Trojan.MulDrop7.14248

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'%ProgramFiles%\Your Uninstaller 2008\vclx.exe'
'%WINDIR%\regedit.exe' /s 1.reg
'%ProgramFiles%\Your Uninstaller 2008\uruninstaller.exe' -buildcache
'%TEMP%\7zS1.tmp\yu2008.exe' /VERYSILENT /NORESTART
'%TEMP%\is-E39F5.tmp\is-M8GSU.tmp' /SL4 $40092 "%TEMP%\7zS1.tmp\yu2008.exe" 3483094 52736 /VERYSILENT /NORESTART

Ищет следующие окна с целью

обнаружения утилит для анализа:

ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
ClassName: 'RegMonClass', WindowName: ''
ClassName: 'FileMonClass', WindowName: ''

Изменения в файловой системе:

Создает следующие файлы:

%ProgramFiles%\Your Uninstaller 2008\is-4GA3I.tmp
%ProgramFiles%\Your Uninstaller 2008\is-0GM0P.tmp
%ProgramFiles%\Your Uninstaller 2008\is-7HJ6N.tmp
%ProgramFiles%\Your Uninstaller 2008\is-OPQON.tmp
%ProgramFiles%\Your Uninstaller 2008\is-D9TM9.tmp
%ProgramFiles%\Your Uninstaller 2008\is-LR2BF.tmp
%ProgramFiles%\Your Uninstaller 2008\is-UOMO7.tmp
%ProgramFiles%\Your Uninstaller 2008\is-B3UM1.tmp
%ProgramFiles%\Your Uninstaller 2008\is-57IU1.tmp
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Your Uninstaller! 2008.lnk
%HOMEPATH%\Desktop\Your Uninstaller! 2008.lnk
%APPDATA%\URSoft\Your Uninstaller 2008\uruninstaller.ini
%ProgramFiles%\Your Uninstaller 2008\unins000.dat
%ProgramFiles%\Your Uninstaller 2008\is-E4OI0.tmp
%ProgramFiles%\Your Uninstaller 2008\is-SVAKR.tmp
%ProgramFiles%\Your Uninstaller 2008\is-CTF21.tmp
%ProgramFiles%\Your Uninstaller 2008\is-U17TA.tmp
%ProgramFiles%\Your Uninstaller 2008\is-LRE67.tmp
%ProgramFiles%\Your Uninstaller 2008\is-8LE2S.tmp
%ProgramFiles%\Your Uninstaller 2008\is-CQQKH.tmp
%ProgramFiles%\Your Uninstaller 2008\Languages\is-D5B6G.tmp
%ProgramFiles%\Your Uninstaller 2008\Languages\is-VRV3O.tmp
%ProgramFiles%\Your Uninstaller 2008\is-AT7MH.tmp
%TEMP%\is-E39F5.tmp\is-M8GSU.tmp
%TEMP%\7zS1.tmp\yu2008.exe
%TEMP%\is-RA0IP.tmp\_isetup\_shfoldr.dll
%TEMP%\is-RA0IP.tmp\_isetup\_RegDLL.tmp
%ProgramFiles%\Your Uninstaller 2008\templates\is-TVOJC.tmp
%ProgramFiles%\Your Uninstaller 2008\templates\is-H6GSP.tmp
%ProgramFiles%\Your Uninstaller 2008\is-24RDD.tmp
%ProgramFiles%\Your Uninstaller 2008\templates\is-UE3QG.tmp
%ProgramFiles%\Your Uninstaller 2008\templates\is-MLJ24.tmp
%ProgramFiles%\Your Uninstaller 2008\templates\is-523O8.tmp
%ProgramFiles%\Your Uninstaller 2008\templates\is-762BD.tmp
%ProgramFiles%\Your Uninstaller 2008\templates\is-2ERJ8.tmp
%ProgramFiles%\Your Uninstaller 2008\templates\is-B4MTN.tmp

Удаляет следующие файлы:

%TEMP%\is-E39F5.tmp\is-M8GSU.tmp
%TEMP%\7zS1.tmp\yu2008.exe
%TEMP%\is-RA0IP.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-RA0IP.tmp\_isetup\_shfoldr.dll

Перемещает следующие файлы:

%ProgramFiles%\Your Uninstaller 2008\is-D9TM9.tmp в %ProgramFiles%\Your Uninstaller 2008\license.rtf
%ProgramFiles%\Your Uninstaller 2008\is-0GM0P.tmp в %ProgramFiles%\Your Uninstaller 2008\update.ini
%ProgramFiles%\Your Uninstaller 2008\is-4GA3I.tmp в %ProgramFiles%\Your Uninstaller 2008\uruninstaller.ini
%ProgramFiles%\Your Uninstaller 2008\is-B3UM1.tmp в %ProgramFiles%\Your Uninstaller 2008\fos.exe.manifest
%ProgramFiles%\Your Uninstaller 2008\is-UOMO7.tmp в %ProgramFiles%\Your Uninstaller 2008\autoupdater.exe
%ProgramFiles%\Your Uninstaller 2008\is-LR2BF.tmp в %ProgramFiles%\Your Uninstaller 2008\skipfilenames.dat
%ProgramFiles%\Your Uninstaller 2008\is-57IU1.tmp в %ProgramFiles%\Your Uninstaller 2008\fos.exe
%ProgramFiles%\Your Uninstaller 2008\is-LRE67.tmp в %ProgramFiles%\Your Uninstaller 2008\uruninstaller.exe.manifest
%ProgramFiles%\Your Uninstaller 2008\is-U17TA.tmp в %ProgramFiles%\Your Uninstaller 2008\1.reg
%ProgramFiles%\Your Uninstaller 2008\is-E4OI0.tmp в %ProgramFiles%\Your Uninstaller 2008\vclx.exe
%ProgramFiles%\Your Uninstaller 2008\is-SVAKR.tmp в %ProgramFiles%\Your Uninstaller 2008\VirtualTreesD7.bpl
%ProgramFiles%\Your Uninstaller 2008\is-OPQON.tmp в %ProgramFiles%\Your Uninstaller 2008\vcl70.bpl
%ProgramFiles%\Your Uninstaller 2008\is-7HJ6N.tmp в %ProgramFiles%\Your Uninstaller 2008\rtl70.bpl
%ProgramFiles%\Your Uninstaller 2008\is-CTF21.tmp в %ProgramFiles%\Your Uninstaller 2008\vclx70.bpl
%ProgramFiles%\Your Uninstaller 2008\Languages\is-D5B6G.tmp в %ProgramFiles%\Your Uninstaller 2008\Languages\Turkish.lng
%ProgramFiles%\Your Uninstaller 2008\templates\is-762BD.tmp в %ProgramFiles%\Your Uninstaller 2008\templates\proginfo_ar.tpl
%ProgramFiles%\Your Uninstaller 2008\templates\is-523O8.tmp в %ProgramFiles%\Your Uninstaller 2008\templates\proginfo_cn.tpl
%ProgramFiles%\Your Uninstaller 2008\Languages\is-VRV3O.tmp в %ProgramFiles%\Your Uninstaller 2008\Languages\English.lng
%ProgramFiles%\Your Uninstaller 2008\is-AT7MH.tmp в %ProgramFiles%\Your Uninstaller 2008\unins000.exe
%ProgramFiles%\Your Uninstaller 2008\is-CQQKH.tmp в %ProgramFiles%\Your Uninstaller 2008\uruninstaller.exe
%ProgramFiles%\Your Uninstaller 2008\is-8LE2S.tmp в %ProgramFiles%\Your Uninstaller 2008\uninstaller.chm
%ProgramFiles%\Your Uninstaller 2008\templates\is-TVOJC.tmp в %ProgramFiles%\Your Uninstaller 2008\templates\proginfo_pl.tpl
%ProgramFiles%\Your Uninstaller 2008\templates\is-UE3QG.tmp в %ProgramFiles%\Your Uninstaller 2008\templates\proginfo_tw.tpl
%ProgramFiles%\Your Uninstaller 2008\is-24RDD.tmp в %ProgramFiles%\Your Uninstaller 2008\diskclean.ico
%ProgramFiles%\Your Uninstaller 2008\templates\is-H6GSP.tmp в %ProgramFiles%\Your Uninstaller 2008\templates\proginfo_hu.tpl
%ProgramFiles%\Your Uninstaller 2008\templates\is-B4MTN.tmp в %ProgramFiles%\Your Uninstaller 2008\templates\proginfo_da.tpl
%ProgramFiles%\Your Uninstaller 2008\templates\is-2ERJ8.tmp в %ProgramFiles%\Your Uninstaller 2008\templates\proginfo_en.tpl
%ProgramFiles%\Your Uninstaller 2008\templates\is-MLJ24.tmp в %ProgramFiles%\Your Uninstaller 2008\templates\proginfo_fr.tpl