Trojan.MulDrop5.15615

Technical Information

To ensure autorun and distribution:

Changes the following executable system files:

<SYSTEM32>\bootcfg.exe
<SYSTEM32>\libeay32.dll

Substitutes the following executable system files:

<SYSTEM32>\dllcache\bootcfg.exe with <SYSTEM32>\dllcache\bootcfg.exe.new

Infects the following executable files:

<SYSTEM32>\dllcache\bootcfg.exe.new
<SYSTEM32>\bootcfg.exe
<SYSTEM32>\libeay32.dll

Modifies file system :

Creates the following files:

%WINDIR%\Cursors\Pearl\V-Resize.cur
%WINDIR%\Cursors\ContrastBlack\Vertical Resize.cur
%WINDIR%\Cursors\X-Steel[BLUE]\UpArrow.cur
%WINDIR%\Cursors\Pearl\up.cur
%WINDIR%\Cursors\Titan\uparrow.cur
%WINDIR%\Cursors\GreenBliss\working.cur
%WINDIR%\Cursors\Fedora\xFree.cur
%WINDIR%\Cursors\Fedora\Working In Background.cur
%WINDIR%\Cursors\ContrastWhite\Vertical Resize.cur
%WINDIR%\Cursors\Fedora\Vertical Resize.cur
%WINDIR%\Cursors\GreenBliss\unavailable.cur
%WINDIR%\Cursors\Fedora\Target 2.cur
%WINDIR%\Cursors\Fedora\Target 3.cur
%WINDIR%\Cursors\Fedora\Target 1.cur
%WINDIR%\Cursors\Titan\sizewe.cur
%WINDIR%\Cursors\Fedora\Skull.cur
%WINDIR%\Cursors\ContrastBlack\Unavailable.cur
%WINDIR%\Cursors\ContrastWhite\Unavailable.cur
%WINDIR%\Cursors\Fedora\Text Select.cur
%WINDIR%\Cursors\ContrastBlack\Text Select.cur
%WINDIR%\Cursors\ContrastWhite\Text Select.cur
%WINDIR%\Cursors\aero_pen.cur
%WINDIR%\Cursors\aero_prec.cur
%WINDIR%\Cursors\aero_nwse.cur
%WINDIR%\Cursors\aero_nesw.cur
%WINDIR%\Cursors\aero_ns.cur
%WINDIR%\Cursors\AeroII Alternate.cur
%WINDIR%\Cursors\AeroII Cross.cur
%WINDIR%\Cursors\aero_up.cur
%WINDIR%\Cursors\aero_select.cur
%WINDIR%\Cursors\aero_unavail.cur
%WINDIR%\Cursors\aero_move.cur
%WINDIR%\Cursors\AeroII Hand.ani
%WINDIR%\Cursors\AeroII Working In Backround.ani
%WINDIR%\Cursors\AeroII Busy.ani
%WINDIR%\Cursors\aero_busy.ani
%WINDIR%\Cursors\aero_working.ani
%WINDIR%\Cursors\aero_helpsel.cur
%WINDIR%\Cursors\aero_link.cur
%WINDIR%\Cursors\aero_ew.cur
%WINDIR%\Cursors\aero_alt.cur
%WINDIR%\Cursors\aero_arrow.cur
%WINDIR%\Cursors\Quell\Que_06t.cur
%WINDIR%\Cursors\Quell\Que_07h.cur
%WINDIR%\Cursors\Quell\Que_05c.cur
%WINDIR%\Cursors\Quell\Que_02h.cur
%WINDIR%\Cursors\Quell\Que_03w.cur
%WINDIR%\Cursors\Quell\Que_11r.cur
%WINDIR%\Cursors\Quell\Que_12r.cur
%WINDIR%\Cursors\Quell\Que_10r.cur
%WINDIR%\Cursors\Quell\Que_08u.cur
%WINDIR%\Cursors\Quell\Que_09r.cur
