Trojan.DownLoader10.3498

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WERf46a.dir00\svchost.exe.mdmp 16325836412032792

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WERf46a.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'63.##0.97.182':445
'63.##0.142.70':445
'63.##0.184.4':445
'63.##0.27.28':445
'63.#10.3.73':445
'63.##0.211.251':139
'63.##0.252.199':139
'63.#10.8.18':445
'63.##0.116.142':445
'63.##0.67.116':445
'63.##0.186.33':445
'63.##0.154.172':445
'63.##0.129.244':445
'63.##0.211.50':445
'63.##0.23.142':445
'63.##0.31.21':445
'63.##0.141.155':445
'63.##0.131.195':445
'63.##0.217.154':445
'63.##0.222.217':445
'63.##0.96.32':139
'63.##0.164.105':139
'63.##0.107.177':139
'63.##0.178.207':139
'63.##0.189.241':139
'63.##0.182.84':139
'63.##0.101.96':139
'63.##0.40.134':139
'63.##0.139.167':139
'63.##0.254.51':139
'63.##0.44.80':139
'63.##0.184.181':139
'63.##0.63.94':139
'63.##0.43.48':139
'63.##0.94.213':139
'63.##0.234.249':139
'63.##0.162.175':139
'63.##0.142.93':139
'63.##0.31.202':139
'63.##0.93.142':139
'63.##0.149.83':445
'63.##0.8.149':445
'63.##0.128.12':445
'63.##0.209.176':445
'63.##0.100.196':445
'63.##0.69.163':445
'63.##0.225.161':445
'63.##0.141.145':445
'63.##0.164.8':445
'63.##0.106.161':445
'63.##0.142.70':139
'63.##0.116.142':139
'63.##0.97.182':139
'63.#10.3.73':139
'63.##0.184.4':139
'63.##0.115.147':445
'63.##0.36.115':445
'63.##0.66.118':445
'63.##0.67.116':139
'63.#10.8.18':139
'63.##0.147.39':445
'63.##0.9.240':445
'63.##0.172.110':445
'63.##0.94.187':445
'63.##0.127.57':445
'63.##0.50.91':445
'63.##0.143.14':445
'63.##0.251.7':445
'63.##0.19.53':445
'63.##0.85.59':445
'63.##0.100.120':445
'63.##0.145.89':445
'63.##0.121.31':445
'63.##0.95.159':445
'63.##0.31.95':445
'63.##0.107.221':445
'63.##0.186.246':445
'63.##0.12.210':445
'63.##0.168.237':445
'63.##0.55.111':445
'63.##0.63.80':445
'63.##0.128.47':445
'63.##0.13.229':445
'63.##0.101.96':445
'63.##0.10.199':445
'63.##0.57.162':445
'63.#10.62.9':445
'63.##0.23.239':445
'63.##0.20.176':445
'63.#10.3.20':445
'63.##0.107.177':445
'63.##0.96.32':445
'63.##0.189.241':445
'63.##0.162.175':445
'63.##0.178.207':445
'63.##0.40.134':445
'63.##0.182.84':445
'63.##0.254.51':445
'63.##0.164.105':445
'63.##0.139.167':445
'63.##0.38.249':445
'63.##0.54.242':445
'63.##0.129.123':445
'63.##0.59.188':445
'63.##0.123.30':445
'63.##0.221.135':445
'63.##0.7.109':445
'63.##0.135.248':445
'63.##0.57.131':445
'63.##0.248.161':445
'63.##0.109.191':445
'63.##0.198.24':445
'63.##0.34.147':445
'63.##0.30.39':445
'63.##0.219.234':445
'63.##0.46.94':445
'63.##0.246.197':445
'63.##0.118.65':445
'63.##0.103.173':445
'63.##0.65.12':445
'63.##0.198.24':139
'63.##0.103.173':139
'63.##0.109.191':139
'63.##0.219.234':139
'63.##0.34.147':139
'63.##0.246.197':139
'63.##0.59.188':139
'63.##0.46.94':139
'63.##0.65.12':139
'63.##0.118.65':139
'63.##0.128.47':139
'63.##0.20.176':139
'63.##0.63.80':139
'63.##0.10.199':139
'63.##0.13.229':139
'63.#10.62.9':139
'63.##0.30.39':139
'63.##0.57.162':139
'63.#10.3.20':139
'63.##0.23.239':139
'63.##0.63.94':445
'63.##0.44.80':445
'63.##0.94.213':445
'63.##0.252.199':445
'63.##0.43.48':445
'63.##0.142.93':445
'63.##0.234.249':445
'63.##0.93.142':445
'63.##0.184.181':445
'63.##0.31.202':445
'63.##0.54.242':139
'63.##0.57.131':139
'63.##0.38.249':139
'63.##0.123.30':139
'63.##0.129.123':139
'63.##0.7.109':139
'63.##0.211.251':445
'63.##0.221.135':139
'63.##0.248.161':139
'63.##0.135.248':139
'63.##0.197.78':445
'63.##0.49.235':445
'63.##0.78.16':445
'63.##0.124.81':139
'63.##0.17.30':445
'63.#10.4.41':445
'63.##0.219.133':445
'63.#10.87.1':445
'63.##0.47.10':445
'63.##0.12.97':445
'63.##0.144.138':139
'63.##0.84.166':139
'63.##0.168.103':139
'63.##0.23.179':139
'63.##0.233.139':139
'63.##0.54.186':139
'63.##0.81.146':139
'63.##0.49.29':139
'63.##0.128.143':139
'63.##0.199.127':139
'63.##0.22.104':445
'63.##0.88.51':445
'63.##0.103.187':445
'63.##0.247.180':445
'63.##0.187.229':445
'63.##0.21.193':445
'63.##0.46.104':445
'63.##0.148.205':445
'63.##0.26.158':445
'63.##0.140.128':445
'63.##0.19.107':445
'63.##0.133.189':445
'63.##0.156.139':445
'63.##0.95.90':445
'63.##0.115.0':445
'63.##0.44.207':445
'63.##0.28.226':445
'63.##0.49.152':445
'63.##0.225.105':445
'63.##0.152.225':445
'63.##0.133.189':139
'63.##0.225.105':139
'63.##0.19.107':139
'63.##0.115.0':139
'63.##0.156.139':139
'63.##0.28.226':139
'63.##0.247.180':139
'63.##0.44.207':139
'63.##0.152.225':139
'63.##0.49.152':139
'63.##0.49.235':139
'63.##0.197.78':139
'63.##0.47.10':139
'63.##0.78.16':139
'63.##0.17.30':139
'63.##0.219.133':139
'63.##0.95.90':139
'63.#10.4.41':139
'63.#10.87.1':139
'63.##0.12.97':139
'63.##0.25.176':139
'63.##0.100.36':139
'63.##0.29.160':139
'63.##0.208.141':139
'63.##0.29.219':139
'63.##0.20.92':139
'63.##0.195.19':139
'63.##0.109.177':139
'63.##0.115.109':139
'63.##0.57.117':139
'63.##0.88.51':139
'63.##0.26.158':139
'63.##0.22.104':139
'63.##0.187.229':139
'63.##0.103.187':139
'63.##0.46.104':139
'63.##0.141.46':139
'63.##0.21.193':139
'63.##0.140.128':139
'63.##0.148.205':139
'63.##0.145.89':139
'63.##0.168.237':139
'63.##0.100.120':139
'63.##0.31.95':139
'63.##0.121.31':139
'63.##0.186.246':139
'63.##0.94.187':139
'63.##0.107.221':139
'63.##0.55.111':139
'63.##0.12.210':139
'63.##0.8.149':139
'63.##0.164.8':139
'63.##0.149.83':139
'63.##0.100.196':139
'63.##0.128.12':139
'63.##0.225.161':139
'63.##0.95.159':139
'63.##0.69.163':139
'63.##0.106.161':139
'63.##0.141.145':139
'63.##0.154.172':139
'63.##0.217.154':139
'63.##0.186.33':139
'63.##0.23.142':139
'63.##0.129.244':139
'63.##0.141.155':139
'63.##0.27.28':139
'63.##0.31.21':139
'63.##0.222.217':139
'63.##0.131.195':139
'63.##0.9.240':139
'63.##0.19.53':139
'63.##0.147.39':139
'63.##0.127.57':139
'63.##0.172.110':139
'63.##0.143.14':139
'63.##0.211.50':139
'63.##0.50.91':139
'63.##0.85.59':139
'63.##0.251.7':139
'63.##0.168.103':445
'63.##0.144.138':445
'63.##0.233.139':445
'63.##0.195.19':445
'63.##0.23.179':445
'63.##0.49.29':445
'63.##0.54.186':445
'63.##0.199.127':445
'63.##0.84.166':445
'63.##0.128.143':445
'63.##0.29.160':445
'63.##0.25.176':445
'63.##0.29.219':445
'63.##0.141.46':445
'63.##0.208.141':445
'63.##0.109.177':445
'63.##0.20.92':445
'63.##0.57.117':445
'63.##0.100.36':445
'63.##0.115.109':445
'63.##0.19.107':9988
'63.##0.23.179':9988
'63.##0.49.152':9988
'63.##0.17.30':9988
'63.##0.12.97':9988
'63.##0.36.115':139
'63.##0.209.176':139
'63.##0.115.147':139
'63.#10.87.1':9988
'63.##0.66.118':139
'63.##0.152.225':9988
'63.##0.78.16':9988
'63.##0.103.187':9988
'63.##0.81.146':445
'63.##0.124.81':445
'63.##0.247.180':9988
'63.##0.21.193':9988
'63.##0.197.78':9988
'63.##0.115.109':9988
'63.##0.26.158':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней