Trojan.MulDrop21.46368

Техническая информация

Вредоносные функции

Для затруднения выявления своего присутствия в системе

изменяет следующие системные настройки:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDesktop' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoShellSearchButton' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDrives' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFileMenu' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewContextMenu' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoChangeStartMenu' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSMHelp' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSetFolders' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFavoritesMenu' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoToolbarCustomize' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoPrinters' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDeletePrinter' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoPrinterTabs' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRecentDocsMenu' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoCommonGroups' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuSubFolders' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'StartmenuLogoff' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoUserNameInStartMenu' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuMFUprogramsList' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuPinnedList' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoManageMyComputerVerb' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoNetHood' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoActiveDesktop' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoAddPrinter' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoThemesTab' = '00000000'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\app\wintoolsnet\help\dutch(nederlands).chm
%TEMP%\app\wintoolsnet\lang\turkish.lng
%TEMP%\app\wintoolsnet\lang\ukrainian.lng
%TEMP%\app\wintoolsnet\readme.txt
%TEMP%\app\wintoolsnet\regs\blank.ico
%TEMP%\app\wintoolsnet\regs\fix-drive.reg
%TEMP%\app\wintoolsnet\regs\fix-exe.reg
%TEMP%\app\wintoolsnet\regs\fix-folder.reg
%TEMP%\app\wintoolsnet\regs\fix-ico.reg
%TEMP%\app\wintoolsnet\regs\fix-lnk.reg
%TEMP%\app\wintoolsnet\regs\photoviewer.reg
%TEMP%\app\wintoolsnet\lang\spanish.lng
%TEMP%\app\wintoolsnet\lang\tchinese.lng
%TEMP%\app\wintoolsnet\wintoolsnet.ini
%TEMP%\data\wintoolsnet\wintoolspremium.xml
%TEMP%\data\wintoolsnetportable.ini
%TEMP%\wintoolsnetportable.ini
%TEMP%\app\wintoolsnet\language.exe
%TEMP%\app\wintoolsnet\wintoolsnet.exe
%TEMP%\wintoolsnetportable.exe
%TEMP%\nsxc7d2.tmp
%TEMP%\nsmc7e2.tmp\registry.dll
%TEMP%\nsmc7e2.tmp\findprocdll.dll
%APPDATA%\wintools\premiumwt
%TEMP%\app\wintoolsnet\wintoolspremium.xml
%TEMP%\data\wintoolsnet\wintoolsnet.ini
%TEMP%\app\wintoolsnet\lang\slovenian.lng
%TEMP%\app\wintoolsnet\lang\serbian latin.lng
%TEMP%\app\wintoolsnet\lang\serbian cyrillic.lng
%TEMP%\app\wintoolsnet\help\german.chm
%TEMP%\app\wintoolsnet\help\russian.chm
%TEMP%\app\wintoolsnet\help\spanish.chm
%TEMP%\app\wintoolsnet\lang\arabic.lng
%TEMP%\app\wintoolsnet\lang\belarusian.lng
%TEMP%\app\wintoolsnet\lang\croatian.lng
%TEMP%\app\wintoolsnet\lang\czech.lng
%TEMP%\app\wintoolsnet\lang\danish.lng
%TEMP%\app\wintoolsnet\lang\default.lng
%TEMP%\app\wintoolsnet\lang\dutch(nederlands).lng
%TEMP%\app\wintoolsnet\lang\english.lng
%TEMP%\app\wintoolsnet\help\english.chm
%TEMP%\app\wintoolsnet\lang\french.lng
%TEMP%\app\wintoolsnet\lang\hebrew.lng
%TEMP%\app\wintoolsnet\lang\hungary.lng
%TEMP%\app\wintoolsnet\lang\italian.lng
%TEMP%\app\wintoolsnet\lang\korean.lng
%TEMP%\app\wintoolsnet\lang\korean1.lng
%TEMP%\app\wintoolsnet\lang\persian.lng
%TEMP%\app\wintoolsnet\lang\polish.lng
%TEMP%\app\wintoolsnet\lang\portuguese.lng
%TEMP%\app\wintoolsnet\lang\romana.lng
%TEMP%\app\wintoolsnet\lang\russian.lng
%TEMP%\app\wintoolsnet\lang\schinese.lng
%TEMP%\app\wintoolsnet\lang\german.lng
%APPDATA%\wintools\premiumwt.dll
%TEMP%\nsmc7e2.tmp\system.dll

Присваивает атрибут 'скрытый' для следующих файлов

%TEMP%\data\wintoolsnetportable.ini

Перемещает следующие файлы

%TEMP%\data\wintoolsnet\wintoolsnet.ini в %TEMP%\app\wintoolsnet\wintoolsnet.ini
%TEMP%\data\wintoolsnet\wintoolspremium.xml в %TEMP%\app\wintoolsnet\wintoolspremium.xml

Другое

Ищет следующие окна