Trojan.MulDrop6.52936

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\IDriverT] 'ImagePath' = '"%CommonProgramFiles%\InstallShield\Driver\11\Intel 32\IDriverT.exe"'
[<HKLM>\SYSTEM\ControlSet001\Services\PrismXL] 'ImagePath' = '%CommonProgramFiles%\New Boundary\PrismXL\PRISMXL.SYS'
[<HKLM>\SYSTEM\ControlSet001\Services\PrismXL] 'Start' = '00000002'

Вредоносные функции:

Запускает на исполнение:

'%CommonProgramFiles%\New Boundary\PrismXL\PRISMXL.SYS'

Изменения в файловой системе:

Создает следующие файлы:

%ProgramFiles%\Westkm\WestkmLit.cnt
%ProgramFiles%\Westkm\ROBOEX32.DLL
%ProgramFiles%\Westkm\WestkmLit.hlp
%ProgramFiles%\Westkm\WestkmLitTrans.hlp
%ProgramFiles%\Westkm\WestkmLitTrans.cnt
%ProgramFiles%\Westkm\Graphics\km_inline.bmp
%ProgramFiles%\Westkm\Examples\memo-workerscomp.wpd
%ProgramFiles%\Westkm\Examples\Demo Brief3.wpd
%ProgramFiles%\Westkm\Examples\WordExamples.ver
%ProgramFiles%\Westkm\Graphics\Graphics.ver
%ProgramFiles%\Westkm\Examples\WordPerfectExamples.ver
%ProgramFiles%\Westkm\WestkmTrans.cnt
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\74BFD122C0875EC75DBE5C6DB4C59019
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\486CC6AFD08942336C61FCD401C4A1D1
%APPDATA%\Microsoft\Installer\{06FAEE41-7107-4FC1-A078-B1B92222A6F0}\ARPPRODUCTICON.exe
%WINDIR%\PICTAKER.LOG
%APPDATA%\Microsoft\Word\STARTUP\westkmlit.dot
%APPDATA%\Microsoft\CryptnetUrlCache\Content\74BFD122C0875EC75DBE5C6DB4C59019
%ProgramFiles%\Westkm\WPHTML.dll
%ProgramFiles%\Westkm\WestkmTrans.hlp
%WINDIR%\Downloaded Installations\{765B55E0-B345-4957-9B1F-534BBAC6B579}\West km Client.msi
%APPDATA%\Microsoft\CryptnetUrlCache\Content\486CC6AFD08942336C61FCD401C4A1D1
%WINDIR%\Installer\113c2b26.msi
%ProgramFiles%\Altiris\Altiris Agent\Queue\{A2927123-D0D8-4E31-8C92-55D478095FF3}
%ProgramFiles%\Altiris\Altiris Agent\Queue\{00DF3301-6410-495C-B260-68F44BFAF792}
%ProgramFiles%\Altiris\Altiris Agent\Queue\{B5E3A870-DD95-4950-A27B-AC601958E23B}
%CommonProgramFiles%\InstallShield\Driver\11\Intel 32\IDriver.exe
%CommonProgramFiles%\InstallShield\Driver\11\Intel 32\_ISRES1033.dll
%ProgramFiles%\Altiris\Altiris Agent\Logs\agent.log
%CommonProgramFiles%\New Boundary\PrismXL\PRISMXL.SYS
%TEMP%\PRISMXL.SYS
%ALLUSERSPROFILE%\Application Data\Prism Pack\UNAPPLY\<Имя вируса>.PWR
%ProgramFiles%\Altiris\Altiris Agent\AeXProcessList.txt
%ALLUSERSPROFILE%\Application Data\Prism Pack\UNAPPLY\<Имя вируса> 1.PWR
%CommonProgramFiles%\InstallShield\Driver\11\Intel 32\IDriver2.exe
%ProgramFiles%\Westkm\atlas.dll
%ProgramFiles%\Westkm\ahttp.dll
%ProgramFiles%\Westkm\atlas.exe
%ProgramFiles%\Westkm\Examples\Brief1.wpd
%ProgramFiles%\Westkm\Documentation.ver
%CommonProgramFiles%\InstallShield\Driver\11\Intel 32\objpscnv.dll
%CommonProgramFiles%\InstallShield\Driver\11\Intel 32\iGdiCnv.dll
%CommonProgramFiles%\InstallShield\Driver\11\Intel 32\IDriverT.exe
%CommonProgramFiles%\InstallShield\Driver\11\Intel 32\IScrCnv.dll
%CommonProgramFiles%\InstallShield\Driver\11\Intel 32\IUserCnv.dll
%CommonProgramFiles%\InstallShield\Driver\11\Intel 32\ISRT.dll