Trojan.DownLoader9.58309

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER58bb.dir00\svchost.exe.mdmp 16325836412032820

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%TEMP%\WER58bb.dir00\svchost.exe.mdmp
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'19#.#28.56.63':139
'19#.#28.252.175':139
'19#.#28.49.219':139
'19#.#28.66.237':139
'19#.#28.46.41':139
'19#.#28.229.90':139
'19#.#28.59.218':445
'19#.#28.88.74':139
'19#.#28.175.69':139
'19#.#28.70.94':139
'19#.#28.28.205':139
'19#.#28.70.94':445
'19#.#28.229.90':445
'19#.#28.49.219':445
'19#.#28.175.69':445
'19#.#28.252.175':445
'19#.#28.67.77':139
'19#.#28.30.151':139
'19#.#28.82.162':139
'19#.#28.8.134':139
'19#.#28.133.42':139
'19#.#28.120.247':445
'19#.#28.70.106':445
'19#.#28.196.5':445
'19#.#28.160.97':445
'19#.#28.249.64':445
'19#.#28.252.24':445
'19#.#28.25.99':445
'19#.#28.63.131':445
'19#.#28.34.182':445
'19#.#28.80.98':445
'19#.#28.21.118':445
'19#.#28.70.49':445
'19#.#28.199.201':445
'19#.#28.252.222':445
'19#.#28.13.156':445
'19#.#28.30.4':445
'19#.#28.12.21':445
'19#.#28.42.217':445
'19#.#28.17.49':445
'19#.#28.201.198':445
'19#.#28.199.17':445
'19#.#28.151.132':139
'19#.#28.33.140':139
'19#.#28.90.90':139
'19#.#28.138.33':139
'19#.#28.89.6':139
'19#.#28.56.190':139
'19#.#28.239.125':139
'19#.#28.166.160':139
'19#.#28.199.167':139
'19#.#28.242.25':139
'19#.#28.33.89':139
'19#.#28.172.215':139
'19#.#28.123.138':139
'19#.#28.148.67':139
'19#.#28.44.3':139
'19#.#28.48.84':139
'19#.#28.8.72':139
'19#.#28.89.126':139
'19#.#28.157.68':139
'19#.#28.126.79':139
'19#.#28.56.247':139
'19#.#28.133.42':445
'19#.#28.28.205':445
'19#.#28.8.134':445
'19#.#28.30.151':445
'19#.#28.67.77':445
'19#.#28.88.74':445
'19#.#28.56.63':445
'19#.#28.66.237':445
'19#.#28.82.162':445
'19#.#28.46.41':445
'19#.#28.211.110':139
'19#.#28.62.111':139
'19#.#28.14.136':139
'19#.#28.41.3':139
'19#.#28.36.63':139
'19#.#28.123.18':139
'19#.#28.8.161':139
'19#.#28.99.100':139
'19#.#28.231.181':139
'19#.#28.25.199':139
'19#.#28.221.136':139
'19#.#28.30.44':445
'19#.#28.80.253':445
'19#.#28.225.50':445
'19#.#28.5.249':445
'19#.#28.154.224':445
'19#.#28.78.83':445
'19#.#28.161.225':445
'19#.#28.210.113':445
'19#.#28.132.17':445
'19#.#28.247.126':445
'19#.#28.66.46':445
'19#.#28.12.184':139
'19#.#28.23.112':139
'19#.#28.62.109':139
'19#.#28.212.193':139
'19#.#28.85.10':139
'19#.#28.82.13':445
'19#.#28.20.11':445
'19#.#28.107.24':139
'19#.#28.28.166':139
'19#.#28.66.109':139
'19#.#28.78.83':139
'19#.#28.161.225':139
'19#.#28.70.247':139
'19#.#28.247.126':139
'19#.#28.210.113':139
'19#.#28.235.215':445
'19#.#28.10.77':445
'19#.#28.183.102':445
'19#.#28.238.235':445
'19#.#28.152.58':445
'19#.#28.80.253':139
'19#.#28.20.11':139
'19#.#28.66.46':139
'19#.#28.82.13':139
'19#.#28.70.247':445
'19#.#28.191.238':445
'19#.#28.30.44':139
'19#.#28.132.17':139
'19#.#28.225.50':139
'19#.#28.5.249':139
'19#.#28.154.224':139
'19#.#28.59.218':139
'19#.#28.13.156':139
'19#.#28.66.109':445
'19#.#28.23.112':445
'19#.#28.28.166':445
'19#.#28.199.201':139
'19#.#28.201.198':139
'19#.#28.70.49':139
'19#.#28.30.4':139
'19#.#28.252.222':139
'19#.#28.107.24':445
'19#.#28.167.46':445
'19#.#28.212.193':445
'19#.#28.66.145':445
'19#.#28.222.240':445
'19#.#28.80.0':445
'19#.#28.62.109':445
'19#.#28.12.184':445
'19#.#28.85.10':445
'19#.#28.70.241':445
'19#.#28.194.44':445
'19#.#28.25.99':139
'19#.#28.66.145':139
'19#.#28.252.24':139
'19#.#28.80.98':139
'19#.#28.63.131':139
'19#.#28.70.241':139
'19#.#28.194.44':139
'19#.#28.167.46':139
'19#.#28.222.240':139
'19#.#28.80.0':139
'19#.#28.196.5':139
'19#.#28.21.118':139
'19#.#28.42.217':139
'19#.#28.12.21':139
'19#.#28.199.17':139
'19#.#28.17.49':139
'19#.#28.160.97':139
'19#.#28.70.106':139
'19#.#28.249.64':139
'19#.#28.34.182':139
'19#.#28.120.247':139
'19#.#28.9.136':445
'19#.#28.147.127':445
'19#.#28.123.230':445
'19#.#28.222.57':445
'19#.#28.233.75':445
'19#.#28.127.240':445
'19#.#28.19.154':139
'19#.#28.63.82':445
'19#.#28.52.36':445
'19#.#28.243.223':445
'19#.#28.124.148':445
'19#.#28.174.102':445
'19#.#28.74.129':445
'19#.#28.156.17':445
'19#.#28.85.113':445
'19#.#28.71.113':445
'19#.#28.137.242':139
'19#.#28.40.26':445
'19#.#28.177.119':139
'19#.#28.62.54':445
'19#.#28.36.208':139
'19#.#28.71.113':139
'19#.#28.53.216':139
'19#.#28.174.102':139
'19#.#28.31.155':139
'19#.#28.226.53':139
'19#.#28.62.54':139
'19#.#28.74.129':139
'19#.#28.156.17':139
'19#.#28.14.6':139
'19#.#28.162.64':139
'19#.#28.138.224':139
'19#.#28.6.56':139
'19#.#28.164.180':139
'19#.#28.136.86':139
'19#.#28.101.182':139
'19#.#28.168.114':139
'19#.#28.71.190':139
'19#.#28.202.86':139
'19#.#28.76.101':139
'19#.#28.105.157':139
'19#.#28.65.163':139
'19#.#28.30.157':139
'19#.#28.7.248':139
'19#.#28.168.30':139
'19#.#28.125.170':139
'19#.#28.170.168':139
'19#.#28.59.236':139
'19#.#28.237.10':139
'19#.#28.107.109':139
'19#.#28.234.253':139
'19#.#28.253.218':139
'19#.#28.137.242':445
'19#.#28.107.109':445
'19#.#28.185.15':445
'19#.#28.253.218':445
'19#.#28.7.248':445
'19#.#28.234.253':445
'19#.#28.36.208':445
'19#.#28.177.119':445
'19#.#28.168.18':445
'19#.#28.59.236':445
'19#.#28.237.10':445
'19#.#28.202.86':445
'19#.#28.226.53':445
'19#.#28.127.34':445
'19#.#28.71.190':445
'19#.#28.105.157':445
'19#.#28.14.6':445
'19#.#28.31.155':445
'19#.#28.138.224':445
'19#.#28.53.216':445
'19#.#28.162.64':445
'19#.#28.168.18':139
'19#.#28.185.15':139
'19#.#28.168.114':445
'19#.#28.19.154':445
'19#.#28.6.56':445
'19#.#28.101.182':445
'19#.#28.49.108':445
'19#.#28.65.163':445
'19#.#28.164.180':445
'19#.#28.136.86':445
'19#.#28.76.101':445
'19#.#28.216.161':139
'19#.#28.138.33':445
'19#.#28.89.80':139
'19#.#28.8.72':445
'19#.#28.89.126':445
'19#.#28.90.90':445
'19#.#28.151.132':445
'19#.#28.89.6':445
'19#.#28.33.89':445
'19#.#28.162.51':139
'19#.#28.157.68':445
'19#.#28.123.138':445
'19#.#28.41.57':445
'19#.#28.48.84':445
'19#.#28.148.67':445
'19#.#28.82.9':445
'19#.#28.172.215':445
'19#.#28.116.219':139
'19#.#28.44.3':445
'19#.#28.56.247':445
'19#.#28.113.181':445
'19#.#28.99.100':445
'19#.#28.221.136':445
'19#.#28.25.199':445
'19#.#28.8.161':445
'19#.#28.231.181':445
'19#.#28.41.57':139
'19#.#28.113.181':139
'19#.#28.82.9':139
'19#.#28.211.110':445
'19#.#28.132.44':139
'19#.#28.14.136':445
'19#.#28.166.160':445
'19#.#28.41.3':445
'19#.#28.242.25':445
'19#.#28.199.167':445
'19#.#28.33.140':445
'19#.#28.62.111':445
'19#.#28.36.63':445
'19#.#28.123.18':445
'19#.#28.56.190':445
'19#.#28.239.125':445
'19#.#28.249.86':445
'19#.#28.57.72':445
'19#.#28.243.223':139
'19#.#28.127.240':139
'19#.#28.9.136':139
'19#.#28.157.182':445
'19#.#28.1.44':445
'19#.#28.114.74':445
'19#.#28.124.78':445
'19#.#28.55.29':445
'19#.#28.123.230':139
'19#.#28.40.26':139
'19#.#28.124.148':139
'19#.#28.49.108':139
'19#.#28.127.34':139
'19#.#28.85.113':139
'19#.#28.147.127':139
'19#.#28.63.82':139
'19#.#28.52.36':139
'19#.#28.222.57':139
'19#.#28.233.75':139
'19#.#28.9.27':139
'19#.#28.107.141':139
'19#.#28.157.182':139
'19#.#28.57.72':139
'19#.#28.44.96':139
'19#.#28.126.79':445
'19#.#28.132.44':445
'19#.#28.114.74':139
'19#.#28.141.137':139
'19#.#28.1.44':139
'19#.#28.55.29':139
'19#.#28.141.137':445
'19#.#28.44.96':445
'19#.#28.116.219':445
'19#.#28.107.141':445
'19#.#28.9.27':445
'19#.#28.249.86':139
'19#.#28.124.78':139
'19#.#28.162.51':445
'19#.#28.89.80':445
'19#.#28.216.161':445
'19#.#28.191.238':139
'19#.#28.96.249':9988
'19#.#28.6.177':9988
'19#.#28.136.121':9988
'19#.#28.172.15':9988
'19#.#28.11.133':9988
'19#.#28.49.152':9988
'19#.#28.60.144':9988
'19#.#28.163.246':9988
'19#.#28.130.83':9988
'19#.#28.68.70':9988
'19#.#28.62.44':9988
'19#.#28.167.136':9988
'19#.#28.137.9':9988
'19#.#28.40.18':9988
'19#.#28.253.110':9988
'19#.#28.144.50':9988
'19#.#28.77.95':9988
'19#.#28.185.137':9988
'19#.#28.131.122':9988
'19#.#28.18.83':9988
'19#.#28.95.60':9988
'19#.#28.59.105':445
'19#.#28.117.75':445
'19#.#28.237.22':445
'19#.#28.144.50':445
'19#.#28.131.122':445
'19#.#28.130.83':445
'19#.#28.167.136':445
'19#.#28.34.58':445
'19#.#28.225.12':445
'19#.#28.163.123':445
'19#.#28.43.248':445
'19#.#28.249.30':445
'19#.#28.101.253':445
'19#.#28.152.128':9988
'19#.#28.221.70':9988
'19#.#28.128.158':9988
'19#.#28.52.215':445
'19#.#28.55.107':445
'19#.#28.98.151':445
'19#.#28.6.177':445
'19#.#28.96.249':445
'19#.#28.136.139':445
'19#.#28.151.82':445
'19#.#28.117.29':445
'19#.#28.9.214':445
'19#.#28.20.181':445
'19#.#28.217.44':139
'19#.#28.163.85':139
'19#.#28.227.216':139
'19#.#28.12.241':139
'19#.#28.210.237':139
'19#.#28.60.6':445
'19#.#28.217.44':445
'19#.#28.227.216':445
'19#.#28.210.237':445
'19#.#28.152.75':139
'19#.#28.12.241':445
'19#.#28.136.217':445
'19#.#28.217.135':445
'19#.#28.16.39':445
'19#.#28.163.85':445
'19#.#28.76.240':445
'19#.#28.34.58':9988
'19#.#28.225.12':9988
'19#.#28.138.85':9988
'19#.#28.162.156':9988
'19#.#28.98.151':9988
'19#.#28.99.26':9988
'19#.#28.255.129':9988
'19#.#28.6.127':9988
'19#.#28.12.30':9988
'19#.#28.55.107':9988
'19#.#28.52.215':9988
'19#.#28.217.135':139
'19#.#28.117.29':139
'19#.#28.136.217':139
'19#.#28.76.240':139
'19#.#28.16.39':139
'19#.#28.136.139':139
'19#.#28.151.82':139
'19#.#28.9.214':139
'19#.#28.60.6':139
'19#.#28.20.181':139
'19#.#28.100.162':139
'19#.#28.188.142':139
'19#.#28.167.136':139
'19#.#28.233.100':139
'19#.#28.162.156':139
'19#.#28.130.83':139
'19#.#28.193.45':139
'19#.#28.225.12':139
'19#.#28.136.121':139
'19#.#28.255.129':139
'19#.#28.243.23':139
'19#.#28.117.75':139
'19#.#28.138.85':139
'19#.#28.144.50':139
'19#.#28.237.22':139
'19#.#28.98.151':139
'19#.#28.163.123':139
'19#.#28.11.133':139
'19#.#28.77.95':139
'19#.#28.34.58':139
'19#.#28.68.70':139
'19#.#28.232.25':139
'19#.#28.99.26':139
'19#.#28.128.158':139
'19#.#28.49.152':139
'19#.#28.152.128':139
'19#.#28.253.110':139
'19#.#28.221.70':139
'19#.#28.145.4':139
'19#.#28.172.15':139
'19#.#28.163.246':139
'19#.#28.62.44':139
'19#.#28.18.83':139
'19#.#28.12.30':139
'19#.#28.40.18':139
'19#.#28.60.144':139
'19#.#28.6.127':139
'19#.#28.75.18':139
'19#.#28.60.23':139
'19#.#28.95.60':139
'19#.#28.137.9':139
'19#.#28.185.137':139
'19#.#28.40.18':445
'19#.#28.18.83':445
'19#.#28.6.127':445
'19#.#28.193.45':445
'19#.#28.60.144':445
'19#.#28.62.44':445
'19#.#28.60.23':445
'19#.#28.185.137':445
'19#.#28.137.9':445
'19#.#28.12.30':445
'19#.#28.233.100':445
'19#.#28.188.142':445
'19#.#28.11.133':445
'19#.#28.255.129':445
'19#.#28.136.121':445
'19#.#28.138.85':445
'19#.#28.162.156':445
'19#.#28.100.162':445
'19#.#28.77.95':445
'19#.#28.68.70':445
'19#.#28.243.23':445
'19#.#28.6.177':139
'19#.#28.249.30':139
'19#.#28.96.249':139
'19#.#28.145.4':445
'19#.#28.101.253':139
'19#.#28.43.248':139
'19#.#28.59.105':139
'19#.#28.55.107':139
'19#.#28.52.215':139
'19#.#28.131.122':139
'19#.#28.221.70':445
'19#.#28.152.128':445
'19#.#28.128.158':445
'19#.#28.49.152':445
'19#.#28.95.60':445
'19#.#28.75.18':445
'19#.#28.163.246':445
'19#.#28.253.110':445
'19#.#28.172.15':445
'19#.#28.232.25':445
'19#.#28.99.26':445
'19#.#28.217.47':139
'19#.#28.29.248':139
'19#.#28.253.122':139
'19#.#28.42.126':139
'19#.#28.119.161':139
'19#.#28.136.209':139
'19#.#28.105.32':139
'19#.#28.198.89':139
'19#.#28.122.191':139
'19#.#28.191.57':139
'19#.#28.231.41':139
'19#.#28.202.77':139
'19#.#28.162.168':139
'19#.#28.249.202':139
'19#.#28.130.147':139
'19#.#28.146.249':139
'19#.#28.188.219':139
'19#.#28.219.230':139
'19#.#28.49.246':139
'19#.#28.203.177':139
'19#.#28.175.27':139
'19#.#28.98.80':445
'19#.#28.5.45':445
'19#.#28.48.189':445
'19#.#28.211.243':445
'19#.#28.224.35':445
'19#.#28.117.38':139
'19#.#28.60.228':139
'19#.#28.175.220':445
'19#.#28.192.4':445
'19#.#28.173.252':445
'19#.#28.178.186':445
'19#.#28.182.107':139
'19#.#28.117.38':445
'19#.#28.196.182':139
'19#.#28.105.207':139
'19#.#28.75.122':139
'19#.#28.83.226':445
'19#.#28.43.16':445
'19#.#28.21.130':445
'19#.#28.60.228':445
'19#.#28.64.194':445
'19#.#28.231.41':445
'19#.#28.253.122':445
'19#.#28.49.246':445
'19#.#28.203.177':445
'19#.#28.175.27':445
'19#.#28.219.230':445
'19#.#28.217.47':445
'19#.#28.119.161':445
'19#.#28.42.126':445
'19#.#28.188.219':445
'19#.#28.162.168':445
'19#.#28.217.112':445
'19#.#28.130.147':445
'19#.#28.249.202':445
'19#.#28.174.57':445
'19#.#28.100.33':445
'19#.#28.180.217':445
'19#.#28.202.77':445
'19#.#28.146.249':445
'19#.#28.113.130':445
'19#.#28.111.0':445
'19#.#28.235.215':139
'19#.#28.174.57':139
'19#.#28.10.77':139
'19#.#28.183.102':139
'19#.#28.152.58':139
'19#.#28.113.130':139
'19#.#28.217.112':139
'19#.#28.180.217':139
'19#.#28.100.33':139
'19#.#28.111.0':139
'19#.#28.238.235':139
'19#.#28.75.122':445
'19#.#28.196.182':445
'19#.#28.182.107':445
'19#.#28.29.248':445
'19#.#28.122.191':445
'19#.#28.198.89':445
'19#.#28.191.57':445
'19#.#28.136.209':445
'19#.#28.105.207':445
'19#.#28.105.32':445
'19#.#28.197.206':139
'19#.#28.69.194':139
'19#.#28.5.18':139
'19#.#28.178.172':139
'19#.#28.49.23':139
'19#.#28.30.56':139
'19#.#28.149.29':139
'19#.#28.231.52':139
'19#.#28.216.8':139
'19#.#28.134.66':139
'19#.#28.153.179':139
'19#.#28.171.152':445
'19#.#28.247.171':445
'19#.#28.85.135':445
'19#.#28.5.15':445
'19#.#28.111.194':445
'19#.#28.138.52':139
'19#.#28.228.180':139
'19#.#28.237.232':139
'19#.#28.155.8':445
'19#.#28.152.75':445
'19#.#28.111.194':139
'19#.#28.143.176':139
'19#.#28.5.15':139
'19#.#28.68.109':139
'19#.#28.160.167':139
'19#.#28.247.171':139
'19#.#28.171.152':139
'19#.#28.155.8':139
'19#.#28.243.71':139
'19#.#28.85.135':139
'19#.#28.187.191':139
'19#.#28.134.128':139
'19#.#28.142.195':139
'19#.#28.118.164':139
'19#.#28.249.68':139
'19#.#28.65.47':139
'19#.#28.79.134':139
'19#.#28.252.44':139
'19#.#28.10.64':139
'19#.#28.195.118':139
'19#.#28.184.157':139
'19#.#28.138.52':445
'19#.#28.228.180':445
'19#.#28.237.232':445
'19#.#28.173.252':139
'19#.#28.175.220':139
'19#.#28.5.18':445
'19#.#28.197.206':445
'19#.#28.49.23':445
'19#.#28.153.179':445
'19#.#28.178.172':445
'19#.#28.192.4':139
'19#.#28.178.186':139
'19#.#28.43.16':139
'19#.#28.21.130':139
'19#.#28.64.194':139
'19#.#28.83.226':139
'19#.#28.98.80':139
'19#.#28.5.45':139
'19#.#28.48.189':139
'19#.#28.211.243':139
'19#.#28.224.35':139
'19#.#28.10.64':445
'19#.#28.252.44':445
'19#.#28.79.134':445
'19#.#28.195.118':445
'19#.#28.184.157':445
'19#.#28.143.176':445
'19#.#28.243.71':445
'19#.#28.160.167':445
'19#.#28.187.191':445
'19#.#28.68.109':445
'19#.#28.65.47':445
'19#.#28.134.66':445
'19#.#28.30.56':445
'19#.#28.216.8':445
'19#.#28.231.52':445
'19#.#28.69.194':445
'19#.#28.249.68':445
'19#.#28.118.164':445
'19#.#28.142.195':445
'19#.#28.149.29':445
'19#.#28.134.128':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней