Trojan.Starman.4920

Trojan.Starman.4920

Добавлен в вирусную базу Dr.Web: 2014-06-21

Описание добавлено: 2014-06-22

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1124 -dm 7 7 %TEMP%\WER2e29.dir00\svchost.exe.mdmp 16325836412031996

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER2e29.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Сетевая активность:

Подключается к:

'61.##.99.209':445
'61.##.66.215':445
'61.##.226.211':445
'61.##.242.112':445
'61.##.97.145':445
'61.##.145.28':445
'61.##.183.129':445
'61.#4.32.35':445
'61.##.170.91':445
'61.#4.30.45':445
'61.##.97.174':445
'61.##.113.206':445
'61.#4.45.20':445
'61.#4.5.42':445
'61.#4.51.59':445
'61.##.221.116':445
'61.##.21.245':445
'61.##.133.204':139
'61.##.204.223':139
'61.##.160.167':139
'61.##.134.139':139
'61.##.244.161':139
'61.#4.17.3':139
'61.#4.43.80':139
'61.##.141.252':139
'61.##.139.11':139
'61.#4.157.6':445
'61.##.114.106':445
'61.##.234.144':445
'61.##.170.211':445
'61.##.58.219':139
'61.#4.64.31':139
'61.##.106.201':445
'61.##.191.134':445
'61.##.125.48':445
'61.##.183.129':139
'61.#4.32.35':139
'61.##.99.209':139
'61.##.66.215':139
'61.##.234.144':139
'61.##.170.211':139
'61.##.97.145':139
'61.##.145.28':139
'61.##.242.112':139
'61.##.221.116':139
'61.##.21.245':139
'61.#4.30.45':139
'61.##.97.174':139
'61.##.170.91':139
'61.##.226.211':139
'61.#4.5.42':139
'61.#4.51.59':139
'61.#4.63.42':445
'61.##.32.220':445
'61.##.237.115':445
'61.##.160.166':445
'61.##.185.207':445
'61.#4.95.84':445
'61.##.203.238':445
'61.#4.5.187':445
'61.##.116.157':445
'61.##.106.201':139
'61.##.191.134':139
'61.#4.157.6':139
'61.##.114.106':139
'61.##.149.85':445
'61.##.124.54':445
'61.##.47.164':445
'61.##.161.185':445
'61.##.253.59':139
'61.##.235.49':445
'61.##.186.50':445
'61.#4.78.15':445
'61.##.146.174':445
'61.##.129.74':139
'61.##.207.59':139
'61.##.127.236':139
'61.##.24.211':139
'61.#4.119.4':445
'61.##.220.152':445
'61.##.57.220':445
'61.##.23.128':445
'61.##.153.23':445
'61.##.195.80':445
'61.#4.97.74':445
'61.##.85.170':445
'61.##.97.198':445
'61.##.188.51':139
'61.##.20.237':139
'61.#4.1.20':139
'61.##.110.40':139
'61.##.60.161':139
'61.#4.166.0':139
'61.##.136.21':139
'61.#4.96.68':139
'61.##.200.109':139
'61.##.45.168':139
'61.##.90.222':139
'61.#4.2.239':139
'61.##.248.129':139
'61.##.47.246':139
'61.##.33.173':139
'61.##.191.58':139
'61.##.231.13':139
'61.#4.128.3':445
'61.##.195.80':139
'61.#4.97.74':139
'61.##.85.170':139
'61.##.97.198':139
'61.##.146.174':139
'61.##.235.49':139
'61.#4.119.4':139
'61.#4.78.15':139
'61.##.57.220':139
'61.##.110.135':139
'61.#4.3.177':139
'61.##.73.160':139
'61.##.205.73':139
'61.##.153.23':139
'61.##.220.152':139
'61.#4.128.3':139
'61.##.23.128':139
'61.#4.17.3':445
'61.##.253.59':445
'61.##.141.252':445
'61.##.244.161':445
'61.##.110.135':445
'61.#4.3.177':445
'61.##.73.160':445
'61.##.205.73':445
'61.#4.43.80':445
'61.#4.64.31':445
'61.##.139.11':445
'61.##.186.50':139
'61.##.58.219':445
'61.##.133.204':445
'61.##.204.223':445
'61.##.160.167':445
'61.##.134.139':445
'61.#4.45.20':139
'61.##.30.132':139
'61.##.160.71':139
'61.##.42.128':139
'61.##.37.104':139
'61.#4.41.40':139
'61.##.67.246':445
'61.##.170.160':139
'61.##.47.200':139
'61.##.137.63':139
'61.##.13.187':139
'61.##.63.140':139
'61.#4.16.77':139
'61.##.210.107':139
'61.#4.86.81':139
'61.##.31.216':139
'61.#4.83.63':139
'61.#4.19.9':139
'61.##.198.147':445
'61.##.158.137':445
'61.#4.81.77':445
'61.##.134.90':445
'61.##.84.254':445
'61.##.243.29':445
'61.#4.54.41':445
'61.#4.1.217':445
'61.#4.8.77':445
'61.#4.75.85':445
'61.##.166.153':445
'61.##.174.99':445
'61.##.180.161':445
'61.##.250.180':445
'61.##.215.134':445
'61.##.210.161':445
'61.#4.26.76':445
'61.##.107.197':139
'61.##.158.137':139
'61.##.134.90':139
'61.#4.8.77':139
'61.#4.81.77':139
'61.##.84.254':139
'61.#4.1.217':139
'61.#4.54.41':139
'61.##.198.147':139
'61.##.215.134':139
'61.##.174.99':139
'61.#4.75.85':139
'61.##.67.246':139
'61.##.180.161':139
'61.##.250.180':139
'61.#4.26.76':139
'61.##.166.153':139
'61.##.210.161':139
'61.##.108.183':139
'61.#4.76.48':139
'61.#4.47.2':139
'61.##.183.25':139
'61.##.232.128':139
'61.#4.3.91':139
'61.##.142.136':139
'61.##.62.126':139
'61.##.176.118':139
'61.##.14.222':139
'61.##.119.128':139
'61.##.243.29':139
'61.##.161.115':139
'61.##.188.228':139
'61.##.126.21':139
'61.##.139.176':139
'61.##.191.65':139
'61.##.161.115':445
'61.##.139.176':9988
'61.##.243.29':9988
'61.##.160.71':9988
'61.##.107.197':9988
'61.#4.83.63':9988
'61.##.183.25':9988
'61.##.119.128':9988
'61.##.166.153':9988
'61.##.63.140':9988
'61.##.67.246':9988
'61.#4.26.76':9988
'61.##.14.222':9988
'61.##.174.99':9988
'61.##.30.132':9988
'61.#4.86.81':9988
'61.##.84.254':9988
'61.#4.8.77':9988
'61.##.203.238':139
'61.#4.5.187':139
'61.#4.63.42':139
'61.##.32.220':139
'61.##.125.48':139
'61.##.113.206':139
'61.##.185.207':139
'61.#4.95.84':139
'61.##.160.166':139
'61.##.47.164':139
'61.##.161.185':139
'61.#4.3.91':9988
'61.##.137.63':9988
'61.##.116.157':139
'61.##.237.115':139
'61.##.149.85':139
'61.##.124.54':139
'61.##.210.161':9988
'61.##.142.136':445
'61.##.62.126':445
'61.##.183.25':445
'61.##.108.183':445
'61.##.107.197':445
'61.#4.16.77':445
'61.##.232.128':445
'61.#4.3.91':445
'61.##.176.118':445
'61.##.191.65':445
'61.##.119.128':445
'61.##.14.222':445
'61.##.139.176':445
'61.#4.47.2':445
'61.#4.76.48':445
'61.##.188.228':445
'61.##.126.21':445
'61.##.137.63':445
'61.##.47.200':445
'61.##.42.128':445
'61.##.37.104':445
'61.##.188.228':9988
'61.##.191.65':9988
'61.##.170.160':445
'61.#4.41.40':445
'61.##.30.132':445
'61.#4.86.81':445
'61.##.13.187':445
'61.##.210.107':445
'61.##.31.216':445
'61.#4.83.63':445
'61.##.160.71':445
'61.##.63.140':445
'61.#4.19.9':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней