Trojan.MulDrop20.2831

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Classes\dvhfile\shell\open\command] '' = 'WScript.exe "%ProgramFiles%\Messenger\Messenger.jse" "%1"'

Malicious functions

To complicate detection of its presence in the operating system,

modifies the following system settings:

[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoInternetIcon' = '00000001'

Modifies file system

Creates the following files

%ProgramFiles%\internet explorer\mui\iexplore.exe
%HOMEPATH%\application data\microsoft\internet explorer\quick launch\google chrome.dvh
%HOMEPATH%\application data\microsoft\internet explorer\quick launch\icq.dvh
%HOMEPATH%\application data\microsoft\internet explorer\quick launch\mail.ru agent.dvh
%HOMEPATH%\application data\microsoft\internet explorer\quick launch\mozilla thunderbird.dvh
%HOMEPATH%\application data\microsoft\internet explorer\quick launch\qip 2012.dvh
%HOMEPATH%\application data\microsoft\internet explorer\quick launch\winamp.dvh
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\windows dvd maker.dvh
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\windows media player.dvh
C:\users\public\desktop\Г¬ГґВ±В¦ГГё.url
%HOMEPATH%\favorites\ГЈГ ГҐВ®ГЄГіГ¦ВµГЎГ¤Г¬Г¬ГЈГўВ·Г±ГЄГґВїВґВЈВЎ.url
%HOMEPATH%\favorites\Г°В§В№Г»ВєГЈВµГ¤ГўГ¬Г©В«ВјГµВ·ГЄВІГєГ¦В·ВЈВ¬ГµГ¦В№ГјГіГЈВЈВЎ.url
%HOMEPATH%\favorites\ГўГ¬Г©В«В·ГЎГ°ГёГ¤В§В·ВЁВЈВ¬30Г¬Г¬ГґГ¶ВґГі3ГµГ¶В±ВВЈВ¬Г¬В«ВѕГёГЎГ«ВЈВЎ.url
%HOMEPATH%\favorites\ВјВ«Г¦В·Г°ГґВёГ°ГЈГ ГҐВ®Г°ВґГµГ¦ВЈВ¬90ВєГіГ°ГґВёГ°Г°ВЎГЈГ ГҐВ®Г—ГґГҐГ¤.url
%HOMEPATH%\favorites\Г—ГЈГ§ГІГҐГўГўГЄВЈВ¬Г—Г®Г ГЇГҐГ¦ВµГ¤ВІВ©ВІГЄВ№В«Г«ВѕВЈВЎ.url
%HOMEPATH%\favorites\Г°ГґВёГ°Г¤ВЈГ¬ГёВЈВ¬Г«Г¤ГЁВ»Г°ГёВґГіВµВ«ГІГ ГЁВ»Г§ГҐВґВї.url
%HOMEPATH%\favorites\ВіГ©В№В¦ГГёГ©ГЇГ—В¬Г§В® ГГёГўГ§ВґВґГІВµВ·ВЅВ·ВЁГ¶ВёВµВј.url
%HOMEPATH%\favorites\Г—Г®Г°ГўВєГєГўГВ№Г©Г¦В±ГГ¦ВјГ¶ВЈВ¬Г¤ГєГ¤В»ВЅГІГЈГёВЈВЎ.url
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sidebar.dvh
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\pidgin.dvh
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\opera.dvh
C:\users\public\desktop\acrobat reader dc.dvh
C:\users\public\desktop\google chrome.dvh
C:\users\public\desktop\mirc.dvh
C:\users\public\desktop\mozilla firefox.dvh
C:\users\public\desktop\mozilla thunderbird.dvh
C:\users\public\desktop\opera.dvh
C:\users\public\desktop\steam.dvh
C:\users\public\desktop\internet explorer.dvh
C:\users\public\desktop\winamp.dvh
%HOMEPATH%\desktop\mail.ru agent.dvh
%HOMEPATH%\desktop\qip 2012.dvh
%HOMEPATH%\desktop\telegram.dvh
%HOMEPATH%\desktop\total commander 64 bit.dvh
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\media center.dvh
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mozilla firefox.dvh
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mozilla thunderbird.dvh
%HOMEPATH%\desktop\icq.dvh
%HOMEPATH%\favorites\Г¬ГґВ±В¦ГГёВ»ГЄВ№ГєВµГЄВґГіГЁВ«ВЈВ¬Г¦В·Г¶ГЄВ±ВЈГ¶В¤ВЈВЎ.url
%HOMEPATH%\favorites\ВёГ·В№ГєГ¤Г°Г°ГґГІГµВѕВҐВіГџВґГ§ГҐГҐГ°Г°В°Г±ВЈВЁГВјВЈВ©.url