Trojan.MulDrop5.28931

Техническая информация

Вредоносные функции:

Ищет следующие окна с целью

обнаружения утилит для анализа:

ClassName: 'FileMonClass' WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: 'FileMonClass'
ClassName: 'APIMonitor By Rohitab' WindowName: '(null)'
ClassName: 'OLLYDBG' WindowName: '(null)'
ClassName: 'TIdaWindow' WindowName: '(null)'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\d3d9caps.tmp
%TEMP%\drm_dialogs.dll
<SYSTEM32>CmdLineExt.dll
<SYSTEM32>\d3d9caps.dat

Удаляет следующие файлы:

<SYSTEM32>\d3d9caps.dat

Перемещает следующие файлы:

<SYSTEM32>\d3d9caps.tmp в <SYSTEM32>\d3d9caps.dat

Другое:

Ищет следующие окна:

ClassName: 'ToolbarWindow32?' WindowName: '(null)'
ClassName: 'ThunderRT6Main' WindowName: 'SD4 Sucks v0.10 by Joseph Cox'
ClassName: 'TApplication' WindowName: '<Имя вируса>'
ClassName: 'ThunderRT6Main' WindowName: 'SysAnalyzer'
ClassName: 'ReBarWindow32' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: '(null)' WindowName: 'APIMonitor By Rohitab'
ClassName: 'SafeDisc4 Hider 1.1 ? 2005 SKULL' WindowName: 'Tsd4hideform'
ClassName: 'Tsd4hideform' WindowName: 'SafeDisc4 Hider 1.1 ? 2005 SKULL'
ClassName: 'ThunderRT6FormDC' WindowName: 'Pr0t.St0p v1.0'
ClassName: 'ThunderRT6Main' WindowName: 'Pr0t.St0p v1.0'
ClassName: 'ThunderRT6FormDC' WindowName: 'Settings'
ClassName: 'SysAnalyzer Configuration Wizard' WindowName: 'ThunderRT6Main'
ClassName: 'ThunderRT6Main' WindowName: 'SysAnalyzer Configuration Wizard'
ClassName: 'sniff_hit' WindowName: 'ThunderRT6Main'
ClassName: 'SysListView32' WindowName: '(null)'
ClassName: 'PEBrowse Professional Interactive' WindowName: 'TMainForm'
ClassName: 'TMainForm' WindowName: 'PEBrowse Professional Interactive'
ClassName: 'ApiLogger' WindowName: 'ThunderRT6Main'
ClassName: 'ThunderRT6Main' WindowName: 'ApiLogger'
ClassName: 'SysAnalyzer' WindowName: 'ThunderRT6Main'
ClassName: 'ThunderRT6Main' WindowName: 'sniff_hit'
ClassName: 'Process Analyzer - right click on a process to access menu' WindowName: 'ThunderRT6Main'
ClassName: 'ThunderRT6Main' WindowName: 'Process Analyzer - right click on a process to access menu'
ClassName: 'SafeDisc4 Hider 1.0 ? 2005 SKULL' WindowName: 'TForm1'
ClassName: '[ LordPE Deluxe ] by yoda' WindowName: '(null)'
ClassName: '(null)' WindowName: '[ LordPE Deluxe ] by yoda'
ClassName: 'ThunderRT6Main' WindowName: 'SR7Stop'
ClassName: '#32770' WindowName: '[ LordPE Deluxe b ] by yoda'
ClassName: '[ LordPE Dumper Server ]' WindowName: '(null)'
ClassName: '(null)' WindowName: '[ LordPE Dumper Server ]'
ClassName: 'WispWindowClass' WindowName: 'Syser [Ctrl+F12]'
ClassName: 'kk1' WindowName: '(null)'
ClassName: '18467-41' WindowName: '(null)'
ClassName: 'Virtual-CD-Hide' WindowName: 'Virtual-CD-Hide'
ClassName: '#32770' WindowName: 'Starforce Nightmare'
ClassName: 'ThunderRT6Main' WindowName: 'Anti-Blaxx'
ClassName: 'BusTrace Status' WindowName: '#32770'
ClassName: '#32770' WindowName: 'BusTrace Status'
ClassName: 'Fucker of CDROM Protections v0.83 Beta' WindowName: 'TForm1'
ClassName: 'TForm1' WindowName: 'SafeDisc4 Hider 1.0 ? 2005 SKULL'
ClassName: 'SafeDisc4 Hider' WindowName: 'TApplication'
ClassName: 'TApplication' WindowName: 'SafeDisc4 Hider'
ClassName: 'STARFUCK TOOL' WindowName: '#32770'
ClassName: '#32770' WindowName: 'STARFUCK TOOL'
ClassName: '[ LordPE Deluxe b ] by yoda' WindowName: '#32770'
ClassName: 'TForm1' WindowName: 'Fucker of CDROM Protections v0.83 Beta'
ClassName: 'Fucker of CDROM Protections v0.81 Beta' WindowName: 'TForm1'
ClassName: 'TForm1' WindowName: 'Fucker of CDROM Protections v0.81 Beta'