Trojan.Siggen18.34266

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\rarsfx0\c.exe
%TEMP%\ixp000.tmp\asycfilt.dll
%TEMP%\ixp000.tmp\oleaut32.dll
%TEMP%\ixp000.tmp\olepro32.dll
%TEMP%\ixp000.tmp\stdole2.tlb
%TEMP%\ixp000.tmp\msvbvm60.dll
%TEMP%\ixp000.tmp\comcat.dll
%TEMP%\ixp000.tmp\advpack.dll
%TEMP%\ixp000.tmp\w95inf32.dll
%TEMP%\ixp000.tmp\w95inf16.dll
%HOMEPATH%\desktop\vopt.lnk
%TEMP%\ixp000.tmp\vbrun60.inf
%WINDIR%\temp\oldc36d.tmp
%WINDIR%\syswow64\setc3dc.tmp
%WINDIR%\temp\oldc3ec.tmp
%WINDIR%\syswow64\setc3fc.tmp
%WINDIR%\temp\oldc41c.tmp
%WINDIR%\syswow64\setc42c.tmp
%WINDIR%\temp\oldc43c.tmp
%WINDIR%\syswow64\setc48a.tmp
%WINDIR%\temp\oldc4ca.tmp
%WINDIR%\syswow64\setc4e9.tmp
%WINDIR%\syswow64\setc39c.tmp
%WINDIR%\temp\oldc3cc.tmp
C:\vopt8\help.lnk
C:\vopt8\vopt.lnk
%ProgramFiles(x86)%\vopt8\~glh0015.tmp
%TEMP%\rarsfx1\vopt806.exe
%TEMP%\glbb5c7.tmp
%TEMP%\glcb72e.tmp
%TEMP%\gljb73e.tmp
%TEMP%\glgbb65.tmp
%TEMP%\~glh0000.tmp
%ProgramFiles(x86)%\vopt8\~glh0001.tmp
%WINDIR%\syswow64\~glh0002.tmp
%WINDIR%\syswow64\temp.000
%ProgramFiles(x86)%\vopt8\~glh0004.tmp
%TEMP%\rarsfx0\vopt806.exe
%ProgramFiles(x86)%\vopt8\~glh0005.tmp
%ProgramFiles(x86)%\vopt8\~glh0007.tmp
%ProgramFiles(x86)%\vopt8\~glh0008.tmp
%ProgramFiles(x86)%\vopt8\~glh0009.tmp
%ProgramFiles(x86)%\vopt8\~glh000a.tmp
%ProgramFiles(x86)%\vopt8\~glh000b.tmp
%TEMP%\~glh000d.tmp
%ProgramFiles(x86)%\vopt8\~glh000e.tmp
%ProgramFiles(x86)%\vopt8\~glh000f.tmp
%ProgramFiles(x86)%\vopt8\~glh0011.tmp
%ProgramFiles(x86)%\vopt8\~glh0013.tmp
%ProgramFiles%\vopt8\temp.000
%ProgramFiles%\vopt8\install.log
%ProgramFiles(x86)%\vopt8\vopt.exe

Удаляет следующие файлы

%WINDIR%\syswow64\~glh0002.tmp
%TEMP%\ixp000.tmp\w95inf32.dll
%TEMP%\ixp000.tmp\advpack.dll
%TEMP%\ixp000.tmp\comcat.dll
%TEMP%\ixp000.tmp\msvbvm60.dll
%TEMP%\ixp000.tmp\stdole2.tlb
%TEMP%\ixp000.tmp\olepro32.dll
%TEMP%\ixp000.tmp\oleaut32.dll
%TEMP%\ixp000.tmp\asycfilt.dll
%TEMP%\ixp000.tmp\vbrun60.inf
%TEMP%\glgbb65.tmp
%TEMP%\gljb73e.tmp
%TEMP%\glfbb66.tmp
%TEMP%\glcb72e.tmp
%TEMP%\glbb5c7.tmp
%TEMP%\rarsfx1\vopt806.exe
%TEMP%\ixp000.tmp\w95inf16.dll
%TEMP%\rarsfx0\c.exe
%WINDIR%\temp\oldc36d.tmp
%WINDIR%\temp\oldc3ec.tmp
%ProgramFiles(x86)%\vopt8\~glh0005.tmp
%ProgramFiles(x86)%\vopt8\~glh000b.tmp
%ProgramFiles(x86)%\vopt8\~glh000f.tmp
%ProgramFiles(x86)%\vopt8\~glh0011.tmp
%ProgramFiles(x86)%\vopt8\~glh0013.tmp
%ProgramFiles(x86)%\vopt8\~glh0015.tmp
%WINDIR%\syswow64\setc39c.tmp
%WINDIR%\syswow64\setc3dc.tmp
%WINDIR%\syswow64\setc3fc.tmp
%WINDIR%\syswow64\setc42c.tmp
%WINDIR%\syswow64\setc48a.tmp
%WINDIR%\syswow64\setc4e9.tmp
%WINDIR%\temp\oldc4ca.tmp
%WINDIR%\temp\oldc43c.tmp
%WINDIR%\temp\oldc41c.tmp
%WINDIR%\temp\oldc3cc.tmp
%TEMP%\rarsfx0\vopt806.exe

Перемещает следующие файлы

%TEMP%\~glh0000.tmp в %TEMP%\glfbb66.tmp
%ProgramFiles%\vopt8\~glh0014.tmp в %ProgramFiles%\vopt8\voptaux.exe
%ProgramFiles%\vopt8\temp.000 в %ProgramFiles%\vopt8\~glh0014.tmp
%ProgramFiles%\vopt8\~glh0012.tmp в %ProgramFiles%\vopt8\vopt.exe
%ProgramFiles%\vopt8\temp.000 в %ProgramFiles%\vopt8\~glh0012.tmp
%ProgramFiles%\vopt8\~glh0010.tmp в %ProgramFiles%\vopt8\vopt.dll
%ProgramFiles%\vopt8\temp.000 в %ProgramFiles%\vopt8\~glh0010.tmp
%ProgramFiles(x86)%\vopt8\~glh000e.tmp в %ProgramFiles(x86)%\vopt8\vopt.chm
%TEMP%\~glh000d.tmp в %TEMP%\vbrun60sp6.exe
%ProgramFiles%\vopt8\~glh000c.tmp в %ProgramFiles%\vopt8\tssofficemenu1d.ocx
%ProgramFiles%\vopt8\temp.000 в %ProgramFiles%\vopt8\~glh0016.tmp
%ProgramFiles%\vopt8\temp.000 в %ProgramFiles%\vopt8\~glh000c.tmp
%ProgramFiles(x86)%\vopt8\~glh0009.tmp в %ProgramFiles(x86)%\vopt8\portuguese-br.ini
%ProgramFiles(x86)%\vopt8\~glh0008.tmp в %ProgramFiles(x86)%\vopt8\license.txt
%ProgramFiles(x86)%\vopt8\~glh0007.tmp в %ProgramFiles(x86)%\vopt8\language.txt
%ProgramFiles%\vopt8\~glh0006.tmp в %ProgramFiles%\vopt8\fraplus1.ocx
%ProgramFiles%\vopt8\temp.000 в %ProgramFiles%\vopt8\~glh0006.tmp
%ProgramFiles(x86)%\vopt8\~glh0004.tmp в %ProgramFiles(x86)%\vopt8\english.ini
%WINDIR%\syswow64\~glh0003.tmp в %WINDIR%\syswow64\comctl32.ocx
%WINDIR%\syswow64\temp.000 в %WINDIR%\syswow64\~glh0003.tmp
%ProgramFiles(x86)%\vopt8\~glh0001.tmp в %ProgramFiles(x86)%\vopt8\unwise.exe
%ProgramFiles(x86)%\vopt8\~glh000a.tmp в %ProgramFiles(x86)%\vopt8\russian.ini
%ProgramFiles%\vopt8\~glh0016.tmp в %ProgramFiles%\vopt8\voptsx.dll