Trojan.Inject1.52502

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = '%APPDATA%\Microsoft\facecall.exe,explorer.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Facebook Update' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Facebook Update' = ''

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\TROLLFACE.PNG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\TROLL-TROLLOL.JPG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\TROLLFACE_TEREZI_ICON___BLANK_BY_TROLLTEREZIPLZ-D41K8AD.PNG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\TROLLFACE_GIF_BY_SENORHANKEY-D4XZ91X.GIF
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\PHOTO.PNG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\MEXICAN_TROLL_FACE_BY_MARIODUDE12312-D5MTL9Z.PNG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\SPONGE_BOB_TROLOLO_XD_BY_DANIELLAS_WIFE-D3ER3I8.PNG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\RAINBOW_DASH_TROLL_FACE_BY_ELYBOTZ-D6DPOLD.PNG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\TROLOLO_FACE_BY_ANNBAUDELAIRE-D33DS6U.JPG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\TROLOLO-FUNNY-FACE.JPG
'<SYSTEM32>\wbem\wmiadap.exe' /R /T
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\URL.PNG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\TROLL_FACE-1280X800.JPG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\TROLL_1FCCDF_2057672.JPG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\TROLL_FACE_HELLO_KITTY_BY_GOLDENFAIRYUNI-D4FXDDF.JPG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\TROLL_FACE_BY_DUALGEMINI-D3J2HQD.PNG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\AWESOME-HAIRED-TROLL-FACE-BY-BUDAKUROSAKI-DSQC.JPG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\791818667_1827104.GIF
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\A_FA33CDCE.JPG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\A_E4B9E028.JPG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\1Y7B3ZT.PNG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\05529BF8FBFD71EC663DC58A32022A639A5279CE32718748DF80AC96786C59E5.JPG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\53ZNBJJ85O.JPG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\4FBD0C3C1FE74.PNG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\LOL.JPG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\INTERNET-TROLL-FACE-EXPLORER.PNG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\MAXRESDEFAULT.JPG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\LUIIXS9EQFC.JPG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\IMAGES.JPG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\HELLO-KITTY-MASHUP-U-MAD-MEME.JPG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\IMGRES.JPG
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\IMAGES.PNG