Trojan.MulDrop7.54092

Техническая информация

Изменения в файловой системе:

Создает следующие файлы:

%ProgramFiles%\Advanced JPEG Compressor\Profiles\is-T91PF.tmp
%ProgramFiles%\Advanced JPEG Compressor\Profiles\is-R054Q.tmp
%ProgramFiles%\Advanced JPEG Compressor\is-CKQRN.tmp
%ProgramFiles%\Advanced JPEG Compressor\Profiles\is-MELFF.tmp
%ProgramFiles%\Advanced JPEG Compressor\Profiles\is-UGHF7.tmp
%ProgramFiles%\Advanced JPEG Compressor\Profiles\is-6JSII.tmp
%ProgramFiles%\Advanced JPEG Compressor\Profiles\is-RVT5G.tmp
%ProgramFiles%\Advanced JPEG Compressor\is-T885J.tmp
%HOMEPATH%\SendTo\Advanced JPEG Compressor (process...).lnk
%ProgramFiles%\Advanced JPEG Compressor\unins000.exe
%ProgramFiles%\Advanced JPEG Compressor\unins000.dat
%HOMEPATH%\SendTo\Advanced JPEG Compressor (open).lnk
%ProgramFiles%\Advanced JPEG Compressor\is-M4MB4.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Advanced JPEG Compressor.lnk
%HOMEPATH%\Desktop\Advanced JPEG Compressor.lnk
%ProgramFiles%\Advanced JPEG Compressor\Profiles\is-V4J4D.tmp
%ProgramFiles%\Advanced JPEG Compressor\is-UR7JA.tmp
%ProgramFiles%\Advanced JPEG Compressor\is-G21A1.tmp
%ProgramFiles%\Advanced JPEG Compressor\is-R539T.tmp
%ProgramFiles%\Advanced JPEG Compressor\is-1P7A7.tmp
%TEMP%\RarSFX0\adv.bat
%TEMP%\RarSFX0\adv.exe
%TEMP%\is-RB7T8.tmp\_shfoldr.dll
%ProgramFiles%\Advanced JPEG Compressor\is-FFSGH.tmp
%ProgramFiles%\Advanced JPEG Compressor\Profiles\is-C6MCK.tmp
%ProgramFiles%\Advanced JPEG Compressor\Profiles\is-7L2MH.tmp
%ProgramFiles%\Advanced JPEG Compressor\Profiles\is-UIVE9.tmp
%ProgramFiles%\Advanced JPEG Compressor\is-T0FNM.tmp
%ProgramFiles%\Advanced JPEG Compressor\is-FUELT.tmp
%ProgramFiles%\Advanced JPEG Compressor\is-KEM5U.tmp
%ProgramFiles%\Advanced JPEG Compressor\is-C230B.tmp

Удаляет следующие файлы:

%TEMP%\INS1.tmp
%TEMP%\is-RB7T8.tmp\_shfoldr.dll

Перемещает следующие файлы:

%ProgramFiles%\Advanced JPEG Compressor\Profiles\is-MELFF.tmp в %ProgramFiles%\Advanced JPEG Compressor\Profiles\Scanned Text.jcp
%ProgramFiles%\Advanced JPEG Compressor\Profiles\is-T91PF.tmp в %ProgramFiles%\Advanced JPEG Compressor\Profiles\Screenshot.jcp
%ProgramFiles%\Advanced JPEG Compressor\Profiles\is-UIVE9.tmp в %ProgramFiles%\Advanced JPEG Compressor\Profiles\Compress for PocketPC.jcp
%ProgramFiles%\Advanced JPEG Compressor\Profiles\is-V4J4D.tmp в %ProgramFiles%\Advanced JPEG Compressor\Profiles\E-Mail Photo.jcp
%ProgramFiles%\Advanced JPEG Compressor\is-T885J.tmp в %ProgramFiles%\Advanced JPEG Compressor\ajcieex.htm
%ProgramFiles%\Advanced JPEG Compressor\is-M4MB4.tmp в %ProgramFiles%\Advanced JPEG Compressor\ExShell.ocx
%ProgramFiles%\Advanced JPEG Compressor\Profiles\is-R054Q.tmp в %ProgramFiles%\Advanced JPEG Compressor\Profiles\Thumbnail 100x100.jcp
%ProgramFiles%\Advanced JPEG Compressor\is-CKQRN.tmp в %ProgramFiles%\Advanced JPEG Compressor\ContextMenuExt.dll
%ProgramFiles%\Advanced JPEG Compressor\is-T0FNM.tmp в %ProgramFiles%\Advanced JPEG Compressor\cprofile.ico
%ProgramFiles%\Advanced JPEG Compressor\is-G21A1.tmp в %ProgramFiles%\Advanced JPEG Compressor\ajc_console.exe
%ProgramFiles%\Advanced JPEG Compressor\is-R539T.tmp в %ProgramFiles%\Advanced JPEG Compressor\ajc.chm
%ProgramFiles%\Advanced JPEG Compressor\is-1P7A7.tmp в %ProgramFiles%\Advanced JPEG Compressor\unins000.exe
%ProgramFiles%\Advanced JPEG Compressor\is-UR7JA.tmp в %ProgramFiles%\Advanced JPEG Compressor\ajc.exe
%ProgramFiles%\Advanced JPEG Compressor\is-KEM5U.tmp в %ProgramFiles%\Advanced JPEG Compressor\license.txt
%ProgramFiles%\Advanced JPEG Compressor\is-C230B.tmp в %ProgramFiles%\Advanced JPEG Compressor\readme.txt
%ProgramFiles%\Advanced JPEG Compressor\is-FFSGH.tmp в %ProgramFiles%\Advanced JPEG Compressor\ajcGettingStarted.chm
%ProgramFiles%\Advanced JPEG Compressor\is-FUELT.tmp в %ProgramFiles%\Advanced JPEG Compressor\file_id.diz

Другое:

Ищет следующие окна:

ClassName: 'EDIT' WindowName: ''

Создает и запускает на исполнение:

'%TEMP%\INS1.tmp' /SL3 $10106 %TEMP%\RarSFX0\adv.exe 1787727 1791087 61440 /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\RarSFX0\adv.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-

Запускает на исполнение:

'<SYSTEM32>\reg.exe' ADD "HKCU\SOFTWARE\WinSoftMagic\AJC" /v "ExePath" /t REG_SZ /d "C:\\Program Files (x86)\\Advanced JPEG Compressor\\ajc.exe" /f
'<SYSTEM32>\reg.exe' ADD "HKCU\SOFTWARE\WinSoftMagic\AJC" /v "StartCtr1" /t REG_SZ /d "42702735" /f
'<SYSTEM32>\reg.exe' ADD "HKCU\SOFTWARE\WinSoftMagic\AJC" /f
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\adv.bat" "
'<SYSTEM32>\reg.exe' ADD "HKCU\SOFTWARE\WinSoftMagic" /f