Trojan.MulDrop5.4945

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Tracks Eraser Pro' = '%PROGRAM_FILES%\Acesoft\Tracks Eraser Pro\te.exe min'

Malicious functions:

Creates and executes the following:

'<Current directory>\Data\te.exe'
'<Current directory>\Data\gora.exe'
'%TEMP%\tempT.exe'

Executes the following:

'%WINDIR%\regedit.exe' /s TEP.reg

Modifies file system :

Creates the following files:

<Current directory>\Data\Plugins\MS Office 97.te
<Current directory>\Data\Plugins\MS Office XP.te
<Current directory>\Data\Plugins\MS Paint.te
<Current directory>\Data\Plugins\MS Office 2003.te
<Current directory>\Data\Plugins\MS FrontPage XP.te
<Current directory>\Data\Plugins\MS Imaging.te
<Current directory>\Data\Plugins\MS Office 2000.te
<Current directory>\Data\Plugins\MS Photo Editor.te
<Current directory>\Data\Plugins\MS Publisher 2007.te
<Current directory>\Data\Plugins\MS Word 2000.te
<Current directory>\Data\Plugins\MS Word 2003.te
<Current directory>\Data\Plugins\MS PowerPoint XP.te
<Current directory>\Data\Plugins\MS PowerPoint 2000.te
<Current directory>\Data\Plugins\MS PowerPoint 2003.te
<Current directory>\Data\Plugins\MS PowerPoint 2007.te
<Current directory>\Data\Plugins\MS Access 2000.te
<Current directory>\Data\Plugins\MS Access 2003.te
<Current directory>\Data\Plugins\MS Access 2007.te
<Current directory>\Data\Plugins\Mozilla Mail.te
<Current directory>\Data\Plugins\Macromedia Flash MX.te
<Current directory>\Data\Plugins\Media Jukebox.te
<Current directory>\Data\Plugins\Morpheus.te
<Current directory>\Data\Plugins\MS Access XP.te
<Current directory>\Data\Plugins\MS FrontPage 2000.te
<Current directory>\Data\Plugins\MS FrontPage 2003.te
<Current directory>\Data\Plugins\MS FrontPage 2007.te
<Current directory>\Data\Plugins\MS Excel XP.te
<Current directory>\Data\Plugins\MS Excel 2000.te
<Current directory>\Data\Plugins\MS Excel 2003.te
<Current directory>\Data\Plugins\MS Excel 2007.te
<Current directory>\Data\Plugins\Windows Media Player.te
<Current directory>\Data\Plugins\WinRar 2.x.te
<Current directory>\Data\Plugins\WinRar 3.x.te
<Current directory>\Data\Plugins\Windows Log Files.te
<Current directory>\Data\Plugins\The Playe.te
<Current directory>\Data\Plugins\Thunderbird.te
<Current directory>\Data\Plugins\Winamp .te
<Current directory>\Data\Plugins\Winzip.te
<Current directory>\Data\te.url
<Current directory>\Data\logo.jpg
<Current directory>\Data\onlinehelp.url
<Current directory>\Data\Plugins\Word Pad.te
<Current directory>\Data\Plugins\Yahoo Toolbar.te
<Current directory>\Data\Plugins\Yahoo! Messenger.te
<Current directory>\Data\Plugins\MusicMatch Jukebox.te
<Current directory>\Data\Plugins\Netscape Mail.te
<Current directory>\Data\Plugins\PowerDVD.te
<Current directory>\Data\Plugins\MSN Tool Bar.te
<Current directory>\Data\Plugins\MS Word 2007.te
<Current directory>\Data\Plugins\MS Word XP.te
<Current directory>\Data\Plugins\MSN Messenger.te
<Current directory>\Data\Plugins\QuickTime.te
<Current directory>\Data\Plugins\Safari.te
<Current directory>\Data\Plugins\Skype 2.0.te
<Current directory>\Data\Plugins\SWiSH 2.0.te
<Current directory>\Data\Plugins\RealPlayer.te
<Current directory>\Data\Plugins\Ras Autodial.te
<Current directory>\Data\Plugins\Real Download 4.0.te
<Current directory>\Data\Plugins\RealOne.te
<Current directory>\Data\Plugins\Macromedia Firework MX.te
<Current directory>\Data\settings.dat
<Current directory>\Data\supportbrowser.dat
<Current directory>\Data\MSCOMCTL.OCX
<Current directory>\Data\browser.dat
<Current directory>\Data\help.chm
<Current directory>\Data\BossEnable.dat
<Current directory>\Data\bosskey.dat
<Current directory>\Data\msinet.ocx
<Current directory>\Data\Plugins\ACDsee 5.0.te
<Current directory>\Data\Plugins\ACDsee 6.0.te
<Current directory>\Data\Plugins\ACDsee 7.0.te
<Current directory>\Data\Plugins\ACDsee 4.0.te
<Current directory>\Data\TabCtl32.ocx
<Current directory>\Data\TEP.reg
<Current directory>\Data\Plugins\ACDSee 3.x.te
<Current directory>\Data\fileshred.ini
<Current directory>\Data\autocomp.exe
<Current directory>\Data\delautocomp.exe
<Current directory>\Data\syslog.txt
%TEMP%\aut1.tmp
%TEMP%\$$.tmp
<Current directory>\Data\License.txt
<Current directory>\Data\fileshred.exe
<Current directory>\Data\te.exe
<Current directory>\Data\Plugins\ThundbirdEraser.exe
<Current directory>\Data\oestore.dll
<Current directory>\Data\Plugins\remove_googletoolbar_for_firefox.exe
<Current directory>\Data\gora.exe
<Current directory>\Data\PluginMaker.exe
<Current directory>\Data\Plugins\quicktime65.exe
<Current directory>\Data\Plugins\Google Tool Bar.te
<Current directory>\Data\Plugins\Google Toolbar For Firefox.te
<Current directory>\Data\Plugins\Hotbar 3.0.te
<Current directory>\Data\Plugins\Google Deskbar.te
<Current directory>\Data\Plugins\FlashGet.te
<Current directory>\Data\Plugins\GetRight 4.x.te
<Current directory>\Data\Plugins\GO!ZLLA.te
<Current directory>\Data\Plugins\ICQ 5.te
<Current directory>\Data\Plugins\KaZaA.te
<Current directory>\Data\Plugins\Kodak Imaging.te
<Current directory>\Data\Plugins\Macromedia Dreamweaver MX.te
<Current directory>\Data\Plugins\IrfanView.te
<Current directory>\Data\Plugins\ICQ2000B.te
<Current directory>\Data\Plugins\ICQ2002a.te
<Current directory>\Data\Plugins\ICQ2003a.te
<Current directory>\Data\Plugins\Acrobat Reader 7.0.te
<Current directory>\Data\Plugins\Ad-aware 6.te
<Current directory>\Data\Plugins\Adobe Acrobat 5.0.te
<Current directory>\Data\Plugins\Acrobat Reader 6.0.te
<Current directory>\Data\Plugins\Acrobat Reader 3.x.te
<Current directory>\Data\Plugins\Acrobat Reader 4.x.te
<Current directory>\Data\Plugins\Acrobat Reader 5.te
<Current directory>\Data\Plugins\Agent NewsReader.te
<Current directory>\Data\Plugins\DLExpert v0.99.te
<Current directory>\Data\Plugins\Download Accelerator (DAP).te
<Current directory>\Data\Plugins\Ebay Toolbar.te
<Current directory>\Data\Plugins\Divx Player.te
<Current directory>\Data\Plugins\AOL Instant Messenger.te
<Current directory>\Data\Plugins\Comcast Toolbar.te
<Current directory>\Data\Plugins\CuteFTP 4.0 .te

Deletes the following files:

<Current directory>\Data\TEP.reg
%TEMP%\tempT.exe
%TEMP%\aut1.tmp

Moves the following files:

from %TEMP%\$$.tmp to %TEMP%\tempT.exe

Miscellaneous:

Searches for the following windows:

ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
ClassName: 'Indicator' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'EDIT' WindowName: '(null)'

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial