Trojan.DownLoader10.3398

Добавлен в вирусную базу Dr.Web: 2013-08-14

Описание добавлено: 2013-08-14

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1128 -dm 7 7 %TEMP%\WER41dd.dir00\svchost.exe.mdmp 16325836412032848

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER41dd.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'12.##1.101.135':445
'12.##1.87.101':445
'12.##1.18.116':445
'12.##1.135.18':445
'12.#21.7.73':445
'12.##1.160.126':445
'12.##1.56.87':445
'12.##1.104.87':445
'12.##1.245.72':139
'12.##1.226.42':139
'12.##1.54.79':139
'12.##1.122.148':139
'12.##1.151.128':445
'12.##1.126.50':445
'12.##1.17.31':139
'12.##1.19.78':445
'12.##1.55.18':445
'12.##1.84.62':445
'12.##1.163.78':445
'12.##1.37.163':445
'12.##1.50.159':445
'12.##1.215.82':445
'12.##1.65.47':445
'12.##1.61.214':445
'12.##1.165.63':445
'12.##1.56.178':445
'12.##1.43.115':445
'12.##1.0.192':445
'12.##1.146.27':445
'12.##1.9.234':445
'12.##1.123.206':445
'12.#21.16.8':445
'12.##1.61.214':139
'12.##1.50.159':139
'12.##1.84.62':139
'12.##1.65.47':139
'12.##1.61.254':139
'12.##1.201.92':139
'12.##1.215.82':139
'12.##1.234.249':139
'12.#21.16.8':139
'12.##1.146.27':139
'12.##1.56.178':139
'12.##1.123.206':139
'12.##1.37.163':139
'12.##1.55.18':139
'12.##1.9.234':139
'12.##1.163.78':139
'12.##1.116.155':139
'12.##1.120.166':139
'12.##1.197.162':139
'12.##1.27.198':139
'12.##1.164.9':139
'12.##1.6.161':139
'12.##1.222.184':139
'12.##1.8.184':139
'12.##1.243.120':139
'12.##1.80.38':139
'12.##1.17.141':139
'12.##1.129.197':139
'12.##1.113.102':139
'12.##1.228.0':139
'12.##1.87.195':139
'12.##1.101.200':139
'12.##1.234.249':445
'12.#21.23.1':139
'12.##1.40.84':139
'12.##1.188.18':139
'12.##1.86.88':139
'12.##1.91.145':139
'12.##1.46.243':139
'12.##1.157.87':139
'12.##1.116.134':139
'12.##1.200.8':139
'12.#21.8.3':139
'12.##1.218.176':139
'12.##1.147.192':139
'12.##1.144.96':139
'12.##1.99.167':139
'12.##1.48.180':139
'12.##1.91.55':139
'12.##1.176.150':139
'12.##1.224.176':139
'12.##1.106.211':139
'12.##1.168.128':139
'12.#21.9.40':139
'12.##1.119.8':139
'12.##1.130.21':139
'12.##1.41.10':139
'12.##1.3.218':139
'12.##1.19.55':139
'12.##1.157.39':139
'12.##1.157.94':139
'12.##1.33.21':139
'12.##1.62.231':139
'12.##1.19.165':139
'12.##1.20.58':139
'12.##1.197.162':445
'12.##1.27.198':445
'12.##1.113.102':445
'12.##1.228.0':445
'12.##1.222.184':445
'12.##1.8.184':445
'12.##1.116.155':445
'12.##1.120.166':445
'12.##1.17.141':445
'12.##1.129.197':445
'12.##1.61.254':445
'12.##1.201.92':445
'12.##1.87.195':445
'12.##1.101.200':445
'12.##1.243.120':445
'12.##1.80.38':445
'12.##1.211.251':139
'12.##1.254.168':139
'12.##1.66.165':139
'12.##1.252.65':139
'12.#21.97.5':139
'12.##1.107.140':139
'12.##1.53.163':139
'12.##1.43.30':139
'12.##1.54.79':445
'12.##1.122.148':445
