Trojan.Zadved.1668

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-ahmej.tmp\<File name>.tmp
%ProgramFiles(x86)%\ckdrive\is-077u9.tmp
%ProgramFiles(x86)%\ckdrive\is-39ob9.tmp
%ProgramFiles(x86)%\ckdrive\is-6i44t.tmp
%ProgramFiles(x86)%\ckdrive\is-i595m.tmp
%ProgramFiles(x86)%\ckdrive\is-5s2mt.tmp
%ProgramFiles(x86)%\ckdrive\is-gct1j.tmp
%ProgramFiles(x86)%\ckdrive\is-094up.tmp
%ProgramFiles(x86)%\ckdrive\is-pleds.tmp
%ProgramFiles(x86)%\ckdrive\is-kuucb.tmp
%ProgramFiles(x86)%\ckdrive\is-51jdm.tmp
%ProgramFiles(x86)%\ckdrive\is-2vj6j.tmp
%ProgramFiles(x86)%\ckdrive\is-bbn2e.tmp
%ProgramFiles(x86)%\ckdrive\is-94tdr.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ckdrive\ckdrive.lnk
%ProgramFiles(x86)%\ckdrive\is-op75p.tmp
%ProgramFiles(x86)%\ckdrive\is-89ajk.tmp
%ProgramFiles(x86)%\ckdrive\is-q5ium.tmp
%ProgramFiles(x86)%\ckdrive\is-hhk45.tmp
%ProgramFiles(x86)%\ckdrive\is-afnp3.tmp
%ProgramFiles(x86)%\ckdrive\is-d45ln.tmp
%ProgramFiles(x86)%\ckdrive\is-ibsm3.tmp
%ProgramFiles(x86)%\ckdrive\is-hbo71.tmp
%ProgramFiles(x86)%\ckdrive\is-8pg29.tmp
%ProgramFiles(x86)%\ckdrive\is-e3s0v.tmp
%ProgramFiles(x86)%\ckdrive\is-rrsvb.tmp
%TEMP%\is-8j5gm.tmp\_isetup\_iscrypt.dll
%TEMP%\is-8j5gm.tmp\_isetup\_isdecmp.dll
%TEMP%\is-8j5gm.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\ckdrive\is-fjsdk.tmp
%ProgramFiles(x86)%\ckdrive\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\ckdrive\is-rrsvb.tmp to %ProgramFiles(x86)%\ckdrive\unins000.exe
from %ProgramFiles(x86)%\ckdrive\is-6i44t.tmp to %ProgramFiles(x86)%\ckdrive\closeapp.exe
from %ProgramFiles(x86)%\ckdrive\is-i595m.tmp to %ProgramFiles(x86)%\ckdrive\xdmessaging.transport.iostream.dll
from %ProgramFiles(x86)%\ckdrive\is-5s2mt.tmp to %ProgramFiles(x86)%\ckdrive\xdmessaging.dll
from %ProgramFiles(x86)%\ckdrive\is-gct1j.tmp to %ProgramFiles(x86)%\ckdrive\xceed.wpf.toolkit.dll
from %ProgramFiles(x86)%\ckdrive\is-094up.tmp to %ProgramFiles(x86)%\ckdrive\xceed.wpf.avalondock.themes.vs2010.dll
from %ProgramFiles(x86)%\ckdrive\is-pleds.tmp to %ProgramFiles(x86)%\ckdrive\xceed.wpf.avalondock.themes.metro.dll
from %ProgramFiles(x86)%\ckdrive\is-kuucb.tmp to %ProgramFiles(x86)%\ckdrive\xceed.wpf.avalondock.themes.aero.dll
from %ProgramFiles(x86)%\ckdrive\is-51jdm.tmp to %ProgramFiles(x86)%\ckdrive\xceed.wpf.avalondock.dll
from %ProgramFiles(x86)%\ckdrive\is-2vj6j.tmp to %ProgramFiles(x86)%\ckdrive\system.net.http.webrequest.dll
from %ProgramFiles(x86)%\ckdrive\is-bbn2e.tmp to %ProgramFiles(x86)%\ckdrive\system.net.http.dll
from %ProgramFiles(x86)%\ckdrive\is-39ob9.tmp to %ProgramFiles(x86)%\ckdrive\sqlite3.dll
from %ProgramFiles(x86)%\ckdrive\is-94tdr.tmp to %ProgramFiles(x86)%\ckdrive\newtonsoft.json.dll
from %ProgramFiles(x86)%\ckdrive\is-fjsdk.tmp to %ProgramFiles(x86)%\ckdrive\log4net.dll
from %ProgramFiles(x86)%\ckdrive\is-89ajk.tmp to %ProgramFiles(x86)%\ckdrive\icsharpcode.sharpziplib.dll
from %ProgramFiles(x86)%\ckdrive\is-q5ium.tmp to %ProgramFiles(x86)%\ckdrive\hardcodet.wpf.taskbarnotification.dll
from %ProgramFiles(x86)%\ckdrive\is-hhk45.tmp to %ProgramFiles(x86)%\ckdrive\devicenotificationservice.dll
from %ProgramFiles(x86)%\ckdrive\is-afnp3.tmp to %ProgramFiles(x86)%\ckdrive\devexpress.xtrascheduler.v11.1.dll
from %ProgramFiles(x86)%\ckdrive\is-d45ln.tmp to %ProgramFiles(x86)%\ckdrive\devexpress.xtrascheduler.v11.1.core.dll
from %ProgramFiles(x86)%\ckdrive\is-ibsm3.tmp to %ProgramFiles(x86)%\ckdrive\devexpress.xtraeditors.v11.1.dll
from %ProgramFiles(x86)%\ckdrive\is-hbo71.tmp to %ProgramFiles(x86)%\ckdrive\devexpress.utils.v11.1.dll
from %ProgramFiles(x86)%\ckdrive\is-8pg29.tmp to %ProgramFiles(x86)%\ckdrive\devexpress.printing.v11.1.core.dll
from %ProgramFiles(x86)%\ckdrive\is-e3s0v.tmp to %ProgramFiles(x86)%\ckdrive\devexpress.data.v11.1.dll
from %ProgramFiles(x86)%\ckdrive\is-op75p.tmp to %ProgramFiles(x86)%\ckdrive\microsoft.win32.taskscheduler.dll
from %ProgramFiles(x86)%\ckdrive\is-077u9.tmp to %ProgramFiles(x86)%\ckdrive\checkdrive.exe