Техническая информация
Для обеспечения автозапуска и распространения:
Заражает следующие исполняемые файлы:
- C:\Far2\Plugins\arclite\7z.sfx
- C:\Far2\Plugins\arclite\7zS2.sfx
- C:\Far2\Plugins\arclite\7zCon.sfx
- C:\Far2\Plugins\arclite\7zS2con.sfx
- C:\Far2\Plugins\arclite\7zSD.sfx
- C:\Far2\Plugins\FTP\lib\ftpProgress.fll
- C:\Far2\Plugins\FTP\lib\ftpDirList.fll
- %CommonProgramFiles%\System\ado\msado21.tlb
- %CommonProgramFiles%\System\ado\msado26.tlb
- %CommonProgramFiles%\System\ado\msado27.tlb
- %CommonProgramFiles%\System\ado\msado20.tlb
- %CommonProgramFiles%\System\Ole DB\sqloledb.rll
- %CommonProgramFiles%\System\ado\msado25.tlb
- %CommonProgramFiles%\System\Ole DB\sqlxmlx.rll
Изменения в файловой системе:
Создает следующие файлы:
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\60ab7492cc039a867c9d2b0144c3d0d6_23ef5514-3059-436f-a4a7-4cefaab20eb1
- C:\Muldrop\DECRYPT_INFORMATION.iunm_58
- C:\Muldrop\DECRYPT_INFORMATION.iunm_5
- C:\Muldrop\DECRYPT_INFORMATION.iunm_60
- C:\Muldrop\DECRYPT_INFORMATION.iunm_61
- %ProgramFiles%\DECRYPT_INFORMATION.html
- C:\Muldrop\PUBLIC_0
- %CommonProgramFiles%\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\MSSoap\DECRYPT_INFORMATION.html
- C:\Muldrop\DECRYPT_INFORMATION.iunm_57
- C:\Muldrop\DECRYPT_INFORMATION.iunm_6
- %CommonProgramFiles%\MSSoap\Binaries\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\System\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\browser\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\browser\content\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\browser\content\browser\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\browser\skin\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\browser\skin\classic\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\MSSoap\Binaries\Resources\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\ODBC\DECRYPT_INFORMATION.html
- C:\Muldrop\DECRYPT_INFORMATION.iunm_4
- C:\Muldrop\DECRYPT_INFORMATION.iunm_8
- C:\Muldrop\DECRYPT_INFORMATION.iunm_29
- C:\Muldrop\DECRYPT_INFORMATION.iunm_36
- C:\Muldrop\DECRYPT_INFORMATION.iunm_3
- C:\Muldrop\DECRYPT_INFORMATION.iunm_42
- C:\Muldrop\DECRYPT_INFORMATION.iunm_38
- C:\Muldrop\DECRYPT_INFORMATION.iunm_35
- C:\Muldrop\DECRYPT_INFORMATION.iunm_17
- C:\Muldrop\DECRYPT_INFORMATION.iunm_34
- C:\Muldrop\DECRYPT_INFORMATION.iunm_48
- C:\Muldrop\DECRYPT_INFORMATION.iunm_31
- C:\Muldrop\DECRYPT_INFORMATION.iunm_20
- C:\Muldrop\DECRYPT_INFORMATION.iunm_7
- C:\Muldrop\DECRYPT_INFORMATION.iunm_46
- C:\Muldrop\DECRYPT_INFORMATION.iunm_32
- C:\Muldrop\DECRYPT_INFORMATION.iunm_54
- C:\Muldrop\DECRYPT_INFORMATION.iunm_18
- C:\Muldrop\DECRYPT_INFORMATION.iunm_53
- C:\Muldrop\DECRYPT_INFORMATION.iunm_49
- C:\Muldrop\DECRYPT_INFORMATION.iunm_9
- C:\Muldrop\DECRYPT_INFORMATION.iunm_47
- C:\Muldrop\DECRYPT_INFORMATION.iunm_59
- C:\Muldrop\DECRYPT_INFORMATION.iunm_25
- %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\System\ado\msado21.tlb.new
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\defaults\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\defaults\profile\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\extensions\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\modules\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\modules\services-sync\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\res\DECRYPT_INFORMATION.html
- %ProgramFiles%\Internet Explorer\DECRYPT_INFORMATION.html
- %ProgramFiles%\Internet Explorer\MUI\DECRYPT_INFORMATION.html
- %ProgramFiles%\microsoft frontpage\DECRYPT_INFORMATION.html
- %ProgramFiles%\microsoft frontpage\version3.0\DECRYPT_INFORMATION.html
- %ProgramFiles%\Movie Maker\DECRYPT_INFORMATION.html
- %ProgramFiles%\Movie Maker\MUI\DECRYPT_INFORMATION.html
- %ProgramFiles%\Movie Maker\Shared\DECRYPT_INFORMATION.html
- %ProgramFiles%\MSN\DECRYPT_INFORMATION.html
- %ProgramFiles%\MSN\MSNCoreFiles\DECRYPT_INFORMATION.html
- %ProgramFiles%\MSN\MSNCoreFiles\Install\DECRYPT_INFORMATION.html
- %ProgramFiles%\xerox\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\skin\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\System\ado\msado26.tlb.new
- %CommonProgramFiles%\System\ado\msado20.tlb.new
- %CommonProgramFiles%\System\ado\msado25.tlb.new
- %CommonProgramFiles%\System\ado\msado27.tlb.new
- %ProgramFiles%\FireFox\chrome\en-US\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\en-US\locale\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\en-US\locale\browser\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\en-US\locale\en-US\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global-platform\DECRYPT_INFORMATION.html
- <SYSTEM32>\dllcache\msado21.tlb.new
- <SYSTEM32>\dllcache\msado26.tlb.new
- %ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\DECRYPT_INFORMATION.html
- <SYSTEM32>\dllcache\msado20.tlb.new
- <SYSTEM32>\dllcache\msado25.tlb.new
- <SYSTEM32>\dllcache\msado27.tlb.new
- %ProgramFiles%\FireFox\chrome\pippki\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\pippki\content\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\content\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\DECRYPT_INFORMATION.html
- C:\RECYCLER\DECRYPT_INFORMATION.html
- C:\Muldrop\DECRYPT_INFORMATION.iunm_28
- C:\Muldrop\DECRYPT_INFORMATION.iunm_41
- C:\Muldrop\DECRYPT_INFORMATION.iunm_2
- C:\Documents and Settings\NetworkService\DECRYPT_INFORMATION.html
- C:\Documents and Settings\NetworkService\Local Settings\DECRYPT_INFORMATION.html
- C:\Documents and Settings\NetworkService\Local Settings\History\DECRYPT_INFORMATION.html
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\DECRYPT_INFORMATION.html
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\DECRYPT_INFORMATION.html
- %HOMEPATH%\DECRYPT_INFORMATION.html
- %APPDATA%\DECRYPT_INFORMATION.html
- %APPDATA%\Identities\DECRYPT_INFORMATION.html
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\DECRYPT_INFORMATION.html
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\DECRYPT_INFORMATION.html
- %HOMEPATH%\Favorites\DECRYPT_INFORMATION.html
- <LS_APPDATA>\Identities\DECRYPT_INFORMATION.html
- %HOMEPATH%\Local Settings\History\DECRYPT_INFORMATION.html
- %HOMEPATH%\Local Settings\History\History.IE5\DECRYPT_INFORMATION.html
- %HOMEPATH%\Local Settings\<INETFILES>\DECRYPT_INFORMATION.html
- %HOMEPATH%\My Documents\DECRYPT_INFORMATION.html
- %HOMEPATH%\Start Menu\DECRYPT_INFORMATION.html
- %HOMEPATH%\Start Menu\Programs\DECRYPT_INFORMATION.html
- %HOMEPATH%\Start Menu\Programs\Accessories\DECRYPT_INFORMATION.html
- %HOMEPATH%\Local Settings\DECRYPT_INFORMATION.html
- <LS_APPDATA>\DECRYPT_INFORMATION.html
- C:\Documents and Settings\LocalService\Local Settings\History\DECRYPT_INFORMATION.html
- C:\Documents and Settings\LocalService\Local Settings\DECRYPT_INFORMATION.html
- C:\Documents and Settings\LocalService\DECRYPT_INFORMATION.html
- C:\Documents and Settings\Default User\UNIQUE_ID_DO_NOT_REMOVE
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_23ef5514-3059-436f-a4a7-4cefaab20eb1
- C:\DECRYPT_INFORMATION.html
- C:\Documents and Settings\DECRYPT_INFORMATION.html
- %ALLUSERSPROFILE%\DECRYPT_INFORMATION.html
- %ALLUSERSPROFILE%\Documents\DECRYPT_INFORMATION.html
- %ALLUSERSPROFILE%\Documents\My Music\DECRYPT_INFORMATION.html
