Trojan.MulDrop11.45496

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv.exe -o'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\ixp000.tmp\330x141.bmp
%TEMP%\ixp000.tmp\freenet.inf
%TEMP%\ixp000.tmp\instcm.inf
%TEMP%\ixp000.tmp\16x16.ico
%TEMP%\ixp000.tmp\32x32.ico
%TEMP%\ixp000.tmp\freenet.pbk
%TEMP%\ixp000.tmp\readme.txt
%TEMP%\ixp000.tmp\114x304.bmp
%TEMP%\ixp000.tmp\cmdl32.exe
%TEMP%\ixp000.tmp\w95inf16.dll
%TEMP%\ixp000.tmp\w95inf32.dll
%PROGRAMDATA%\microsoft\network\connections\cm\freenet\set905b.tmp
%PROGRAMDATA%\microsoft\network\connections\cm\freenet\set90bc.tmp
%PROGRAMDATA%\microsoft\network\connections\cm\freenet\set90cc.tmp
%PROGRAMDATA%\microsoft\network\connections\cm\freenet\set911b.tmp
%PROGRAMDATA%\microsoft\network\connections\cm\freenet\set913c.tmp
%PROGRAMDATA%\microsoft\network\connections\cm\freenet\set914c.tmp
%PROGRAMDATA%\microsoft\network\connections\cm\freenet\set916c.tmp
%PROGRAMDATA%\microsoft\network\connections\cm\freenet\set91db.tmp
%PROGRAMDATA%\microsoft\network\connections\cm\set91fb.tmp
%PROGRAMDATA%\microsoft\network\connections\cm\freenet\set908b.tmp
%PROGRAMDATA%\microsoft\network\connections\cm\freenet\set909b.tmp
%TEMP%\ixp000.tmp\mbslgn32.dll
%TEMP%\ixp000.tmp\cnetcfg.dll
%TEMP%\ixp000.tmp\cnet16.dll
%TEMP%\ixp000.tmp\cmmon32.exe
%TEMP%\ixp000.tmp\cmstp.exe
%TEMP%\ixp000.tmp\icwscrpt.exe
%TEMP%\ixp000.tmp\freenet.cmp
%TEMP%\ixp000.tmp\freenet.cms
%TEMP%\ixp000.tmp\cmmgr32.gid
%TEMP%\ixp000.tmp\advapi32.old
%TEMP%\ixp000.tmp\comctl32.old
%TEMP%\ixp000.tmp\rnaph.old
%TEMP%\ixp000.tmp\cmmgr32.exe
%TEMP%\ixp000.tmp\wininet.old
%TEMP%\ixp000.tmp\cmmgr32.hlp
%TEMP%\ixp000.tmp\freenet.hlp
%TEMP%\ixp000.tmp\advpack.dll
%TEMP%\ixp000.tmp\ccfg95.dll
%TEMP%\ixp000.tmp\ccfgnt.dll
%TEMP%\ixp000.tmp\cmcfg32.dll
%TEMP%\ixp000.tmp\cmdial32.dll
%TEMP%\ixp000.tmp\cmpbk32.dll
%TEMP%\ixp000.tmp\cmutil.dll
%TEMP%\ixp000.tmp\freenet.pbr
%PROGRAMDATA%\microsoft\network\connections\cm\freenet.cmp
%PROGRAMDATA%\microsoft\network\connections\pbk\rasphone.pbk

Присваивает атрибут 'скрытый' для следующих файлов

%TEMP%\ixp000.tmp\cmmgr32.gid

Удаляет следующие файлы

%TEMP%\ixp000.tmp\cmdl32.exe
%TEMP%\ixp000.tmp\advpack.dll
%TEMP%\ixp000.tmp\freenet.hlp
%TEMP%\ixp000.tmp\cmmgr32.hlp
%TEMP%\ixp000.tmp\freenet.pbr
%TEMP%\ixp000.tmp\wininet.old
%TEMP%\ixp000.tmp\rnaph.old
%TEMP%\ixp000.tmp\advapi32.old
%TEMP%\ixp000.tmp\cmmgr32.exe
%TEMP%\ixp000.tmp\cmmgr32.gid
%TEMP%\ixp000.tmp\freenet.cms
%TEMP%\ixp000.tmp\freenet.cmp
%TEMP%\ixp000.tmp\icwscrpt.exe
%TEMP%\ixp000.tmp\cmstp.exe
%TEMP%\ixp000.tmp\cmmon32.exe
%TEMP%\ixp000.tmp\ccfg95.dll
%TEMP%\ixp000.tmp\comctl32.old
%TEMP%\ixp000.tmp\ccfgnt.dll
%TEMP%\ixp000.tmp\freenet.inf
%TEMP%\ixp000.tmp\114x304.bmp
%TEMP%\ixp000.tmp\readme.txt
%TEMP%\ixp000.tmp\freenet.pbk
%TEMP%\ixp000.tmp\32x32.ico
%TEMP%\ixp000.tmp\16x16.ico
%TEMP%\ixp000.tmp\instcm.inf
%TEMP%\ixp000.tmp\w95inf32.dll
%TEMP%\ixp000.tmp\cmdial32.dll
%TEMP%\ixp000.tmp\w95inf16.dll
%TEMP%\ixp000.tmp\mbslgn32.dll
%TEMP%\ixp000.tmp\cnetcfg.dll
%TEMP%\ixp000.tmp\cnet16.dll
%TEMP%\ixp000.tmp\cmutil.dll
%TEMP%\ixp000.tmp\cmpbk32.dll
%TEMP%\ixp000.tmp\cmcfg32.dll
%TEMP%\ixp000.tmp\330x141.bmp

Перемещает следующие файлы

%PROGRAMDATA%\microsoft\network\connections\cm\freenet\set905b.tmp в %PROGRAMDATA%\microsoft\network\connections\cm\freenet\freenet.pbk
%PROGRAMDATA%\microsoft\network\connections\cm\freenet\set908b.tmp в %PROGRAMDATA%\microsoft\network\connections\cm\freenet\freenet.pbr
%PROGRAMDATA%\microsoft\network\connections\cm\freenet\set909b.tmp в %PROGRAMDATA%\microsoft\network\connections\cm\freenet\330x141.bmp
%PROGRAMDATA%\microsoft\network\connections\cm\freenet\set90bc.tmp в %PROGRAMDATA%\microsoft\network\connections\cm\freenet\114x304.bmp
%PROGRAMDATA%\microsoft\network\connections\cm\freenet\set90cc.tmp в %PROGRAMDATA%\microsoft\network\connections\cm\freenet\32x32.ico
%PROGRAMDATA%\microsoft\network\connections\cm\freenet\set911b.tmp в %PROGRAMDATA%\microsoft\network\connections\cm\freenet\16x16.ico
%PROGRAMDATA%\microsoft\network\connections\cm\freenet\set913c.tmp в %PROGRAMDATA%\microsoft\network\connections\cm\freenet\freenet.hlp
%PROGRAMDATA%\microsoft\network\connections\cm\freenet\set914c.tmp в %PROGRAMDATA%\microsoft\network\connections\cm\freenet\readme.txt
%PROGRAMDATA%\microsoft\network\connections\cm\freenet\set916c.tmp в %PROGRAMDATA%\microsoft\network\connections\cm\freenet\freenet.cms
%PROGRAMDATA%\microsoft\network\connections\cm\freenet\set91db.tmp в %PROGRAMDATA%\microsoft\network\connections\cm\freenet\freenet.inf
%PROGRAMDATA%\microsoft\network\connections\cm\set91fb.tmp в %PROGRAMDATA%\microsoft\network\connections\cm\freenet.cmp