Техническая информация
Для обеспечения автозапуска и распространения:
Заражает следующие исполняемые файлы:
- C:\Far2\Plugins\arclite\7zS2con.sfx
- C:\Far2\Plugins\arclite\7z.sfx
- C:\Far2\Plugins\arclite\7zCon.sfx
- C:\Far2\Plugins\arclite\7zSD.sfx
- C:\Far2\Plugins\arclite\7zS2.sfx
- C:\Far2\Plugins\FTP\lib\ftpDirList.fll
- C:\Far2\Plugins\FTP\lib\ftpProgress.fll
- %CommonProgramFiles%\System\ado\msado26.tlb
- %CommonProgramFiles%\System\ado\msado25.tlb
- %CommonProgramFiles%\System\ado\msado27.tlb
- %CommonProgramFiles%\System\ado\msado20.tlb
- %CommonProgramFiles%\System\ado\msado21.tlb
- %CommonProgramFiles%\System\Ole DB\sqloledb.rll
- %CommonProgramFiles%\System\Ole DB\sqlxmlx.rll
Изменения в файловой системе:
Создает следующие файлы:
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\7dc80875910261de2fa3b5f12eefc92f_23ef5514-3059-436f-a4a7-4cefaab20eb1
- C:\Muldrop\DECRYPT__INFORMATION.iunm_48
- C:\Muldrop\DECRYPT__INFORMATION.iunm_27
- C:\Muldrop\DECRYPT__INFORMATION.iunm_6
- C:\Muldrop\DECRYPT__INFORMATION.iunm_51
- %ProgramFiles%\DECRYPT__INFORMATION.html
- C:\Muldrop\PUBLIC_0
- %CommonProgramFiles%\DECRYPT__INFORMATION.html
- %CommonProgramFiles%\MSSoap\DECRYPT__INFORMATION.html
- C:\Muldrop\DECRYPT__INFORMATION.iunm_53
- C:\Muldrop\DECRYPT__INFORMATION.iunm_55
- %CommonProgramFiles%\MSSoap\Binaries\DECRYPT__INFORMATION.html
- %CommonProgramFiles%\System\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\chrome\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\chrome\browser\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\chrome\browser\content\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\chrome\browser\content\browser\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\chrome\browser\skin\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\chrome\browser\skin\classic\DECRYPT__INFORMATION.html
- %CommonProgramFiles%\MSSoap\Binaries\Resources\DECRYPT__INFORMATION.html
- %CommonProgramFiles%\ODBC\DECRYPT__INFORMATION.html
- C:\Muldrop\DECRYPT__INFORMATION.iunm_59
- C:\Muldrop\DECRYPT__INFORMATION.iunm_4
- C:\Muldrop\DECRYPT__INFORMATION.iunm_54
- C:\Muldrop\DECRYPT__INFORMATION.iunm_38
- C:\Muldrop\DECRYPT__INFORMATION.iunm_24
- C:\Muldrop\DECRYPT__INFORMATION.iunm_31
- C:\Muldrop\DECRYPT__INFORMATION.iunm_5
- C:\Muldrop\DECRYPT__INFORMATION.iunm_35
- C:\Muldrop\DECRYPT__INFORMATION.iunm_23
- C:\Muldrop\DECRYPT__INFORMATION.iunm_46
- C:\Muldrop\DECRYPT__INFORMATION.iunm_28
- C:\Muldrop\DECRYPT__INFORMATION.iunm_22
- C:\Muldrop\DECRYPT__INFORMATION.iunm_49
- C:\Muldrop\DECRYPT__INFORMATION.iunm_9
- C:\Muldrop\DECRYPT__INFORMATION.iunm_52
- C:\Muldrop\DECRYPT__INFORMATION.iunm_42
- C:\Muldrop\DECRYPT__INFORMATION.iunm_40
- C:\Muldrop\DECRYPT__INFORMATION.iunm_33
- C:\Muldrop\DECRYPT__INFORMATION.iunm_26
- C:\Muldrop\DECRYPT__INFORMATION.iunm_57
- C:\Muldrop\DECRYPT__INFORMATION.iunm_41
- C:\Muldrop\DECRYPT__INFORMATION.iunm_19
- C:\Muldrop\DECRYPT__INFORMATION.iunm_7
- C:\Muldrop\DECRYPT__INFORMATION.iunm_58
- %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\chrome\en-US\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\defaults\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\defaults\profile\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\extensions\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\modules\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\modules\services-sync\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\res\DECRYPT__INFORMATION.html
- %ProgramFiles%\Internet Explorer\DECRYPT__INFORMATION.html
- %ProgramFiles%\Internet Explorer\MUI\DECRYPT__INFORMATION.html
- %ProgramFiles%\microsoft frontpage\DECRYPT__INFORMATION.html
- %ProgramFiles%\microsoft frontpage\version3.0\DECRYPT__INFORMATION.html
- %ProgramFiles%\Movie Maker\DECRYPT__INFORMATION.html
- %ProgramFiles%\Movie Maker\MUI\DECRYPT__INFORMATION.html
- %ProgramFiles%\Movie Maker\Shared\DECRYPT__INFORMATION.html
- %ProgramFiles%\MSN\DECRYPT__INFORMATION.html
- %ProgramFiles%\MSN\MSNCoreFiles\DECRYPT__INFORMATION.html
- %ProgramFiles%\MSN\MSNCoreFiles\Install\DECRYPT__INFORMATION.html
- %ProgramFiles%\xerox\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\skin\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\chrome\en-US\locale\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\chrome\en-US\locale\browser\DECRYPT__INFORMATION.html
- %CommonProgramFiles%\System\ado\msado20.tlb.new
- %CommonProgramFiles%\System\ado\msado26.tlb.new
- %CommonProgramFiles%\System\ado\msado25.tlb.new
- %CommonProgramFiles%\System\ado\msado27.tlb.new
- %CommonProgramFiles%\System\ado\msado21.tlb.new
- %ProgramFiles%\FireFox\chrome\en-US\locale\en-US\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global-platform\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\chrome\pippki\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\chrome\pippki\content\DECRYPT__INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\DECRYPT__INFORMATION.html
- <SYSTEM32>\dllcache\msado20.tlb.new
- <SYSTEM32>\dllcache\msado26.tlb.new
- %ProgramFiles%\FireFox\chrome\toolkit\content\DECRYPT__INFORMATION.html
- <SYSTEM32>\dllcache\msado25.tlb.new
- <SYSTEM32>\dllcache\msado27.tlb.new
- <SYSTEM32>\dllcache\msado21.tlb.new
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\DECRYPT__INFORMATION.html
- C:\RECYCLER\DECRYPT__INFORMATION.html
- C:\Muldrop\DECRYPT__INFORMATION.iunm_2
- C:\Muldrop\DECRYPT__INFORMATION.iunm_0
- C:\Muldrop\DECRYPT__INFORMATION.iunm_17
- C:\Documents and Settings\NetworkService\DECRYPT__INFORMATION.html
- C:\Documents and Settings\NetworkService\Local Settings\DECRYPT__INFORMATION.html
- C:\Documents and Settings\NetworkService\Local Settings\History\DECRYPT__INFORMATION.html
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\DECRYPT__INFORMATION.html
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\DECRYPT__INFORMATION.html
- %HOMEPATH%\DECRYPT__INFORMATION.html
- %APPDATA%\DECRYPT__INFORMATION.html
- %APPDATA%\Identities\DECRYPT__INFORMATION.html
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\DECRYPT__INFORMATION.html
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\DECRYPT__INFORMATION.html
- %HOMEPATH%\Favorites\DECRYPT__INFORMATION.html
- <LS_APPDATA>\Identities\DECRYPT__INFORMATION.html
- %HOMEPATH%\Local Settings\History\DECRYPT__INFORMATION.html
- %HOMEPATH%\Local Settings\History\History.IE5\DECRYPT__INFORMATION.html
- %HOMEPATH%\Local Settings\<INETFILES>\DECRYPT__INFORMATION.html
- %HOMEPATH%\My Documents\DECRYPT__INFORMATION.html
- %HOMEPATH%\Start Menu\DECRYPT__INFORMATION.html
- %HOMEPATH%\Start Menu\Programs\DECRYPT__INFORMATION.html
- %HOMEPATH%\Start Menu\Programs\Accessories\DECRYPT__INFORMATION.html
- %HOMEPATH%\Local Settings\DECRYPT__INFORMATION.html
- <LS_APPDATA>\DECRYPT__INFORMATION.html
- C:\Documents and Settings\LocalService\Local Settings\History\DECRYPT__INFORMATION.html
- C:\Documents and Settings\LocalService\Local Settings\DECRYPT__INFORMATION.html
- C:\Documents and Settings\LocalService\DECRYPT__INFORMATION.html
- C:\Documents and Settings\Default User\UNIQUE__ID_DO_NOT__REMOVE
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_23ef5514-3059-436f-a4a7-4cefaab20eb1
- C:\DECRYPT__INFORMATION.html
- C:\Documents and Settings\DECRYPT__INFORMATION.html
- %ALLUSERSPROFILE%\DECRYPT__INFORMATION.html
- %ALLUSERSPROFILE%\Documents\DECRYPT__INFORMATION.html
