Trojan.MulDrop7.14248

Technical Information

Malicious functions:

Executes the following:

'%ProgramFiles%\Your Uninstaller 2008\vclx.exe'
'%WINDIR%\regedit.exe' /s 1.reg
'%ProgramFiles%\Your Uninstaller 2008\uruninstaller.exe' -buildcache
'%TEMP%\7zS1.tmp\yu2008.exe' /VERYSILENT /NORESTART
'%TEMP%\is-E39F5.tmp\is-M8GSU.tmp' /SL4 $40092 "%TEMP%\7zS1.tmp\yu2008.exe" 3483094 52736 /VERYSILENT /NORESTART

Searches for windows to

detect analytical utilities:

ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
ClassName: 'RegMonClass', WindowName: ''
ClassName: 'FileMonClass', WindowName: ''

Modifies file system:

Creates the following files:

%ProgramFiles%\Your Uninstaller 2008\is-4GA3I.tmp
%ProgramFiles%\Your Uninstaller 2008\is-0GM0P.tmp
%ProgramFiles%\Your Uninstaller 2008\is-7HJ6N.tmp
%ProgramFiles%\Your Uninstaller 2008\is-OPQON.tmp
%ProgramFiles%\Your Uninstaller 2008\is-D9TM9.tmp
%ProgramFiles%\Your Uninstaller 2008\is-LR2BF.tmp
%ProgramFiles%\Your Uninstaller 2008\is-UOMO7.tmp
%ProgramFiles%\Your Uninstaller 2008\is-B3UM1.tmp
%ProgramFiles%\Your Uninstaller 2008\is-57IU1.tmp
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Your Uninstaller! 2008.lnk
%HOMEPATH%\Desktop\Your Uninstaller! 2008.lnk
%APPDATA%\URSoft\Your Uninstaller 2008\uruninstaller.ini
%ProgramFiles%\Your Uninstaller 2008\unins000.dat
%ProgramFiles%\Your Uninstaller 2008\is-E4OI0.tmp
%ProgramFiles%\Your Uninstaller 2008\is-SVAKR.tmp
%ProgramFiles%\Your Uninstaller 2008\is-CTF21.tmp
%ProgramFiles%\Your Uninstaller 2008\is-U17TA.tmp
%ProgramFiles%\Your Uninstaller 2008\is-LRE67.tmp
%ProgramFiles%\Your Uninstaller 2008\is-8LE2S.tmp
%ProgramFiles%\Your Uninstaller 2008\is-CQQKH.tmp
%ProgramFiles%\Your Uninstaller 2008\Languages\is-D5B6G.tmp
%ProgramFiles%\Your Uninstaller 2008\Languages\is-VRV3O.tmp
%ProgramFiles%\Your Uninstaller 2008\is-AT7MH.tmp
%TEMP%\is-E39F5.tmp\is-M8GSU.tmp
%TEMP%\7zS1.tmp\yu2008.exe
%TEMP%\is-RA0IP.tmp\_isetup\_shfoldr.dll
%TEMP%\is-RA0IP.tmp\_isetup\_RegDLL.tmp
%ProgramFiles%\Your Uninstaller 2008\templates\is-TVOJC.tmp
%ProgramFiles%\Your Uninstaller 2008\templates\is-H6GSP.tmp
%ProgramFiles%\Your Uninstaller 2008\is-24RDD.tmp
%ProgramFiles%\Your Uninstaller 2008\templates\is-UE3QG.tmp
%ProgramFiles%\Your Uninstaller 2008\templates\is-MLJ24.tmp
%ProgramFiles%\Your Uninstaller 2008\templates\is-523O8.tmp
%ProgramFiles%\Your Uninstaller 2008\templates\is-762BD.tmp
%ProgramFiles%\Your Uninstaller 2008\templates\is-2ERJ8.tmp
%ProgramFiles%\Your Uninstaller 2008\templates\is-B4MTN.tmp

Deletes the following files:

%TEMP%\is-E39F5.tmp\is-M8GSU.tmp
%TEMP%\7zS1.tmp\yu2008.exe
%TEMP%\is-RA0IP.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-RA0IP.tmp\_isetup\_shfoldr.dll

