Trojan.MulDrop4.35975

Техническая информация

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\LastGood\TMP24.tmp
<SYSTEM32>\SET23.tmp
<SYSTEM32>\SET22.tmp
%WINDIR%\Temp\OLD25.tmp
%WINDIR%\LastGood\TMP28.tmp
<SYSTEM32>\SET27.tmp
<SYSTEM32>\SET26.tmp
%WINDIR%\Temp\OLD1D.tmp
%WINDIR%\LastGood\TMP1C.tmp
<SYSTEM32>\SET1B.tmp
<SYSTEM32>\SET1E.tmp
%WINDIR%\Temp\OLD21.tmp
%WINDIR%\LastGood\TMP20.tmp
<SYSTEM32>\SET1F.tmp
%WINDIR%\Temp\OLD29.tmp
%CommonProgramFiles%\Microsoft Shared\Replication Manager 4.0\SET33.tmp
%CommonProgramFiles%\Microsoft Shared\Replication Manager 4.0\SET32.tmp
%CommonProgramFiles%\Microsoft Shared\DAO\SET31.tmp
%CommonProgramFiles%\Microsoft Shared\Replication Manager 4.0\SET34.tmp
%CommonProgramFiles%\Microsoft Shared\Replication Manager 4.0\SET37.tmp
%CommonProgramFiles%\Microsoft Shared\Replication Manager 4.0\SET36.tmp
%CommonProgramFiles%\Microsoft Shared\Replication Manager 4.0\SET35.tmp
%WINDIR%\LastGood\TMP2C.tmp
<SYSTEM32>\SET2B.tmp
<SYSTEM32>\SET2A.tmp
%WINDIR%\Temp\OLD2D.tmp
%WINDIR%\Temp\OLD30.tmp
%CommonProgramFiles%\Microsoft Shared\DAO\SET2F.tmp
<SYSTEM32>\SET2E.tmp
<SYSTEM32>\SET7.tmp
<SYSTEM32>\SET6.tmp
%WINDIR%\Temp\OLD5.tmp
%WINDIR%\LastGood\TMP8.tmp
<SYSTEM32>\SETB.tmp
<SYSTEM32>\SETA.tmp
%WINDIR%\Temp\OLD9.tmp
%TEMP%\IXP000.TMP\ADVPACK.DLL
%TEMP%\IXP000.TMP\jetsetup.cab
%TEMP%\IXP000.TMP\jetsetup.inf
%TEMP%\IXP000.TMP\W95INF32.DLL
%WINDIR%\LastGood\TMP4.tmp
<SYSTEM32>\SET3.tmp
%TEMP%\IXP000.TMP\W95INF16.DLL
%WINDIR%\LastGood\TMPC.tmp
<SYSTEM32>\SET16.tmp
%WINDIR%\Temp\OLD15.tmp
%WINDIR%\LastGood\TMP14.tmp
<SYSTEM32>\SET17.tmp
<SYSTEM32>\SET1A.tmp
%WINDIR%\Temp\OLD19.tmp
%WINDIR%\LastGood\TMP18.tmp
<SYSTEM32>\SETF.tmp
<SYSTEM32>\SETE.tmp
%WINDIR%\Temp\OLDD.tmp
%WINDIR%\LastGood\TMP10.tmp
<SYSTEM32>\SET13.tmp
<SYSTEM32>\SET12.tmp
%WINDIR%\Temp\OLD11.tmp

Удаляет следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Replication Manager 4.0\SET36.tmp
%CommonProgramFiles%\Microsoft Shared\Replication Manager 4.0\SET34.tmp
%WINDIR%\Temp\OLD2D.tmp
%WINDIR%\Temp\OLD30.tmp
%CommonProgramFiles%\Microsoft Shared\Replication Manager 4.0\SET32.tmp
<SYSTEM32>\SET2B.tmp
<SYSTEM32>\SET2E.tmp
%CommonProgramFiles%\Microsoft Shared\DAO\SET2F.tmp
%CommonProgramFiles%\Microsoft Shared\DAO\SET31.tmp
%WINDIR%\Temp\OLD29.tmp
%WINDIR%\Temp\OLDD.tmp
%WINDIR%\Temp\OLD11.tmp
%WINDIR%\Temp\OLD5.tmp
%WINDIR%\Temp\OLD9.tmp
%WINDIR%\Temp\OLD15.tmp
%WINDIR%\Temp\OLD21.tmp
%WINDIR%\Temp\OLD25.tmp
%WINDIR%\Temp\OLD19.tmp
%WINDIR%\Temp\OLD1D.tmp
<SYSTEM32>\SET27.tmp
<SYSTEM32>\SET12.tmp
<SYSTEM32>\SETB.tmp
<SYSTEM32>\SET16.tmp
<SYSTEM32>\SETF.tmp
<SYSTEM32>\SETE.tmp
<SYSTEM32>\SET3.tmp
<SYSTEM32>\SET6.tmp
<SYSTEM32>\SET7.tmp
<SYSTEM32>\SETA.tmp
<SYSTEM32>\SET13.tmp
<SYSTEM32>\SET26.tmp
<SYSTEM32>\SET1F.tmp
<SYSTEM32>\SET2A.tmp
<SYSTEM32>\SET23.tmp
<SYSTEM32>\SET22.tmp
<SYSTEM32>\SET17.tmp
<SYSTEM32>\SET1A.tmp
<SYSTEM32>\SET1B.tmp
<SYSTEM32>\SET1E.tmp

Перемещает следующие файлы:

%WINDIR%\LastGood\TMP28.tmp в %WINDIR%\LastGood\system32\msxbde40.dll
%WINDIR%\LastGood\TMP24.tmp в %WINDIR%\LastGood\system32\mstext40.dll
%WINDIR%\LastGood\TMP20.tmp в %WINDIR%\LastGood\system32\mspbde40.dll
%WINDIR%\LastGood\TMP2C.tmp в %WINDIR%\LastGood\system32\msjtes40.dll
%CommonProgramFiles%\Microsoft Shared\Replication Manager 4.0\SET37.tmp в %CommonProgramFiles%\Microsoft Shared\Replication Manager 4.0\mstran40.exe
%CommonProgramFiles%\Microsoft Shared\Replication Manager 4.0\SET35.tmp в %CommonProgramFiles%\Microsoft Shared\Replication Manager 4.0\mstrai40.exe
%CommonProgramFiles%\Microsoft Shared\Replication Manager 4.0\SET33.tmp в %CommonProgramFiles%\Microsoft Shared\Replication Manager 4.0\msrpfs40.dll
%WINDIR%\LastGood\TMPC.tmp в %WINDIR%\LastGood\system32\msrd3x40.dll
%WINDIR%\LastGood\TMP8.tmp в %WINDIR%\LastGood\system32\msjetoledb40.dll
%WINDIR%\LastGood\TMP4.tmp в %WINDIR%\LastGood\system32\msjet40.dll
%WINDIR%\LastGood\TMP10.tmp в %WINDIR%\LastGood\system32\msrepl40.dll
%WINDIR%\LastGood\TMP1C.tmp в %WINDIR%\LastGood\system32\msltus40.dll
%WINDIR%\LastGood\TMP18.tmp в %WINDIR%\LastGood\system32\msexch40.dll
%WINDIR%\LastGood\TMP14.tmp в %WINDIR%\LastGood\system32\msexcl40.dll