Trojan.MulDrop9.36029

Technical Information

Modifies file system

Creates the following files

%TEMP%\aut1.tmp
<SYSTEM32>\msjet35.dll
<SYSTEM32>\msjint35.dll
<SYSTEM32>\msjter35.dll
<SYSTEM32>\msrd2x35.dll
<SYSTEM32>\msrepl35.dll
<SYSTEM32>\msexcl35.dll
<SYSTEM32>\mstext35.dll
<SYSTEM32>\sscsdk32.dll
<SYSTEM32>\cpeaut32.dll
<SYSTEM32>\mscal.ocx
<SYSTEM32>\craxdrt.dll
<SYSTEM32>\crpe32.dll
<SYSTEM32>\crxlat32.dll
<SYSTEM32>\p2bbde.dll
<SYSTEM32>\p2bbnd.dll
<SYSTEM32>\p2bdao.dll
<SYSTEM32>\p2bxbse.dll
<SYSTEM32>\p2ctdao.dll
<SYSTEM32>\p2irdao.dll
<SYSTEM32>\p2sifmx.dll
<SYSTEM32>\crpaig32.dll
%ProgramFiles%\time sheet system\w95mbx01.ico
%ProgramFiles%\time sheet system\u2lsamp1.dll
%ProgramFiles%\time sheet system\u2ldts.dll
%APPDATA%\teracopy\filelist.dat
%APPDATA%\teracopy\transfer.log
D:\local settings\application data\google\chrome\user data\local state
D:\local settings\application data\google\google desktop\4ed63b55aa97\sidebar_plugin_data
D:\local settings\application data\google\google desktop\4ed63b55aa97\uinfo.dat
%ProgramFiles%\novell\zenworks\cache\zmd\zencache\metadata\objinfo.db
%WINDIR%\st6unst.exe
%WINDIR%\setup1.exe
D:\local settings\application data\google\chrome\user data\default\cache\f_000838
D:\start menu\programs\time sheet system 1.4\time sheet system 1.4.lnk
%CommonProgramFiles%\microsoft shared\dao\dao350.dll
%ProgramFiles%\novell\zenworks\cache\zmd\zencache\5f3db883-be78-4bdb-938b-1b12e11e32ec
%ProgramFiles%\time sheet system\st6unst.log
%ProgramFiles%\time sheet system\drag1pg.ico
%ProgramFiles%\time sheet system\drop1pg.ico
%ProgramFiles%\time sheet system\implode.dll
%ProgramFiles%\time sheet system\point02.ico
%ProgramFiles%\time sheet system\point04.ico
%ProgramFiles%\time sheet system\u25dts.dll
%ProgramFiles%\time sheet system\u25store.dll
%ProgramFiles%\time sheet system\u2lbar.dll
<SYSTEM32>\p2smon.dll
%ProgramFiles%\appdeploy\repackager\appdeployrepackager.ini
<SYSTEM32>\p2sodbc.dll
<SYSTEM32>\p2sora7.dll
<Current directory>\microsoftВ® visual basic for windows_6.00.8804.xml
%TEMP%\autb.tmp
<Current directory>\microsoftВ® visual basic for windows.msi
%TEMP%\auta.tmp
<SYSTEM32>\implode.dll
%TEMP%\aut9.tmp
<Current directory>\postgresql_timesheet.reg
%TEMP%\aut8.tmp
%WINDIR%\installer\msi7.tmp
%WINDIR%\installer\1444f8.msi
%WINDIR%\installer\1444f7.msi
<SYSTEM32>\psqlodbc30.dll
<SYSTEM32>\psqlodbc.dll
C:\config.msi\1444f6.rbs
%WINDIR%\installer\msi4.tmp
%WINDIR%\installer\1444f5.ipi
%WINDIR%\installer\msi3.tmp
%WINDIR%\installer\msi2.tmp
%WINDIR%\installer\1444f2.msi
<Current directory>\psqlodbc.msi
<SYSTEM32>\psqlodbc30w.dll
%WINDIR%\installer\1444fb.ipi
%WINDIR%\installer\msic.tmp
C:\config.msi\1444fc.rbs
<SYSTEM32>\p2ssql.dll
<SYSTEM32>\p2ssyb10.dll
<SYSTEM32>\u252000.dll
<SYSTEM32>\u2dapp.dll
<SYSTEM32>\u2ddisk.dll
<SYSTEM32>\u2dmapi.dll
<SYSTEM32>\u2dnotes.dll
<SYSTEM32>\u2dpost.dll
<SYSTEM32>\u2dvim.dll
<SYSTEM32>\u2fcr.dll
<SYSTEM32>\u2fhtml.dll
<SYSTEM32>\u2fodbc.dll
<SYSTEM32>\u2frec.dll
<SYSTEM32>\u2frtf.dll
<SYSTEM32>\u2fsepv.dll
<SYSTEM32>\u2ftext.dll
<SYSTEM32>\u2fwks.dll
<SYSTEM32>\u2fwordw.dll
<SYSTEM32>\u2fxls.dll
<SYSTEM32>\u2l2000.dll
<SYSTEM32>\u2lcom.dll
<SYSTEM32>\p2soledb.dll
%WINDIR%\installer\1444fd.msi