Trojan.MulDrop5.41545

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\7zS4.tmp\setup.exe'
'%TEMP%\software.exe'
'%TEMP%\mySecureSurfer_no_chrome.exe'

Завершает или пытается завершить

следующие пользовательские процессы:

firefox.exe

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\7zS4.tmp\core\update-settings.ini
%TEMP%\7zS4.tmp\core\updater.ini
%TEMP%\7zS4.tmp\core\platform.ini
%TEMP%\7zS4.tmp\core\crashreporter-override.ini
%TEMP%\7zS4.tmp\core\crashreporter.ini
%TEMP%\7zS4.tmp\core\defaults\pref\channel-prefs.js
%TEMP%\7zS4.tmp\core\dependentlibs.list
%TEMP%\7zS4.tmp\core\webapprt\omni.ja
%TEMP%\7zS4.tmp\core\webapprt\webapprt.ini
%TEMP%\7zS4.tmp\core\omni.ja
%TEMP%\7zS4.tmp\core\maintenanceservice_installer.exe
%TEMP%\7zS4.tmp\core\plugin-container.exe
%TEMP%\7zS4.tmp\core\maintenanceservice.exe
%TEMP%\7zS4.tmp\core\firefox.exe
%TEMP%\7zS4.tmp\core\uninstall\helper.exe
%TEMP%\7zS4.tmp\core\webapprt-stub.exe
%TEMP%\7zS4.tmp\core\application.ini
%TEMP%\7zS4.tmp\core\webapp-uninstaller.exe
%TEMP%\7zS4.tmp\setup.exe
%TEMP%\7zS4.tmp\core\updater.exe
%TEMP%\7zS4.tmp\core\components\binary.manifest
%TEMP%\nsn6.tmp\shortcuts.ini
%TEMP%\nsn6.tmp\components.ini
%TEMP%\nsn6.tmp\options.ini
%TEMP%\7zS4.tmp\core\searchplugins\yahoo-de.xml
%TEMP%\nsn6.tmp\System.dll
%TEMP%\nsn6.tmp\modern-header.bmp
%TEMP%\nsn6.tmp\InstallOptions.dll
%TEMP%\nsn6.tmp\modern-wizard.bmp
%TEMP%\nsn6.tmp\summary.ini
%TEMP%\nsn6.tmp\ioSpecial.ini
%TEMP%\7zS4.tmp\core\searchplugins\amazondotcom-de.xml
%TEMP%\7zS4.tmp\core\searchplugins\bing.xml
%TEMP%\7zS4.tmp\core\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\install.rdf
%TEMP%\7zS4.tmp\core\chrome.manifest
%TEMP%\7zS4.tmp\core\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\icon.png
%TEMP%\7zS4.tmp\core\searchplugins\leo_ende_de.xml
%TEMP%\7zS4.tmp\core\searchplugins\wikipedia-de.xml
%TEMP%\7zS4.tmp\core\searchplugins\google.xml
%TEMP%\7zS4.tmp\core\blocklist.xml
%TEMP%\7zS4.tmp\core\searchplugins\eBay-de.xml
%TEMP%\7zS4.tmp\core\AccessibleMarshal.dll
%TEMP%\7zS4.tmp\core\breakpadinjector.dll
%TEMP%\7zS4.tmp\core\softokn3.chk
%TEMP%\7zS4.tmp\core\freebl3.chk
%TEMP%\7zS4.tmp\core\nssdbm3.chk
%TEMP%\7zS4.tmp\core\freebl3.dll
%TEMP%\7zS4.tmp\core\gkmedias.dll
%TEMP%\7zS4.tmp\core\d3dx9_43.dll
%TEMP%\7zS4.tmp\core\components\browsercomps.dll
%TEMP%\7zS4.tmp\core\D3DCompiler_43.dll
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157}\icon.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157}\icon32.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157}\bootstrap.js
%TEMP%\mySecureSurfer_no_chrome.exe
%TEMP%\nsf3.tmp\KillProcDLL.dll
%TEMP%\7zS4.tmp\core\precomplete
%TEMP%\7zS4.tmp\core\removed-files
%TEMP%\software.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157}\install.rdf
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157}\chrome\content\extension.js
%TEMP%\7zS4.tmp\core\libEGL.dll
%TEMP%\7zS4.tmp\core\plds4.dll
%TEMP%\7zS4.tmp\core\smime3.dll
%TEMP%\7zS4.tmp\core\plc4.dll
%TEMP%\7zS4.tmp\core\nssdbm3.dll
%TEMP%\7zS4.tmp\core\nssutil3.dll
%TEMP%\7zS4.tmp\core\xul.dll
%TEMP%\7zS4.tmp\core\crashreporter.exe
%TEMP%\7zS4.tmp\core\xpcom.dll
%TEMP%\7zS4.tmp\core\softokn3.dll
%TEMP%\7zS4.tmp\core\ssl3.dll
%TEMP%\7zS4.tmp\core\mozjs.dll
%TEMP%\7zS4.tmp\core\mozsqlite3.dll
%TEMP%\7zS4.tmp\core\mozglue.dll
%TEMP%\7zS4.tmp\core\libGLESv2.dll
%TEMP%\7zS4.tmp\core\mozalloc.dll
%TEMP%\7zS4.tmp\core\nss3.dll
%TEMP%\7zS4.tmp\core\nssckbi.dll
%TEMP%\7zS4.tmp\core\nspr4.dll
%TEMP%\7zS4.tmp\core\msvcp100.dll
%TEMP%\7zS4.tmp\core\msvcr100.dll