Trojan.Hosts.33458

Technical Information

Malicious functions:

Creates and executes the following:

'%TEMP%\RarSFX0\IDM.exe'
'%TEMP%\RarSFX0\IDM621.exe'

Executes the following:

'%WINDIR%\regedit.exe' /S reg14.reg

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\Internet Download Manager\Toolbar\apple.tbi
%PROGRAM_FILES%\Internet Download Manager\Toolbar\apple.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\apple_hot.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\BilsOrbit\BilsOrbit_LN.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\BilsOrbit\BilsOrbit_LH.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\3d_style_3.tbi
%PROGRAM_FILES%\Internet Download Manager\Toolbar\3d_small_3.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\8.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\8_hot.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\8.tbi
%PROGRAM_FILES%\Internet Download Manager\Toolbar\BilsOrbit\BilsOrbit_SH.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\dk_small_3.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\dk_smallHot_3.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\dk_style_3.tbi
%PROGRAM_FILES%\Internet Download Manager\Toolbar\ios.tbi
%PROGRAM_FILES%\Internet Download Manager\Toolbar\ios.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\BilsOrbit\Thumbs.db
%PROGRAM_FILES%\Internet Download Manager\Toolbar\BilsOrbit\BilsOrbit_SN.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\BilsOrbit.tbi
%PROGRAM_FILES%\Internet Download Manager\Toolbar\dk_large_3.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\dk_largeHot_3.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\3d_smallHot_3.bmp
%PROGRAM_FILES%\Internet Download Manager\IEGetAll.htm
%PROGRAM_FILES%\Internet Download Manager\IEExt.htm
%PROGRAM_FILES%\Internet Download Manager\IEGetVL.htm
%PROGRAM_FILES%\Internet Download Manager\IEMonitor.exe
%PROGRAM_FILES%\Internet Download Manager\IEGetVL2.htm
%PROGRAM_FILES%\Internet Download Manager\idmwfp.cat
%PROGRAM_FILES%\Internet Download Manager\idmvs.dll
%PROGRAM_FILES%\Internet Download Manager\idmwfp.inf
%PROGRAM_FILES%\Internet Download Manager\idmwfp64.sys
%PROGRAM_FILES%\Internet Download Manager\idmwfp32.sys
%PROGRAM_FILES%\Internet Download Manager\license.txt
%PROGRAM_FILES%\Internet Download Manager\Toolbar\3d_largeHot_3.bmp
%PROGRAM_FILES%\Internet Download Manager\Uninstall.exe
%PROGRAM_FILES%\Internet Download Manager\Toolbar\3d_largeHot_3_hdpi15.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\3d_large_3_hdpi15.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\3d_large_3.bmp
%PROGRAM_FILES%\Internet Download Manager\reg14.reg
%PROGRAM_FILES%\Internet Download Manager\MediumILStart.exe
%PROGRAM_FILES%\Internet Download Manager\scheduler.chm
%PROGRAM_FILES%\Internet Download Manager\tutor.chm
%PROGRAM_FILES%\Internet Download Manager\tips.txt
%PROGRAM_FILES%\Internet Download Manager\Toolbar\ios7.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\Ultimate3Dhot.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\Ultimate3D.tbi
%PROGRAM_FILES%\Internet Download Manager\defexclist.txt
%PROGRAM_FILES%\Internet Download Manager\downlWithIDM.dll
%PROGRAM_FILES%\Internet Download Manager\downlWithIDM64.dll
%PROGRAM_FILES%\Internet Download Manager\Toolbar\rizillion_Small_Hot.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\rizillion_Large_Normal.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\rizillion_Small_Normal.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\Ultimate3D.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\Thumbs.db
%PROGRAM_FILES%\Internet Download Manager\grabber.chm
%PROGRAM_FILES%\Internet Download Manager\idmcchandler2.dll
%PROGRAM_FILES%\Internet Download Manager\idmBroker.exe
%HOMEPATH%\Desktop\Internet Download Manager.lnk
%HOMEPATH%\Start Menu\Programs\Internet Download Manager\Uninstall IDM.lnk
%HOMEPATH%\Start Menu\Programs\Internet Download Manager\Internet Download Manager.lnk
%PROGRAM_FILES%\Internet Download Manager\IDMan.exe
%PROGRAM_FILES%\Internet Download Manager\idman.chm
%PROGRAM_FILES%\Internet Download Manager\idmantypeinfo.tlb
%PROGRAM_FILES%\Internet Download Manager\idmbrbtn.dll
%PROGRAM_FILES%\Internet Download Manager\idmbrbtn64.dll
%PROGRAM_FILES%\Internet Download Manager\Toolbar\rizillion_Large_Hot.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\Mac.tbi
%PROGRAM_FILES%\Internet Download Manager\Toolbar\Mac\Thumbs.db
%PROGRAM_FILES%\Internet Download Manager\Toolbar\MM_config_3.tbi
%PROGRAM_FILES%\Internet Download Manager\Toolbar\MM_largeHot.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\MM_large.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\ios7_hot.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\ios7.tbi
%PROGRAM_FILES%\Internet Download Manager\Toolbar\ios_hot.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\Mac\MacHot.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\Mac\Mac.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\MM_small.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\Pure_Flat_2013\Pure_Flat_2013-Small_Normal.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\Pure_Flat_2013\Pure_Flat_2013-Small_Hot.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\Pure_Flat_2013\Thumbs.db
%PROGRAM_FILES%\Internet Download Manager\Toolbar\rizillion.tbi
%PROGRAM_FILES%\Internet Download Manager\Toolbar\Pure_Flat_2013.tbi
%PROGRAM_FILES%\Internet Download Manager\Toolbar\Pure_Flat_2013\Pure_Flat_2013-Large_Disabled.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\MM_smallHot.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\Pure_Flat_2013\Pure_Flat_2013-Large_Hot.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\Pure_Flat_2013\Pure_Flat_2013-Small_Disabled.bmp
%PROGRAM_FILES%\Internet Download Manager\Toolbar\Pure_Flat_2013\Pure_Flat_2013-Large_Normal.bmp
%PROGRAM_FILES%\Internet Download Manager\Languages\inst_fa.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\inst_es.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\inst_fr.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\inst_id.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\inst_hu.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\inst_cht.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\inst_chn.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\inst_cz.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\inst_dk.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\inst_de.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\inst_it.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\inst_sk.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\inst_ru.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\inst_src.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\inst_tr.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\inst_th.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\inst_kr.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\inst_iw.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\inst_pl.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\inst_ptbr.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\inst_pt.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\inst_bg.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\idm_de.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\idm_ba.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\idm_es.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\idm_fi.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\idm_fa.lng
%TEMP%\RarSFX0\geoda2015.jpg
%TEMP%\RarSFX0\geoda2014.JPG
%TEMP%\RarSFX0\IDM.exe
%PROGRAM_FILES%\Internet Download Manager\Languages\idm_ar.lng
%TEMP%\RarSFX0\IDM621.exe
%PROGRAM_FILES%\Internet Download Manager\Languages\idm_fr.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\idm_th.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\idm_ru.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\idm_tr.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\inst_ar.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\idm_vn.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\idm_jp.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\idm_it.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\idm_nl.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\idm_ptbr.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\idm_pl.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\inst_ua.lng
%PROGRAM_FILES%\Internet Download Manager\IDMIECC.dll
%PROGRAM_FILES%\Internet Download Manager\IDMIECC64.dll
%PROGRAM_FILES%\Internet Download Manager\idmindex.dll
%PROGRAM_FILES%\Internet Download Manager\idmmkb.dll
%PROGRAM_FILES%\Internet Download Manager\IDMIntegrator64.exe
%PROGRAM_FILES%\Internet Download Manager\IDMGCExt.crx
%PROGRAM_FILES%\Internet Download Manager\idmftype.dll
%PROGRAM_FILES%\Internet Download Manager\IDMGetAll64.dll
%PROGRAM_FILES%\Internet Download Manager\IDMGrHlp.exe
%PROGRAM_FILES%\Internet Download Manager\IDMGetAll.dll
%PROGRAM_FILES%\Internet Download Manager\idmmzcc.xpi
%PROGRAM_FILES%\Internet Download Manager\idmtdi.inf
%PROGRAM_FILES%\Internet Download Manager\idmtdi.cat
%PROGRAM_FILES%\Internet Download Manager\idmtdi32.sys
%PROGRAM_FILES%\Internet Download Manager\idmvconv.dll
%PROGRAM_FILES%\Internet Download Manager\idmtdi64.sys
%PROGRAM_FILES%\Internet Download Manager\IDMNetMon.dll
%PROGRAM_FILES%\Internet Download Manager\IDMNetMon64.dll
%PROGRAM_FILES%\Internet Download Manager\IDMSetup2.log
%PROGRAM_FILES%\Internet Download Manager\IDMShellExt.dll
%PROGRAM_FILES%\Internet Download Manager\IDMShellExt64.dll
%PROGRAM_FILES%\Internet Download Manager\IDMFType64.dll
%PROGRAM_FILES%\Internet Download Manager\Languages\tips_fa.txt
%PROGRAM_FILES%\Internet Download Manager\Languages\tips_es.txt
%PROGRAM_FILES%\Internet Download Manager\Languages\tips_fi.txt
%PROGRAM_FILES%\Internet Download Manager\Languages\tips_it.txt
%PROGRAM_FILES%\Internet Download Manager\Languages\tips_fr.txt
%PROGRAM_FILES%\Internet Download Manager\Languages\template_inst.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\template.lng
%PROGRAM_FILES%\Internet Download Manager\Languages\tips_ar.txt
%PROGRAM_FILES%\Internet Download Manager\Languages\tips_de.txt
%PROGRAM_FILES%\Internet Download Manager\Languages\tips_ba.txt
%PROGRAM_FILES%\Internet Download Manager\Languages\tips_jp.txt
%PROGRAM_FILES%\Internet Download Manager\Languages\tips_vn.txt
%PROGRAM_FILES%\Internet Download Manager\Languages\tips_tr.txt
%PROGRAM_FILES%\Internet Download Manager\idmcchandler2_64.dll
%PROGRAM_FILES%\Internet Download Manager\IDMFType.dat
%PROGRAM_FILES%\Internet Download Manager\idmfsa.dll
%PROGRAM_FILES%\Internet Download Manager\Languages\tips_pl.txt
%PROGRAM_FILES%\Internet Download Manager\Languages\tips_nl.txt
%PROGRAM_FILES%\Internet Download Manager\Languages\tips_ptbr.txt
%PROGRAM_FILES%\Internet Download Manager\Languages\tips_th.txt
%PROGRAM_FILES%\Internet Download Manager\Languages\tips_ru.txt

Sets the 'hidden' attribute to the following files:

%PROGRAM_FILES%\Internet Download Manager\Toolbar\Pure_Flat_2013\Thumbs.db
%PROGRAM_FILES%\Internet Download Manager\Toolbar\Thumbs.db
%PROGRAM_FILES%\Internet Download Manager\Toolbar\BilsOrbit\Thumbs.db
%PROGRAM_FILES%\Internet Download Manager\Toolbar\Mac\Thumbs.db

Deletes the following files:

%TEMP%\RarSFX0\IDM.exe
%TEMP%\RarSFX0\IDM621.exe
%TEMP%\RarSFX0\geoda2014.JPG
%TEMP%\RarSFX0\geoda2015.jpg

Modifies the HOSTS file.

Miscellaneous:

Searches for the following windows:

ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'EDIT' WindowName: ''

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial