Trojan.DownLoader11.22731

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Rejoice Service] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\ainqngz5.4\Ainqngz5.4.exe'
'%PROGRAM_FILES%\ainqngz5.4\elated.exe' /hh1
'%PROGRAM_FILES%\ainqngz5.4\elated.exe' /s/s
'%PROGRAM_FILES%\ainqngz5.4\elated.exe'
'%PROGRAM_FILES%\ainqngz5.4\rejoice.exe'
'%PROGRAM_FILES%\Your Product\pczh_138_765.exe'
'%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:1744242 "__IRAFN:<Полный путь к вирусу>" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-2052111302-484763869-725345543-1003"
'%PROGRAM_FILES%\Your Product\setup_3340-765.exe'
'%PROGRAM_FILES%\yyfm0529\201404221629\YFMSever.exe'
'%PROGRAM_FILES%\yyfm0529\201404221629\yymusic05.exe' -tuopan

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\yyfm0529\201404221629\SysConfig.ini
%PROGRAM_FILES%\yyfm0529\201404221629\swresample-0.dll
%PROGRAM_FILES%\yyfm0529\201404221629\source.dll
%PROGRAM_FILES%\yyfm0529\201404221629\yymusic05.exe
%PROGRAM_FILES%\yyfm0529\201404221629\YFMSever.exe
%PROGRAM_FILES%\yyfm0529\201404221629\Unins.exe
%PROGRAM_FILES%\yyfm0529\201404221629\pthreadGC2.dll
%PROGRAM_FILES%\yyfm0529\201404221629\Data\version.ini
%PROGRAM_FILES%\yyfm0529\201404221629\Data\setup.ini
%PROGRAM_FILES%\yyfm0529\201404221629\Data\dh.ini
%PROGRAM_FILES%\yyfm0529\201404221629\libav.dll
%PROGRAM_FILES%\yyfm0529\201404221629\favorfm.xml
%PROGRAM_FILES%\yyfm0529\201404221629\DuiLib.dll
%TEMP%\nsd4.tmp\NSISdl.dll
%HOMEPATH%\Start Menu\Programs\°®Зй.ЦЗ»Ы.5.4\Р¶ФШ.lnk
%PROGRAM_FILES%\ainqngz5.4\rejoice.exe
%PROGRAM_FILES%\ainqngz5.4\elated.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\zhibo2[1].html
%HOMEPATH%\Desktop\°®Зй.ЦЗ»Ы.5.4.lnk
%HOMEPATH%\Start Menu\Programs\°®Зй.ЦЗ»Ы.5.4\°®Зй.ЦЗ»Ы.5.4.lnk
%PROGRAM_FILES%\ainqngz5.4\uninstall.exe
%HOMEPATH%\Start Menu\Programs\yyfm0529\ЕдЦГ№¤ѕЯ\Р¶ФШyyfm0529.lnk
%HOMEPATH%\Start Menu\Programs\yyfm0529\№Щ·ЅЦчТі.lnk
%HOMEPATH%\Start Menu\Programs\yyfm0529\yyfm0529.lnk
%PROGRAM_FILES%\ainqngz5.4\Ainqngz5.4.exe
%HOMEPATH%\Templates\222014416295878\YYM_955WD30.gif
%PROGRAM_FILES%\yyfm0529\201404221629\Data\user2.ini
%PROGRAM_FILES%\Your Product\lua5.1.dll
%PROGRAM_FILES%\Your Product\uninstall.exe
%PROGRAM_FILES%\Your Product\Uninstall\uninstall.dat
%PROGRAM_FILES%\Your Product\setup_3340-765.exe
%PROGRAM_FILES%\Your Product\pczh_138_765.exe
%PROGRAM_FILES%\Your Product\Uninstall\uninstall.xml
%PROGRAM_FILES%\Your Product\Uninstall\uni1.tmp
%TEMP%\_ir_sf_temp_0\irsetup.dat
%TEMP%\_ir_sf_temp_0\lua5.1.dll
%TEMP%\_ir_sf_temp_0\irsetup.exe
%TEMP%\Your Product Setup Log.txt
%TEMP%\_ir_sf_temp_0\IRIMG2.JPG
%TEMP%\_ir_sf_temp_0\IRIMG1.JPG
%HOMEPATH%\Start Menu\Programs\Your Product\°®ЗйЦЗ»Ы.lnk
%PROGRAM_FILES%\yyfm0529\201404221629\avformat-54.dll
%PROGRAM_FILES%\yyfm0529\201404221629\avcore.dll
%PROGRAM_FILES%\yyfm0529\201404221629\avcodec-54.dll
%PROGRAM_FILES%\yyfm0529\201404221629\Data\client.ini
%PROGRAM_FILES%\yyfm0529\201404221629\channels.xml
%PROGRAM_FILES%\yyfm0529\201404221629\avutil-52.dll
%PROGRAM_FILES%\yyfm0529\201404221629\audio.dll
%PROGRAM_FILES%\Your Product\Uninstall\IRIMG2.JPG
%PROGRAM_FILES%\Your Product\Uninstall\IRIMG1.JPG
%HOMEPATH%\Start Menu\Programs\Your Product\MuiscFM°ІЧ°іМРт.lnk
%TEMP%\nsd4.tmp\System.dll
%TEMP%\nsd4.tmp\Base64.dll
%TEMP%\nst3.tmp