Trojan.Inject.55115

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие файлы на съемном носителе:

<Имя диска съемного носителя>:\boot.inf
<Имя диска съемного носителя>:\SecurityUSB.exe

Вредоносные функции:

Создает и запускает на исполнение:

%APPDATA%\Neu !!Toolbox_1.9_Opticum.exe

Запускает на исполнение:

<SYSTEM32>\winlogon.exe

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\kabo.txt
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\MyText1.txt
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\iconejardimdigital.ico
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\Dplus.txt
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\GloboTV.txt
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\Plugins\sb_Charcoal.png
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\Plugins\sb_Chrome.png
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\Plugins\sb_BasicBlue.png
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\N4101.txt
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\N4901.txt
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Plugins\sb_Charcoal.png
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Plugins\sb_Chrome.png
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Plugins\sb_BasicBlue.png
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Images\Sem ttulo.JPG
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Images\Thumbs.db
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\autorun.exe
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\bild.jpg
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Plugins\Thumbs.db
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Plugins\sb_Euro.png
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Plugins\SHAPE\SHAPE.APO
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\Plugins\sb_Euro.png
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Hilfe.png
%TEMP%\ir_ext_temp_0\AutoPlay\Images\Thumbs.db
%TEMP%\ir_ext_temp_0\AutoPlay\Images\630C0343.jpg
%TEMP%\ir_ext_temp_0\AutoPlay\Images\002EQ16.png
%TEMP%\ir_ext_temp_0\AutoPlay\Images\033DR13.png
%TEMP%\_ir_tmpfnt_1\Arial_1.TFT
%TEMP%\_ir_tmpfnt_1\Arial_1.FON
%TEMP%\ir_ext_temp_0\Master-Joda.ico
%TEMP%\ir_ext_temp_0\AutoPlay\Plugins\IRSlideTransition.tns
%TEMP%\ir_ext_temp_0\autorun.exe
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\Premiere.txt
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\SRG.txt
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\Polsat.txt
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\Plugins\SHAPE\SHAPE.APO
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\Plugins\Thumbs.db
%TEMP%\ir_ext_temp_0\AutoPlay\Icons\Thumbs.db
%TEMP%\ir_ext_temp_0\AutoPlay\Images\002AE16.png
%TEMP%\ir_ext_temp_0\AutoPlay\Icons\Master-Joda.ico
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\V009400.txt
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\systeme_upgrader\Upgrade.exe
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Bootlogo\bmp2logo.exe
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Bootlogo\Bmplogo.doc
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\ali_mini_upgrade\ALIMINIUPG.EXE
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\ali_channel_edit\script.ini
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\ali_key_upgrade\alikeyupg.exe
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Audio\High1.OGG
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\autorun.cdd
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Audio\Click1.OGG
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Bootlogo\Bootlogo_„ndern SL35 II.txt
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\firm_info\firm_info.EXE
%TEMP%\ir_ext_temp_0\AutoPlay\Audio\Click1.ogg
%TEMP%\ir_ext_temp_0\AutoPlay\Audio\Glass.ogg
%APPDATA%\Neu !!Toolbox_1.9_Opticum.exe
C:\SecurityUSB.exe
C:\boot.inf
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\ali_channel_edit\AliEditor.exe
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\ali_channel_edit\av_db_3l.h
%TEMP%\ir_ext_temp_0\AutoPlay\autorun.cdd
%TEMP%\ir_ext_temp_0\AutoPlay\Audio\Gnome.ogg
%TEMP%\ir_ext_temp_0\AutoPlay\Audio\High1.ogg
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Buttons\1_301.BTN
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Images\Formel_1_bei_Premiere_World__124296.gif
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Images\ggf.JPG
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Images\chatpic.JPG
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Images\3405783.jpg
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Images\630B2601.jpg
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Images\partner_08_mi.gif
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Images\polsat_logo02.jpg
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Images\logo.gif
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Images\globo_tv_internacional.jpg
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Images\lg_tvcabo.gif
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Images\002AC11.png
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Images\002AC14.png
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Icons\iconejardimdigital.ico
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Docs\RAI_S0030_Keys.txt
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Docs\SRG_V009400_Keys.txt
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Images\033ER12.png
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Images\150px-Digital_Plus.gif
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Images\003EB10.png
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Images\002AE16.png
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\Key Finder\AutoPlay\Images\003EA10.png