Moves the following files:

from %ProgramFiles%\Your Uninstaller 2008\is-D9TM9.tmp to %ProgramFiles%\Your Uninstaller 2008\license.rtf
from %ProgramFiles%\Your Uninstaller 2008\is-0GM0P.tmp to %ProgramFiles%\Your Uninstaller 2008\update.ini
from %ProgramFiles%\Your Uninstaller 2008\is-4GA3I.tmp to %ProgramFiles%\Your Uninstaller 2008\uruninstaller.ini
from %ProgramFiles%\Your Uninstaller 2008\is-B3UM1.tmp to %ProgramFiles%\Your Uninstaller 2008\fos.exe.manifest
from %ProgramFiles%\Your Uninstaller 2008\is-UOMO7.tmp to %ProgramFiles%\Your Uninstaller 2008\autoupdater.exe
from %ProgramFiles%\Your Uninstaller 2008\is-LR2BF.tmp to %ProgramFiles%\Your Uninstaller 2008\skipfilenames.dat
from %ProgramFiles%\Your Uninstaller 2008\is-57IU1.tmp to %ProgramFiles%\Your Uninstaller 2008\fos.exe
from %ProgramFiles%\Your Uninstaller 2008\is-LRE67.tmp to %ProgramFiles%\Your Uninstaller 2008\uruninstaller.exe.manifest
from %ProgramFiles%\Your Uninstaller 2008\is-U17TA.tmp to %ProgramFiles%\Your Uninstaller 2008\1.reg
from %ProgramFiles%\Your Uninstaller 2008\is-E4OI0.tmp to %ProgramFiles%\Your Uninstaller 2008\vclx.exe
from %ProgramFiles%\Your Uninstaller 2008\is-SVAKR.tmp to %ProgramFiles%\Your Uninstaller 2008\VirtualTreesD7.bpl
from %ProgramFiles%\Your Uninstaller 2008\is-OPQON.tmp to %ProgramFiles%\Your Uninstaller 2008\vcl70.bpl
from %ProgramFiles%\Your Uninstaller 2008\is-7HJ6N.tmp to %ProgramFiles%\Your Uninstaller 2008\rtl70.bpl
from %ProgramFiles%\Your Uninstaller 2008\is-CTF21.tmp to %ProgramFiles%\Your Uninstaller 2008\vclx70.bpl
from %ProgramFiles%\Your Uninstaller 2008\Languages\is-D5B6G.tmp to %ProgramFiles%\Your Uninstaller 2008\Languages\Turkish.lng
from %ProgramFiles%\Your Uninstaller 2008\templates\is-762BD.tmp to %ProgramFiles%\Your Uninstaller 2008\templates\proginfo_ar.tpl
from %ProgramFiles%\Your Uninstaller 2008\templates\is-523O8.tmp to %ProgramFiles%\Your Uninstaller 2008\templates\proginfo_cn.tpl
from %ProgramFiles%\Your Uninstaller 2008\Languages\is-VRV3O.tmp to %ProgramFiles%\Your Uninstaller 2008\Languages\English.lng
from %ProgramFiles%\Your Uninstaller 2008\is-AT7MH.tmp to %ProgramFiles%\Your Uninstaller 2008\unins000.exe
from %ProgramFiles%\Your Uninstaller 2008\is-CQQKH.tmp to %ProgramFiles%\Your Uninstaller 2008\uruninstaller.exe
from %ProgramFiles%\Your Uninstaller 2008\is-8LE2S.tmp to %ProgramFiles%\Your Uninstaller 2008\uninstaller.chm
from %ProgramFiles%\Your Uninstaller 2008\templates\is-TVOJC.tmp to %ProgramFiles%\Your Uninstaller 2008\templates\proginfo_pl.tpl
from %ProgramFiles%\Your Uninstaller 2008\templates\is-UE3QG.tmp to %ProgramFiles%\Your Uninstaller 2008\templates\proginfo_tw.tpl
from %ProgramFiles%\Your Uninstaller 2008\is-24RDD.tmp to %ProgramFiles%\Your Uninstaller 2008\diskclean.ico
from %ProgramFiles%\Your Uninstaller 2008\templates\is-H6GSP.tmp to %ProgramFiles%\Your Uninstaller 2008\templates\proginfo_hu.tpl
from %ProgramFiles%\Your Uninstaller 2008\templates\is-B4MTN.tmp to %ProgramFiles%\Your Uninstaller 2008\templates\proginfo_da.tpl
from %ProgramFiles%\Your Uninstaller 2008\templates\is-2ERJ8.tmp to %ProgramFiles%\Your Uninstaller 2008\templates\proginfo_en.tpl
from %ProgramFiles%\Your Uninstaller 2008\templates\is-MLJ24.tmp to %ProgramFiles%\Your Uninstaller 2008\templates\proginfo_fr.tpl