Trojan.MulDrop6.57217

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'sys32ex' = '<SYSTEM32>\NTLDR.exe'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует отображение:

скрытых файлов
расширений файлов

блокирует запуск следующих системных утилит:

Диспетчера задач (Taskmgr)
Редактора реестра (RegEdit)

блокирует:

Компонент восстановления системы (SR)

изменяет следующие системные настройки:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoRun' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoFolderOptions' = '00000001'

Изменения в файловой системе:

Создает следующие файлы:

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.exe
%HOMEPATH%\NTUSER.DAT.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat.exe
C:\Documents and Settings\NetworkService\NTUSER.DAT.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.exe
C:\Documents and Settings\LocalService\Cookies\index.dat.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
C:\Documents and Settings\Default User\NTUSER.DAT.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\index.dat.exe
C:\Documents and Settings\LocalService\NTUSER.DAT.exe
C:\Documents and Settings\Default User\Cookies\index.dat.exe
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\index.dat.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Nature Bkgrd.jpg.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Pie Charts Bkgrd.jpg.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Leaves Bkgrd.jpg.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Maize Bkgrd.jpg.exe
%CommonProgramFiles%\Services\verisign.bmp.exe
%CommonProgramFiles%\Services\whowhere.bmp.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Sunflower Bkgrd.jpg.exe
%CommonProgramFiles%\Services\bigfoot.bmp.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Glacier Bkgrd.jpg.exe
<LS_APPDATA>\Microsoft\Windows\UsrClass.dat.exe
<LS_APPDATA>\VMware\hgfs.dat.exe
%HOMEPATH%\Cookies\index.dat.exe
<LS_APPDATA>\GDIPFONTCACHEV1.DAT.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Clear Day Bkgrd.jpg.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Fiesta Bkgrd.jpg.exe
%HOMEPATH%\Local Settings\History\History.IE5\index.dat.exe
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\index.dat.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
<SYSTEM32>\NTLDR.exe
C:\Diperkosa.flv.exe
%TEMP%\~DFA749.tmp
%WINDIR%\system manager.sys.EXE
<SYSTEM32>\readme.txt
C:\gadis cantik ABG.flv.exe
C:\readme.txt
%WINDIR%\windows.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe