Trojan.DownLoader8.59709

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '%WINDIR%\4THOFJ~1.SCR'
[<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = ''

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\rundll32.exe' desk.cpl,InstallScreenSaver %WINDIR%\4THOFJ~1.SCR
'<SYSTEM32>\mshta.exe' "%PROGRAM_FILES%\4th of July Fireworks Show 1.1\readme.hta"

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\4th of July Fireworks Show 1.1\~GLH001c.TMP
%PROGRAM_FILES%\4th of July Fireworks Show 1.1\~GLH001b.TMP
%PROGRAM_FILES%\4th of July Fireworks Show 1.1\~GLH001d.TMP
%PROGRAM_FILES%\4th of July Fireworks Show 1.1\~GLH001f.TMP
%PROGRAM_FILES%\4th of July Fireworks Show 1.1\~GLH001e.TMP
%WINDIR%\acezsoft\fireworks\~GLH001a.TMP
%WINDIR%\acezsoft\fireworks\~GLH0016.TMP
%WINDIR%\acezsoft\fireworks\~GLH0015.TMP
%WINDIR%\acezsoft\fireworks\~GLH0017.TMP
%WINDIR%\acezsoft\fireworks\~GLH0019.TMP
%WINDIR%\acezsoft\fireworks\~GLH0018.TMP
%APPDATA%\Microsoft\Windows\Themes\Custom.theme
%PROGRAM_FILES%\4th of July Fireworks Show 1.1\INSTALL.LOG
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\index[1].htm
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\image[1].gif
%HOMEPATH%\Start Menu\Programs\4th of July Fireworks Show 1.1\Get Android & iPhone apps.lnk
%HOMEPATH%\Start Menu\Programs\4th of July Fireworks Show 1.1\Acez.com - More Screen Savers!.lnk
%PROGRAM_FILES%\4th of July Fireworks Show 1.1\~GLH0020.TMP
%HOMEPATH%\Start Menu\Programs\4th of July Fireworks Show 1.1\Readme.lnk
%HOMEPATH%\Start Menu\Programs\4th of July Fireworks Show 1.1\Uninstall Screen Saver.lnk
%HOMEPATH%\Start Menu\Programs\4th of July Fireworks Show 1.1\Tell a friend about Fireworks Screen Saver!.lnk
%WINDIR%\acezsoft\fireworks\~GLH0014.TMP
%WINDIR%\acezsoft\fireworks\~GLH0005.TMP
%PROGRAM_FILES%\4th of July Fireworks Show 1.1\~GLH0004.TMP
%WINDIR%\acezsoft\fireworks\~GLH0006.TMP
%WINDIR%\acezsoft\fireworks\~GLH0008.TMP
%WINDIR%\acezsoft\fireworks\~GLH0007.TMP
%PROGRAM_FILES%\4th of July Fireworks Show 1.1\~GLH0003.TMP
%TEMP%\GLG3.tmp
%TEMP%\GLC1.tmp
%TEMP%\~GLH0000.TMP
%PROGRAM_FILES%\4th of July Fireworks Show 1.1\~GLH0002.TMP
%PROGRAM_FILES%\4th of July Fireworks Show 1.1\~GLH0001.TMP
%WINDIR%\acezsoft\fireworks\~GLH0010.TMP
%WINDIR%\acezsoft\fireworks\~GLH000f.TMP
%WINDIR%\acezsoft\fireworks\~GLH0011.TMP
%WINDIR%\acezsoft\fireworks\~GLH0013.TMP
%WINDIR%\acezsoft\fireworks\~GLH0012.TMP
%WINDIR%\acezsoft\fireworks\~GLH000e.TMP
%WINDIR%\~GLH000a.TMP
%WINDIR%\acezsoft\fireworks\~GLH0009.TMP
%WINDIR%\~GLH000b.TMP
%WINDIR%\acezsoft\fireworks\~GLH000d.TMP
%WINDIR%\acezsoft\fireworks\~GLH000c.TMP

Удаляет следующие файлы:

%TEMP%\GLC1.tmp
%TEMP%\~DFB249.tmp
%TEMP%\GLG3.tmp
%TEMP%\GLF4.tmp

Перемещает следующие файлы:

%WINDIR%\acezsoft\fireworks\~GLH0016.TMP в %WINDIR%\acezsoft\fireworks\fwpink.bmp
%WINDIR%\acezsoft\fireworks\~GLH0015.TMP в %WINDIR%\acezsoft\fireworks\fwgreen.bmp
%WINDIR%\acezsoft\fireworks\~GLH0018.TMP в %WINDIR%\acezsoft\fireworks\fwyellow.bmp
%WINDIR%\acezsoft\fireworks\~GLH0017.TMP в %WINDIR%\acezsoft\fireworks\fwpurple.bmp
%WINDIR%\acezsoft\fireworks\~GLH0012.TMP в %WINDIR%\acezsoft\fireworks\Do Not Delete Files.txt
%WINDIR%\acezsoft\fireworks\~GLH0011.TMP в %WINDIR%\acezsoft\fireworks\city.bmp
%WINDIR%\acezsoft\fireworks\~GLH0014.TMP в %WINDIR%\acezsoft\fireworks\fwblue.bmp
%WINDIR%\acezsoft\fireworks\~GLH0013.TMP в %WINDIR%\acezsoft\fireworks\fwbackground.bmp
%PROGRAM_FILES%\4th of July Fireworks Show 1.1\~GLH001e.TMP в %PROGRAM_FILES%\4th of July Fireworks Show 1.1\acez.htm
%PROGRAM_FILES%\4th of July Fireworks Show 1.1\~GLH001d.TMP в %PROGRAM_FILES%\4th of July Fireworks Show 1.1\tellafriend.htm
%PROGRAM_FILES%\4th of July Fireworks Show 1.1\~GLH0020.TMP в %PROGRAM_FILES%\4th of July Fireworks Show 1.1\tellafriend.ico
%PROGRAM_FILES%\4th of July Fireworks Show 1.1\~GLH001f.TMP в %PROGRAM_FILES%\4th of July Fireworks Show 1.1\acez.ico
%WINDIR%\acezsoft\fireworks\~GLH001a.TMP в %WINDIR%\acezsoft\fireworks\redlight.bmp
%WINDIR%\acezsoft\fireworks\~GLH0019.TMP в %WINDIR%\acezsoft\fireworks\moon.bmp
%PROGRAM_FILES%\4th of July Fireworks Show 1.1\~GLH001c.TMP в %PROGRAM_FILES%\4th of July Fireworks Show 1.1\readme.htm
%PROGRAM_FILES%\4th of July Fireworks Show 1.1\~GLH001b.TMP в %PROGRAM_FILES%\4th of July Fireworks Show 1.1\readme.hta
%WINDIR%\acezsoft\fireworks\~GLH0010.TMP в %WINDIR%\acezsoft\fireworks\bwhitetop.bmp
%WINDIR%\acezsoft\fireworks\~GLH0005.TMP в %WINDIR%\acezsoft\fireworks\redlight1.bmp
%PROGRAM_FILES%\4th of July Fireworks Show 1.1\~GLH0004.TMP в %PROGRAM_FILES%\4th of July Fireworks Show 1.1\uninstall.ico
%WINDIR%\acezsoft\fireworks\~GLH0007.TMP в %WINDIR%\acezsoft\fireworks\firework1.wav
%WINDIR%\acezsoft\fireworks\~GLH0006.TMP в %WINDIR%\acezsoft\fireworks\firework2.wav
%PROGRAM_FILES%\4th of July Fireworks Show 1.1\~GLH0001.TMP в %PROGRAM_FILES%\4th of July Fireworks Show 1.1\UNWISE.EXE
%TEMP%\~GLH0000.TMP в %TEMP%\GLF4.tmp
%PROGRAM_FILES%\4th of July Fireworks Show 1.1\~GLH0003.TMP в %PROGRAM_FILES%\4th of July Fireworks Show 1.1\allfunapps.htm
%PROGRAM_FILES%\4th of July Fireworks Show 1.1\~GLH0002.TMP в %PROGRAM_FILES%\4th of July Fireworks Show 1.1\help.ico
%WINDIR%\acezsoft\fireworks\~GLH000d.TMP в %WINDIR%\acezsoft\fireworks\bgreytop.bmp
%WINDIR%\acezsoft\fireworks\~GLH000c.TMP в %WINDIR%\acezsoft\fireworks\bdiamondtop.bmp
%WINDIR%\acezsoft\fireworks\~GLH000f.TMP в %WINDIR%\acezsoft\fireworks\bskyrise.bmp
%WINDIR%\acezsoft\fireworks\~GLH000e.TMP в %WINDIR%\acezsoft\fireworks\blightwide.bmp
%WINDIR%\acezsoft\fireworks\~GLH0009.TMP в %WINDIR%\acezsoft\fireworks\greenlight.bmp
%WINDIR%\acezsoft\fireworks\~GLH0008.TMP в %WINDIR%\acezsoft\fireworks\whitelight.bmp
%WINDIR%\~GLH000b.TMP в %WINDIR%\acezfireworks.ini
%WINDIR%\~GLH000a.TMP в %WINDIR%\4th of July Fireworks.scr