Trojan.DownLoader10.2329

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1152 -dm 7 7 %TEMP%\WER2dc8.dir00\svchost.exe.mdmp 16325836412031908

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER2dc8.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'14.##1.74.141':139
'14.##1.114.121':139
'14.##1.103.16':139
'14.##1.218.111':445
'14.##1.85.157':139
'14.##1.218.111':139
'14.##1.85.157':445
'14.##1.126.200':139
'14.##1.10.19':139
'14.##1.212.122':139
'14.##1.251.229':139
'14.##1.92.92':139
'14.##1.62.132':139
'14.##1.7.251':139
'14.##1.255.43':445
'14.##1.22.11':445
'14.##1.28.86':445
'14.##1.33.97':445
'14.##1.173.144':445
'14.##1.213.185':445
'14.##1.210.195':445
'14.##1.134.148':445
'14.##1.234.109':445
'14.##1.249.113':445
'14.##1.157.136':445
'14.##1.86.34':445
'14.##1.183.135':445
'14.##1.136.186':445
'14.##1.20.84':139
'14.##1.55.140':139
'14.##1.90.67':139
'14.##1.83.240':139
'14.##1.103.50':139
'14.##1.63.101':139
'14.##1.239.204':139
'14.##1.68.149':139
'14.##1.48.156':139
'14.##1.91.164':139
'14.##1.98.219':139
'14.##1.195.53':139
'14.##1.51.208':139
'14.##1.52.237':139
'14.##1.123.232':139
'14.##1.155.142':139
'14.##1.214.191':139
'14.##1.232.124':139
'14.##1.149.212':139
'14.##1.236.23':139
'14.##1.37.217':139
'14.##1.126.223':139
'14.##1.33.238':139
'14.##1.156.78':139
'14.##1.86.86':139
'14.##1.61.169':139
'14.##1.229.31':139
'14.##1.71.42':139
'14.##1.134.148':139
'14.##1.234.109':139
'14.##1.249.113':139
'14.##1.157.136':139
'14.##1.28.86':139
'14.##1.183.135':139
'14.##1.136.186':139
'14.##1.29.150':445
'14.##1.132.166':445
'14.##1.204.14':445
'14.##1.114.66':445
'14.##1.80.192':445
'14.##1.213.107':445
'14.##1.238.87':445
'14.##1.214.170':139
'14.##1.96.43':139
'14.##1.164.135':139
'14.##1.163.164':139
'14.##1.55.37':139
'14.##1.202.54':139
'14.##1.186.201':139
'14.##1.255.43':139
'14.##1.22.11':139
'14.##1.86.34':139
'14.##1.33.97':139
'14.##1.173.144':139
'14.##1.213.185':139
'14.##1.210.195':139
'14.##1.198.208':445
'14.##1.110.76':445
'14.##1.37.130':445
'14.##1.112.250':445
'14.##1.80.72':445
'14.#41.3.80':445
'14.##1.188.86':445
'14.##1.214.170':445
'14.##1.164.135':445
'14.##1.96.43':445
'14.##1.163.164':445
'14.##1.55.37':445
'14.##1.202.54':445
'14.##1.186.201':445
'14.#41.44.1':445
'14.##1.91.134':445
'14.##1.138.176':445
'14.##1.63.32':445
'14.##1.66.130':445
'14.##1.40.52':445
'14.##1.248.119':445
'14.##1.145.251':445
'14.#41.19.6':445
'14.##1.58.149':445
'14.##1.54.238':445
'14.##1.157.227':445
'14.##1.57.157':445
'14.##1.180.199':445
'14.##1.206.6':139
'14.##1.27.165':139
'14.##1.33.231':139
'14.##1.0.221':139
'14.##1.177.39':139
'14.##1.28.81':139
'14.##1.71.195':139
'14.##1.35.228':139
'14.##1.237.21':139
'14.##1.22.12':139
'14.##1.130.1':139
'14.#41.66.8':139
'14.##1.191.127':139
'14.##1.88.64':139
'14.##1.50.226':139
'14.##1.212.10':139
'14.##1.143.156':445
'14.##1.212.10':445
'14.##1.143.156':139
'14.##1.186.21':445
'14.##1.109.102':445
'14.##1.45.10':445
'14.##1.172.16':139
'14.##1.244.184':139
'14.##1.59.162':139
'14.##1.219.59':139
'14.##1.12.151':139
'14.##1.23.149':139
'14.##1.59.228':139
'14.##1.117.82':139
'14.##1.105.166':139
'14.##1.3.106':139
'14.##1.157.50':139
'14.##1.58.56':139
'14.##1.41.162':139
'14.##1.47.68':139
'14.##1.15.240':139
'14.##1.210.38':139
'14.##1.75.151':139
'14.#41.0.46':139
'14.##1.41.75':139
'14.##1.136.5':139
'14.##1.66.119':139
'14.##1.155.87':139
'14.##1.141.82':139
'14.##1.215.36':139
'14.#41.0.72':139
'14.##1.193.8':139
'14.##1.227.138':139
'14.##1.19.103':139
'14.##1.58.213':139
'14.##1.191.195':139
'14.##1.12.117':139
'14.##1.212.229':139
'14.##1.6.150':139
'14.##1.180.54':139
'14.##1.136.200':139
'14.##1.10.19':445
'14.##1.212.122':445
'14.##1.149.212':445
'14.##1.126.200':445
'14.##1.62.132':445
'14.##1.7.251':445
'14.##1.251.229':445
'14.##1.155.142':445
'14.##1.214.191':445
'14.##1.61.169':445
'14.##1.123.232':445
'14.##1.236.23':445
'14.##1.37.217':445
'14.##1.232.124':445
'14.##1.116.8':139
'14.##1.102.116':139
'14.##1.21.102':139
'14.##1.78.202':139
'14.##1.83.126':139
'14.##1.122.12':139
'14.##1.219.80':139
'14.##1.114.121':445
'14.##1.103.16':445
'14.##1.92.92':445
'14.##1.74.141':445
'14.##1.186.21':139
'14.##1.109.102':139
'14.##1.45.10':139
'14.##1.48.156':445
'14.##1.91.164':445
'14.##1.206.6':445
'14.##1.68.149':445
'14.##1.51.208':445
'14.##1.52.237':445
'14.##1.98.219':445
'14.##1.116.8':445
'14.##1.102.116':445
'14.##1.21.102':445
'14.##1.78.202':445
'14.##1.83.126':445
'14.##1.122.12':445
'14.##1.219.80':445
'14.##1.33.238':445
'14.##1.156.78':445
'14.##1.103.50':445
'14.##1.126.223':445
'14.##1.229.31':445
'14.##1.71.42':445
'14.##1.86.86':445
'14.##1.55.140':445
'14.##1.90.67':445
'14.##1.195.53':445
'14.##1.20.84':445
'14.##1.63.101':445
'14.##1.239.204':445
'14.##1.83.240':445
'14.##1.37.130':139
'14.##1.249.53':445
'14.##1.59.225':445
'14.##1.150.35':445
'14.##1.136.112':445
'14.##1.151.35':445
'14.##1.213.241':445
'14.#41.84.6':445
'14.##1.237.143':445
'14.##1.84.53':445
'14.##1.158.146':445
'14.##1.68.241':445
'14.##1.87.188':445
'14.##1.204.103':445
'14.##1.19.98':445
'14.##1.128.196':445
'14.##1.71.239':445
'14.##1.222.129':445
'14.##1.81.90':445
'14.##1.236.105':445
'14.##1.74.164':445
'14.##1.228.48':445
'14.##1.186.112':445
'14.##1.32.206':445
'14.##1.19.92':445
'14.##1.232.188':445
'14.##1.108.199':445
'14.#41.5.86':445
'14.##1.31.116':445
'14.##1.203.141':9988
'14.##1.8.231':9988
'14.##1.243.173':139
'14.##1.56.233':445
'14.##1.249.49':445
'14.##1.44.29':445
'14.##1.88.216':445
'14.##1.11.26':139
'14.##1.247.116':139
'14.##1.104.247':139
'14.#41.2.61':139
'14.##1.218.27':139
'14.##1.51.226':139
'14.##1.3.131':139
'14.##1.35.114':445
'14.##1.188.170':445
'14.##1.244.161':445
'14.##1.70.69':445
'14.##1.196.118':445
'14.##1.14.70':445
'14.##1.167.142':445
'14.##1.156.188':445
'14.##1.45.249':445
'14.##1.8.251':445
'14.##1.144.176':445
'14.##1.240.24':445
'14.##1.224.160':445
'14.##1.11.161':445
'14.##1.19.92':139
'14.##1.151.35':139
'14.##1.213.241':139
'14.##1.32.206':139
'14.##1.31.116':139
'14.##1.232.188':139
'14.##1.186.112':139
'14.##1.150.35':139
'14.##1.87.188':139
'14.##1.204.103':139
'14.##1.59.225':139
'14.#41.84.6':139
'14.##1.136.112':139
'14.##1.249.53':139
'14.##1.81.90':139
'14.##1.71.239':139
'14.##1.195.196':139
'14.##1.53.212':139
'14.##1.8.231':139
'14.##1.203.141':139
'14.##1.80.29':139
'14.##1.108.199':139
'14.##1.236.105':139
'14.#41.5.86':139
'14.##1.128.196':139
'14.##1.74.164':139
'14.##1.222.129':139
'14.##1.228.48':139
'14.##1.8.251':139
'14.##1.249.49':139
'14.##1.88.216':139
'14.##1.45.249':139
'14.##1.11.161':139
'14.##1.144.176':139
'14.##1.156.188':139
'14.##1.80.29':445
'14.##1.53.212':445
'14.##1.195.196':445
'14.##1.8.231':445
'14.##1.44.29':139
'14.##1.56.233':139
'14.##1.203.141':445
'14.##1.158.146':139
'14.##1.196.118':139
'14.##1.14.70':139
'14.##1.84.53':139
'14.##1.19.98':139
'14.##1.68.241':139
'14.##1.237.143':139
'14.##1.244.161':139
'14.##1.240.24':139
'14.##1.224.160':139
'14.##1.188.170':139
'14.##1.167.142':139
'14.##1.70.69':139
'14.##1.35.114':139
'14.##1.239.55':139
'14.##1.53.19':445
'14.##1.189.13':445
'14.##1.212.158':445
'14.##1.13.92':445
'14.##1.192.138':445
'14.##1.40.196':445
'14.##1.44.142':445
'14.##1.238.128':139
'14.##1.192.238':139
'14.##1.238.128':445
'14.##1.128.0':445
'14.##1.64.212':445
'14.##1.18.33':445
'14.##1.0.226':445
'14.##1.51.73':445
'14.##1.104.51':445
'14.##1.138.104':445
'14.#41.35.5':445
'14.##1.252.145':445
'14.##1.33.15':445
'14.##1.175.252':445
'14.##1.101.208':445
'14.##1.47.211':445
'14.##1.69.186':445
'14.##1.0.237':445
'14.##1.57.95':445
'14.##1.39.133':445
'14.##1.246.39':445
'14.##1.54.238':139
'14.##1.145.251':139
'14.#41.19.6':139
'14.##1.180.199':139
'14.##1.138.176':139
'14.##1.157.227':139
'14.##1.57.157':139
'14.##1.112.250':139
'14.##1.198.208':139
'14.##1.110.76':139
'14.##1.188.86':139
'14.##1.58.149':139
'14.##1.80.72':139
'14.#41.3.80':139
'14.##1.114.66':139
'14.##1.29.150':139
'14.##1.132.166':139
'14.##1.238.87':139
'14.##1.192.238':445
'14.##1.80.192':139
'14.##1.213.107':139
'14.##1.63.32':139
'14.#41.44.1':139
'14.##1.91.134':139
'14.##1.248.119':139
'14.##1.204.14':139
'14.##1.66.130':139
'14.##1.40.52':139
'14.##1.57.95':139
'14.##1.39.133':139
'14.##1.246.39':139
'14.##1.138.104':139
'14.#41.35.5':139
'14.##1.51.73':139
'14.##1.104.51':139
'14.##1.192.138':139
'14.##1.40.196':139
'14.##1.44.142':139
'14.##1.69.186':139
'14.##1.0.237':139
'14.##1.101.208':139
'14.##1.47.211':139
'14.##1.84.253':139
'14.##1.57.68':139
'14.##1.34.225':139
'14.##1.93.198':139
'14.#41.85.4':139
'14.##1.65.69':139
'14.##1.180.10':139
'14.##1.252.145':139
'14.##1.33.15':139
'14.##1.175.252':139
'14.##1.210.143':139
'14.##1.59.181':139
'14.##1.12.57':139
'14.##1.193.47':139
'14.##1.65.69':445
'14.##1.180.10':445
'14.##1.93.198':445
'14.#41.85.4':445
'14.##1.247.116':445
'14.##1.104.247':445
'14.##1.239.55':445
'14.##1.12.57':445
'14.##1.193.47':445
'14.##1.210.143':445
'14.##1.59.181':445
'14.##1.84.253':445
'14.##1.57.68':445
'14.##1.34.225':445
'14.##1.64.212':139
'14.##1.18.33':139
'14.##1.0.226':139
'14.##1.212.158':139
'14.##1.13.92':139
'14.##1.53.19':139
'14.##1.189.13':139
'14.##1.3.131':445
'14.#41.2.61':445
'14.##1.11.26':445
'14.##1.51.226':445
'14.##1.128.0':139
'14.##1.243.173':445
'14.##1.218.27':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней