Trojan.DownLoader10.3531

Добавлен в вирусную базу Dr.Web: 2013-08-14

Описание добавлено: 2013-08-14

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1128 -dm 7 7 %TEMP%\WER4579.dir00\svchost.exe.mdmp 16325836412032456

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER4579.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'88.##.208.237':445
'88.##.188.64':445
'88.##.230.60':445
'88.##.73.139':445
'88.##.202.230':445
'88.##.87.225':445
'88.##.230.207':445
'88.##.231.217':445
'88.#8.66.62':445
'88.##.32.105':445
'88.#8.29.64':445
'88.##.114.212':445
'88.#8.7.203':445
'88.##.124.241':445
'88.##.121.13':445
'88.##.202.140':445
'88.#8.31.68':445
'88.##.151.152':445
'88.##.242.90':445
'88.##.173.126':445
'88.##.29.160':445
'88.##.129.13':445
'88.##.143.219':445
'88.##.208.195':445
'88.##.13.245':445
'88.##.159.22':445
'88.##.37.101':445
'88.##.104.68':445
'88.##.34.200':445
'88.##.123.229':445
'88.##.169.185':445
'88.##.208.27':445
'88.##.149.97':445
'88.##.15.174':445
'88.##.151.152':139
'88.##.242.90':139
'88.##.173.126':139
'88.##.29.160':139
'88.##.129.13':139
'88.##.143.219':139
'88.##.208.195':139
'88.##.13.245':139
'88.##.159.22':139
'88.##.37.101':139
'88.##.104.68':139
'88.##.34.200':139
'88.##.123.229':139
'88.##.169.185':139
'88.##.208.27':139
'88.##.149.97':139
'88.#8.64.10':139
'88.##.98.228':139
'88.##.34.133':139
'88.##.208.169':139
'88.#8.42.62':139
'88.##.155.18':139
'88.##.118.192':139
'88.##.110.220':139
'88.##.147.110':139
'88.#8.9.112':139
'88.##.197.225':139
'88.##.184.92':139
'88.##.106.213':139
'88.#8.0.187':139
'88.##.139.254':139
'88.##.161.238':139
'88.##.204.179':139
'88.#8.64.10':445
'88.##.230.43':139
'88.##.50.137':139
'88.#8.2.212':139
'88.##.91.156':139
'88.##.68.228':139
'88.#8.94.3':139
'88.##.215.24':139
'88.##.222.134':139
'88.##.197.104':139
'88.##.26.144':139
'88.##.52.207':139
'88.##.253.192':139
'88.##.180.24':139
'88.##.183.21':139
'88.#8.29.11':139
'88.##.80.133':139
'88.#8.35.23':139
'88.#8.4.66':139
'88.##.180.174':139
'88.##.221.30':139
'88.##.116.182':139
'88.##.166.147':139
'88.##.214.89':139
'88.##.117.130':139
'88.##.55.250':139
'88.#8.79.91':139
'88.##.38.134':139
'88.##.140.19':139
'88.#8.98.21':139
'88.##.201.144':139
'88.#8.39.3':139
'88.#8.93.39':139
'88.#8.149.4':139
'88.##.12.193':139
'88.##.98.228':445
'88.##.34.133':445
'88.##.208.169':445
'88.#8.42.62':445
'88.##.155.18':445
'88.##.118.192':445
'88.##.110.220':445
'88.##.147.110':445
'88.#8.9.112':445
'88.##.197.225':445
'88.##.184.92':445
'88.##.106.213':445
'88.#8.0.187':445
'88.##.139.254':445
'88.##.161.238':445
'88.##.204.179':445
'88.##.211.86':139
'88.##.234.118':139
'88.##.165.167':139
'88.#8.3.202':139
'88.#8.46.60':139
'88.##.12.148':139
'88.##.218.175':139
'88.##.34.165':139
'88.##.204.34':139
'88.##.158.83':139
'88.##.102.231':139
'88.##.117.62':139
'88.##.157.113':139
'88.##.212.189':139
'88.##.255.211':139
'88.##.27.166':139
'88.##.190.107':139
'88.##.248.73':139
'88.##.87.147':139
'88.##.211.158':139
'88.##.21.211':139
'88.#8.16.55':139
'88.##.198.208':139
'88.##.212.219':139
'88.#8.61.60':139
'88.##.23.102':139
'88.##.158.102':139
'88.##.123.84':139
'88.#8.8.237':139
'88.##.174.26':139
'88.##.109.82':139
'88.##.219.245':139
'88.#8.98.99':139
'88.#8.241.0':139
'88.##.46.254':445
'88.##.136.139':445
'88.##.253.169':445
'88.##.254.58':445
'88.##.101.65':445
'88.##.226.56':445
'88.#8.42.51':445
'88.##.225.227':445
'88.#8.34.32':445
'88.##.197.60':445
'88.##.186.246':445
'88.##.112.188':445
'88.##.190.139':445
'88.#8.24.37':445
'88.#8.76.79':445
'88.#8.51.0':445
'88.##.244.53':139
'88.##.46.254':139
'88.##.136.139':139
'88.##.253.169':139
'88.##.254.58':139
'88.##.101.65':139
'88.##.226.56':139
'88.#8.42.51':139
'88.##.225.227':139
'88.##.186.246':139
'88.##.197.60':139
'88.#8.76.79':139
'88.#8.34.32':139
'88.##.190.139':139
'88.#8.24.37':139
'88.##.112.188':139
'88.#8.51.0':139
'88.#8.89.79':139
'88.##.152.143':139
'88.##.116.238':139
'88.##.141.75':139
'88.##.88.141':139
'88.#8.13.9':139
'88.##.189.230':139
'88.##.91.181':139
'88.#8.1.184':139
'88.##.253.113':139
'88.#8.77.21':139
'88.#8.42.11':139
'88.##.17.147':139
'88.##.230.93':139
'88.#8.76.38':139
'88.##.175.195':139
'88.##.137.241':139
'88.#8.89.79':445
'88.##.189.230':9988
'88.##.88.141':9988
'88.##.226.56':9988
'88.##.186.246':9988
'88.#8.241.0':9988
'88.##.15.174':139
'88.##.225.227':9988
'88.#8.98.99':9988
'88.##.46.254':9988
'88.#8.24.37':9988
'88.#8.89.79':9988
'88.##.190.139':9988
'88.##.152.143':9988
'88.##.212.219':9988
'88.##.141.75':9988
'88.#8.34.32':9988
'88.#8.29.64':139
'88.##.188.64':139
'88.##.230.207':139
'88.##.73.139':139
'88.##.208.237':139
'88.##.87.225':139
'88.#8.31.68':139
'88.##.231.217':139
'88.##.202.230':139
'88.##.32.105':139
'88.##.121.13':139
'88.##.114.212':139
'88.#8.66.62':139
'88.##.124.241':139
'88.##.230.60':139
'88.##.202.140':139
'88.#8.7.203':139
'88.#8.241.0':445
'88.##.152.143':445
'88.##.116.238':445
'88.##.141.75':445
'88.##.88.141':445
'88.#8.13.9':445
'88.##.189.230':445
'88.##.91.181':445
'88.#8.1.184':445
'88.##.253.113':445
'88.#8.77.21':445
'88.#8.42.11':445
'88.##.17.147':445
'88.##.230.93':445
'88.#8.76.38':445
'88.##.175.195':445
'88.##.137.241':445
'88.##.244.53':445
'88.##.248.73':445
'88.##.87.147':445
'88.##.211.158':445
'88.##.21.211':445
'88.#8.16.55':445
'88.##.198.208':445
'88.##.212.219':445
'88.#8.61.60':445
'88.##.23.102':445
'88.##.158.102':445
'88.##.123.84':445
'88.#8.8.237':445
'88.##.174.26':445
'88.##.109.82':445
'88.##.219.245':445
'88.#8.98.99':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней