Trojan.Hosts.39395

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\ping.exe' 127.0.0.1 -n 2 -w 1000
'<SYSTEM32>\find.exe' /C /I "www.in#######ownloadmanager.com" <DRIVERS>\etc\hosts
'<SYSTEM32>\attrib.exe' +R ""<DRIVERS>\etc\hosts""
'<SYSTEM32>\cmd.exe' /c ""%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.Kt#######.net\DangNguyenFix.bat" "
'%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\IDMan.exe'
'<SYSTEM32>\attrib.exe' -R ""<DRIVERS>\etc\hosts""

Изменения в файловой системе:

Создает следующие файлы:

%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\idmwfp64.sys
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\idmwfp32.sys
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\idmwfp.inf
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\IEExt.htm
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\IEGetVL2.htm
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\IEGetVL.htm
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\IEGetAll.htm
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\idmtdi.cat
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\IDMShellExt64.dll
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\IDMShellExt.dll
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\idmtdi.inf
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\idmwfp.cat
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\idmtdi64.sys
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\idmtdi32.sys
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\IEMonitor.exe
%HOMEPATH%\Desktop\IDM 6.07.7.lnk
%HOMEPATH%\Start Menu\IDMan.lnk
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\Uninstall.exe
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\Uninstall.ini
<DRIVERS>\etc\hosts.bk
%APPDATA%\IDM\urlexclist.dat
%APPDATA%\IDM\defextmap.dat
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\setup_error.log
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\scheduler.chm
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\license.txt
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\suf1A18.tmp
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\tutor.chm
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\tips.txt
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\suf19F7.tmp
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\IDMNetMon64.dll
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\idmantypeinfo.tlb
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\IDMan.exe
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\idman.chm
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\idmbrbtn.dll
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\idmcchandler.dll~
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\idmcchandler.dll
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\idmbrbtn64.dll
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\DangNguyenFix.bat
%TEMP%\$inst\temp_0.tmp
%TEMP%\$inst\2.tmp
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\defexclist.txt
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\grabber.chm
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\downlWithIDM64.dll
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\downlWithIDM.dll
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\idmcchandler64.dll
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\IDMIntegrator64.exe
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\IDMIECC64.dll
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\IDMIECC.dll
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\IDMkill.bat
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\IDMNetMon.dll
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\idmmzcc.xpi
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\idmmkb.dll
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\idmftype.dll
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\IDMFType.dat
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\idmfsa.dll
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\IDMFType64.dll
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\IDMGrHlp.exe
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\IDMGetAll64.dll
%ProgramFiles%\Internet Download Manager\IDM 6.07.7 Cracked by www.KtvBaoLoc.net\IDMGetAll.dll