is-1035M.tmp
%PROGRAM_FILES%\Taorar\webframe\ico\is-GJG87.tmp
%PROGRAM_FILES%\Taorar\webframe\ico\is-ANMO1.tmp
%PROGRAM_FILES%\Taorar\webframe\ico\is-E65TG.tmp
%PROGRAM_FILES%\Taorar\webframe\ico\is-80ECT.tmp
%PROGRAM_FILES%\Taorar\webframe\js\is-HKHBA.tmp
%PROGRAM_FILES%\Taorar\webframe\js\is-JS1TD.tmp
%PROGRAM_FILES%\Taorar\webframe\manager\is-I5OP9.tmp
%PROGRAM_FILES%\Taorar\webframe\js\is-BO111.tmp
%PROGRAM_FILES%\Taorar\webframe\js\is-O7CNT.tmp