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\DECRYPT_INFORMATION.html
- %ALLUSERSPROFILE%\Documents\My Pictures\DECRYPT_INFORMATION.html
- C:\Documents and Settings\Default User\PUBLIC
- %ALLUSERSPROFILE%\Start Menu\DECRYPT_INFORMATION.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\DECRYPT_INFORMATION.html
- C:\Documents and Settings\Default User\DECRYPT_INFORMATION.html
- C:\Documents and Settings\Default User\Local Settings\DECRYPT_INFORMATION.html
- C:\Documents and Settings\Default User\Local Settings\History\DECRYPT_INFORMATION.html
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\DECRYPT_INFORMATION.html
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\DECRYPT_INFORMATION.html
- C:\Documents and Settings\Default User\Start Menu\DECRYPT_INFORMATION.html
- C:\Documents and Settings\Default User\Start Menu\Programs\DECRYPT_INFORMATION.html
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\DECRYPT_INFORMATION.html
- %ALLUSERSPROFILE%\Start Menu\Programs\DECRYPT_INFORMATION.html
- C:\Far2\DECRYPT_INFORMATION.html
- C:\Far2\Addons\DECRYPT_INFORMATION.html
- C:\Far2\Addons\Colors\DECRYPT_INFORMATION.html
- C:\Far2\Addons\XLat\DECRYPT_INFORMATION.html
- C:\Muldrop\DECRYPT_INFORMATION.iunm_26
- C:\Muldrop\DECRYPT_INFORMATION.iunm_56
- C:\Muldrop\DECRYPT_INFORMATION.iunm_22
- C:\Muldrop\DECRYPT_INFORMATION.iunm_51
- C:\Muldrop\DECRYPT_INFORMATION.iunm_30
- C:\Muldrop\DECRYPT_INFORMATION.iunm_40
- C:\Muldrop\DECRYPT_INFORMATION.iunm_39
- C:\Muldrop\DECRYPT_INFORMATION.iunm_33
- C:\Muldrop\DECRYPT_INFORMATION.iunm_37
- C:\Muldrop\DECRYPT_INFORMATION.iunm_44
- C:\Muldrop\DECRYPT_INFORMATION.iunm_52
- C:\Muldrop\DECRYPT_INFORMATION.iunm_15
- C:\Muldrop\DECRYPT_INFORMATION.iunm_50
- C:\Muldrop\DECRYPT_INFORMATION.iunm_21
- C:\Muldrop\DECRYPT_INFORMATION.iunm_0
- C:\Muldrop\DECRYPT_INFORMATION.iunm_55
- C:\Muldrop\DECRYPT_INFORMATION.iunm_27
- C:\Muldrop\DECRYPT_INFORMATION.iunm_45
- C:\Muldrop\DECRYPT_INFORMATION.iunm_24
- C:\Muldrop\DECRYPT_INFORMATION.iunm_16
- C:\Muldrop\DECRYPT_INFORMATION.iunm_23
- C:\Muldrop\DECRYPT_INFORMATION.iunm_43
- C:\Muldrop\DECRYPT_INFORMATION.iunm_14
- C:\Muldrop\DECRYPT_INFORMATION.iunm_10
- C:\Muldrop\DECRYPT_INFORMATION.iunm_12
- C:\Far2\Documentation\DECRYPT_INFORMATION.html
- C:\Far2\Plugins\DECRYPT_INFORMATION.html
- C:\Far2\Plugins\Colorer\DECRYPT_INFORMATION.html
- C:\Far2\Plugins\Colorer\hrc\DECRYPT_INFORMATION.html
- C:\Far2\Plugins\Colorer\hrc\auto\DECRYPT_INFORMATION.html
- C:\Far2\Plugins\Colorer\hrd\DECRYPT_INFORMATION.html
- C:\Far2\Plugins\Colorer\hrd\console\DECRYPT_INFORMATION.html
- C:\Far2\Plugins\ExtSearch\DECRYPT_INFORMATION.html
- C:\Far2\Plugins\ExtSearch\sources\DECRYPT_INFORMATION.html
- C:\Far2\Plugins\FTP\DECRYPT_INFORMATION.html
- C:\Far2\Plugins\WinSCP\DECRYPT_INFORMATION.html
- C:\Far2\Plugins\WinSCP\filezilla\DECRYPT_INFORMATION.html
- C:\Far2\Plugins\WinSCP\packages\DECRYPT_INFORMATION.html
- C:\Far2\Plugins\WinSCP\putty\DECRYPT_INFORMATION.html
- C:\Far2\PluginSDK\DECRYPT_INFORMATION.html
- C:\Muldrop\08f575673ddf10d72090304839888f02_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_0
- C:\Muldrop\60bc7492dd039b867d9e2c0144d3e0e6_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_0
- C:\Muldrop\60bc7492dd039b867d9e2c0144d3e0e6_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_1
- C:\Muldrop\DECRYPT_INFORMATION.iunm_11
- C:\Muldrop\DECRYPT_INFORMATION.iunm_13
- C:\Muldrop\DECRYPT_INFORMATION.iunm_19
- C:\Muldrop\DECRYPT_INFORMATION.iunm_1
- <STUBS_DIR>\DECRYPT_INFORMATION.html
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
