Trojan.MulDrop28.19195

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\Software\Classes\InstallRite File\Shell\Open\Command] '' = '<Текущая директория>\dbc2000.exe %1'

Изменения в файловой системе

Создает следующие файлы

<Текущая директория>\dbc2000.exe
%ProgramFiles%\db commander 2000 pro\db commander help.gid
%ProgramFiles%\db commander 2000 pro\db commander help.cnt
%CommonProgramFiles%\borland shared\bde\usa.btl
%CommonProgramFiles%\borland shared\bde\other.btl
%CommonProgramFiles%\borland shared\bde\japan.btl
%CommonProgramFiles%\borland shared\bde\idsql32.dll
%ProgramFiles%\db commander 2000 pro\db commander help.hlp
%CommonProgramFiles%\borland shared\bde\idr20009.dll
%CommonProgramFiles%\borland shared\bde\idpdx32.dll
%CommonProgramFiles%\borland shared\bde\idodbc32.dll
%CommonProgramFiles%\borland shared\bde\iddr32.dll
%CommonProgramFiles%\borland shared\bde\iddbas32.dll
%CommonProgramFiles%\borland shared\bde\iddao32.dll
%CommonProgramFiles%\borland shared\bde\idda3532.dll
%CommonProgramFiles%\borland shared\bde\idqbe32.dll
%WINDIR%\installer\{db6c3449-ad77-4c65-a038-bac98e4f7536}\newshortcut4_db6c3449ad774c65a038bac98e4f7536.exe
%TEMP%\41\iwt_registry.reg
%ProgramFiles%\db commander 2000 pro\pd_user.gid
%TEMP%\41\delreg.lst
%WINDIR%\syswow64\wbem\logs\wbemess.log
%WINDIR%\syswow64\wbem\logs\wbemcore.log
%WINDIR%\syswow64\midas.dll
%WINDIR%\syswow64\dbclient.dll
%WINDIR%\syswow64\bdeadmin.cpl
%CommonProgramFiles%\borland shared\bde\idbat32.dll
%WINDIR%\installer\de315.msi
%WINDIR%\installer\{db6c3449-ad77-4c65-a038-bac98e4f7536}\newshortcut3.exe
%WINDIR%\installer\{db6c3449-ad77-4c65-a038-bac98e4f7536}\newshortcut2.hlp
%WINDIR%\installer\{db6c3449-ad77-4c65-a038-bac98e4f7536}\newshortcut1_db6c3449ad774c65a038bac98e4f7536.exe
%WINDIR%\downloaded installations\{f0b8164c-2607-415d-8b79-326ae06e24ff}\db commander 2000 pro.msi
%ProgramFiles%\db commander 2000 pro\uninstall.exe
%ProgramFiles%\db commander 2000 pro\pd_user.hlp
%ProgramFiles%\db commander 2000 pro\db_commander.exe
%ProgramFiles%\db commander 2000 pro\pd_user.cnt
%CommonProgramFiles%\borland shared\bde\idasci32.dll
C:\documents and settings\all users\ВЎВёВїВЄГЄВјВЎВ№ВІГ«ВµВҐ\ВіГ¬Г°ГІ\db commander 2000 pro\db commander help.lnk
C:\documents and settings\administrator\recent\dbc2000v6.8ГґВГ—В°ГГЄГµГ»13.2.24 (2).lnk
C:\documents and settings\administrator\local settings\<INETFILES>\content.ie5\index.dat
C:\documents and settings\administrator\local settings\temp\idapi32.cfg
C:\documents and settings\administrator\local settings\temp\idapi.cnf
C:\documents and settings\administrator\local settings\history\history.ie5\index.dat
C:\documents and settings\administrator\local settings\application data\microsoft\feeds cache\index.dat
C:\documents and settings\administrator\recent\Г«ВµГЈГ·.lnk
C:\documents and settings\administrator\cookies\index.dat
%TEMP%\41\delfile.lst
%TEMP%\41\filelist.lst
%TEMP%\41\ver.txt
%TEMP%\41\kit.opt
<Текущая директория>\ВЅГўВѕГ¶210dВ±ВЁВґГ.reg
<Текущая директория>\idapi32.cfg
%TEMP%\41\dirlist.lst
%CommonProgramFiles%\borland shared\bde\blw32.dll
%CommonProgramFiles%\borland shared\bde\idapi32.dll
C:\documents and settings\all users\ВЎВёВїВЄГЄВјВЎВ№ВІГ«ВµВҐ\ВіГ¬Г°ГІ\db commander 2000 pro\uninstall db commander 2000 pro.lnk
%CommonProgramFiles%\borland shared\bde\idapi32.cfg
%CommonProgramFiles%\borland shared\bde\fareast.btl
%CommonProgramFiles%\borland shared\bde\europe.btl
%CommonProgramFiles%\borland shared\bde\disp.pak
%CommonProgramFiles%\borland shared\bde\disp.dll
%CommonProgramFiles%\borland shared\bde\charset.cvb
%CommonProgramFiles%\borland shared\bde\idapinst.dll
%CommonProgramFiles%\borland shared\bde\ceeurope.btl
%CommonProgramFiles%\borland shared\bde\bdeadmin.toc
%CommonProgramFiles%\borland shared\bde\bdeadmin.hlp
%CommonProgramFiles%\borland shared\bde\bdeadmin.exe
%CommonProgramFiles%\borland shared\bde\bdeadmin.cnt
%CommonProgramFiles%\borland shared\bde\bantam.dll
C:\documents and settings\all users\Г—Г ГЈГ¦\db commander shortcut.lnk
C:\documents and settings\all users\ВЎВёВїВЄГЄВјВЎВ№ВІГ«ВµВҐ\ВіГ¬Г°ГІ\db commander 2000 pro\db commander 2000 pro.lnk
<Текущая директория>\config.ini

Присваивает атрибут 'скрытый' для следующих файлов

C:\documents and settings\administrator\local settings\application data\microsoft\feeds cache\index.dat
%ProgramFiles%\db commander 2000 pro\db commander help.gid
%ProgramFiles%\db commander 2000 pro\pd_user.gid

Удаляет следующие файлы