Trojan.MulDrop8.58280

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\Applications\RegCloneDVD.exe\shell\open\command] '' = '"%ProgramFiles%\Elaborate Bytes\CloneDVD2\RegCloneDVD.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\elby.CloneDVD.1\shell\open\command] '' = '"%ProgramFiles%\Elaborate Bytes\CloneDVD2\RegCloneDVD.exe" "%1"'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\ElbyCDIO] 'Start' = '00000001'
[<HKLM>\SYSTEM\ControlSet001\Services\ElbyCDIO] 'ImagePath' = 'System32\Drivers\ElbyCDIO.sys'

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\7ZipSfx.000\SetupCloneDVD2.exe
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\fr\index.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\fr\process.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\fr\usage.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\images\clone_drive.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\images\clone_dvd.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\images\elby.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\images\left_light.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\es\index.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\images\mouse.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\it\before.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\it\command.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\it\drive.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\it\elby.css
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\it\images\audio_settings.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\it\images\case_copy.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\it\images\case_process.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\fr\images\title_selection.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\fr\images\writing_dvd.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\fr\images\source_output.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\fr\images\output_method.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\fr\images\film_strip.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\es\images\audio_settings.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\es\images\case_copy.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\es\images\case_process.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\es\images\film_strip.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\es\images\output_method.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\es\images\source_output.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\es\images\title_selection.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\it\images\drive_install.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\images\pixel.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\es\images\writing_dvd.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\es\usage.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\fr\before.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\fr\command.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\fr\elby.css
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\fr\images\audio_settings.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\fr\images\case_copy.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\fr\images\case_process.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\es\elby.css
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\es\process.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\ja\command.html
%ALLUSERSPROFILE%\Start Menu\Programs\Elaborate Bytes\CloneDVD2\CloneDVD2 Revision History.lnk
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\it\images\drive_verify.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\ja\images\writing_dvd.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\ja\index.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\ja\process.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\ja\usage.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\RegCloneDVD.exe
%ProgramFiles%\Elaborate Bytes\CloneDVD2\SetRegACL.exe
%ProgramFiles%\Elaborate Bytes\CloneDVD2\sounds\error.wav
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\it\images\drive_select.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\sounds\success.wav
%ProgramFiles%\Elaborate Bytes\CloneDVD2\WriteDVD.dll
%ProgramFiles%\Elaborate Bytes\CloneDVD2\CloneDVD2.ini
<SYSTEM32>\ElbyCDIO.dll
<DRIVERS>\ElbyCDIO.sys
%ALLUSERSPROFILE%\Start Menu\Programs\Elaborate Bytes\CloneDVD2\CloneDVD2.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Elaborate Bytes\CloneDVD2\Register CloneDVD2.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Elaborate Bytes\CloneDVD2\CloneDVD2 Help.lnk
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\ja\images\source_output.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\ja\images\title_selection.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\ja\images\output_method.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\ja\images\film_strip.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\ja\images\drive_verify.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\it\images\output_method.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\it\images\source_output.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\it\images\title_selection.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\it\images\writing_dvd.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\it\index.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\it\process.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\it\usage.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\it\images\drive_shell.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\es\command.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\ja\before.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\ja\elby.css
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\ja\images\audio_settings.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\ja\images\case_copy.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\ja\images\case_process.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\ja\images\drive_install.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\ja\images\drive_select.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\ja\images\drive_shell.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\it\images\film_strip.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\ja\drive.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\sounds\wait.wav
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\es\before.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\en\images\drive_shell.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_de.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_el.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_es.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_et.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_fi.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_fr.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_hr.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\eraser\NTSC\VIDEO_TS\VTS_01_0.IFO
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_hu.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_it.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_ja.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_mk.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_nl.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_no.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_pl.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_pt.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_cs.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_da.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_br.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_ar.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\HelpLauncher.exe
%TEMP%\nst1.tmp\InstallHelp.dll
%ProgramFiles%\Elaborate Bytes\CloneDVD2\ExecuteWithUAC.exe
%ProgramFiles%\Elaborate Bytes\CloneDVD2\InstallHelp.dll
%ProgramFiles%\Elaborate Bytes\CloneDVD2\CloneDVD2-uninst.exe
%ProgramFiles%\Elaborate Bytes\CloneDVD2\CloneDVD2-uninst.ini
%ALLUSERSPROFILE%\Start Menu\Programs\Elaborate Bytes\CloneDVD2\Uninstall.lnk
%ProgramFiles%\Elaborate Bytes\CloneDVD2\CloneDVD2.exe
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_ru.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_id.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\eraser\NTSC\VIDEO_TS\VIDEO_TS.IFO
%ProgramFiles%\Elaborate Bytes\CloneDVD2\eraser\NTSC\VIDEO_TS\VTS_02_0.IFO
%ProgramFiles%\Elaborate Bytes\CloneDVD2\eraser\NTSC\VIDEO_TS\VTS_02_1.VOB
%ProgramFiles%\Elaborate Bytes\CloneDVD2\eraser\PAL\VIDEO_TS\VIDEO_TS.IFO
%ProgramFiles%\Elaborate Bytes\CloneDVD2\eraser\PAL\VIDEO_TS\VTS_01_0.IFO
%ProgramFiles%\Elaborate Bytes\CloneDVD2\eraser\PAL\VIDEO_TS\VTS_01_1.VOB
%ProgramFiles%\Elaborate Bytes\CloneDVD2\eraser\PAL\VIDEO_TS\VTS_02_0.IFO
%ProgramFiles%\Elaborate Bytes\CloneDVD2\eraser\PAL\VIDEO_TS\VTS_02_1.VOB
%TEMP%\nst1.tmp\ExecuteWithUAC.exe
%ProgramFiles%\Elaborate Bytes\CloneDVD2\eraser\NTSC\VIDEO_TS\VTS_01_1.VOB
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\de\images\case_process.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\en\process.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_sr.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\en\command.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\en\drive.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\en\elby.css
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\en\images\audio_settings.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\en\images\case_copy.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\en\images\case_process.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\en\images\drive_install.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_sc.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\en\images\drive_select.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\en\images\drive_verify.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\en\images\film_strip.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\en\images\output_method.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\en\images\source_output.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\en\images\title_selection.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\en\images\writing_dvd.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\en\index.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\de\usage.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\en\before.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\de\process.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\de\index.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\de\images\writing_dvd.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_tc.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\clonedvd_changes.txt
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\de\before.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\de\command.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\de\drive.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\de\elby.css
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\de\images\audio_settings.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_sk.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\en\usage.html
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\de\images\case_copy.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\de\images\drive_select.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\de\images\drive_shell.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\de\images\drive_verify.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\de\images\film_strip.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\de\images\output_method.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\de\images\source_output.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\de\images\title_selection.gif
%ProgramFiles%\Elaborate Bytes\CloneDVD2\language\clonedvd_sv.qm
%ProgramFiles%\Elaborate Bytes\CloneDVD2\manual\de\images\drive_install.gif
%ALLUSERSPROFILE%\Desktop\CloneDVD2.lnk

Присваивает атрибут 'скрытый' для следующих файлов:

%ProgramFiles%\Elaborate Bytes\CloneDVD2\CloneDVD2-uninst.ini

Удаляет следующие файлы:

%ProgramFiles%\Elaborate Bytes\CloneDVD2\SetRegACL.exe
%TEMP%\nst1.tmp\ExecuteWithUAC.exe
%TEMP%\nst1.tmp\InstallHelp.dll
%TEMP%\7ZipSfx.000\SetupCloneDVD2.exe

Другое:

Ищет следующие окна:

ClassName: 'MainWClass' WindowName: 'ElbyTrayWindow'

Создает и запускает на исполнение:

'%TEMP%\7ZipSfx.000\SetupCloneDVD2.exe' /S /NCRC
'%ProgramFiles%\Elaborate Bytes\CloneDVD2\SetRegACL.exe' Software\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons 64

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней