Trojan.MulDrop8.3841

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'

Изменяет следующие исполняемые системные файлы:

<SYSTEM32>\msvbvm60.dll

Изменения в файловой системе:

Создает следующие файлы:

%ProgramFiles%\Creata-Tree\Engine\Media\Bullet Icons\bookOpen_blue.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Bullet Icons\disk.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Bullet Icons\bookClosed_blue.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Bullet Icons\bookopen.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Bullet Icons\folderClosed.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Bullet Icons\macclosed.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Bullet Icons\macopen.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Bullet Icons\folderopen.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Bullet Icons\helpbook.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Bullet Icons\bookclosed.gif
%ProgramFiles%\Creata-Tree\Engine\tree.html
%ProgramFiles%\Creata-Tree\Engine\About\About.html
%ProgramFiles%\Creata-Tree\Engine\head.js
%ProgramFiles%\Creata-Tree\Engine\tlst.mid
%ProgramFiles%\Creata-Tree\Engine\About\aboutlogo.png
%ProgramFiles%\Creata-Tree\Engine\Media\Backgrounds\n7.bmp
%ProgramFiles%\Creata-Tree\Engine\Media\Bullet Icons\app.gif
%ProgramFiles%\Creata-Tree\Engine\Media\202.gif
%ProgramFiles%\Creata-Tree\Engine\Media\404.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Bullet Icons\mailbox.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Menu Pictures\companyon.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Menu Pictures\download.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Bullet Icons\world_blue.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Menu Pictures\company.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Menu Pictures\downloadon.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Menu Pictures\products.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Menu Pictures\productson.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Menu Pictures\email.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Menu Pictures\emailon.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Bullet Icons\world.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Bullet Icons\page.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Bullet Icons\page_blue.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Bullet Icons\overview.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Bullet Icons\overview_blue.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Bullet Icons\pencil.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Bullet Icons\topic_blue.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Bullet Icons\tree.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Bullet Icons\search.gif
%ProgramFiles%\Creata-Tree\Engine\Media\Bullet Icons\topic.gif
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
<SYSTEM32>\wbem\AutoRecover\23BDE61F1F4FACE17E9B0C01F2A1FD9B.mof
%TEMP%\nsy2.tmp\Wizard.exe
%TEMP%\nsy2.tmp\Manifest.ini
%TEMP%\IXP000.TMP\InstStar.exe
%TEMP%\IXP000.TMP\InstStar.cab
%ProgramFiles%\Creata-Tree\Uninstall.exe
<SYSTEM32>\wbem\AutoRecover\C8463ECBE33BC240263A0B094E46D510.mof
%TEMP%\tmp5.tmp
%TEMP%\tmp3.tmp
%TEMP%\tmp4.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
%ProgramFiles%\Creata-Tree\CreataTree.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
%ProgramFiles%\Creata-Tree\CreataTree.ini
%ProgramFiles%\Creata-Tree\Engine\body.js
%ProgramFiles%\Creata-Tree\Engine\custom.js
%ProgramFiles%\Creata-Tree\license.txt
%ProgramFiles%\Creata-Tree\Neotext.org.url
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP