Trojan.MulDrop2.36282

Technical Information

Malicious functions:

Executes the following:

<SYSTEM32>\net1.exe stop "Norton Internet Security Proxy Srvice"
<SYSTEM32>\net.exe stop "Norton Internet Security Proxy Srvice"
<SYSTEM32>\net.exe stop "Norton Internet Security service"
<SYSTEM32>\net.exe stop "Norton AntiVirus Server"
<SYSTEM32>\net1.exe stop "Norton Internet Security service"
<SYSTEM32>\net.exe stop "Symantec Event Manager"
<SYSTEM32>\net1.exe stop "Symantec Proxy Service"
<SYSTEM32>\net1.exe stop "Symantec Event Manager"
<SYSTEM32>\net1.exe stop "Norton Internet Security Accounts Manager"
<SYSTEM32>\net.exe stop "Norton Internet Security Accounts Manager"
<SYSTEM32>\net1.exe stop "Norton AntiVirus Server"
<SYSTEM32>\net.exe stop "ViRobot Professional Monitoring"
<SYSTEM32>\net1.exe stop "Norton AntiVirus Corporate Edition"
<SYSTEM32>\net1.exe stop "ViRobot Professional Monitoring"
<SYSTEM32>\net1.exe stop "PC-cillin Personal Firewall"
<SYSTEM32>\net.exe stop "PC-cillin Personal Firewall"
<SYSTEM32>\net1.exe stop "Norton AntiVirus Auto Protect Service"
<SYSTEM32>\net.exe stop "Norton AntiVirus Auto Protect Service"
<SYSTEM32>\net.exe stop "Norton AntiVirus Client"
<SYSTEM32>\net.exe stop "Norton AntiVirus Corporate Edition"
<SYSTEM32>\net1.exe stop "Norton AntiVirus Client"
<SYSTEM32>\net.exe stop "Symantec Proxy Service"
<SYSTEM32>\net1.exe stop "rising process communication center"
<SYSTEM32>\net.exe stop "rising process communication center"
<SYSTEM32>\net.exe stop "rising realtime monitor service"
<SYSTEM32>\net.exe stop "OfficeScanNT Monitor"
<SYSTEM32>\net1.exe stop "rising realtime monitor service"
<SYSTEM32>\net.exe stop "Turbo Vaccine Monitoring Service"
<SYSTEM32>\cmd.exe /c <SYSTEM32>\feafvc.bat
<SYSTEM32>\net1.exe stop "Turbo Vaccine Monitoring Service"
<SYSTEM32>\net1.exe stop "MonSvcNT"
<SYSTEM32>\net.exe stop "MonSvcNT"
<SYSTEM32>\net1.exe stop "OfficeScanNT Monitor"
<SYSTEM32>\net.exe stop "ZoneAlarm"
<SYSTEM32>\net1.exe stop "Panda Antivirus"
<SYSTEM32>\net1.exe stop "ZoneAlarm"
<SYSTEM32>\net1.exe stop "Detector de OfficeScanNT"
<SYSTEM32>\net.exe stop "Detector de OfficeScanNT"
<SYSTEM32>\net1.exe stop "RemoteAgent"
<SYSTEM32>\net.exe stop "RemoteAgent"
<SYSTEM32>\net.exe stop "Ahnlab Task Scheduler"
<SYSTEM32>\net.exe stop "Panda Antivirus"
<SYSTEM32>\net1.exe stop "Ahnlab Task Scheduler"

Hides the following processes:

<Full path to virus>

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\MSN Gaming Zone\Windows\RCX28.tmp
%PROGRAM_FILES%\MSN Gaming Zone\Windows\RCX27.tmp
%PROGRAM_FILES%\MSN Gaming Zone\Windows\RCX26.tmp
%PROGRAM_FILES%\MSN Gaming Zone\Windows\RCX29.tmp
%PROGRAM_FILES%\NetMeeting\RCX2C.tmp
%PROGRAM_FILES%\NetMeeting\RCX2B.tmp
%PROGRAM_FILES%\MSN Gaming Zone\Windows\RCX2A.tmp
%PROGRAM_FILES%\MSN Gaming Zone\Windows\RCX25.tmp
%PROGRAM_FILES%\Messenger\RCX20.tmp
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\RCX1F.tmp
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\RCX1E.tmp
%PROGRAM_FILES%\Movie Maker\RCX21.tmp
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\MSN9Components\RCX24.tmp
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\MSN9Components\RCX23.tmp
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\RCX22.tmp
%PROGRAM_FILES%\Windows NT\RCX37.tmp
%PROGRAM_FILES%\Windows Media Player\RCX36.tmp
%PROGRAM_FILES%\Windows Media Player\RCX35.tmp
%PROGRAM_FILES%\Windows NT\RCX38.tmp
<Auxiliary element>
%PROGRAM_FILES%\Windows NT\Pinball\RCX3A.tmp
%PROGRAM_FILES%\Windows NT\Accessories\RCX39.tmp
%PROGRAM_FILES%\Windows Media Player\RCX34.tmp
%PROGRAM_FILES%\Outlook Express\RCX2F.tmp
%PROGRAM_FILES%\Outlook Express\RCX2E.tmp
%PROGRAM_FILES%\NetMeeting\RCX2D.tmp
%PROGRAM_FILES%\Outlook Express\RCX30.tmp
%PROGRAM_FILES%\Windows Media Player\RCX33.tmp
%PROGRAM_FILES%\Outlook Express\RCX32.tmp
%PROGRAM_FILES%\Outlook Express\RCX31.tmp
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\RCX1D.tmp
%CommonProgramFiles%\Microsoft Shared\Speech\RCX9.tmp
%CommonProgramFiles%\Microsoft Shared\MSInfo\RCX8.tmp
%CommonProgramFiles%\Microsoft Shared\DW\RCX7.tmp
%PROGRAM_FILES%\FireFox\RCXA.tmp
%PROGRAM_FILES%\FireFox\RCXD.tmp
%PROGRAM_FILES%\FireFox\RCXC.tmp
%PROGRAM_FILES%\FireFox\RCXB.tmp
%CommonProgramFiles%\Microsoft Shared\DW\RCX6.tmp
<Current directory>\RCX1.tmp
<SYSTEM32>\feafvc.bat
<SYSTEM32>\to.ico
C:\Far\RCX2.tmp
%CommonProgramFiles%\Microsoft Shared\DW\RCX5.tmp
C:\Far\Plugins\RCX4.tmp
C:\Far\RCX3.tmp
%PROGRAM_FILES%\Internet Explorer\RCX18.tmp
%PROGRAM_FILES%\FireFox\uninstall\RCX17.tmp
%PROGRAM_FILES%\FireFox\RCX16.tmp
%PROGRAM_FILES%\Internet Explorer\RCX19.tmp
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\RCX1C.tmp
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\RCX1B.tmp
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\RCX1A.tmp
%PROGRAM_FILES%\FireFox\RCX15.tmp
%PROGRAM_FILES%\FireFox\RCX10.tmp
%PROGRAM_FILES%\FireFox\RCXF.tmp
%PROGRAM_FILES%\FireFox\RCXE.tmp
%PROGRAM_FILES%\FireFox\RCX11.tmp
%PROGRAM_FILES%\FireFox\RCX14.tmp
%PROGRAM_FILES%\FireFox\RCX13.tmp
%PROGRAM_FILES%\FireFox\RCX12.tmp

Deletes the following files:

%PROGRAM_FILES%\FireFox\HACK-Aver____z ejmoswasgduxafikbgiloqmtoxoruxcmenchmputietwz fiptvz ceieqqmbfjmppjsknsuz enwkoquz .exe
%CommonProgramFiles%\Microsoft Shared\DW\HACK-Aver____z ejmoswasgduxafikbgiloqmtoxoruxcmenchmpu.exe

Deletes itself.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial