Trojan.DownLoader11.7875

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'PC Cleaner' = '%PROGRAM_FILES%\PC Cleaner\PCCLauncher.exe'

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\PC Cleaner\PCCSmartScan.exe'
'%PROGRAM_FILES%\PC Cleaner\PCCleaner.exe' /START
'%TEMP%\pccleanersetup.exe'
'%TEMP%\is-Q413R.tmp\pccleanersetup.tmp' /SL5="$30092,1878660,54272,%TEMP%\pccleanersetup.exe" /VERYSILENT /NORESTART /SUPPRESSMSGBOXES

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\PC Cleaner\is-J5N4T.tmp
%PROGRAM_FILES%\PC Cleaner\is-LTT3O.tmp
%PROGRAM_FILES%\PC Cleaner\is-O7RS0.tmp
%PROGRAM_FILES%\PC Cleaner\is-1DL51.tmp
%PROGRAM_FILES%\PC Cleaner\is-NJ85K.tmp
%PROGRAM_FILES%\PC Cleaner\is-5Q9N1.tmp
%PROGRAM_FILES%\PC Cleaner\is-MOOLK.tmp
%PROGRAM_FILES%\PC Cleaner\is-B6SIC.tmp
%PROGRAM_FILES%\PC Cleaner\is-HJG0C.tmp
%PROGRAM_FILES%\PC Cleaner\is-UQN0B.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\PC Cleaner\Help.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\PC Cleaner\Check updates.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\PC Cleaner\PC Cleaner on the Web.lnk
%PROGRAM_FILES%\PC Cleaner\unins000.dat
%ALLUSERSPROFILE%\Start Menu\Programs\PC Cleaner\Uninstall PC Cleaner.lnk
%PROGRAM_FILES%\PC Cleaner\is-9BDQ3.tmp
%PROGRAM_FILES%\PC Cleaner\is-6GBEB.tmp
%PROGRAM_FILES%\PC Cleaner\is-AS075.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\PC Cleaner\PC Cleaner.lnk
%HOMEPATH%\Desktop\PC Cleaner.lnk
%PROGRAM_FILES%\PC Cleaner\is-SSH0C.tmp
%PROGRAM_FILES%\PC Cleaner\is-GTSV0.tmp
%PROGRAM_FILES%\PC Cleaner\is-8G0SQ.tmp
%PROGRAM_FILES%\PC Cleaner\is-D9FE5.tmp
%PROGRAM_FILES%\PC Cleaner\is-MTAV0.tmp
%PROGRAM_FILES%\PC Cleaner\is-4EIF8.tmp
%TEMP%\is-Q413R.tmp\pccleanersetup.tmp
%TEMP%\pccleanersetup.exe
%TEMP%\is-H879R.tmp\_isetup\_RegDLL.tmp
%PROGRAM_FILES%\PC Cleaner\is-AI0AK.tmp
%TEMP%\is-H879R.tmp\_isetup\_shfoldr.dll
%PROGRAM_FILES%\PC Cleaner\is-K099D.tmp
%PROGRAM_FILES%\PC Cleaner\is-BNON0.tmp
%PROGRAM_FILES%\PC Cleaner\is-FN77L.tmp
%PROGRAM_FILES%\PC Cleaner\is-VIAF0.tmp
%PROGRAM_FILES%\PC Cleaner\is-7HSA5.tmp
%PROGRAM_FILES%\PC Cleaner\is-OFAAK.tmp
%PROGRAM_FILES%\PC Cleaner\is-43S0S.tmp
%PROGRAM_FILES%\PC Cleaner\is-N6MSJ.tmp
%PROGRAM_FILES%\PC Cleaner\is-PJ4SC.tmp
%PROGRAM_FILES%\PC Cleaner\is-7RMSM.tmp

Удаляет следующие файлы:

%TEMP%\pccleanersetup.exe
%TEMP%\is-Q413R.tmp\pccleanersetup.tmp
%TEMP%\is-H879R.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-H879R.tmp\_isetup\_shfoldr.dll

Перемещает следующие файлы:

%PROGRAM_FILES%\PC Cleaner\is-B6SIC.tmp в %PROGRAM_FILES%\PC Cleaner\file_id.diz
%PROGRAM_FILES%\PC Cleaner\is-UQN0B.tmp в %PROGRAM_FILES%\PC Cleaner\HomePage.url
%PROGRAM_FILES%\PC Cleaner\is-HJG0C.tmp в %PROGRAM_FILES%\PC Cleaner\license_de.txt
%PROGRAM_FILES%\PC Cleaner\is-5Q9N1.tmp в %PROGRAM_FILES%\PC Cleaner\BuildsList.ini
%PROGRAM_FILES%\PC Cleaner\is-VIAF0.tmp в %PROGRAM_FILES%\PC Cleaner\sqlite3.dll
%PROGRAM_FILES%\PC Cleaner\is-SSH0C.tmp в %PROGRAM_FILES%\PC Cleaner\StartupList.txt
%PROGRAM_FILES%\PC Cleaner\is-MOOLK.tmp в %PROGRAM_FILES%\PC Cleaner\Startw3i.exe
%PROGRAM_FILES%\PC Cleaner\is-LTT3O.tmp в %PROGRAM_FILES%\PC Cleaner\license_en.txt
%PROGRAM_FILES%\PC Cleaner\is-6GBEB.tmp в %PROGRAM_FILES%\PC Cleaner\PCC_Setup_Es.iss
%PROGRAM_FILES%\PC Cleaner\is-9BDQ3.tmp в %PROGRAM_FILES%\PC Cleaner\PCC_Setup_Fr.iss
%PROGRAM_FILES%\PC Cleaner\is-AS075.tmp в %PROGRAM_FILES%\PC Cleaner\PCCleaner.chm
%PROGRAM_FILES%\PC Cleaner\is-1DL51.tmp в %PROGRAM_FILES%\PC Cleaner\PCC_Setup_En.iss
%PROGRAM_FILES%\PC Cleaner\is-J5N4T.tmp в %PROGRAM_FILES%\PC Cleaner\License_es.txt
%PROGRAM_FILES%\PC Cleaner\is-O7RS0.tmp в %PROGRAM_FILES%\PC Cleaner\License_fr.txt
%PROGRAM_FILES%\PC Cleaner\is-NJ85K.tmp в %PROGRAM_FILES%\PC Cleaner\PCC_Setup_De.iss
%PROGRAM_FILES%\PC Cleaner\is-4EIF8.tmp в %PROGRAM_FILES%\PC Cleaner\German.ini
%PROGRAM_FILES%\PC Cleaner\is-MTAV0.tmp в %PROGRAM_FILES%\PC Cleaner\PCCGuard.exe
%PROGRAM_FILES%\PC Cleaner\is-43S0S.tmp в %PROGRAM_FILES%\PC Cleaner\PCCLauncher.exe
%PROGRAM_FILES%\PC Cleaner\is-D9FE5.tmp в %PROGRAM_FILES%\PC Cleaner\French.ini
%PROGRAM_FILES%\PC Cleaner\is-AI0AK.tmp в %PROGRAM_FILES%\PC Cleaner\unins000.exe
%PROGRAM_FILES%\PC Cleaner\is-8G0SQ.tmp в %PROGRAM_FILES%\PC Cleaner\CookiesException.txt
%PROGRAM_FILES%\PC Cleaner\is-GTSV0.tmp в %PROGRAM_FILES%\PC Cleaner\English.ini
%PROGRAM_FILES%\PC Cleaner\is-OFAAK.tmp в %PROGRAM_FILES%\PC Cleaner\PCCleaner.exe
%PROGRAM_FILES%\PC Cleaner\is-K099D.tmp в %PROGRAM_FILES%\PC Cleaner\PCCWelcome.exe
%PROGRAM_FILES%\PC Cleaner\is-FN77L.tmp в %PROGRAM_FILES%\PC Cleaner\scan.gif
%PROGRAM_FILES%\PC Cleaner\is-7HSA5.tmp в %PROGRAM_FILES%\PC Cleaner\Spanish.ini
%PROGRAM_FILES%\PC Cleaner\is-BNON0.tmp в %PROGRAM_FILES%\PC Cleaner\PCCUninstaller.exe
%PROGRAM_FILES%\PC Cleaner\is-N6MSJ.tmp в %PROGRAM_FILES%\PC Cleaner\PCCReminder.exe
%PROGRAM_FILES%\PC Cleaner\is-7RMSM.tmp в %PROGRAM_FILES%\PC Cleaner\PCCSchedule.exe
%PROGRAM_FILES%\PC Cleaner\is-PJ4SC.tmp в %PROGRAM_FILES%\PC Cleaner\PCCSmartScan.exe