'12.##1.164.9':445
'12.##1.6.161':445
'12.##1.17.31':445
'12.##1.147.18':139
'12.##1.245.72':445
'12.##1.226.42':445
'12.##1.165.63':139
'12.##1.78.201':139
'12.##1.128.82':139
'12.##1.213.189':139
'12.##1.200.213':139
'12.##1.105.209':139
'12.##1.171.105':139
'12.##1.237.177':139
'12.##1.209.237':139
'12.##1.25.97':139
'12.##1.143.10':139
'12.##1.140.156':139
'12.##1.129.215':139
'12.#21.65.0':139
'12.##1.5.202':139
'12.##1.169.17':139
'12.##1.187.27':139
'12.##1.79.37':445
'12.##1.26.229':445
'12.##1.53.178':445
'12.##1.102.45':445
'12.##1.22.82':445
'12.##1.0.199':445
'12.##1.25.79':445
'12.##1.21.237':445
'12.##1.171.234':139
'12.##1.31.157':445
'12.##1.225.252':139
'12.##1.54.19':139
'12.##1.242.157':445
'12.##1.221.230':445
'12.##1.13.51':445
'12.##1.55.151':445
'12.##1.21.237':139
'12.##1.22.82':139
'12.##1.26.229':139
'12.##1.25.79':139
'12.##1.163.170':139
'12.##1.96.224':139
'12.##1.0.199':139
'12.##1.139.192':139
'12.##1.55.151':139
'12.##1.31.157':139
'12.##1.13.51':139
'12.##1.242.157':139
'12.##1.102.45':139
'12.##1.79.37':139
'12.##1.221.230':139
'12.##1.53.178':139
'12.##1.66.18':139
'12.##1.183.43':139
'12.##1.68.147':139
'12.##1.29.25':139
'12.##1.177.248':139
'12.##1.55.177':139
'12.##1.106.47':139
'12.##1.112.25':139
'12.##1.29.179':139
'12.##1.173.61':139
'12.#21.6.97':139
'12.#21.9.29':139
'12.##1.32.195':139
'12.##1.206.41':139
'12.##1.31.239':139
'12.#21.8.76':139
'12.##1.139.192':445
'12.##1.31.157':9988
'12.#21.65.0':9988
'12.##1.177.248':9988
'12.##1.96.224':9988
'12.##1.128.82':9988
'12.##1.237.177':9988
'12.##1.79.37':9988
'12.##1.173.61':9988
'12.##1.225.252':445
'12.##1.54.19':445
'12.##1.105.209':445
'12.##1.171.105':445
'12.##1.221.230':9988
'12.##1.31.239':9988
'12.##1.171.234':445
'12.##1.22.82':9988
'12.##1.56.87':139
'12.##1.104.87':139
'12.##1.101.135':139
'12.##1.87.101':139
'12.##1.43.115':139
'12.##1.0.192':139
'12.#21.7.73':139
'12.##1.160.126':139
'12.##1.54.19':9988
'12.##1.19.78':139
'12.##1.209.237':9988
'12.##1.105.209':9988
'12.##1.18.116':139
'12.##1.135.18':139
'12.##1.151.128':139
'12.##1.126.50':139
'12.##1.68.147':445
'12.##1.29.25':445
'12.##1.32.195':445
'12.##1.206.41':445
'12.##1.106.47':445
'12.##1.112.25':445
'12.##1.66.18':445
'12.##1.183.43':445
'12.#21.6.97':445
'12.#21.9.29':445
'12.##1.163.170':445
'12.##1.96.224':445
'12.##1.31.239':445
'12.#21.8.76':445
'12.##1.29.179':445
'12.##1.173.61':445
'12.##1.213.189':445
'12.##1.200.213':445
'12.#21.65.0':445
'12.##1.5.202':445
'12.##1.237.177':445
'12.##1.209.237':445
'12.##1.78.201':445
'12.##1.128.82':445
'12.##1.140.156':445
'12.##1.129.215':445
'12.##1.177.248':445
'12.##1.55.177':445
'12.##1.169.17':445
'12.##1.187.27':445
'12.##1.25.97':445
'12.##1.143.10':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней