Trojan.DownLoader36.11211

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-jrn6c.tmp\<File name>.tmp
%ProgramFiles(x86)%\adwis copy\skins\0\is-lgtht.tmp
%ProgramFiles(x86)%\adwis copy\is-j5ufu.tmp
%ProgramFiles(x86)%\adwis copy\is-fr28a.tmp
%ProgramFiles(x86)%\adwis copy\is-eaode.tmp
%ProgramFiles(x86)%\adwis copy\is-lavvd.tmp
%ProgramFiles(x86)%\adwis copy\is-m59id.tmp
%ProgramFiles(x86)%\adwis copy\skins\0\is-csq77.tmp
%ProgramFiles(x86)%\adwis copy\is-07kfp.tmp
%ProgramFiles(x86)%\adwis copy\is-hi609.tmp
%WINDIR%\is-ke35s.tmp
%ProgramFiles(x86)%\adwis copy\help\is-7qts1.tmp
%ProgramFiles(x86)%\adwis copy\is-93ne1.tmp
%WINDIR%\syswow64\is-s63oa.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\adwis copy\adwis copy.lnk
%ProgramFiles(x86)%\adwis copy\skins\0\is-tbmbr.tmp
%ProgramFiles(x86)%\adwis copy\skins\0\is-67785.tmp
%ProgramFiles(x86)%\adwis copy\skins\0\is-35svk.tmp
%ProgramFiles(x86)%\adwis copy\skins\0\is-u6lo1.tmp
%ProgramFiles(x86)%\adwis copy\skins\0\is-gh2t5.tmp
%TEMP%\is-kp46n.tmp\_isetup\_setup64.tmp
%TEMP%\is-kp46n.tmp\_isetup\_shfoldr.dll
%TEMP%\is-kp46n.tmp\_isetup\_isdecmp.dll
%TEMP%\is-kp46n.tmp\_isetup\_iscrypt.dll
%ProgramFiles(x86)%\adwis copy\is-j5kuq.tmp
%ProgramFiles(x86)%\adwis copy\language\is-a9kkf.tmp
%ProgramFiles(x86)%\adwis copy\windvdcopy.url
%ProgramFiles(x86)%\adwis copy\is-djppq.tmp
%ProgramFiles(x86)%\adwis copy\skins\0\is-mtmj2.tmp
%ProgramFiles(x86)%\adwis copy\skins\0\is-1okul.tmp
%ProgramFiles(x86)%\adwis copy\skins\0\is-5m90v.tmp
%ProgramFiles(x86)%\adwis copy\skins\0\is-hmajp.tmp
%ProgramFiles(x86)%\adwis copy\skins\0\is-01cm2.tmp
%ProgramFiles(x86)%\adwis copy\skins\0\is-5r1mp.tmp
%ProgramFiles(x86)%\adwis copy\skins\0\is-d484l.tmp
%TEMP%\is-kp46n.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\adwis copy\skins\0\is-m1lk8.tmp
%ProgramFiles(x86)%\adwis copy\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\adwis copy\is-j5kuq.tmp to %ProgramFiles(x86)%\adwis copy\unins000.exe
from %ProgramFiles(x86)%\adwis copy\help\is-7qts1.tmp to %ProgramFiles(x86)%\adwis copy\help\winavi dvd copy help.chm
from %WINDIR%\is-ke35s.tmp to %WINDIR%\windvdbootrecdoe.sys
from %ProgramFiles(x86)%\adwis copy\is-hi609.tmp to %ProgramFiles(x86)%\adwis copy\readme.txt
from %ProgramFiles(x86)%\adwis copy\is-djppq.tmp to %ProgramFiles(x86)%\adwis copy\videoburn.dll
from %ProgramFiles(x86)%\adwis copy\is-07kfp.tmp to %ProgramFiles(x86)%\adwis copy\fileio.dll
from %ProgramFiles(x86)%\adwis copy\is-m59id.tmp to %ProgramFiles(x86)%\adwis copy\aspi.dll
from %ProgramFiles(x86)%\adwis copy\is-lavvd.tmp to %ProgramFiles(x86)%\adwis copy\dvdcopy.dll
from %ProgramFiles(x86)%\adwis copy\is-eaode.tmp to %ProgramFiles(x86)%\adwis copy\core.dll
from %ProgramFiles(x86)%\adwis copy\is-fr28a.tmp to %ProgramFiles(x86)%\adwis copy\dvd2one.dll
from %ProgramFiles(x86)%\adwis copy\is-j5ufu.tmp to %ProgramFiles(x86)%\adwis copy\mpeg2videotranslator.dll
from %ProgramFiles(x86)%\adwis copy\skins\0\is-lgtht.tmp to %ProgramFiles(x86)%\adwis copy\skins\0\animation.gif
from %ProgramFiles(x86)%\adwis copy\skins\0\is-67785.tmp to %ProgramFiles(x86)%\adwis copy\skins\0\copynow.bmp
from %ProgramFiles(x86)%\adwis copy\is-93ne1.tmp to %ProgramFiles(x86)%\adwis copy\adwiscopy.exe
from %ProgramFiles(x86)%\adwis copy\skins\0\is-tbmbr.tmp to %ProgramFiles(x86)%\adwis copy\skins\0\setting.bmp
from %ProgramFiles(x86)%\adwis copy\skins\0\is-u6lo1.tmp to %ProgramFiles(x86)%\adwis copy\skins\0\down.bmp
from %ProgramFiles(x86)%\adwis copy\skins\0\is-gh2t5.tmp to %ProgramFiles(x86)%\adwis copy\skins\0\wizard.bmp
from %ProgramFiles(x86)%\adwis copy\skins\0\is-d484l.tmp to %ProgramFiles(x86)%\adwis copy\skins\0\splash.bmp
from %ProgramFiles(x86)%\adwis copy\skins\0\is-5r1mp.tmp to %ProgramFiles(x86)%\adwis copy\skins\0\min.bmp
from %ProgramFiles(x86)%\adwis copy\skins\0\is-01cm2.tmp to %ProgramFiles(x86)%\adwis copy\skins\0\menu.bmp
from %ProgramFiles(x86)%\adwis copy\skins\0\is-hmajp.tmp to %ProgramFiles(x86)%\adwis copy\skins\0\help.bmp
from %ProgramFiles(x86)%\adwis copy\skins\0\is-5m90v.tmp to %ProgramFiles(x86)%\adwis copy\skins\0\close.bmp
from %ProgramFiles(x86)%\adwis copy\skins\0\is-1okul.tmp to %ProgramFiles(x86)%\adwis copy\skins\0\web.bmp
from %ProgramFiles(x86)%\adwis copy\skins\0\is-m1lk8.tmp to %ProgramFiles(x86)%\adwis copy\skins\0\buynow.bmp
from %ProgramFiles(x86)%\adwis copy\skins\0\is-csq77.tmp to %ProgramFiles(x86)%\adwis copy\skins\0\background.bmp
from %ProgramFiles(x86)%\adwis copy\skins\0\is-mtmj2.tmp to %ProgramFiles(x86)%\adwis copy\skins\0\skin.ini
from %ProgramFiles(x86)%\adwis copy\language\is-a9kkf.tmp to %ProgramFiles(x86)%\adwis copy\language\english.ini
from %ProgramFiles(x86)%\adwis copy\skins\0\is-35svk.tmp to %ProgramFiles(x86)%\adwis copy\skins\0\select.bmp
from %WINDIR%\syswow64\is-s63oa.tmp to %WINDIR%\syswow64\sqlite3.dll