Trojan.MulDrop7.37497

Техническая информация

Для обеспечения автозапуска и распространения:

Подменяет следующие исполняемые системные файлы:

<SYSTEM32>\msvbvm60.dll

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\is-NGIVA.tmp\~tilcckm.tmp' /SL5="$100E0,4259310,56832,%CommonProgramFiles%\~tilcckm.ibo" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%CommonProgramFiles%\~tilcckm.ibo' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-

Запускает на исполнение:

'<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\Comdlg32.ocx"
'<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\Msinet.ocx"
'<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\Mscomctl.ocx"
'<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\comcat.dll"
'<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\msvbvm60.dll"
'<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\oleaut32.dll"
'<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\olepro32.dll"

Изменения в файловой системе:

Создает следующие файлы:

%ProgramFiles%\Driver Magician\is-PLQ4T.tmp
%ProgramFiles%\Driver Magician\is-P2KPD.tmp
%APPDATA%\Driver Magician\is-6U1UP.tmp
<SYSTEM32>\is-57NKJ.tmp
<SYSTEM32>\is-DPI1C.tmp
%ProgramFiles%\Driver Magician\Language\is-N471N.tmp
%ProgramFiles%\Driver Magician\Language\is-RHFOD.tmp
%ProgramFiles%\Driver Magician\Language\is-JKONH.tmp
%ProgramFiles%\Driver Magician\is-P9IKH.tmp
%ProgramFiles%\Driver Magician\Language\is-NLB8Q.tmp
<SYSTEM32>\is-3K5JT.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Driver Magician\Readme.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Driver Magician\Help.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Driver Magician\Homepage.lnk
%HOMEPATH%\Desktop\Driver Magician.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Driver Magician\Uninstall Driver Magician.lnk
<SYSTEM32>\is-7F5LM.tmp
<SYSTEM32>\is-ELDCL.tmp
<SYSTEM32>\is-U6U52.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Driver Magician\Driver Magician.lnk
<SYSTEM32>\is-QQRT6.tmp
%ProgramFiles%\Driver Magician\Language\is-4ESJ0.tmp
%ProgramFiles%\Driver Magician\is-TEE3T.tmp
%ProgramFiles%\Driver Magician\is-74KE3.tmp
%ProgramFiles%\Driver Magician\is-IA2F5.tmp
%ProgramFiles%\Driver Magician\is-KJE0R.tmp
%ProgramFiles%\Driver Magician\is-BFJUN.tmp
%CommonProgramFiles%\~tilcckm.ibo
%TEMP%\aut1.tmp
%ProgramFiles%\Driver Magician\is-1T921.tmp
%ProgramFiles%\Driver Magician\is-0NH1V.tmp
<SYSTEM32>\is-NP2AQ.tmp
%ProgramFiles%\Driver Magician\is-LB5GN.tmp
%ProgramFiles%\Driver Magician\Language\is-EBQ9I.tmp
%ProgramFiles%\Driver Magician\Language\is-TSQ2F.tmp
%ProgramFiles%\Driver Magician\Language\is-EB7A7.tmp
%ProgramFiles%\Driver Magician\Language\is-MDT6V.tmp
%ProgramFiles%\Driver Magician\Language\is-FJBVQ.tmp
%ProgramFiles%\Driver Magician\is-N7IDA.tmp
%ProgramFiles%\Driver Magician\is-76CQ9.tmp
%ProgramFiles%\Driver Magician\Language\is-HLRSO.tmp
%ProgramFiles%\Driver Magician\Language\is-3LV9T.tmp
%ProgramFiles%\Driver Magician\Language\is-AVMR8.tmp

Присваивает атрибут 'скрытый' для следующих файлов:

%CommonProgramFiles%\~tilcckm.ibo

Удаляет следующие файлы:

<SYSTEM32>\msvbvm60.dll
%TEMP%\aut1.tmp

Перемещает следующие файлы:

%ProgramFiles%\Driver Magician\Language\is-NLB8Q.tmp в %ProgramFiles%\Driver Magician\Language\Turkish.ini
%ProgramFiles%\Driver Magician\Language\is-JKONH.tmp в %ProgramFiles%\Driver Magician\Language\Spanish.ini
%ProgramFiles%\Driver Magician\is-P2KPD.tmp в %ProgramFiles%\Driver Magician\sortdescending.ico
%ProgramFiles%\Driver Magician\is-P9IKH.tmp в %ProgramFiles%\Driver Magician\AutoIntall.dll
%ProgramFiles%\Driver Magician\Language\is-4ESJ0.tmp в %ProgramFiles%\Driver Magician\Language\Korean.ini
%ProgramFiles%\Driver Magician\Language\is-MDT6V.tmp в %ProgramFiles%\Driver Magician\Language\Italian.ini
%ProgramFiles%\Driver Magician\Language\is-N471N.tmp в %ProgramFiles%\Driver Magician\Language\Portuguese.ini
%ProgramFiles%\Driver Magician\Language\is-RHFOD.tmp в %ProgramFiles%\Driver Magician\Language\Polish.ini
%ProgramFiles%\Driver Magician\is-PLQ4T.tmp в %ProgramFiles%\Driver Magician\sortascending.ico
<SYSTEM32>\is-7F5LM.tmp в <SYSTEM32>\XceedCry.dll
<SYSTEM32>\is-ELDCL.tmp в <SYSTEM32>\XCEEDZIP.DLL
<SYSTEM32>\is-QQRT6.tmp в <SYSTEM32>\Codejock.Controls.v15.0.1.ocx
<SYSTEM32>\is-U6U52.tmp в <SYSTEM32>\xcdsfx32.bin
<SYSTEM32>\is-DPI1C.tmp в <SYSTEM32>\Comdlg32.ocx
%APPDATA%\Driver Magician\is-6U1UP.tmp в %APPDATA%\Driver Magician\HiddenUpdate.txt
<SYSTEM32>\is-3K5JT.tmp в <SYSTEM32>\Mscomctl.ocx
<SYSTEM32>\is-57NKJ.tmp в <SYSTEM32>\Msinet.ocx
%ProgramFiles%\Driver Magician\is-BFJUN.tmp в %ProgramFiles%\Driver Magician\DutchHelp.chm
%ProgramFiles%\Driver Magician\is-IA2F5.tmp в %ProgramFiles%\Driver Magician\Help.chm
%ProgramFiles%\Driver Magician\is-LB5GN.tmp в %ProgramFiles%\Driver Magician\icon.ico
%ProgramFiles%\Driver Magician\is-KJE0R.tmp в %ProgramFiles%\Driver Magician\Homepage.url
%ProgramFiles%\Driver Magician\is-0NH1V.tmp в %ProgramFiles%\Driver Magician\Driver Magician.exe
%ProgramFiles%\Driver Magician\is-1T921.tmp в %ProgramFiles%\Driver Magician\unins000.exe
%ProgramFiles%\Driver Magician\is-TEE3T.tmp в %ProgramFiles%\Driver Magician\pcidevs.txt
%ProgramFiles%\Driver Magician\is-74KE3.tmp в %ProgramFiles%\Driver Magician\Readme.txt
%ProgramFiles%\Driver Magician\is-76CQ9.tmp в %ProgramFiles%\Driver Magician\DriverDB.dat
%ProgramFiles%\Driver Magician\Language\is-EBQ9I.tmp в %ProgramFiles%\Driver Magician\Language\German.ini
%ProgramFiles%\Driver Magician\Language\is-TSQ2F.tmp в %ProgramFiles%\Driver Magician\Language\French.ini
%ProgramFiles%\Driver Magician\Language\is-FJBVQ.tmp в %ProgramFiles%\Driver Magician\Language\Hungarian.ini
%ProgramFiles%\Driver Magician\Language\is-EB7A7.tmp в %ProgramFiles%\Driver Magician\Language\Hebrew.ini
%ProgramFiles%\Driver Magician\Language\is-HLRSO.tmp в %ProgramFiles%\Driver Magician\Language\Arabic.ini
%ProgramFiles%\Driver Magician\is-N7IDA.tmp в %ProgramFiles%\Driver Magician\public.key
%ProgramFiles%\Driver Magician\Language\is-3LV9T.tmp в %ProgramFiles%\Driver Magician\Language\English.ini
%ProgramFiles%\Driver Magician\Language\is-AVMR8.tmp в %ProgramFiles%\Driver Magician\Language\Dutch.ini