- %ALLUSERSPROFILE%\Documents\My Music\DECRYPT__INFORMATION.html
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\DECRYPT__INFORMATION.html
- %ALLUSERSPROFILE%\Documents\My Pictures\DECRYPT__INFORMATION.html
- C:\Documents and Settings\Default User\PUBLIC
- %ALLUSERSPROFILE%\Start Menu\DECRYPT__INFORMATION.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\DECRYPT__INFORMATION.html
- C:\Documents and Settings\Default User\DECRYPT__INFORMATION.html
- C:\Documents and Settings\Default User\Local Settings\DECRYPT__INFORMATION.html
- C:\Documents and Settings\Default User\Local Settings\History\DECRYPT__INFORMATION.html
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\DECRYPT__INFORMATION.html
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\DECRYPT__INFORMATION.html
- C:\Documents and Settings\Default User\Start Menu\DECRYPT__INFORMATION.html
- C:\Documents and Settings\Default User\Start Menu\Programs\DECRYPT__INFORMATION.html
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\DECRYPT__INFORMATION.html
- %ALLUSERSPROFILE%\Start Menu\Programs\DECRYPT__INFORMATION.html
- C:\Far2\DECRYPT__INFORMATION.html
- C:\Far2\Addons\DECRYPT__INFORMATION.html
- C:\Far2\Addons\Colors\DECRYPT__INFORMATION.html
- C:\Far2\Addons\XLat\DECRYPT__INFORMATION.html
- C:\Muldrop\DECRYPT__INFORMATION.iunm_47
- C:\Muldrop\DECRYPT__INFORMATION.iunm_39
- C:\Muldrop\DECRYPT__INFORMATION.iunm_43
- C:\Muldrop\DECRYPT__INFORMATION.iunm_14
- C:\Muldrop\DECRYPT__INFORMATION.iunm_8
- C:\Muldrop\DECRYPT__INFORMATION.iunm_16
- C:\Muldrop\DECRYPT__INFORMATION.iunm_21
- C:\Muldrop\DECRYPT__INFORMATION.iunm_29
- C:\Muldrop\DECRYPT__INFORMATION.iunm_12
- C:\Muldrop\DECRYPT__INFORMATION.iunm_61
- C:\Muldrop\DECRYPT__INFORMATION.iunm_20
- C:\Muldrop\DECRYPT__INFORMATION.iunm_56
- C:\Muldrop\DECRYPT__INFORMATION.iunm_45
- C:\Muldrop\DECRYPT__INFORMATION.iunm_37
- C:\Muldrop\DECRYPT__INFORMATION.iunm_44
- C:\Muldrop\DECRYPT__INFORMATION.iunm_1
- C:\Muldrop\DECRYPT__INFORMATION.iunm_60
- C:\Muldrop\DECRYPT__INFORMATION.iunm_30
- C:\Muldrop\DECRYPT__INFORMATION.iunm_50
- C:\Muldrop\DECRYPT__INFORMATION.iunm_34
- C:\Muldrop\DECRYPT__INFORMATION.iunm_32
- C:\Muldrop\DECRYPT__INFORMATION.iunm_11
- C:\Muldrop\DECRYPT__INFORMATION.iunm_15
- C:\Muldrop\DECRYPT__INFORMATION.iunm_18
- C:\Muldrop\DECRYPT__INFORMATION.iunm_3
- C:\Far2\Documentation\DECRYPT__INFORMATION.html
- C:\Far2\Plugins\DECRYPT__INFORMATION.html
- C:\Far2\Plugins\Colorer\DECRYPT__INFORMATION.html
- C:\Far2\Plugins\Colorer\hrc\DECRYPT__INFORMATION.html
- C:\Far2\Plugins\Colorer\hrc\auto\DECRYPT__INFORMATION.html
- C:\Far2\Plugins\Colorer\hrd\DECRYPT__INFORMATION.html
- C:\Far2\Plugins\Colorer\hrd\console\DECRYPT__INFORMATION.html
- C:\Far2\Plugins\ExtSearch\DECRYPT__INFORMATION.html
- C:\Far2\Plugins\ExtSearch\sources\DECRYPT__INFORMATION.html
- C:\Far2\Plugins\FTP\DECRYPT__INFORMATION.html
- C:\Far2\Plugins\WinSCP\DECRYPT__INFORMATION.html
- C:\Far2\Plugins\WinSCP\filezilla\DECRYPT__INFORMATION.html
- C:\Far2\Plugins\WinSCP\packages\DECRYPT__INFORMATION.html
- C:\Far2\Plugins\WinSCP\putty\DECRYPT__INFORMATION.html
- C:\Far2\PluginSDK\DECRYPT__INFORMATION.html
- C:\Muldrop\08f575673ddf10d72090304839888f02_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_0
- C:\Muldrop\7ed80875910261ef2gb3c5g12ffgd92g_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_1
- C:\Muldrop\7ed80875910261ef2gb3c5g12ffgd92g_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_0
- C:\Muldrop\DECRYPT__INFORMATION.iunm_10
- C:\Muldrop\DECRYPT__INFORMATION.iunm_13
- C:\Muldrop\DECRYPT__INFORMATION.iunm_36
- C:\Muldrop\DECRYPT__INFORMATION.iunm_25
- <STUBS_DIR>\DECRYPT__INFORMATION.html
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
