Trojan.DownLoader3.59191

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'x32x' = '%WINDIR%\xwrm.exe'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\dllcache\setup50.exe.new
%WINDIR%\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\bzbyqqjby.jzb
%WINDIR%\Microsoft.NET\Framework\qyajqiaqj.jrr
%WINDIR%\pchealth\helpctr\binaries\bzbyqqjby.jzb
%WINDIR%\brrararqq.jyz.yra
<Служебный элемент>
%PROGRAM_FILES%\Windows Media Player\yjayayara.bri
%PROGRAM_FILES%\Windows Media Player\bzbyqqjby.jzb
%PROGRAM_FILES%\Windows NT\Accessories\azzzariby.qaba
%PROGRAM_FILES%\Windows NT\Pinball\qyajqiaqj.jrr.qaba
%PROGRAM_FILES%\Windows NT\ijrazyiya.iby
%WINDIR%\pchealth\helpctr\binaries\ijrazyiya.iby
%TEMP%\yjiizj.jya
<SYSTEM32>\dllcache\taskman.exe.new
<SYSTEM32>\dllcache\twunk_16.exe.new
<SYSTEM32>\dllcache\winhlp32.exe.new
<SYSTEM32>\dllcache\winhelp.exe.new
<SYSTEM32>\dllcache\uploadm.exe.new
<SYSTEM32>\dllcache\muisetup.exe.new
%WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\azzzariby.qab
<SYSTEM32>\dllcache\helphost.exe.new
<SYSTEM32>\dllcache\notiflag.exe.new
<SYSTEM32>\dllcache\hscupd.exe.new
%PROGRAM_FILES%\FireFox\qyajqiaqj.jrr
%PROGRAM_FILES%\FireFox\zqyjaaari.zar
%PROGRAM_FILES%\FireFox\rrziiirrq.yra
%PROGRAM_FILES%\Messenger\bzbyqqjby.jzbr.exe
%PROGRAM_FILES%\FireFox\brrararqq.jyz
%CommonProgramFiles%\Microsoft Shared\MSInfo\qyajqiaqj.jrr
%WINDIR%\xwrm.exe
%TEMP%\jzbryr.rqy
C:\Far\aiajyyara.bri
%CommonProgramFiles%\Microsoft Shared\DW\ijrazyiya.iby
%CommonProgramFiles%\Microsoft Shared\DW\azzzariby.qab
%PROGRAM_FILES%\MSN Gaming Zone\Windows\ijrazyiya.ibyb
%PROGRAM_FILES%\Outlook Express\ijrazyiya.ibyirrq.yra
%PROGRAM_FILES%\Outlook Express\azzzariby.qabirrq.yra
%PROGRAM_FILES%\Outlook Express\zqyjaaari.zarirrq.yra
%PROGRAM_FILES%\Windows Media Player\brrararqq.jyzyra
%PROGRAM_FILES%\Outlook Express\rrziiirrq.yrairrq.yra
%PROGRAM_FILES%\NetMeeting\yjayayara.brirrziiirrq.yra
%PROGRAM_FILES%\MSN Gaming Zone\Windows\zqyjaaari.zarb
%PROGRAM_FILES%\MSN Gaming Zone\Windows\qyajqiaqj.jrrb
%PROGRAM_FILES%\MSN Gaming Zone\Windows\rrziiirrq.yra
%PROGRAM_FILES%\NetMeeting\bzbyqqjby.jzbrrziiirrq.yra
%PROGRAM_FILES%\NetMeeting\brrararqq.jyzrrziiirrq.yra

Присваивает атрибут 'скрытый' для следующих файлов:

%PROGRAM_FILES%\Windows Media Player\bzbyqqjby.jzb
%PROGRAM_FILES%\Windows Media Player\brrararqq.jyzyra
%PROGRAM_FILES%\Windows NT\Accessories\azzzariby.qaba
%PROGRAM_FILES%\Windows Media Player\yjayayara.bri
%PROGRAM_FILES%\Outlook Express\ijrazyiya.ibyirrq.yra
%PROGRAM_FILES%\Outlook Express\azzzariby.qabirrq.yra
%PROGRAM_FILES%\Outlook Express\rrziiirrq.yrairrq.yra
%PROGRAM_FILES%\Outlook Express\zqyjaaari.zarirrq.yra
%PROGRAM_FILES%\Windows NT\ijrazyiya.iby
%WINDIR%\pchealth\helpctr\binaries\bzbyqqjby.jzb
%WINDIR%\brrararqq.jyz.yra
%WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\azzzariby.qab
%WINDIR%\pchealth\helpctr\binaries\ijrazyiya.iby
<Служебный элемент>
%PROGRAM_FILES%\Windows NT\Pinball\qyajqiaqj.jrr.qaba
%WINDIR%\Microsoft.NET\Framework\qyajqiaqj.jrr
%WINDIR%\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\bzbyqqjby.jzb
%PROGRAM_FILES%\FireFox\zqyjaaari.zar
%CommonProgramFiles%\Microsoft Shared\MSInfo\qyajqiaqj.jrr
%PROGRAM_FILES%\FireFox\rrziiirrq.yra
%PROGRAM_FILES%\FireFox\qyajqiaqj.jrr
C:\Far\aiajyyara.bri
%WINDIR%\xwrm.exe
%CommonProgramFiles%\Microsoft Shared\DW\ijrazyiya.iby
%CommonProgramFiles%\Microsoft Shared\DW\azzzariby.qab
%PROGRAM_FILES%\FireFox\brrararqq.jyz
%PROGRAM_FILES%\NetMeeting\brrararqq.jyzrrziiirrq.yra
%PROGRAM_FILES%\MSN Gaming Zone\Windows\rrziiirrq.yra
%PROGRAM_FILES%\NetMeeting\yjayayara.brirrziiirrq.yra
%PROGRAM_FILES%\NetMeeting\bzbyqqjby.jzbrrziiirrq.yra
%PROGRAM_FILES%\MSN Gaming Zone\Windows\ijrazyiya.ibyb
%PROGRAM_FILES%\Messenger\bzbyqqjby.jzbr.exe
%PROGRAM_FILES%\MSN Gaming Zone\Windows\zqyjaaari.zarb
%PROGRAM_FILES%\MSN Gaming Zone\Windows\qyajqiaqj.jrrb