Trojan.MulDrop8.1364

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'USB Security' = '%ProgramFiles%\USB Disk Security\USBGuard.exe'

Изменения в файловой системе:

Создает следующие файлы:

%ProgramFiles%\USB Disk Security\locales\is-A3BHA.tmp
%ProgramFiles%\USB Disk Security\locales\is-98KVF.tmp
%ProgramFiles%\USB Disk Security\locales\is-6P3U5.tmp
%ProgramFiles%\USB Disk Security\is-UI926.tmp
%ProgramFiles%\USB Disk Security\locales\is-N5QIT.tmp
%ProgramFiles%\USB Disk Security\locales\is-KTB2M.tmp
%ProgramFiles%\USB Disk Security\locales\is-ADONK.tmp
%ProgramFiles%\USB Disk Security\locales\is-UJPCR.tmp
%ProgramFiles%\USB Disk Security\locales\is-BNU4H.tmp
%ProgramFiles%\USB Disk Security\locales\is-D1KNU.tmp
%ProgramFiles%\USB Disk Security\locales\is-TMNVO.tmp
%ProgramFiles%\USB Disk Security\locales\is-L2GJO.tmp
%TEMP%\aut3.tmp
%ProgramFiles%\USB Disk Security\unins000.dat
%ALLUSERSPROFILE%\Desktop\USB Disk Security.lnk
%TEMP%\usb2.tmp
%TEMP%\aut4.tmp
%TEMP%\usb.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\USB Disk Security\Web Navigation.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\USB Disk Security\USB Disk Security.lnk
%ProgramFiles%\USB Disk Security\locales\is-J0U5U.tmp
%ALLUSERSPROFILE%\Desktop\Web Navigation.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\USB Disk Security\Uninstall USB Disk Security.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\USB Disk Security\Help.lnk
%ProgramFiles%\USB Disk Security\locales\is-IEP9A.tmp
%ProgramFiles%\USB Disk Security\is-3JL56.tmp
%ProgramFiles%\USB Disk Security\is-A9AFM.tmp
%ProgramFiles%\USB Disk Security\is-1VJGL.tmp
%ProgramFiles%\USB Disk Security\is-S8U0F.tmp
%ProgramFiles%\USB Disk Security\is-9LJDQ.tmp
%ProgramFiles%\USB Disk Security\is-7A9JU.tmp
%TEMP%\aut2.tmp
%TEMP%\uoxodwy
%TEMP%\aut1.tmp
%TEMP%\is-13953.tmp\_isetup\_shfoldr.dll
%TEMP%\is-DKC84.tmp\USBGuard6.4.0.1.tmp
%TEMP%\USBGuard6.4.0.1.exe
%ProgramFiles%\USB Disk Security\is-BU6EC.tmp
%ProgramFiles%\USB Disk Security\is-MOQU4.tmp
%ProgramFiles%\USB Disk Security\is-A3BAH.tmp
%ProgramFiles%\USB Disk Security\locales\is-KK3KH.tmp
%ProgramFiles%\USB Disk Security\locales\is-PKJ5K.tmp
%ProgramFiles%\USB Disk Security\locales\is-IGR6S.tmp
%ProgramFiles%\USB Disk Security\is-QVS7R.tmp
%ProgramFiles%\USB Disk Security\is-N2O5B.tmp
%ProgramFiles%\USB Disk Security\is-Q8QK3.tmp
%ProgramFiles%\USB Disk Security\is-5Q922.tmp
%ProgramFiles%\USB Disk Security\is-6MRL7.tmp
%ProgramFiles%\USB Disk Security\is-IFAHN.tmp

Удаляет следующие файлы:

%TEMP%\USBGuard6.4.0.1.exe
%TEMP%\is-DKC84.tmp\USBGuard6.4.0.1.tmp
%TEMP%\aut4.tmp
%TEMP%\aut3.tmp
%TEMP%\uoxodwy
%TEMP%\aut1.tmp
%TEMP%\is-13953.tmp\_isetup\_shfoldr.dll
%TEMP%\aut2.tmp

Перемещает следующие файлы:

%ProgramFiles%\USB Disk Security\locales\is-L2GJO.tmp в %ProgramFiles%\USB Disk Security\locales\indonesian.dll
%ProgramFiles%\USB Disk Security\locales\is-ADONK.tmp в %ProgramFiles%\USB Disk Security\locales\ukrainian.dll
%ProgramFiles%\USB Disk Security\locales\is-D1KNU.tmp в %ProgramFiles%\USB Disk Security\locales\turkish.dll
%ProgramFiles%\USB Disk Security\locales\is-TMNVO.tmp в %ProgramFiles%\USB Disk Security\locales\thai.dll
%ProgramFiles%\USB Disk Security\locales\is-IEP9A.tmp в %ProgramFiles%\USB Disk Security\locales\spanish.dll
%ProgramFiles%\USB Disk Security\locales\is-KK3KH.tmp в %ProgramFiles%\USB Disk Security\locales\russian.dll
%ProgramFiles%\USB Disk Security\locales\is-UJPCR.tmp в %ProgramFiles%\USB Disk Security\locales\french.dll
%ProgramFiles%\USB Disk Security\locales\is-BNU4H.tmp в %ProgramFiles%\USB Disk Security\locales\japanese.dll
%ProgramFiles%\USB Disk Security\locales\is-6P3U5.tmp в %ProgramFiles%\USB Disk Security\locales\arabic.dll
%ProgramFiles%\USB Disk Security\locales\is-J0U5U.tmp в %ProgramFiles%\USB Disk Security\locales\chinese.dll
%ProgramFiles%\USB Disk Security\is-UI926.tmp в %ProgramFiles%\USB Disk Security\USBSet.exe
%TEMP%\usb2.tmp в %APPDATA%\Zbshareware Lab\USBGuard\program_config.ini
%TEMP%\usb.tmp в %ALLUSERSPROFILE%\Application Data\Zbshareware Lab\profile.ini
%ProgramFiles%\USB Disk Security\locales\is-A3BHA.tmp в %ProgramFiles%\USB Disk Security\locales\Microsoft.VC80.CRT.manifest
%ProgramFiles%\USB Disk Security\locales\is-98KVF.tmp в %ProgramFiles%\USB Disk Security\locales\vietnam.dll
%ProgramFiles%\USB Disk Security\locales\is-N5QIT.tmp в %ProgramFiles%\USB Disk Security\locales\msvcr80.dll
%ProgramFiles%\USB Disk Security\locales\is-KTB2M.tmp в %ProgramFiles%\USB Disk Security\locales\msvcp80.dll
%ProgramFiles%\USB Disk Security\is-S8U0F.tmp в %ProgramFiles%\USB Disk Security\mfc80u.dll
%ProgramFiles%\USB Disk Security\is-9LJDQ.tmp в %ProgramFiles%\USB Disk Security\BCGPStyle2010Blue150.dll
%ProgramFiles%\USB Disk Security\is-N2O5B.tmp в %ProgramFiles%\USB Disk Security\Microsoft.VC80.MFC.manifest
%ProgramFiles%\USB Disk Security\is-Q8QK3.tmp в %ProgramFiles%\USB Disk Security\Microsoft.VC80.CRT.manifest
%ProgramFiles%\USB Disk Security\is-A9AFM.tmp в %ProgramFiles%\USB Disk Security\USBGuard.exe
%ProgramFiles%\USB Disk Security\is-1VJGL.tmp в %ProgramFiles%\USB Disk Security\unins000.exe
%ProgramFiles%\USB Disk Security\is-7A9JU.tmp в %ProgramFiles%\USB Disk Security\BCGCBPRO1500u80.dll
%ProgramFiles%\USB Disk Security\is-3JL56.tmp в %ProgramFiles%\USB Disk Security\USBGuard.chm
%ProgramFiles%\USB Disk Security\is-QVS7R.tmp в %ProgramFiles%\USB Disk Security\msvcp80.dll
%ProgramFiles%\USB Disk Security\is-BU6EC.tmp в %ProgramFiles%\USB Disk Security\version.ini
%ProgramFiles%\USB Disk Security\is-MOQU4.tmp в %ProgramFiles%\USB Disk Security\log3.dmb
%ProgramFiles%\USB Disk Security\locales\is-PKJ5K.tmp в %ProgramFiles%\USB Disk Security\locales\portuese.dll
%ProgramFiles%\USB Disk Security\locales\is-IGR6S.tmp в %ProgramFiles%\USB Disk Security\locales\chinetw.dll
%ProgramFiles%\USB Disk Security\is-6MRL7.tmp в %ProgramFiles%\USB Disk Security\log.dmb
%ProgramFiles%\USB Disk Security\is-IFAHN.tmp в %ProgramFiles%\USB Disk Security\msvcr80.dll
%ProgramFiles%\USB Disk Security\is-A3BAH.tmp в %ProgramFiles%\USB Disk Security\log2.dmb
%ProgramFiles%\USB Disk Security\is-5Q922.tmp в %ProgramFiles%\USB Disk Security\log1.dmb

Другое:

Создает и запускает на исполнение:

'%ProgramFiles%\USB Disk Security\USBGuard.exe'
'%TEMP%\is-DKC84.tmp\USBGuard6.4.0.1.tmp' /SL5="$100E4,3801169,54272,%TEMP%\USBGuard6.4.0.1.exe" /silent /nocancel /CLOSEAPPLICATIONS /TASKS="desktopicon"
'%TEMP%\USBGuard6.4.0.1.exe' /silent /nocancel /CLOSEAPPLICATIONS /TASKS="desktopicon"