Trojan.DownLoader12.7494

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\Bia2Socks Connection\Bia2Socks.exe'

Завершает или пытается завершить

следующие пользовательские процессы:

firefox.exe

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Bia2Socks Connection\PrxDrvPE64.dll
%PROGRAM_FILES%\Bia2Socks Connection\PrxDrvPE.dll
%PROGRAM_FILES%\Bia2Socks Connection\ProxyChecker.exe
%PROGRAM_FILES%\Bia2Socks Connection\pshow
%PROGRAM_FILES%\Bia2Socks Connection\Settings.ini
%PROGRAM_FILES%\Bia2Socks Connection\Settings.dll
%PROGRAM_FILES%\Bia2Socks Connection\restore.txt
%PROGRAM_FILES%\Bia2Socks Connection\panel.txt
%PROGRAM_FILES%\Bia2Socks Connection\pc2nl\padlock.dll
%PROGRAM_FILES%\Bia2Socks Connection\p
%PROGRAM_FILES%\Bia2Socks Connection\password.txt
%PROGRAM_FILES%\Bia2Socks Connection\Proxifier.exe
%PROGRAM_FILES%\Bia2Socks Connection\PM9.exe
%PROGRAM_FILES%\Bia2Socks Connection\pc2nl\pc2nl.exe
%PROGRAM_FILES%\Bia2Socks Connection\pc2nl\ssleay32.dll
%HOMEPATH%\Desktop\Bia2Socks Connection.lnk
%HOMEPATH%\Start Menu\Programs\Bia2Socks Connection\Bia2Socks Connection Uninstaller.lnk
%PROGRAM_FILES%\Bia2Socks Connection\pc2nl\zlib1.dll
%HOMEPATH%\Start Menu\Programs\Bia2Socks Connection\Bia2Socks Connection.lnk
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs1.js
%WINDIR%\Bia2Socks Connection Uninstaller.exe
%PROGRAM_FILES%\Bia2Socks Connection\pc2nl\sureware.dll
%PROGRAM_FILES%\Bia2Socks Connection\support.txt
%PROGRAM_FILES%\Bia2Socks Connection\pc2nl\stunnel.conf
%PROGRAM_FILES%\Bia2Socks Connection\pc2nl\ubsec.dll
%PROGRAM_FILES%\Bia2Socks Connection\zbd.dll
%PROGRAM_FILES%\Bia2Socks Connection\xmllite.dll
%PROGRAM_FILES%\Bia2Socks Connection\Untitled.ico
%PROGRAM_FILES%\Bia2Socks Connection\pc2nl\chil.dll
%PROGRAM_FILES%\Bia2Socks Connection\pc2nl\capi.dll
%PROGRAM_FILES%\Bia2Socks Connection\Bia2Socks.exe
%PROGRAM_FILES%\Bia2Socks Connection\cpaiam.txt
%PROGRAM_FILES%\Bia2Socks Connection\pc2nl\gmp.dll
%PROGRAM_FILES%\Bia2Socks Connection\Profiles\Default.ppx
%PROGRAM_FILES%\Bia2Socks Connection\pc2nl\cswift.dll
%TEMP%\aiw135656.EXE
%TEMP%\aiw135609.bmp
%TEMP%\aiw135500.bmp
%PROGRAM_FILES%\Bia2Socks Connection\pc2nl\4758cca.dll
%PROGRAM_FILES%\Bia2Socks Connection\aval
%PROGRAM_FILES%\Bia2Socks Connection\pc2nl\atalla.dll
%PROGRAM_FILES%\Bia2Socks Connection\pc2nl\aep.dll
%PROGRAM_FILES%\Bia2Socks Connection\pc2nl\gost.dll
%PROGRAM_FILES%\Bia2Socks Connection\network_places.ico
%PROGRAM_FILES%\Bia2Socks Connection\pc2nl\msvcr90.dll
<SYSTEM32>\MSINET.OCX
%PROGRAM_FILES%\Bia2Socks Connection\pc2nl\nuron.dll
%PROGRAM_FILES%\Bia2Socks Connection\OPENVPN1\OpenVPNPortable.ini
%PROGRAM_FILES%\Bia2Socks Connection\OPENVPN1\OPENVPN.exe
%PROGRAM_FILES%\Bia2Socks Connection\off
%PROGRAM_FILES%\Bia2Socks Connection\ibsng.txt
%PROGRAM_FILES%\Bia2Socks Connection\Helper64.exe
%PROGRAM_FILES%\Bia2Socks Connection\help.txt
%PROGRAM_FILES%\Bia2Socks Connection\INET.exe
%PROGRAM_FILES%\Bia2Socks Connection\mahak.txt
%PROGRAM_FILES%\Bia2Socks Connection\link.txt
%PROGRAM_FILES%\Bia2Socks Connection\pc2nl\libeay32.dll