Trojan.MulDrop2.56327

Technical Information

To ensure autorun and distribution:

Creates the following files on removable media:

<Drive name for removable media>:\My Documents\Favorites\软件下载\视频教程网下载中心计算机.url
<Drive name for removable media>:\My Documents\Favorites\实用查询\世纪前线—宽带速率测试.url
<Drive name for removable media>:\My Documents\Favorites\软件下载\绿色下载站首页.url
<Drive name for removable media>:\My Documents\Favorites\银行金融\兴业银行.url
<Drive name for removable media>:\My Documents\Favorites\软件下载\新浪下载首页_科技时代_新浪网.url
<Drive name for removable media>:\My Documents\Favorites\实用查询\手机号码归属地查询.url
<Drive name for removable media>:\My Documents\Favorites\实用查询\金山爱词霸在线英汉翻译.url
<Drive name for removable media>:\My Documents\Favorites\银行金融\交通银行.url
<Drive name for removable media>:\My Documents\Favorites\实用查询\基金净值查询.url
<Drive name for removable media>:\My Documents\Favorites\软件下载\绿色下载吧.url
<Drive name for removable media>:\My Documents\Favorites\软件下载\绿色软件联盟.url
<Drive name for removable media>:\My Documents\Favorites\软件下载\精美壁纸桌酷壁纸站.url
<Drive name for removable media>:\My Documents\Favorites\迅雷看看-免费高清影视.url
<Drive name for removable media>:\My Documents\Favorites\银行金融\中国银行.url
<Drive name for removable media>:\My Documents\Favorites\银行金融\中国农业银行.url
<Drive name for removable media>:\My Documents\Favorites\淘宝网 - 淘！我喜欢.url
<Drive name for removable media>:\My Documents\Favorites\最新系统下载交流.url
<Drive name for removable media>:\My Documents\Favorites\哈哈115网址导航.url
<Drive name for removable media>:\My Documents\Favorites\银行金融\中国工商银行.url
<Drive name for removable media>:\My Documents\Favorites\实用查询\在线翻译_英汉互译.url
<Drive name for removable media>:\My Documents\Favorites\软件下载\雨林木风软件下载.url
<Drive name for removable media>:\My Documents\Favorites\银行金融\中国民生银行.url
<Drive name for removable media>:\My Documents\Favorites\软件下载\中国教程网论坛学习交流平台.url
<Drive name for removable media>:\My Documents\Favorites\银行金融\中国建设银行.url
<Drive name for removable media>:\My Documents\Favorites\实用查询\火车时刻查询.url
<Drive name for removable media>:\My Documents\Favorites\Desktop.ini
<Drive name for removable media>:\My Documents\My Music\My Playlists\DesktopX Playlist.wpl
<Drive name for removable media>:\My Documents\My Videos\Desktop.ini
<Drive name for removable media>:\My Documents\Favorites\实用查询\IP地址、手机号码、天气查询.url
<Drive name for removable media>:\My Documents\Favorites\实用查询\IP、邮政、手机号码查询.url
<Drive name for removable media>:\My Documents\Favorites\软件下载\GHOST技术交流区.url
<Drive name for removable media>:\movefiles.cmd
<Drive name for removable media>:\Favorites.exe
<Drive name for removable media>:\newpath.reg
<Drive name for removable media>:\My Documents\My Pictures\Desktop.ini
<Drive name for removable media>:\My Documents\My Music\Desktop.ini
<Drive name for removable media>:\My Documents\desktop.ini
<Drive name for removable media>:\My Documents\Favorites\软件下载\各类笔记本驱动(中关村在线).url
<Drive name for removable media>:\My Documents\Favorites\软件下载\霏凡软件站.url
<Drive name for removable media>:\My Documents\Favorites\实用查询\电视节目查询.url
<Drive name for removable media>:\My Documents\Favorites\实用查询\公交车-坐车查询.url
<Drive name for removable media>:\My Documents\Favorites\银行金融\更多银行保险站点.url
<Drive name for removable media>:\My Documents\Favorites\实用查询\更多实用查询--+.url
<Drive name for removable media>:\My Documents\Favorites\软件下载\OFFICE精英俱乐部.url
<Drive name for removable media>:\My Documents\Favorites\实用查询\IP归属地查询.url
<Drive name for removable media>:\My Documents\Favorites\实用查询\IP地址手机归属地等查询.url
<Drive name for removable media>:\My Documents\Favorites\实用查询\词霸在线英汉词典.url
<Drive name for removable media>:\My Documents\Favorites\实用查询\百年日历表(有农历).url
<Drive name for removable media>:\My Documents\Favorites\百度一下-你就知道.url

Malicious functions:

Creates and executes the following:

<Drive name for removable media>:\Favorites.exe

Executes the following:

%WINDIR%\regedit.exe /s <Drive name for removable media>:\newpath.reg

Modifies file system :

Creates the following files:

%TEMP%\aut3.tmp
%TEMP%\aut2.tmp
%TEMP%\aut1.tmp

Sets the 'hidden' attribute to the following files:

<Drive name for removable media>:\My Documents\Favorites\Desktop.ini
<Drive name for removable media>:\My Documents\desktop.ini

Deletes the following files:

<Drive name for removable media>:\newpath.reg
<Drive name for removable media>:\Favorites.exe
<Drive name for removable media>:\movefiles.cmd
%TEMP%\aut1.tmp
%TEMP%\aut2.tmp
%TEMP%\aut3.tmp

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'EDIT' WindowName: ''
ClassName: 'RegEdit_RegEdit' WindowName: ''

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial