Trojan.Siggen9.54995

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\$inst\2.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-gpdsv.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-v8nt3.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-ntejp.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-1to8c.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-09cpu.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-ata2m.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-mfpom.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-djvqo.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-smv9e.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-gn0de.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-vdg7e.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-npebt.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-qia28.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-oc0di.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-cvuv9.tmp
%ProgramFiles%\irfan's games\dx-ball 2\mods\is-p6o22.tmp
%ProgramFiles%\irfan's games\dx-ball 2\mods\is-2eos2.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-50fck.tmp
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-fjg6b.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-d8p0d.tmp
%TEMP%\aut2cf3.tmp
%TEMP%\b.wav
%TEMP%\aut2c95.tmp
%ProgramFiles%\irfan's games\dx-ball 2\unins000.dat
%APPDATA%\microsoft\internet explorer\quick launch\dx-ball 2.lnk
C:\users\public\desktop\dx-ball 2.lnk
%PROGRAMDATA%\microsoft\windows\start menu\programs\dx-ball 2\ desinstalatu.lnk
%PROGRAMDATA%\microsoft\windows\start menu\programs\dx-ball 2\dx-ball 2.lnk
%ProgramFiles%\irfan's games\dx-ball 2\mods\is-fnhfa.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-kv9ig.tmp
%ProgramFiles%\irfan's games\dx-ball 2\is-l4rfo.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-lm7kl.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-65ujg.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-ovh7a.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-6mjj4.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-2skob.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-7s5ee.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-dppqt.tmp
%ProgramFiles%\irfan's games\dx-ball 2\is-rt81g.tmp
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-btrse.tmp
%ProgramFiles%\irfan's games\dx-ball 2\mods\is-pqbje.tmp
%ProgramFiles%\irfan's games\dx-ball 2\gfx\is-bf97g.tmp
%ProgramFiles%\irfan's games\dx-ball 2\gfx\is-mq9fc.tmp
%TEMP%\is-s0urv.tmp\_isetup\_shfoldr.dll
%ProgramFiles%\irfan's games\dx-ball 2\is-jlknj.tmp
%ProgramFiles%\irfan's games\dx-ball 2\is-k9jmk.tmp
%ProgramFiles%\irfan's games\dx-ball 2\is-gkuim.tmp
%ProgramFiles%\irfan's games\dx-ball 2\is-5i3tu.tmp
%ProgramFiles%\irfan's games\dx-ball 2\is-jcd02.tmp
%ProgramFiles%\irfan's games\dx-ball 2\is-j1veh.tmp
%ProgramFiles%\irfan's games\dx-ball 2\is-jfiuf.tmp
%TEMP%\zz.exe
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-6mrd8.tmp
%TEMP%\is-s0urv.tmp\_isetup\_setup64.tmp
%TEMP%\is-l54pj.tmp\ball.tmp
%APPDATA%\microsoft\windows\templates\iz\ball.exe
%APPDATA%\microsoft\windows\templates\iz\temizle.bat
%APPDATA%\microsoft\windows\templates\iz\temizle.reg
%APPDATA%\microsoft\windows\templates\iz\xxx.bat
%APPDATA%\microsoft\windows\templates\iz\mysplash.exe
%TEMP%\$inst\temp_0.tmp
%ProgramFiles%\irfan's games\dx-ball 2\is-h4feg.tmp
%PROGRAMDATA%\microsoft\windows\start menu\programs\dx-ball 2\web sayfam.lnk
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-eooec.tmp
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-t2mqs.tmp
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-cgjdb.tmp
%ProgramFiles%\irfan's games\dx-ball 2\gfx\is-chjj0.tmp
%ProgramFiles%\irfan's games\dx-ball 2\gfx\is-3ueb5.tmp
%ProgramFiles%\irfan's games\dx-ball 2\gfx\is-iroae.tmp
%ProgramFiles%\irfan's games\dx-ball 2\gfx\is-tj55b.tmp
%ProgramFiles%\irfan's games\dx-ball 2\fonts\is-dg70p.tmp
%ProgramFiles%\irfan's games\dx-ball 2\fonts\is-0mc1n.tmp
%ProgramFiles%\irfan's games\dx-ball 2\fonts\is-ulnt5.tmp
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-3gj6c.tmp
%ProgramFiles%\irfan's games\dx-ball 2\fonts\is-6jqr9.tmp
%ProgramFiles%\irfan's games\dx-ball 2\is-aumul.tmp
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-sk8ls.tmp
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-7292e.tmp
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-0eafq.tmp
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-326sa.tmp
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-3pbes.tmp
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-cs801.tmp
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-dn8lh.tmp
%ProgramFiles%\irfan's games\dx-ball 2\fonts\is-v1d4v.tmp
%TEMP%\del.bat

Удаляет следующие файлы

%TEMP%\$inst\temp_0.tmp
%TEMP%\is-s0urv.tmp\_isetup\_setup64.tmp
%TEMP%\is-s0urv.tmp\_isetup\_shfoldr.dll
%TEMP%\is-l54pj.tmp\ball.tmp
%TEMP%\aut2c95.tmp
%TEMP%\aut2cf3.tmp
%TEMP%\$inst\2.tmp
%APPDATA%\microsoft\windows\templates\iz\ball.exe
%APPDATA%\microsoft\windows\templates\iz\mysplash.exe
%APPDATA%\microsoft\windows\templates\iz\temizle.bat
%APPDATA%\microsoft\windows\templates\iz\temizle.reg
%TEMP%\b.wav

Перемещает следующие файлы

%ProgramFiles%\irfan's games\dx-ball 2\is-h4feg.tmp в %ProgramFiles%\irfan's games\dx-ball 2\unins000.exe
%ProgramFiles%\irfan's games\dx-ball 2\mods\is-fnhfa.tmp в %ProgramFiles%\irfan's games\dx-ball 2\mods\orbflowr.mod
%ProgramFiles%\irfan's games\dx-ball 2\mods\is-2eos2.tmp в %ProgramFiles%\irfan's games\dx-ball 2\mods\raiders.mod
%ProgramFiles%\irfan's games\dx-ball 2\mods\is-p6o22.tmp в %ProgramFiles%\irfan's games\dx-ball 2\mods\seasons.mod
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-cvuv9.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\ao-laser.wav
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-oc0di.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\bang.wav
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-qia28.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\bassdrum.wav
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-npebt.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\boing.wav
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-vdg7e.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\byeball.wav
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-smv9e.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\effect.wav
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-50fck.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\effect2.wav
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-djvqo.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\fanfare.wav
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-mfpom.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\firelow8.wav
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-ata2m.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\glass.wav
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-09cpu.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\gunfire.wav
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-1to8c.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\highvoltage8.wav
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-ntejp.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\humm.wav
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-v8nt3.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\orchblas.wav
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-gpdsv.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\orchestr.wav
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-kv9ig.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\padexplo.wav
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-gn0de.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\peow!.wav
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-d8p0d.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\ricochet.wav
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-btrse.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\saucer.wav
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-dppqt.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\sweepdow.wav
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-7s5ee.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\swordswi.wav
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-2skob.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\tank.wav
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-6mjj4.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\thunder8.wav
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-ovh7a.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\wowpulse.wav
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-65ujg.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\xploshor.wav
%ProgramFiles%\irfan's games\dx-ball 2\sounds\is-lm7kl.tmp в %ProgramFiles%\irfan's games\dx-ball 2\sounds\xplosht1.wav
%ProgramFiles%\irfan's games\dx-ball 2\mods\is-pqbje.tmp в %ProgramFiles%\irfan's games\dx-ball 2\mods\beatwave.mod
%ProgramFiles%\irfan's games\dx-ball 2\is-l4rfo.tmp в %ProgramFiles%\irfan's games\dx-ball 2\irfan's site.url
%ProgramFiles%\irfan's games\dx-ball 2\gfx\is-bf97g.tmp в %ProgramFiles%\irfan's games\dx-ball 2\gfx\titlescreen.bmp
%ProgramFiles%\irfan's games\dx-ball 2\gfx\is-chjj0.tmp в %ProgramFiles%\irfan's games\dx-ball 2\gfx\paddle.img
%ProgramFiles%\irfan's games\dx-ball 2\is-jfiuf.tmp в %ProgramFiles%\irfan's games\dx-ball 2\audiow32.dll
%ProgramFiles%\irfan's games\dx-ball 2\is-j1veh.tmp в %ProgramFiles%\irfan's games\dx-ball 2\config.cfg
%ProgramFiles%\irfan's games\dx-ball 2\is-jcd02.tmp в %ProgramFiles%\irfan's games\dx-ball 2\dx-ball 2 web page.url
%ProgramFiles%\irfan's games\dx-ball 2\is-5i3tu.tmp в %ProgramFiles%\irfan's games\dx-ball 2\dxball2.exe
%ProgramFiles%\irfan's games\dx-ball 2\is-gkuim.tmp в %ProgramFiles%\irfan's games\dx-ball 2\install.log
%ProgramFiles%\irfan's games\dx-ball 2\is-k9jmk.tmp в %ProgramFiles%\irfan's games\dx-ball 2\license.txt
%ProgramFiles%\irfan's games\dx-ball 2\is-jlknj.tmp в %ProgramFiles%\irfan's games\dx-ball 2\ordering.txt
%ProgramFiles%\irfan's games\dx-ball 2\is-aumul.tmp в %ProgramFiles%\irfan's games\dx-ball 2\readme.txt
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-6mrd8.tmp в %ProgramFiles%\irfan's games\dx-ball 2\boards\backgroundjim.img
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-eooec.tmp в %ProgramFiles%\irfan's games\dx-ball 2\boards\bricksetjim.img
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-cgjdb.tmp в %ProgramFiles%\irfan's games\dx-ball 2\boards\end.txt
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-3gj6c.tmp в %ProgramFiles%\irfan's games\dx-ball 2\boards\jim.bds
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-t2mqs.tmp в %ProgramFiles%\irfan's games\dx-ball 2\boards\philippe.bds
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-dn8lh.tmp в %ProgramFiles%\irfan's games\dx-ball 2\boards\philippebgset.img
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-cs801.tmp в %ProgramFiles%\irfan's games\dx-ball 2\boards\philippebrickset.img
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-3pbes.tmp в %ProgramFiles%\irfan's games\dx-ball 2\boards\seumas.bds
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-326sa.tmp в %ProgramFiles%\irfan's games\dx-ball 2\boards\seumasbackground.img
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-0eafq.tmp в %ProgramFiles%\irfan's games\dx-ball 2\boards\seumasbrick.img
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-7292e.tmp в %ProgramFiles%\irfan's games\dx-ball 2\boards\wendy3.bds
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-sk8ls.tmp в %ProgramFiles%\irfan's games\dx-ball 2\boards\wendy4.bds
%ProgramFiles%\irfan's games\dx-ball 2\boards\is-fjg6b.tmp в %ProgramFiles%\irfan's games\dx-ball 2\boards\wendy5.bds
%ProgramFiles%\irfan's games\dx-ball 2\fonts\is-v1d4v.tmp в %ProgramFiles%\irfan's games\dx-ball 2\fonts\candyfont.img
%ProgramFiles%\irfan's games\dx-ball 2\fonts\is-6jqr9.tmp в %ProgramFiles%\irfan's games\dx-ball 2\fonts\chiselfont.img
%ProgramFiles%\irfan's games\dx-ball 2\fonts\is-ulnt5.tmp в %ProgramFiles%\irfan's games\dx-ball 2\fonts\dxbigfont.img
%ProgramFiles%\irfan's games\dx-ball 2\fonts\is-0mc1n.tmp в %ProgramFiles%\irfan's games\dx-ball 2\fonts\stsmallfont.img
%ProgramFiles%\irfan's games\dx-ball 2\fonts\is-dg70p.tmp в %ProgramFiles%\irfan's games\dx-ball 2\fonts\sysfont.img
%ProgramFiles%\irfan's games\dx-ball 2\gfx\is-tj55b.tmp в %ProgramFiles%\irfan's games\dx-ball 2\gfx\boing.img
%ProgramFiles%\irfan's games\dx-ball 2\gfx\is-iroae.tmp в %ProgramFiles%\irfan's games\dx-ball 2\gfx\explosion.img
%ProgramFiles%\irfan's games\dx-ball 2\gfx\is-3ueb5.tmp в %ProgramFiles%\irfan's games\dx-ball 2\gfx\highscores.bmp
%ProgramFiles%\irfan's games\dx-ball 2\gfx\is-mq9fc.tmp в %ProgramFiles%\irfan's games\dx-ball 2\gfx\powerups.img
%ProgramFiles%\irfan's games\dx-ball 2\is-rt81g.tmp в %ProgramFiles%\irfan's games\dx-ball 2\ico.ico

Подменяет следующие файлы

%TEMP%\$inst\temp_0.tmp
%TEMP%\$inst\2.tmp
%TEMP%\del.bat

Другое

Ищет следующие окна

ClassName: 'RegEdit_RegEdit' WindowName: ''

Создает и запускает на исполнение

'%APPDATA%\microsoft\windows\templates\iz\ball.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-l54pj.tmp\ball.tmp' /SL5="$1026E,1835177,137728,%APPDATA%\Microsoft\Windows\Templates\iz\ball.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%APPDATA%\microsoft\windows\templates\iz\mysplash.exe'
'%TEMP%\zz.exe'
'%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\Microsoft\Windows\Templates\iz\temizle.bat" "' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\del.bat" "' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\Microsoft\Windows\Templates\iz\xxx.bat" "' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\Microsoft\Windows\Templates\iz\temizle.bat" "
'%WINDIR%\syswow64\regedit.exe' /s temizle.reg
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\del.bat" "
'%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\Microsoft\Windows\Templates\iz\xxx.bat" "

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней