Trojan.DownLoader10.3505

Добавлен в вирусную базу Dr.Web: 2013-08-14

Описание добавлено: 2013-08-14

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER3e33.dir00\svchost.exe.mdmp 16325836412032668

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER3e33.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'80.##.88.136':445
'80.##.63.201':445
'80.#3.46.90':445
'80.##.52.198':445
'80.##.56.247':445
'80.##.135.71':445
'80.#3.94.45':445
'80.#3.70.29':445
'80.#3.36.46':445
'80.#3.86.35':445
'80.##.17.124':139
'80.#3.77.54':445
'80.##.100.73':445
'80.##.70.212':445
'80.#3.37.30':445
'80.##.188.48':445
'80.##.142.20':445
'80.##.60.142':445
'80.##.157.196':445
'80.##.20.158':445
'80.##.56.168':445
'80.##.118.26':445
'80.##.227.60':445
'80.#3.61.13':445
'80.##.253.34':445
'80.##.103.253':445
'80.##.125.105':445
'80.##.213.73':445
'80.#3.51.35':445
'80.##.61.145':445
'80.##.231.103':445
'80.##.48.231':445
'80.#3.61.13':139
'80.##.56.168':139
'80.##.60.142':139
'80.##.227.60':139
'80.##.102.92':139
'80.##.253.54':139
'80.##.118.26':139
'80.#3.248.9':139
'80.##.48.231':139
'80.#3.51.35':139
'80.##.103.253':139
'80.##.231.103':139
'80.##.20.158':139
'80.##.142.20':139
'80.##.61.145':139
'80.##.157.196':139
'80.#3.82.8':139
'80.##.181.226':139
'80.##.206.132':139
'80.##.157.67':139
'80.#3.41.36':139
'80.#3.29.31':139
'80.##.11.182':139
'80.#3.9.160':139
'80.##.17.138':139
'80.##.105.75':139
'80.##.84.218':139
'80.##.51.240':139
'80.##.143.133':139
'80.##.85.157':139
'80.##.126.104':139
'80.##.133.126':139
'80.#3.248.9':445
'80.##.84.172':139
'80.#3.99.85':139
'80.##.87.117':139
'80.##.61.114':139
'80.##.78.102':139
'80.#3.21.59':139
'80.##.118.98':139
'80.##.34.142':139
'80.##.248.107':139
'80.##.87.125':139
'80.##.37.189':139
'80.##.203.56':139
'80.#3.1.104':139
'80.##.93.125':139
'80.##.68.219':139
'80.##.41.189':139
'80.##.167.214':139
'80.##.142.232':139
'80.##.148.163':139
'80.##.56.129':139
'80.##.250.39':139
'80.##.248.51':139
'80.##.211.207':139
'80.##.189.120':139
'80.##.137.194':139
'80.##.43.147':139
'80.##.193.123':139
'80.##.152.252':139
'80.##.175.74':139
'80.##.219.175':139
'80.##.225.89':139
'80.##.117.141':139
'80.##.206.132':445
'80.##.157.67':445
'80.##.143.133':445
'80.##.85.157':445
'80.##.11.182':445
'80.#3.9.160':445
'80.#3.82.8':445
'80.##.181.226':445
'80.##.84.218':445
'80.##.51.240':445
'80.##.102.92':445
'80.##.253.54':445
'80.##.126.104':445
'80.##.133.126':445
'80.##.17.138':445
'80.##.105.75':445
'80.##.152.184':139
'80.#3.32.87':139
'80.#3.7.159':139
'80.##.234.182':139
'80.#3.15.51':139
'80.##.180.86':139
'80.##.244.205':139
'80.##.113.16':139
'80.##.17.124':445
'80.##.227.101':139
'80.#3.41.36':445
'80.#3.29.31':445
'80.##.205.197':139
'80.##.102.175':139
'80.##.223.197':139
'80.##.171.121':139
'80.#3.53.85':139
'80.##.137.173':139
'80.#3.189.9':139
'80.##.39.153':139
'80.#3.79.57':139
'80.##.130.166':139
'80.##.117.137':139
'80.##.129.117':139
'80.#3.92.87':139
'80.#3.20.33':139
'80.##.134.94':139
'80.##.114.134':139
'80.#3.44.75':139
'80.##.100.199':139
'80.##.195.195':139
'80.#3.20.18':139
'80.##.31.105':445
'80.#3.55.31':445
'80.#3.73.76':445
'80.##.11.243':445
'80.##.154.157':445
'80.##.13.155':445
'80.#3.11.14':445
'80.#3.62.65':445
'80.##.83.142':139
'80.##.147.33':445
'80.##.118.42':139
'80.#3.97.44':139
'80.##.49.147':445
'80.##.189.194':445
'80.#3.89.15':445
'80.#3.33.89':445
'80.#3.62.65':139
'80.##.154.157':139
'80.#3.55.31':139
'80.#3.11.14':139
'80.##.83.192':139
'80.#3.8.55':139
'80.##.13.155':139
'80.#3.83.13':139
'80.#3.89.15':139
'80.##.147.33':139
'80.#3.33.89':139
'80.##.49.147':139
'80.##.11.243':139
'80.##.31.105':139
'80.##.189.194':139
'80.#3.73.76':139
'80.#3.16.40':139
'80.##.168.52':139
'80.##.211.168':139
'80.#3.76.27':139
'80.##.248.216':139
'80.##.194.142':139
'80.##.10.153':139
'80.##.217.66':139
'80.##.82.108':139
'80.##.166.82':139
'80.##.163.16':139
'80.#3.17.63':139
'80.##.41.237':139
'80.##.168.104':139
'80.##.86.166':139
'80.#3.98.87':139
'80.#3.83.13':445
'80.##.163.16':9988
'80.#3.89.15':9988
'80.#3.8.55':9988
'80.##.13.155':9988
'80.#3.77.54':139
'80.#3.36.46':139
'80.##.195.195':9988
'80.##.189.194':9988
'80.##.130.166':445
'80.##.118.42':445
'80.#3.79.57':445
'80.#3.97.44':445
'80.##.147.33':9988
'80.#3.55.31':9988
'80.##.83.142':445
'80.#3.76.27':9988
'80.#3.70.29':139
'80.##.56.247':139
'80.##.63.201':139
'80.#3.94.45':139
'80.##.213.73':139
'80.##.253.34':139
'80.##.135.71':139
'80.##.125.105':139
'80.##.188.48':139
'80.##.100.73':139
'80.#3.86.35':139
'80.#3.37.30':139
'80.##.52.198':139
'80.##.88.136':139
'80.##.70.212':139
'80.#3.46.90':139
'80.##.211.168':445
'80.#3.76.27':445
'80.##.41.237':445
'80.##.168.104':445
'80.##.10.153':445
'80.##.217.66':445
'80.#3.16.40':445
'80.##.168.52':445
'80.##.163.16':445
'80.#3.17.63':445
'80.##.83.192':445
'80.#3.8.55':445
'80.##.86.166':445
'80.#3.98.87':445
'80.##.82.108':445
'80.##.166.82':445
'80.#3.189.9':445
'80.##.39.153':445
'80.#3.44.75':445
'80.##.100.199':445
'80.##.117.137':445
'80.##.129.117':445
'80.#3.53.85':445
'80.##.137.173':445
'80.##.134.94':445
'80.##.114.134':445
'80.##.248.216':445
'80.##.194.142':445
'80.##.195.195':445
'80.#3.20.18':445
'80.#3.92.87':445
'80.#3.20.33':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней