Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SA.DAT
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WER98f0.dir00\svchost.exe.mdmp 16325836412032852
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %TEMP%\WER98f0.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- <SYSTEM32>\urdvxc.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
Самоудаляется.
Сетевая активность:
Подключается к:
- '83.#6.20.79':139
- '83.##.249.29':139
- '83.##.29.190':139
- '83.##.29.233':139
- '83.#6.30.54':139
- '83.#6.9.140':139
- '83.##.190.180':139
- '83.##.40.237':139
- '83.#6.46.78':139
- '83.##.103.15':139
- '83.##.15.145':139
- '83.##.217.45':139
- '83.#6.39.54':139
- '83.##.180.23':139
- '83.##.10.218':139
- '83.##.35.224':139
- '83.##.182.210':139
- '83.##.76.179':139
- '83.#6.9.252':139
- '83.#6.56.84':139
- '83.##.179.181':139
- '83.##.181.153':139
- '83.##.153.156':139
- '83.#6.39.51':139
- '83.##.105.75':139
- '83.##.106.45':139
- '83.#6.45.98':139
- '83.##.159.225':139
- '83.#6.53.65':139
- '83.#6.8.95':139
- '83.#6.95.81':139
- '83.#6.5.242':139
- '83.##.31.232':9988
- '83.##.67.218':9988
- '83.##.128.15':9988
- '83.##.150.137':9988
- '83.##.112.202':9988
- '83.##.177.137':9988
- '83.##.116.177':9988
- '83.##.231.220':9988
- '83.#6.41.15':9988
- '83.#6.25.19':9988
- '83.##.217.234':9988
- '83.#6.27.59':9988
- '83.##.221.25':9988
- '83.##.29.211':9988
- '83.##.151.31':9988
- '83.##.122.184':9988
- '83.##.116.110':139
- '83.##.233.52':139
- '83.##.21.125':9988
- '83.##.228.58':139
- '83.##.241.182':139
- '83.##.27.180':139
- '83.##.142.129':139
- '83.##.20.132':9988
- '83.#6.8.183':9988
- '83.##.115.44':9988
- '83.##.175.179':9988
- '83.##.117.192':9988
- '83.#6.4.241':9988
- '83.#6.4.251':9988
- '83.##.215.172':9988
- '83.##.237.47':139
- '83.#6.39.51':445
- '83.#6.53.65':445
- '83.#6.8.95':445
- '83.#6.9.252':445
- '83.#6.56.84':445
- '83.##.182.210':445
- '83.##.76.179':445
- '83.#6.95.81':445
- '83.##.35.224':445
- '83.#6.30.54':445
- '83.#6.9.140':445
- '83.#6.45.98':445
- '83.##.159.225':445
- '83.##.105.75':445
- '83.##.106.45':445
- '83.##.181.153':445
- '83.##.176.254':445
- '83.##.54.183':445
- '83.##.138.190':445
- '83.##.147.101':445
- '83.##.196.65':445
- '83.##.44.240':445
- '83.##.97.174':445
- '83.##.94.245':445
- '83.##.237.47':445
- '83.##.179.181':445
- '83.##.153.156':445
- '83.##.152.233':445
- '83.##.98.235':445
- '83.##.59.175':445
- '83.##.148.109':445
- '83.##.190.180':445
- '83.##.44.240':139
- '83.##.97.174':139
- '83.##.147.101':139
- '83.##.196.65':139
- '83.##.228.58':445
- '83.##.116.110':445
- '83.##.233.52':445
- '83.##.176.254':139
- '83.##.59.175':139
- '83.##.148.109':139
- '83.##.152.233':139
- '83.##.98.235':139
- '83.##.54.183':139
- '83.##.138.190':139
- '83.##.94.245':139
- '83.##.142.129':445
- '83.##.40.237':445
- '83.#6.39.54':445
- '83.##.180.23':445
- '83.##.29.190':445
- '83.##.29.233':445
- '83.#6.20.79':445
- '83.##.249.29':445
- '83.##.10.218':445
- '83.#6.5.242':445
- '83.##.241.182':445
- '83.##.27.180':445
- '83.##.15.145':445
- '83.##.217.45':445
- '83.#6.46.78':445
- '83.##.103.15':445
- '83.##.128.15':139
- '83.##.29.211':139
- '83.##.252.24':139
- '83.##.217.234':139
- '83.##.221.25':139
- '83.#6.27.59':139
- '83.##.67.218':139
- '83.#6.25.19':139
- '83.##.151.31':139
- '83.##.31.216':139
- '83.##.215.172':139
- '83.#6.41.15':139
- '83.##.42.249':139
- '83.##.209.114':139
- '83.##.115.44':139
- '83.##.231.220':139
- '83.##.116.177':445
- '83.##.177.137':445
- '83.##.112.202':445
- '83.##.188.116':445
- '83.##.243.121':445
- '83.##.145.88':445
- '83.##.87.188':445
- '83.#6.0.5':445
- '83.##.21.125':139
- '83.#6.4.251':139
- '83.##.31.232':139
- '83.##.150.137':445
- '83.##.45.233':445
- '83.##.227.150':445
- '83.#6.10.62':445
- '83.##.172.200':139
- '83.##.145.88':139
- '83.##.87.188':139
- '83.##.188.116':139
- '83.##.243.121':139
- '83.##.225.21':139
- '83.#6.4.166':139
- '83.##.126.115':139
- '83.##.116.177':139
- '83.#6.10.62':139
- '83.##.227.150':139
- '83.##.150.137':139
- '83.##.45.233':139
- '83.##.177.137':139
- '83.##.112.202':139
- '83.#6.0.5':139
- '83.##.127.81':139
- '83.##.185.94':139
- '83.#6.8.183':139
- '83.##.160.210':139
- '83.#6.4.241':139
- '83.##.20.132':139
- '83.##.168.151':139
- '83.##.117.192':139
- '83.##.197.38':139
- '83.##.175.179':139
- '83.##.57.220':139
- '83.##.29.173':139
- '83.##.122.184':139
- '83.##.224.80':139
- '83.##.129.186':139
- '83.##.39.122':139
- '83.##.126.115':445
- '83.#6.4.166':9988
- '83.##.172.200':9988
- '83.##.227.150':9988
- '83.#6.0.5':9988
- '83.##.126.115':9988
- '83.##.145.88':9988
- '83.##.42.249':9988
- '83.##.129.186':9988
- '83.##.231.220':445
- '83.##.221.25':445
- '83.#6.27.59':445
- '83.##.31.232':445
- '83.##.224.80':9988
- '83.##.21.125':445
- '83.#6.4.251':445
- '83.##.39.122':9988
- '83.##.197.38':9988
- '83.#6.10.62':9988
- '83.##.29.173':9988
- '83.##.57.220':9988
- '83.##.252.24':9988
- '83.##.209.114':9988
- '83.##.31.216':9988
- '83.##.45.233':9988
- '83.##.243.121':9988
- '83.##.225.21':9988
- '83.##.188.116':9988
- '83.##.185.94':9988
- '83.##.127.81':9988
- '83.##.160.210':9988
- '83.##.87.188':9988
- '83.##.67.218':445
- '83.##.197.38':445
- '83.##.224.80':445
- '83.##.129.186':445
- '83.##.160.210':445
- '83.#6.4.241':445
- '83.##.185.94':445
- '83.#6.8.183':445
- '83.##.39.122':445
- '83.##.127.81':445
- '83.##.225.21':445
- '83.#6.4.166':445
- '83.##.29.173':445
- '83.##.122.184':445
- '83.##.175.179':445
- '83.##.57.220':445
- '83.##.117.192':445
- '83.#6.25.19':445
- '83.##.42.249':445
- '83.##.209.114':445
- '83.##.252.24':445
- '83.##.217.234':445
- '83.##.128.15':445
- '83.##.29.211':445
- '83.##.115.44':445
- '83.##.172.200':445
- '83.##.20.132':445
- '83.##.168.151':445
- '83.##.215.172':445
- '83.#6.41.15':445
- '83.##.151.31':445
- '83.##.31.216':445
