Trojan.MulDrop4.29741

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

%TEMP%\install\tryyyesesss.exe
%TEMP%\INS1.tmp /SL3 $1013C %TEMP%\install\ajpegcompr.exe 1779980 1783340 61440 /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
%TEMP%\install\ajpegcompr.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-

Запускает на исполнение:

<SYSTEM32>\cmd.exe /c ""%TEMP%\install\sil_2.bat" "

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Advanced JPEG Compressor\Profiles\is-REHE4.tmp
%PROGRAM_FILES%\Advanced JPEG Compressor\Profiles\is-IUANG.tmp
%PROGRAM_FILES%\Advanced JPEG Compressor\Profiles\is-5FVGN.tmp
%PROGRAM_FILES%\Advanced JPEG Compressor\Profiles\is-QBUAG.tmp
%PROGRAM_FILES%\Advanced JPEG Compressor\Profiles\is-5CAML.tmp
%PROGRAM_FILES%\Advanced JPEG Compressor\Profiles\is-HQA86.tmp
%PROGRAM_FILES%\Advanced JPEG Compressor\Profiles\is-HGU07.tmp
%PROGRAM_FILES%\Advanced JPEG Compressor\Profiles\is-QF6U7.tmp
%HOMEPATH%\SendTo\Advanced JPEG Compressor (process...).lnk
%HOMEPATH%\SendTo\Advanced JPEG Compressor (open).lnk
%PROGRAM_FILES%\Advanced JPEG Compressor\unins000.dat
%PROGRAM_FILES%\Advanced JPEG Compressor\unins000.exe
%PROGRAM_FILES%\Advanced JPEG Compressor\is-OLD0J.tmp
%PROGRAM_FILES%\Advanced JPEG Compressor\Profiles\is-CPH8V.tmp
%HOMEPATH%\Desktop\Advanced JPEG Compressor.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Advanced JPEG Compressor.lnk
%PROGRAM_FILES%\Advanced JPEG Compressor\Profiles\is-D39JB.tmp
%TEMP%\INS1.tmp
%TEMP%\install\sil_2.bat
%PROGRAM_FILES%\Advanced JPEG Compressor\is-2RA89.tmp
%TEMP%\is-KJ1CS.tmp\_shfoldr.dll
%TEMP%\$inst\temp_0.tmp
%TEMP%\$inst\2.tmp
%TEMP%\install\tryyyesesss.exe
%TEMP%\install\ajpegcompr.exe
%PROGRAM_FILES%\Advanced JPEG Compressor\is-CBKGB.tmp
%PROGRAM_FILES%\Advanced JPEG Compressor\is-KNEEC.tmp
%PROGRAM_FILES%\Advanced JPEG Compressor\is-R3CS7.tmp
%PROGRAM_FILES%\Advanced JPEG Compressor\is-J2O4F.tmp
%PROGRAM_FILES%\Advanced JPEG Compressor\is-THPP7.tmp
%PROGRAM_FILES%\Advanced JPEG Compressor\is-5T7PI.tmp
%PROGRAM_FILES%\Advanced JPEG Compressor\is-E8NBR.tmp
%PROGRAM_FILES%\Advanced JPEG Compressor\is-P0J5P.tmp

Удаляет следующие файлы:

%TEMP%\install\ajpegcompr.exe
%TEMP%\install\tryyyesesss.exe
%TEMP%\$inst\2.tmp
%TEMP%\$inst\temp_0.tmp
%TEMP%\is-KJ1CS.tmp\_shfoldr.dll
%TEMP%\INS1.tmp

Перемещает следующие файлы:

%PROGRAM_FILES%\Advanced JPEG Compressor\Profiles\is-QF6U7.tmp в %PROGRAM_FILES%\Advanced JPEG Compressor\Profiles\E-Mail Photo.jcp
%PROGRAM_FILES%\Advanced JPEG Compressor\Profiles\is-5CAML.tmp в %PROGRAM_FILES%\Advanced JPEG Compressor\Profiles\Compress for PocketPC.jcp
%PROGRAM_FILES%\Advanced JPEG Compressor\is-R3CS7.tmp в %PROGRAM_FILES%\Advanced JPEG Compressor\cprofile.ico
%PROGRAM_FILES%\Advanced JPEG Compressor\Profiles\is-QBUAG.tmp в %PROGRAM_FILES%\Advanced JPEG Compressor\Profiles\Scanned Text.jcp
%PROGRAM_FILES%\Advanced JPEG Compressor\is-OLD0J.tmp в %PROGRAM_FILES%\Advanced JPEG Compressor\ContextMenuExt.dll
%PROGRAM_FILES%\Advanced JPEG Compressor\Profiles\is-CPH8V.tmp в %PROGRAM_FILES%\Advanced JPEG Compressor\Profiles\Thumbnail 100x100.jcp
%PROGRAM_FILES%\Advanced JPEG Compressor\Profiles\is-5FVGN.tmp в %PROGRAM_FILES%\Advanced JPEG Compressor\Profiles\Screenshot.jcp
%PROGRAM_FILES%\Advanced JPEG Compressor\is-J2O4F.tmp в %PROGRAM_FILES%\Advanced JPEG Compressor\readme.txt
%PROGRAM_FILES%\Advanced JPEG Compressor\is-THPP7.tmp в %PROGRAM_FILES%\Advanced JPEG Compressor\ajc_console.exe
%PROGRAM_FILES%\Advanced JPEG Compressor\is-5T7PI.tmp в %PROGRAM_FILES%\Advanced JPEG Compressor\ajc.exe
%PROGRAM_FILES%\Advanced JPEG Compressor\is-2RA89.tmp в %PROGRAM_FILES%\Advanced JPEG Compressor\unins000.exe
%PROGRAM_FILES%\Advanced JPEG Compressor\is-P0J5P.tmp в %PROGRAM_FILES%\Advanced JPEG Compressor\ajc.chm
%PROGRAM_FILES%\Advanced JPEG Compressor\is-CBKGB.tmp в %PROGRAM_FILES%\Advanced JPEG Compressor\license.txt
%PROGRAM_FILES%\Advanced JPEG Compressor\is-KNEEC.tmp в %PROGRAM_FILES%\Advanced JPEG Compressor\file_id.diz
%PROGRAM_FILES%\Advanced JPEG Compressor\is-E8NBR.tmp в %PROGRAM_FILES%\Advanced JPEG Compressor\ajcGettingStarted.chm