Trojan.MulDrop5.42256

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%CommonProgramFiles%\InstallShield\engine\6\Intel 32\IKernel.exe'
'%CommonProgramFiles%\InstallShield\engine\6\Intel 32\IKernel.exe' 32\IKernel.exe -Embedding
'%CommonProgramFiles%\InstallShield\engine\6\Intel 32\IKernel.exe' /REGSERVER
'%TEMP%\mySecureSurfer_no_chrome.exe'
'%TEMP%\software.exe'
'%TEMP%\pft6~tmp\Setup.exe' /SMS

Завершает или пытается завершить

следующие пользовательские процессы:

firefox.exe

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\InstallShield\engine\6\Intel 32\core965a.rra
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\ILog9495.rra
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\obje982f.rra
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\ctor96a8.rra
%TEMP%\pft6~tmp\data1.cab
%TEMP%\pft6~tmp\data1.hdr
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\temp.000
%TEMP%\pft6~tmp\Setup.ini
%TEMP%\{1f5e7060-d8bf-11d2-b0ac-00104bde59ed}\isrta241.rra
%TEMP%\{1f5e7060-d8bf-11d2-b0ac-00104bde59ed}\valua147.rra
%TEMP%\{1f5e7060-d8bf-11d2-b0ac-00104bde59ed}\_IsRa2fc.rra
%TEMP%\{1f5e7060-d8bf-11d2-b0ac-00104bde59ed}\defaa29f.rra
%CommonProgramFiles%\InstallShield\IScript\IScr9abf.rra
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\iuse988d.rra
%TEMP%\{1f5e7060-d8bf-11d2-b0ac-00104bde59ed}\licea0da.rra
%TEMP%\{1f5e7060-d8bf-11d2-b0ac-00104bde59ed}\setua04d.rra
%TEMP%\pft6~tmp\layout.bin
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157}\install.rdf
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157}\icon32.png
%TEMP%\software.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157}\chrome\content\extension.js
%TEMP%\nsx3.tmp\KillProcDLL.dll
%TEMP%\mySecureSurfer_no_chrome.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157}\icon.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157}\bootstrap.js
%TEMP%\pft6~tmp\ikernel.ex_
%TEMP%\pft6~tmp\Setup.exe
%TEMP%\pft6~tmp\setup.inx
%TEMP%\pft6~tmp\data2.cab
%TEMP%\plf4.tmp
%TEMP%\ext5.tmp
%TEMP%\pft6~tmp\pftw1.pkg

Удаляет следующие файлы:

%TEMP%\ext5.tmp
%TEMP%\pft6~tmp\pftw1.pkg
%TEMP%\nsx3.tmp\KillProcDLL.dll
%TEMP%\mySecureSurfer_no_chrome.exe

Перемещает следующие файлы:

%TEMP%\{1f5e7060-d8bf-11d2-b0ac-00104bde59ed}\valua147.rra в %TEMP%\{1f5e7060-d8bf-11d2-b0ac-00104bde59ed}\value.shl
%TEMP%\{1f5e7060-d8bf-11d2-b0ac-00104bde59ed}\licea0da.rra в %TEMP%\{1f5e7060-d8bf-11d2-b0ac-00104bde59ed}\license.txt
%TEMP%\{1f5e7060-d8bf-11d2-b0ac-00104bde59ed}\setua04d.rra в %TEMP%\{1f5e7060-d8bf-11d2-b0ac-00104bde59ed}\setup.inx
%TEMP%\{1f5e7060-d8bf-11d2-b0ac-00104bde59ed}\_IsRa2fc.rra в %TEMP%\{1f5e7060-d8bf-11d2-b0ac-00104bde59ed}\_IsRes.dll
%TEMP%\{1f5e7060-d8bf-11d2-b0ac-00104bde59ed}\defaa29f.rra в %TEMP%\{1f5e7060-d8bf-11d2-b0ac-00104bde59ed}\default.pal
%TEMP%\{1f5e7060-d8bf-11d2-b0ac-00104bde59ed}\isrta241.rra в %TEMP%\{1f5e7060-d8bf-11d2-b0ac-00104bde59ed}\isrt.dll
%CommonProgramFiles%\InstallShield\IScript\IScr9abf.rra в %CommonProgramFiles%\InstallShield\IScript\IScript.dll
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\core965a.rra в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\corecomp.ini
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\ILog9495.rra в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\ILog.dll
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\temp.000 в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\IKernel.exe
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\iuse988d.rra в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\iuser.dll
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\obje982f.rra в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\objectps.dll
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\ctor96a8.rra в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\ctor.dll