%WINDIR%\Cursors\Quell\Que_01n.cur
%WINDIR%\Cursors\ContrastWhite\Normal Select.cur
%WINDIR%\Cursors\Fedora\Normal Select.cur
%WINDIR%\Cursors\ContrastBlack\Normal Select.cur
%WINDIR%\Cursors\[noir]\Noir_13M.cur
%WINDIR%\Cursors\[noir]\Noir_14A.cur
%WINDIR%\Cursors\ContrastWhite\Precision Select.cur
%WINDIR%\Cursors\Fedora\Precision Select.cur
%WINDIR%\Cursors\ContrastBlack\Precision Select.cur
%WINDIR%\Cursors\GreenBliss\normal.cur
%WINDIR%\Cursors\Pearl\pen.cur
%WINDIR%\Cursors\Rainstik XP\RaiXPS_13_move.cur
%WINDIR%\Cursors\Rainstik XP\RaiXPS_14_altr.cur
%WINDIR%\Cursors\Rainstik XP\RaiXPS_12_dgn2.cur
%WINDIR%\Cursors\Rainstik XP\RaiXPS_10_horz.cur
%WINDIR%\Cursors\Rainstik XP\RaiXPS_11_dgn1.cur
%WINDIR%\Cursors\Titan\sizens.cur
%WINDIR%\Cursors\Titan\sizenwse.cur
%WINDIR%\Cursors\Titan\sizenesw.cur
%WINDIR%\Cursors\Fedora\Refresh.cur
%WINDIR%\Cursors\Titan\sizeall.cur
%WINDIR%\Cursors\Rainstik XP\RaiXPS_09_vert.cur
%WINDIR%\Cursors\Rainstik XP\RaiXPS_01_norm.cur
%WINDIR%\Cursors\Rainstik XP\RaiXPS_02_help.cur
%WINDIR%\Cursors\Quell\Que_15l.cur
%WINDIR%\Cursors\Quell\Que_13m.cur
%WINDIR%\Cursors\Quell\Que_14a.cur
%WINDIR%\Cursors\Rainstik XP\RaiXPS_07_pen.cur
%WINDIR%\Cursors\Rainstik XP\RaiXPS_08_unav.cur
%WINDIR%\Cursors\Rainstik XP\RaiXPS_06_text.cur
%WINDIR%\Cursors\Rainstik XP\RaiXPS_03_work.cur
%WINDIR%\Cursors\Rainstik XP\RaiXPS_05_cross.cur
%WINDIR%\Resources\Themes\Immersion\Immersion.msstyles
%WINDIR%\Resources\Themes\La_Clarte\LaClarte.msstyles
%WINDIR%\Resources\Themes\ForestGreen\ForestGreen.msstyles
%WINDIR%\Resources\Themes\CatalystVS_Blue\CatalystVS_Blue.msstyles
%WINDIR%\Resources\Themes\Desatch\Desatch.msstyles
%WINDIR%\Resources\Themes\Catalyst.theme
%WINDIR%\Resources\Themes\Clarte.theme
%WINDIR%\Resources\Themes\Element\Luna Element.msstyles
%WINDIR%\Resources\Themes\Longhorn\Longhorn.msstyles
%WINDIR%\Resources\Themes\LOR\LOR.msstyles
%WINDIR%\Resources\Themes\ForestGreen\Icons\Printers And Faxes.ico
%WINDIR%\Resources\Themes\ForestGreen\Icons\BIN Empty.ico
%WINDIR%\Resources\Themes\ForestGreen\Icons\BIN Full.ico
%WINDIR%\Resources\Themes\ForestGreen\User Icon\ForestGreen User Icon.bmp
%WINDIR%\Resources\Themes\Element\Shell\BlackC\Shellstyle.dll
%WINDIR%\Resources\Themes\Element\Shell\NormalColor\Shellstyle.dll
%WINDIR%\Resources\Themes\ForestGreen\Icons\My Documents.ico
%WINDIR%\Resources\Themes\ForestGreen\Icons\My Network.ico
%WINDIR%\Resources\Themes\ForestGreen\Icons\My Computer.ico
%WINDIR%\Resources\Themes\ForestGreen\Icons\Control Panel.ico
%WINDIR%\Resources\Themes\ForestGreen\Icons\Internet Explorer.ico
%WINDIR%\Resources\Themes\Desatch\Rose.jpg
%WINDIR%\Resources\Themes\CatalystVS_Blue\Wallpaper\Wisconsin River.jpg
%WINDIR%\Resources\Themes\Longhorn\Oiseaum.jpg
%WINDIR%\Resources\Themes\LOR\GondoR1280.jpg
%WINDIR%\Resources\Themes\Element\Luna Element.jpg
%WINDIR%\Resources\Themes\Muku\Lever du soleil.jpg
%WINDIR%\Resources\Themes\Luna element\Nuages.jpg
%WINDIR%\Resources\Themes\Luna element.theme
%WINDIR%\Resources\Themes\Luna element\Luna element.msstyles
%WINDIR%\Resources\Themes\Muku\Muku.msstyles
%WINDIR%\Resources\Themes\ForestGreen\Wallpaper\ForestGreen.jpg
%WINDIR%\Resources\Themes\Immersion.theme
%WINDIR%\Resources\Themes\Lever de soleil.theme
%WINDIR%\Resources\Themes\ForestGreen.Theme
%WINDIR%\Resources\Themes\Desatch.theme
%WINDIR%\Resources\Themes\Element.Theme
%WINDIR%\Resources\Themes\La_Clarte\Bora.jpg
%WINDIR%\Resources\Themes\Immersion\EnergyBliss.jpg
%WINDIR%\Resources\Themes\ForestGreen\Font\Dungeon.TTF
%WINDIR%\Resources\Themes\Longhorn.theme
%WINDIR%\Resources\Themes\LOR.theme
<SYSTEM32>\oemlogo.bmp
<SYSTEM32>\GlobFX Space Travel.scr
%WINDIR%\vdi.exe
<SYSTEM32>\cmdow.exe
<SYSTEM32>\sleep.exe
%WINDIR%\Fonts\English.ttf
%WINDIR%\Fonts\Jean-Claude's hand.ttf
%WINDIR%\Fonts\CrayonE.ttf
%WINDIR%\Fonts\Amandine.ttf
%WINDIR%\Fonts\Computerfont Regular.ttf
<SYSTEM32>\oeminfo.ini
%WINDIR%\Cursors\AeroII Resize All.cur
%WINDIR%\Cursors\AeroII Resize Left.cur
%WINDIR%\Cursors\AeroII Normal Select.cur
%WINDIR%\Cursors\AeroII Handwriting.cur
%WINDIR%\Cursors\AeroII Help Select.cur
%WINDIR%\Cursors\AeroII Text Select.cur
%WINDIR%\Cursors\AeroII Unavailable.cur
%WINDIR%\Cursors\AeroII Size Vert.cur
%WINDIR%\Cursors\AeroII Resize Right.cur
%WINDIR%\Cursors\AeroII Size Horz.cur
%WINDIR%\Resources\Themes\LOR\shell\Normalcolor\shellstyle.dll
%WINDIR%\Resources\Themes\Longhorn\Shell\Neon\shellstyle.dll
%WINDIR%\Resources\Themes\Desatch\Shell\NormalColor\shellstyle.dll
%WINDIR%\wxo.txt
%WINDIR%\Resources\Themes\ForestGreen\Icons\Permission.txt
%WINDIR%\Resources\Themes\ForestGreen\Shell\NormalColor\shellstyle.dll
%WINDIR%\Resources\Themes\Immersion\Shell\NormalColor\shellstyle.dll
%WINDIR%\Resources\Themes\Longhorn\Shell\Metallic\shellstyle.dll
%WINDIR%\Resources\Themes\Longhorn\Shell\NormalColor\shellstyle.dll
%WINDIR%\Resources\Themes\Longhorn\Shell\Homestead\shellstyle.dll
%WINDIR%\NOTEPAD.ini
%WINDIR%\POWER.exe
<SYSTEM32>\NiwradSoft.scr
<SYSTEM32>\TimeZone.exe
%WINDIR%\Fonts\KARINE.ttf
<SYSTEM32>\Setting.ini
<SYSTEM32>\cttune.cpl
<SYSTEM32>\NOTEPAD.ini
<SYSTEM32>\WgaLogon.dll
<SYSTEM32>\WgaTray.exe
<SYSTEM32>\LegitCheckControl.dll
%WINDIR%\Cursors\[noir]\Noir_12R.cur
%WINDIR%\Cursors\3Dplavi\11.cur
%WINDIR%\Cursors\3Dplavi\12.cur
%WINDIR%\Cursors\3Dplavi\10.cur
%WINDIR%\Cursors\3Dplavi\08.cur
%WINDIR%\Cursors\3Dplavi\09.cur
%WINDIR%\Cursors\ContrastBlack\Alternate Select.cur
%WINDIR%\Cursors\ContrastWhite\Alternate Select.cur
%WINDIR%\Cursors\3Dplavi\15.cur
%WINDIR%\Cursors\3Dplavi\13.cur
%WINDIR%\Cursors\3Dplavi\14.cur
%WINDIR%\Cursors\3Dplavi\06.cur
%WINDIR%\Cursors\ContrastBlack\Working In Background.ani
%WINDIR%\Cursors\ContrastWhite\Working In Background.ani
%WINDIR%\Cursors\chick\waitpoing.ani
%WINDIR%\Cursors\X-Steel[BLUE]\Wait.ani
%WINDIR%\Cursors\Titan\Wait.ani
%WINDIR%\Cursors\3Dplavi\04.cur
%WINDIR%\Cursors\3Dplavi\05.cur
%WINDIR%\Cursors\3Dplavi\03.cur
%WINDIR%\Cursors\3Dplavi\01.cur
%WINDIR%\Cursors\3Dplavi\02.cur
%WINDIR%\Cursors\BarQNX\bqx_r04.cur
%WINDIR%\Cursors\BarQNX\bqx_text.cur
%WINDIR%\Cursors\BarQNX\bqx_r03.cur
%WINDIR%\Cursors\BarQNX\bqx_r01.cur
%WINDIR%\Cursors\BarQNX\bqx_r02.cur
%WINDIR%\Cursors\carbon6 XP\C6XPS_3_working.cur
%WINDIR%\Cursors\carbon6 XP\C6XPS_4_busy.cur
%WINDIR%\Cursors\carbon6 XP\C6XPS_2_help.cur
%WINDIR%\Cursors\BarQNX\bqx_unav.cur
%WINDIR%\Cursors\carbon6 XP\C6XPS_1_normal.cur
%WINDIR%\Cursors\BarQNX\bqx_norm.cur
%WINDIR%\Cursors\Pearl\arrow.cur
%WINDIR%\Cursors\Titan\arrow.cur
%WINDIR%\Cursors\Gloomy\Arrow.cur
%WINDIR%\Cursors\Fedora\Alternate Select.cur
%WINDIR%\Cursors\GreenBliss\appstarting.cur
%WINDIR%\Cursors\BarQNX\bqx_hand.cur
%WINDIR%\Cursors\BarQNX\bqx_move.cur
%WINDIR%\Cursors\BarQNX\bqx_cros.cur
%WINDIR%\Cursors\X-Steel[BLUE]\Arrow.cur
%WINDIR%\Cursors\BarQNX\bqx_altr.cur
%WINDIR%\Cursors\chick\chickpointerclick.ani
%WINDIR%\Cursors\dCursor\dc_Busy.ani
%WINDIR%\Cursors\chick\chickpointer.ani
%WINDIR%\Cursors\ContrastWhite\Busy.ani
%WINDIR%\Cursors\Fedora\Busy.ANI
%WINDIR%\Cursors\X-Steel[BLUE]\Hand.ani
%WINDIR%\Cursors\X-Steel[BLUE]\Handwriting.ani
%WINDIR%\Cursors\chick\diagonal2.ani
%WINDIR%\Cursors\dCursor\dc_Busy2.ani
%WINDIR%\Cursors\chick\diagonal.ani
%WINDIR%\Cursors\ContrastBlack\Busy.ani
%WINDIR%\Cursors\Pearl\app.ani
%WINDIR%\Cursors\Titan\appstarting.ani
%WINDIR%\Cursors\Gloomy\app.ani
%WINDIR%\Cursors\BarQNX\BarQNX.txt
%WINDIR%\Cursors\X-Steel[BLUE]\install.inf
%WINDIR%\Cursors\BarQNX\bqx_link.ani
%WINDIR%\Cursors\BarQNX\bqx_work.ani
%WINDIR%\Cursors\BarQNX\bqx_help.ani
%WINDIR%\Cursors\X-Steel[BLUE]\AppStarting.ani
%WINDIR%\Cursors\BarQNX\bqx_busy.ani
%WINDIR%\Cursors\X-Steel[BLUE]\SizeWE.ani
%WINDIR%\Cursors\chick\text.ani
%WINDIR%\Cursors\X-Steel[BLUE]\SizeNWSE.ani
%WINDIR%\Cursors\X-Steel[BLUE]\SizeNESW.ani
%WINDIR%\Cursors\X-Steel[BLUE]\SizeNS.ani
%WINDIR%\Cursors\chick\wait.ani
%WINDIR%\Cursors\Pearl\wait.ani
%WINDIR%\Cursors\Gloomy\Wait.ani
%WINDIR%\Cursors\chick\unavailable.ani
%WINDIR%\Cursors\chick\vertical.ani
%WINDIR%\Cursors\X-Steel[BLUE]\SizeAll.ani
%WINDIR%\Cursors\X-Steel[BLUE]\NO.ani
%WINDIR%\Cursors\[noir]\Noir_03W.ani
%WINDIR%\Cursors\chick\move.ani
%WINDIR%\Cursors\X-Steel[BLUE]\Help.ani
%WINDIR%\Cursors\chick\horizontal.ani
%WINDIR%\Cursors\Rainstik XP\RaiXPS_04_busy.ani
%WINDIR%\Cursors\Rainstik XP\RaiXPS_15_link.ani
%WINDIR%\Cursors\Quell\Que_04b.ani
%WINDIR%\Cursors\[noir]\Noir_15L.ani
%WINDIR%\Cursors\chick\pointer.ani
%WINDIR%\Cursors\Pearl\help.cur
%WINDIR%\Cursors\Titan\help.cur
%WINDIR%\Cursors\GreenBliss\help.cur
%WINDIR%\Cursors\Fedora\Help Select.cur
%WINDIR%\Cursors\Gloomy\Help.cur
%WINDIR%\Cursors\Pearl\ibeam.cur
%WINDIR%\Cursors\Titan\ibeam.cur
%WINDIR%\Cursors\Fedora\Horizontal Resize.cur
%WINDIR%\Cursors\ContrastBlack\Horizontal Resize.cur
%WINDIR%\Cursors\ContrastWhite\Horizontal Resize.cur
%WINDIR%\Cursors\ContrastWhite\Help Select.cur
%WINDIR%\Cursors\GreenBliss\hand.cur
%WINDIR%\Cursors\Pearl\hand.cur
%WINDIR%\Cursors\Gloomy\Hand.cur
%WINDIR%\Cursors\Fedora\Favorites.cur
%WINDIR%\Cursors\Pearl\H-Resize.cur
%WINDIR%\Cursors\Titan\Handwriting.cur
%WINDIR%\Cursors\ContrastBlack\Help Select.cur
%WINDIR%\Cursors\Fedora\Handwriting.cur
%WINDIR%\Cursors\ContrastBlack\Handwriting.cur
%WINDIR%\Cursors\ContrastWhite\Handwriting.cur
%WINDIR%\Cursors\[noir]\Noir_05P.cur
%WINDIR%\Cursors\[noir]\Noir_06T.cur
%WINDIR%\Cursors\[noir]\Noir_04B.cur
%WINDIR%\Cursors\[noir]\Noir_01N.cur
%WINDIR%\Cursors\[noir]\Noir_02H.cur
%WINDIR%\Cursors\[noir]\Noir_10R.cur
%WINDIR%\Cursors\[noir]\Noir_11R.cur
%WINDIR%\Cursors\[noir]\Noir_09R.cur
%WINDIR%\Cursors\[noir]\Noir_07H.cur
%WINDIR%\Cursors\[noir]\Noir_08U.cur
%WINDIR%\Cursors\Titan\no.cur
%WINDIR%\Cursors\ContrastWhite\Link Select.cur
%WINDIR%\Cursors\Fedora\Link.cur
%WINDIR%\Cursors\ContrastBlack\Link Select.cur
%WINDIR%\Cursors\X-Steel[BLUE]\IBeam.cur
%WINDIR%\Cursors\Fedora\Link 2.cur
%WINDIR%\Cursors\Pearl\Move.cur
%WINDIR%\Cursors\Pearl\no.cur
%WINDIR%\Cursors\Fedora\Move.cur
%WINDIR%\Cursors\ContrastBlack\Move.cur
%WINDIR%\Cursors\ContrastWhite\Move.cur
%WINDIR%\Cursors\Pearl\D1.cur
%WINDIR%\Cursors\Pearl\D2.cur
%WINDIR%\Cursors\X-Steel[BLUE]\cross.cur
%WINDIR%\Cursors\Pearl\cross.cur
%WINDIR%\Cursors\Titan\Cross.cur
%WINDIR%\Cursors\dCursor\dc_Hand.cur
%WINDIR%\Cursors\dCursor\dc_Help.cur
%WINDIR%\Cursors\dCursor\dc_Cros.cur
%WINDIR%\Cursors\dCursor\dc_Altr.cur
%WINDIR%\Cursors\dCursor\dc_Altr2.cur
%WINDIR%\Cursors\carbon6 XP\C6XPS_F_link.cur
%WINDIR%\Cursors\carbon6 XP\C6XPS_8_unavailable.cur
%WINDIR%\Cursors\carbon6 XP\C6XPS_9_vertical.cur
%WINDIR%\Cursors\carbon6 XP\C6XPS_7_handwriting.cur
%WINDIR%\Cursors\carbon6 XP\C6XPS_5_precision.cur
%WINDIR%\Cursors\carbon6 XP\C6XPS_6_text.cur
%WINDIR%\Cursors\carbon6 XP\C6XPS_D_move.cur
%WINDIR%\Cursors\carbon6 XP\C6XPS_E_alternate.cur
%WINDIR%\Cursors\carbon6 XP\C6XPS_C_diagonal2.cur
%WINDIR%\Cursors\carbon6 XP\C6XPS_A_horizontal.cur
%WINDIR%\Cursors\carbon6 XP\C6XPS_B_diagonal1.cur
%WINDIR%\Cursors\dCursor\dc_Work2.cur
%WINDIR%\Cursors\ContrastBlack\Diagonal Resize 1.cur
%WINDIR%\Cursors\dCursor\dc_Work.cur
%WINDIR%\Cursors\dCursor\dc_Unav.cur
%WINDIR%\Cursors\dCursor\dc_Unav2.cur
%WINDIR%\Cursors\ContrastWhite\Diagonal Resize 2.cur
%WINDIR%\Cursors\Fedora\Diagonal Resize 2.cur
%WINDIR%\Cursors\ContrastBlack\Diagonal Resize 2.cur
%WINDIR%\Cursors\ContrastWhite\Diagonal Resize 1.cur
%WINDIR%\Cursors\Fedora\Diagonal Resize 1.cur
%WINDIR%\Cursors\dCursor\dc_Text.cur
%WINDIR%\Cursors\dCursor\dc_Move.cur
%WINDIR%\Cursors\dCursor\dc_Norm.cur
%WINDIR%\Cursors\dCursor\dc_Link2.cur
%WINDIR%\Cursors\dCursor\dc_Help2.cur
%WINDIR%\Cursors\dCursor\dc_Link.cur
%WINDIR%\Cursors\dCursor\dc_RH.cur
%WINDIR%\Cursors\dCursor\dc_RV.cur
%WINDIR%\Cursors\dCursor\dc_R2.cur
%WINDIR%\Cursors\dCursor\dc_Norm2.cur
%WINDIR%\Cursors\dCursor\dc_R1.cur

Sets the 'hidden' attribute to the following files:

%WINDIR%\wxo.txt
%WINDIR%\POWER.exe

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'EDIT' WindowName: '(null)'

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial