Trojan.DownLoader12.25348

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\xdcc\shell\open\command] '' = '"<Полный путь к вирусу>" "%1"'

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\_MEI29402\irc\events.pyd
%TEMP%\_MEI29402\irc\features.pyd
%TEMP%\_MEI29402\irc\functools.pyd
%TEMP%\_MEI29402\irc\dict.pyd
%TEMP%\_MEI29402\irc\buffer.pyd
%TEMP%\_MEI29402\irc\client.pyd
%TEMP%\_MEI29402\irc\connection.pyd
%TEMP%\_MEI29402\irc\server.pyd
%TEMP%\_MEI29402\irc\six.py
%TEMP%\_MEI29402\irc\six.pyc
%TEMP%\_MEI29402\irc\schedule.pyd
%TEMP%\_MEI29402\irc\logging.pyd
%TEMP%\_MEI29402\irc\modes.pyd
%TEMP%\_MEI29402\irc\rfc.pyd
%TEMP%\_MEI29402\QtSvg4.dll
%TEMP%\_MEI29402\QtXml4.dll
%TEMP%\_MEI29402\QtOpenGL4.dll
%TEMP%\_MEI29402\QtGui4.dll
%TEMP%\_MEI29402\pywintypes27.dll
%TEMP%\_MEI29402\QtNetwork4.dll
%TEMP%\_MEI29402\QtCore4.dll
%TEMP%\_MEI29402\eggs\psutil-2.0.0-py2.7-win32.egg
%TEMP%\_MEI29402\Include\pyconfig.h
%TEMP%\_MEI29402\irc\bot.pyd
%TEMP%\_MEI29402\eggs\setuptools-1.3.2-py2.7.egg
%TEMP%\_MEI29402\LIBEAY32.dll
%TEMP%\_MEI29402\SSLEAY32.dll
%TEMP%\_MEI29402\eggs\pyreadline-2.0-py2.7-win32.egg
%TEMP%\_MEI29402\bs4\testing.pyc
%TEMP%\_MEI29402\bs4\__init__.py
%TEMP%\_MEI29402\bs4\__init__.pyc
%TEMP%\_MEI29402\bs4\testing.py
%TEMP%\_MEI29402\bs4\diagnose.pyc
%TEMP%\_MEI29402\bs4\element.py
%TEMP%\_MEI29402\bs4\element.pyc
%HOMEPATH%\.XdccDownloader\__db.XDCCdownloader.config
%HOMEPATH%\.XdccDownloader\XDCCdownloader.config
%TEMP%\unu3ka
%APPDATA%\Python-Eggs\psutil-2.0.0-py2.7-win32.egg-tmp\tmptgqj0t.$extract
%TEMP%\_MEI29402\six.pyc
%TEMP%\_MEI29402\Resource_rc.pyc
%TEMP%\_MEI29402\XdccDownloader.exe.manifest
%TEMP%\_MEI29402\bs4\builder\_html5lib.pyc
%TEMP%\_MEI29402\bs4\builder\_htmlparser.py
%TEMP%\_MEI29402\bs4\builder\_htmlparser.pyc
%TEMP%\_MEI29402\bs4\builder\_html5lib.py
%TEMP%\_MEI29402\irc\strings.pyd
%TEMP%\_MEI29402\irc\util.pyd
%TEMP%\_MEI29402\irc\__init__.pyc
%TEMP%\_MEI29402\bs4\dammit.py
%TEMP%\_MEI29402\bs4\dammit.pyc
%TEMP%\_MEI29402\bs4\diagnose.py
%TEMP%\_MEI29402\bs4\builder\__init__.pyc
%TEMP%\_MEI29402\bs4\builder\_lxml.py
%TEMP%\_MEI29402\bs4\builder\_lxml.pyc
%TEMP%\_MEI29402\bs4\builder\__init__.py
%TEMP%\_MEI29402\ui_closing.pyd
%TEMP%\_MEI29402\PyQt4.QtNetwork.pyd
%TEMP%\_MEI29402\qt4_plugins\bearer\qgenericbearer4.dll
%TEMP%\_MEI29402\qt4_plugins\bearer\qnativewifibearer4.dll
%TEMP%\_MEI29402\ui_options.pyd
%TEMP%\_MEI29402\ui_Message_from_server.pyd
%TEMP%\_MEI29402\win32file.pyd
%TEMP%\_MEI29402\search_packet.pyd
%TEMP%\_MEI29402\bz2.pyd
%TEMP%\_MEI29402\_ssl.pyd
%TEMP%\_MEI29402\PyQt4.QtCore.pyd
%TEMP%\_MEI29402\ui_log.pyd
%TEMP%\_MEI29402\ui_exit.pyd
%TEMP%\_MEI29402\ui_info.pyd
%TEMP%\_MEI29402\_hashlib.pyd
%TEMP%\_MEI29402\python27.dll
%TEMP%\_MEI29402\search_packet_sunxdcc.pyd
%TEMP%\_MEI29402\lxml.etree.pyd
%TEMP%\_MEI29402\msvcm90.dll
%TEMP%\_MEI29402\Microsoft.VC90.CRT.manifest
%TEMP%\_MEI29402\msvcr90.dll
%TEMP%\_MEI29402\msvcp90.dll
%TEMP%\_MEI29402\Util.pyd
%TEMP%\_MEI29402\win32evtlog.pyd
%TEMP%\_MEI29402\ui_Message_to_user.pyd
%TEMP%\_MEI29402\sip.pyd
%TEMP%\_MEI29402\win32pipe.pyd
%TEMP%\_MEI29402\select.pyd
%TEMP%\_MEI29402\unicodedata.pyd
%TEMP%\_MEI29402\qt4_plugins\imageformats\qjpeg4.dll
%TEMP%\_MEI29402\qt4_plugins\imageformats\qmng4.dll
%TEMP%\_MEI29402\qt4_plugins\imageformats\qsvg4.dll
%TEMP%\_MEI29402\qt4_plugins\imageformats\qico4.dll
%TEMP%\_MEI29402\qt4_plugins\accessible\qtaccessiblewidgets4.dll
%TEMP%\_MEI29402\qt4_plugins\iconengines\qsvgicon4.dll
%TEMP%\_MEI29402\qt4_plugins\imageformats\qgif4.dll
%TEMP%\_MEI29402\_socket.pyd
%TEMP%\_MEI29402\_bsddb.pyd
%TEMP%\_MEI29402\ui_news.pyd
%TEMP%\_MEI29402\win32api.pyd
%TEMP%\_MEI29402\qt4_plugins\imageformats\qtga4.dll
%TEMP%\_MEI29402\qt4_plugins\imageformats\qtiff4.dll
%TEMP%\_MEI29402\qt4_plugins\graphicssystems\qglgraphicssystem4.dll
%TEMP%\_MEI29402\_ctypes.pyd
%TEMP%\_MEI29402\engine.pyd
%TEMP%\_MEI29402\ui_Message.pyd
%TEMP%\_MEI29402\qt4_plugins\codecs\qtwcodecs4.dll
%TEMP%\_MEI29402\qt4_plugins\codecs\qcncodecs4.dll
%TEMP%\_MEI29402\qt4_plugins\codecs\qjpcodecs4.dll
%TEMP%\_MEI29402\qt4_plugins\codecs\qkrcodecs4.dll
%TEMP%\_MEI29402\search_packet_xdcc_finder_it.pyd
%TEMP%\_MEI29402\ClientIrcMod.pyd
%TEMP%\_MEI29402\PyQt4.QtGui.pyd
%TEMP%\_MEI29402\ui_ircDownloader.pyd
%TEMP%\_MEI29402\pyexpat.pyd
%TEMP%\_MEI29402\ui_Custom_DB.pyd
%TEMP%\_MEI29402\ui_xWeasel_url.pyd

Удаляет следующие файлы:

%TEMP%\unu3ka
%TEMP%\_MEI29402\irc\__init__.pyc

Перемещает следующие файлы:

%HOMEPATH%\.XdccDownloader\__db.XDCCdownloader.config в %HOMEPATH%\.XdccDownloader\XDCCdownloader.config
%APPDATA%\Python-Eggs\psutil-2.0.0-py2.7-win32.egg-tmp\tmptgqj0t.$extract в %APPDATA%\Python-Eggs\psutil-2.0.0-py2.7-win32.egg-tmp\_psutil_windows.pyd

Сетевая активность:

Подключается к: