Trojan.MulDrop3.11623

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\D-Link\D-Link DSL USB Driver\DeviceInst.exe -rescan -install Device.dat
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe /REGSERVER 32\IKernel.exe -Embedding -RegServer
%TEMP%\pft3~tmp\Disk1\Setup.exe

Изменения в файловой системе:

Создает следующие файлы:

C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
%PROGRAM_FILES%\InstallShield Installation Information\{C1F92443-8B5A-44EB-BFD5-4F35A77D991C}\data990a.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
%PROGRAM_FILES%\InstallShield Installation Information\{C1F92443-8B5A-44EB-BFD5-4F35A77D991C}\data98db.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
%PROGRAM_FILES%\InstallShield Installation Information\{C1F92443-8B5A-44EB-BFD5-4F35A77D991C}\Setu9958.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
%PROGRAM_FILES%\InstallShield Installation Information\{C1F92443-8B5A-44EB-BFD5-4F35A77D991C}\layo98bb.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\drivetable.txt
%PROGRAM_FILES%\D-Link\D-Link DSL USB Driver\Unina619.rra
%PROGRAM_FILES%\D-Link\D-Link DSL USB Driver\Devia639.rra
%PROGRAM_FILES%\D-Link\D-Link DSL USB Driver\RNDIa08b.rra
%PROGRAM_FILES%\D-Link\D-Link DSL USB Driver\Devia30c.rra
%WINDIR%\inf\oem3.PNF
%PROGRAM_FILES%\D-Link\D-Link DSL USB Driver\LogFile.ini
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
%WINDIR%\inf\oem3.inf
%PROGRAM_FILES%\D-Link\D-Link DSL USB Driver\dlina01e.rra
%PROGRAM_FILES%\InstallShield Installation Information\{C1F92443-8B5A-44EB-BFD5-4F35A77D991C}\Setup.ini
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
%PROGRAM_FILES%\InstallShield Installation Information\{C1F92443-8B5A-44EB-BFD5-4F35A77D991C}\Setu9987.rra
%PROGRAM_FILES%\InstallShield Installation Information\{C1F92443-8B5A-44EB-BFD5-4F35A77D991C}\setu99a6.rra
%PROGRAM_FILES%\D-Link\D-Link DSL USB Driver\usb89fc0.rra
%PROGRAM_FILES%\D-Link\D-Link DSL USB Driver\dlin9fe0.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
%ALLUSERSPROFILE%\Start Menu\Programs\DSL USB Driver\Uninstall DSL USB Driver.lnk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
%TEMP%\IEC4.tmp
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
%TEMP%\pft3~tmp\Disk1\Setup.ini
%TEMP%\pft3~tmp\Disk1\setup.inx
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor60f2.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje63c1.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core60a4.rra
%TEMP%\pft3~tmp\Disk1\Setup.exe
%TEMP%\pft3~tmp\pftw1.pkg
%TEMP%\pft3~tmp\Disk1\data1.cab
%TEMP%\ext2.tmp
%TEMP%\plf1.tmp
%TEMP%\pft3~tmp\Disk1\ikernel.ex_
%TEMP%\pft3~tmp\Disk1\layout.bin
%TEMP%\pft3~tmp\Disk1\data1.hdr
%TEMP%\pft3~tmp\Disk1\data2.cab
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
%TEMP%\{C1F92443-8B5A-44EB-BFD5-4F35A77D991C}\setu7313.rra
%TEMP%\{C1F92443-8B5A-44EB-BFD5-4F35A77D991C}\valu73ee.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse643e.rra
%CommonProgramFiles%\InstallShield\IScript\iscr67b9.rra
%TEMP%\{C1F92443-8B5A-44EB-BFD5-4F35A77D991C}\_IsR7507.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
%TEMP%\{C1F92443-8B5A-44EB-BFD5-4F35A77D991C}\isrt745b.rra
%TEMP%\{C1F92443-8B5A-44EB-BFD5-4F35A77D991C}\defa74b9.rra