Trojan.Starman.5475

Trojan.Starman.5475

Добавлен в вирусную базу Dr.Web: 2015-02-21

Описание добавлено: 2015-02-21

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER1764.dir00\svchost.exe.mdmp 16325836412029980

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%TEMP%\WER1764.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe

Сетевая активность:

Подключается к:

'12#.#26.19.141':445
'12#.#26.73.171':445
'12#.#26.0.120':445
'12#.#26.23.25':445
'12#.#26.146.120':445
'12#.#26.220.140':445
'12#.#26.232.86':445
'12#.#26.233.84':445
'12#.#26.144.1':445
'12#.#26.118.197':445
'12#.#26.211.3':445
'12#.#26.15.144':445
'12#.#26.162.149':445
'12#.#26.94.33':445
'12#.#26.27.1':445
'12#.#26.166.103':445
'12#.#26.1.221':445
'12#.#26.87.50':445
'12#.#26.95.93':445
'12#.#26.61.63':445
'12#.#26.50.142':445
'12#.#26.232.242':445
'12#.#26.57.211':445
'12#.#26.143.67':445
'12#.#26.40.92':445
'12#.#26.178.121':445
'12#.#26.147.2':445
'12#.#26.166.102':445
'12#.#26.126.225':445
'12#.#26.64.30':445
'12#.#26.30.166':445
'12#.#26.1.142':445
'12#.#26.61.63':139
'12#.#26.1.221':139
'12#.#26.87.50':139
'12#.#26.57.211':139
'12#.#26.192.207':139
'12#.#26.50.142':139
'12#.#26.232.242':139
'12#.#26.95.93':139
'12#.#26.166.102':139
'12#.#26.40.92':139
'12#.#26.178.121':139
'12#.#26.30.166':139
'12#.#26.143.67':139
'12#.#26.126.225':139
'12#.#26.64.30':139
'12#.#26.236.235':139
'12#.#26.134.181':445
'12#.#26.91.233':445
'12#.#26.246.10':139
'12#.#26.79.79':445
'12#.#26.115.136':445
'12#.#26.14.127':445
'12#.#26.119.131':445
'12#.#26.11.82':139
'12#.#26.147.238':139
'12#.#26.154.32':139
'12#.#26.250.124':139
'12#.#26.56.249':139
'12#.#26.206.216':139
'12#.#26.5.223':139
'12#.#26.180.31':139
'12#.#26.192.207':445
'12#.#26.252.13':139
'12#.#26.74.157':139
'12#.#26.157.69':139
'12#.#26.255.57':139
'12#.#26.59.14':139
'12#.#26.82.41':139
'12#.#26.10.232':139
'12#.#26.68.192':139
'12#.#26.83.122':139
'12#.#26.217.33':139
'12#.#26.33.121':139
'12#.#26.16.234':139
'12#.#26.191.128':139
'12#.#26.136.201':139
'12#.#26.72.165':139
'12#.#26.43.233':139
'12#.#26.165.8':139
'12#.#26.70.25':139
'12#.#26.128.107':139
'12#.#26.119.2':139
'12#.#26.29.164':139
'12#.#26.164.14':139
'12#.#26.14.149':139
'12#.#26.144.170':139
'12#.#26.21.56':139
'12#.#26.38.130':139
'12#.#26.84.146':139
'12#.#26.33.11':139
'12#.#26.225.244':139
'12#.#26.92.201':139
'12#.#26.73.251':139
'12#.#26.120.235':139
'12#.#26.188.246':139
'12#.#26.246.10':445
'12#.#26.11.82':445
'12#.#26.174.188':139
'12#.#26.169.68':139
'12#.#26.174.188':445
'12#.#26.188.246':445
'12#.#26.206.216':445
'12#.#26.154.32':445
'12#.#26.250.124':445
'12#.#26.236.235':445
'12#.#26.147.238':445
'12#.#26.5.223':445
'12#.#26.180.31':445
'12#.#26.56.249':445
'12#.#26.243.231':139
'12#.#26.178.196':139
'12#.#26.161.96':139
'12#.#26.114.86':139
'12#.#26.57.179':139
'12#.#26.236.35':139
'12#.#26.152.225':139
'12#.#26.245.56':139
'12#.#26.1.145':139
'12#.#26.2.207':139
'12#.#26.163.52':139
'12#.#26.52.243':139
'12#.#26.202.190':139
'12#.#26.149.211':139
'12#.#26.102.88':139
'12#.#26.99.254':139
'12#.#26.9.125':139
'12#.#26.116.2':139
'12#.#26.170.28':139
'12#.#26.126.230':139
'12#.#26.11.121':139
'12#.#26.7.70':139
'12#.#26.46.182':139
'12#.#26.4.151':139
'12#.#26.77.210':139
'12#.#26.48.105':139
'12#.#26.217.22':139
'12#.#26.130.23':139
'12#.#26.90.113':139
'12#.#26.205.82':139
'12#.#26.26.130':139
'12#.#26.12.1':139
'12#.#26.194.13':445
'12#.#26.103.201':445
'12#.#26.51.208':445
'12#.#26.108.194':445
'12#.#26.2.40':445
'12#.#26.50.102':445
'12#.#26.45.108':445
'12#.#26.187.111':445
'12#.#26.2.68':139
'12#.#26.218.236':139
'12#.#26.31.96':139
'12#.#26.54.106':445
'12#.#26.155.92':445
'12#.#26.166.115':445
'12#.#26.118.106':445
'12#.#26.116.70':139
'12#.#26.2.40':139
'12#.#26.45.108':139
'12#.#26.108.194':139
'12#.#26.50.102':139
'12#.#26.3.196':139
'12#.#26.195.145':139
'12#.#26.145.198':139
'12#.#26.194.13':139
'12#.#26.118.106':139
'12#.#26.166.115':139
'12#.#26.51.208':139
'12#.#26.155.92':139
'12#.#26.187.111':139
'12#.#26.103.201':139
'12#.#26.54.106':139
'12#.#26.32.147':139
'12#.#26.251.10':139
'12#.#26.11.17':139
'12#.#26.16.106':139
'12#.#26.64.251':139
'12#.#26.56.99':139
'12#.#26.154.97':139
'12#.#26.84.141':139
'12#.#26.106.14':139
'12#.#26.154.215':139
'12#.#26.132.36':139
'12#.#26.115.192':139
'12#.#26.215.154':139
'12#.#26.24.140':139
'12#.#26.28.231':139
'12#.#26.70.176':139
'12#.#26.195.145':445
'12#.#26.119.131':139
'12#.#26.79.79':139
'12#.#26.134.181':139
'12#.#26.14.127':139
'12#.#26.211.3':139
'12#.#26.1.142':139
'12#.#26.115.136':139
'12#.#26.91.233':139
'12#.#26.31.96':445
'12#.#26.11.121':445
'12#.#26.7.70':445
'12#.#26.12.1':445
'12#.#26.170.28':9988
'12#.#26.2.68':445
'12#.#26.218.236':445
'12#.#26.118.197':139
'12#.#26.232.86':139
'12#.#26.23.25':139
'12#.#26.19.141':139
'12#.#26.220.140':139
'12#.#26.147.2':139
'12#.#26.166.103':139
'12#.#26.146.120':139
'12#.#26.73.171':139
'12#.#26.27.1':139
'12#.#26.15.144':139
'12#.#26.144.1':139
'12#.#26.94.33':139
'12#.#26.0.120':139
'12#.#26.233.84':139
'12#.#26.162.149':139
'12#.#26.46.182':445
'12#.#26.106.14':445
'12#.#26.154.215':445
'12#.#26.24.140':445
'12#.#26.251.10':445
'12#.#26.16.106':445
'12#.#26.64.251':445
'12#.#26.11.17':445
'12#.#26.215.154':445
'12#.#26.32.147':445
'12#.#26.3.196':445
'12#.#26.145.198':445
'12#.#26.115.192':445
'12#.#26.70.176':445
'12#.#26.28.231':445
'12#.#26.132.36':445
'12#.#26.84.141':445
'12#.#26.170.28':445
'12#.#26.90.113':445
'12#.#26.205.82':445
'12#.#26.4.151':445
'12#.#26.126.230':445
'12#.#26.116.2':445
'12#.#26.9.125':445
'12#.#26.26.130':445
'12#.#26.116.70':445
'12#.#26.56.99':445
'12#.#26.154.97':445
'12#.#26.217.22':445
'12#.#26.130.23':445
'12#.#26.77.210':445
'12#.#26.48.105':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней