Trojan.MulDrop13.46046

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\SOFTWARE\Classes\PDF-XChangeViewer.1\shell\open\command] '' = '\"%ProgramFiles%\Tracker Software\PDF Viewer\PDFXCview.exe\" \"%1\"'
[<HKLM>\SOFTWARE\Classes\PDFXCviewIEPlugin.CoPDFXCviewIEPlugin.1\shell\open\command] '' = '\"%ProgramFiles%\Tracker Software\PDF Viewer\PDFXCview.exe\" \"%1\"'
[<HKLM>\SOFTWARE\Classes\Applications\PDFXCview.exe\shell\open\command] '' = '\"%ProgramFiles%\Tracker Software\PDF Viewer\PDFXCview.exe\" \"%1\"'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\$inst\2.tmp
%ProgramFiles(x86)%\tracker software\pdf viewer\nppdfxcviewnpplugin.dll
%ProgramFiles(x86)%\tracker software\pdf viewer\pdfxcview.exe
%ProgramFiles(x86)%\tracker software\pdf viewer\pdfxcviewax.dll
%ProgramFiles(x86)%\tracker software\pdf viewer\pdfxcviewieplugin.dll
%ProgramFiles(x86)%\tracker software\pdf viewer\resource.dat
%ProgramFiles(x86)%\tracker software\pdf viewer\searchproviders\ask.png
%ProgramFiles(x86)%\tracker software\pdf viewer\searchproviders\ask.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\searchproviders\bing.png
%ProgramFiles(x86)%\tracker software\pdf viewer\searchproviders\bing.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\searchproviders\google.png
%ProgramFiles(x86)%\tracker software\pdf viewer\searchproviders\google.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\searchproviders\seznam.png
%ProgramFiles(x86)%\tracker software\pdf viewer\searchproviders\seznam.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\searchproviders\uameta.png
%ProgramFiles(x86)%\tracker software\pdf viewer\searchproviders\uameta.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\searchproviders\wikipedia.png
%ProgramFiles(x86)%\tracker software\pdf viewer\searchproviders\wikipedia.xml
%APPDATA%\microsoft\windows\start menu\programs\pdf-xchange pdf viewer\pdf-viewer.lnk
%HOMEPATH%\desktop\pdf-viewer.lnk
%ProgramFiles(x86)%\tracker software\uninstall.exe
%TEMP%\$inst\0001.tmp
%ProgramFiles(x86)%\tracker software\shell extensions\xcshinfo.dll
%ProgramFiles(x86)%\tracker software\shell extensions\pxcprevhost.exe
%ProgramFiles(x86)%\tracker software\pdf viewer\unins000.msg
%ProgramFiles(x86)%\tracker software\shell extensions\pdfproperties.propdesc
%ProgramFiles(x86)%\tracker software\pdf viewer\unins000.exe
%ProgramFiles(x86)%\tracker software\pdf viewer\unins000.dat
%ProgramFiles(x86)%\tracker software\pdf viewer\searchproviders\yandex.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\searchproviders\yandex.png
%ProgramFiles(x86)%\tracker software\pdf viewer\searchproviders\yahoo.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\searchproviders\yahoo.png
%APPDATA%\microsoft\windows\start menu\programs\pdf-xchange pdf viewer\uninstall.lnk
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pxcv_ua.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pxcv_ru.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_tr.xml
%TEMP%\$inst\temp_0.tmp
%ProgramFiles(x86)%\tracker software\live update\liveupdate.exe
%ProgramFiles(x86)%\tracker software\pdf viewer\help\pdfvlicense.pdf
%ProgramFiles(x86)%\tracker software\pdf viewer\help\pdfvmanualsm.pdf
%ProgramFiles(x86)%\tracker software\pdf viewer\istask.dll
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_ar.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_br.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_cat.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_chs.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_cht.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_cz.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_da.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_de.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_el.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_fa.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_fin.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_fr.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_sr.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_spa.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_sk.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_si.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_rom.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_pt.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_no.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_pl.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_ned.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_jpn.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_it.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_hun.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_hr.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_fry.xml
%ProgramFiles(x86)%\tracker software\pdf viewer\languages\pdfxvw_sv.xml
%ProgramFiles(x86)%\tracker software\uninstall.ini