Trojan.DownLoader10.3494

Добавлен в вирусную базу Dr.Web: 2013-08-14

Описание добавлено: 2013-08-14

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1108 -dm 7 7 %TEMP%\WER44d1.dir00\svchost.exe.mdmp 16325836412032788

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER44d1.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'21#.#.169.102':139
'21#.#.243.27':139
'21#.#.104.225':139
'21#.#.189.49':139
'21#.#.155.101':139
'21#.#.218.77':139
'21#.6.6.50':139
'21#.#.13.132':139
'21#.#.91.134':139
'21#.#.165.227':139
'21#.6.124.8':139
'21#.#.168.56':139
'21#.#.187.239':139
'21#.6.109.2':139
'21#.#.169.170':139
'21#.6.1.110':445
'21#.#.242.33':445
'21#.#.134.63':445
'21#.#.200.166':445
'21#.#.48.190':445
'21#.#.164.109':445
'21#.6.45.91':445
'21#.#.251.13':139
'21#.#.136.208':139
'21#.#.208.75':139
'21#.6.39.21':139
'21#.#.30.222':445
'21#.#.184.70':445
'21#.#.70.141':445
'21#.#.196.72':139
'21#.#.247.95':139
'21#.#.196.130':139
'21#.#.106.146':139
'21#.#.136.193':139
'21#.#.138.194':139
'21#.6.57.59':139
'21#.6.1.110':139
'21#.#.242.33':139
'21#.#.134.63':139
'21#.#.200.166':139
'21#.#.48.190':139
'21#.#.164.109':139
'21#.6.45.91':139
'21#.6.191.1':139
'21#.#.226.131':139
'21#.#.132.100':139
'21#.#.100.244':139
'21#.6.15.5':139
'21#.#.202.194':139
'21#.#.249.50':139
'21#.#.59.233':139
'21#.#.161.51':139
'21#.#.141.132':139
'21#.#.132.155':139
'21#.#.162.118':139
'21#.#.165.239':139
'21#.#.31.161':139
'21#.#.224.162':139
'21#.#.196.130':445
'21#.#.251.13':445
'21#.#.136.208':445
'21#.#.208.75':445
'21#.6.39.21':445
'21#.6.42.5':139
'21#.#.249.120':139
'21#.#.121.109':139
'21#.#.189.49':445
'21#.#.169.102':445
'21#.#.243.27':445
'21#.6.6.50':445
'21#.#.169.170':445
'21#.#.155.101':445
'21#.#.218.77':445
'21#.#.224.144':139
'21#.#.52.209':139
'21#.6.71.12':139
'21#.#.157.114':139
'21#.6.30.50':139
'21#.6.107.9':139
'21#.#.123.161':139
'21#.#.194.74':139
'21#.#.106.131':139
'21#.#.72.248':139
'21#.#.143.224':139
'21#.6.36.9':139
'21#.#.139.137':139
'21#.#.179.105':139
'21#.#.105.35':139
'21#.#.161.51':445
'21#.#.141.132':445
'21#.#.132.155':445
'21#.#.162.118':445
'21#.#.165.239':445
'21#.#.31.161':445
'21#.#.224.162':445
'21#.#.106.146':445
'21#.#.196.72':445
'21#.#.247.95':445
'21#.6.57.59':445
'21#.6.191.1':445
'21#.#.136.193':445
'21#.#.138.194':445
'21#.#.100.244':445
'21#.6.124.8':445
'21#.#.13.132':445
'21#.#.91.134':445
'21#.6.109.2':445
'21#.#.104.225':445
'21#.#.168.56':445
'21#.#.187.239':445
'21#.6.15.5':445
'21#.#.226.131':445
'21#.#.132.100':445
'21#.#.59.233':445
'21#.#.165.227':445
'21#.#.202.194':445
'21#.#.249.50':445
'21#.#.30.222':139
'21#.#.32.195':139
'21#.#.195.174':139
'21#.#.91.201':139
'21#.#.205.32':139
'21#.#.216.185':139
'21#.#.88.117':139
'21#.#.225.204':139
'21#.#.148.140':139
'21#.#.140.19':139
'21#.#.19.148':139
'21#.#.125.83':139
'21#.#.48.134':139
'21#.#.210.114':139
'21#.#.38.142':139
'21#.#.248.73':139
'21#.#.25.111':445
'21#.#.125.84':445
'21#.#.13.234':445
'21#.#.152.79':445
'21#.#.234.128':445
'21#.#.160.174':445
'21#.#.174.90':445
'21#.#.128.221':139
'21#.#.104.122':139
'21#.#.122.248':139
'21#.6.39.63':139
'21#.#.141.227':139
'21#.#.198.92':139
'21#.6.3.13':139
'21#.#.45.219':139
'21#.#.218.231':139
'21#.#.232.35':139
'21#.#.138.133':139
'21#.#.62.103':139
'21#.6.7.132':139
'21#.#.122.225':139
'21#.#.25.111':139
'21#.#.152.79':139
'21#.#.125.84':139
'21#.#.13.234':139
'21#.#.234.128':139
'21#.#.160.174':139
'21#.#.174.90':139
'21#.#.180.227':139
'21#.#.21.218':139
'21#.#.56.241':139
'21#.#.21.165':139
'21#.#.88.174':139
'21#.#.148.45':139
'21#.#.127.243':139
'21#.6.26.51':139
'21#.#.14.153':139
'21#.#.23.127':139
'21#.#.63.185':139
'21#.#.107.247':139
'21#.6.79.78':139
'21#.#.33.118':139
'21#.#.125.11':139
'21#.#.232.35':445
'21#.#.128.221':445
'21#.#.104.122':445
'21#.#.122.248':445
'21#.6.39.63':445
'21#.#.141.227':445
'21#.#.198.92':445
'21#.6.3.13':445
'21#.#.205.32':445
'21#.#.32.195':445
'21#.#.195.174':445
'21#.#.225.204':445
'21#.#.248.73':445
'21#.#.216.185':445
'21#.#.88.117':445
'21#.#.152.79':9988
'21#.#.122.248':9988
'21#.#.205.32':9988
'21#.#.25.111':9988
'21#.#.128.221':9988
'21#.#.184.70':139
'21#.#.70.141':139
'21#.6.39.63':9988
'21#.#.174.90':9988
'21#.#.148.140':9988
'21#.#.45.219':9988
'21#.#.32.195':9988
'21#.#.127.243':9988
'21#.#.56.241':9988
'21#.#.225.204':9988
'21#.#.14.153':445
'21#.#.23.127':445
'21#.#.63.185':445
'21#.#.107.247':445
'21#.6.79.78':445
'21#.#.33.118':445
'21#.#.125.11':445
'21#.#.138.133':445
'21#.#.45.219':445
'21#.#.218.231':445
'21#.#.122.225':445
'21#.#.180.227':445
'21#.#.62.103':445
'21#.6.7.132':445
'21#.#.21.165':445
'21#.#.125.83':445
'21#.#.148.140':445
'21#.#.140.19':445
'21#.#.38.142':445
'21#.#.91.201':445
'21#.#.48.134':445
'21#.#.210.114':445
'21#.#.88.174':445
'21#.#.21.218':445
'21#.#.56.241':445
'21#.6.26.51':445
'21#.#.19.148':445
'21#.#.148.45':445
'21#.#.127.243':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней