Trojan.Starman.5746

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WERc9ad.dir00\svchost.exe.mdmp 16325836412032104

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WERc9ad.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'62.##8.242.36':445
'62.##8.85.218':445
'62.##8.99.211':445
'62.##8.78.116':445
'62.##8.125.251':445
'62.##8.217.230':445
'62.##8.69.41':445
'62.##8.143.27':445
'62.##8.14.81':445
'62.##8.13.93':445
'62.##8.117.187':445
'62.##8.16.250':445
'62.##8.210.193':445
'62.##8.128.112':445
'62.##8.48.239':445
'62.##8.39.90':445
'62.##8.78.159':445
'62.##8.14.170':445
'62.##8.86.66':445
'62.##8.118.211':445
'62.##8.32.161':445
'62.##8.126.31':445
'62.##8.101.85':445
'62.##8.116.101':445
'62.##8.163.36':445
'62.##8.63.178':445
'62.##8.95.221':445
'62.##8.90.69':445
'62.##8.119.182':445
'62.##8.70.154':445
'62.#48.0.67':445
'62.##8.255.212':445
'62.##8.22.31':139
'62.##8.105.177':139
'62.##8.214.55':139
'62.##8.97.84':445
'62.##8.71.61':445
'62.##8.56.180':139
'62.##8.216.126':445
'62.##8.194.242':445
'62.##8.37.17':445
'62.##8.42.188':445
'62.##8.163.121':445
'62.##8.111.26':445
'62.##8.196.51':445
'62.##8.213.204':445
'62.##8.14.44':445
'62.##8.126.87':445
'62.##8.212.12':445
'62.##8.242.219':445
'62.##8.205.25':445
'62.##8.210.193':139
'62.##8.78.116':139
'62.##8.125.251':139
'62.##8.118.211':139
'62.##8.32.161':139
'62.##8.126.31':139
'62.##8.99.211':139
'62.##8.13.93':139
'62.##8.117.187':139
'62.##8.217.230':139
'62.##8.242.36':139
'62.##8.85.218':139
'62.##8.163.36':139
'62.##8.159.61':445
'62.##8.78.159':139
'62.##8.14.170':139
'62.##8.4.121':445
'62.##8.167.142':445
'62.##8.122.60':445
'62.##8.39.90':139
'62.##8.101.85':139
'62.##8.116.101':139
'62.##8.86.66':139
'62.##8.128.112':139
'62.##8.48.239':139
'62.##8.16.250':139
'62.##8.216.126':139
'62.##8.70.154':139
'62.#48.0.67':139
'62.##8.213.204':139
'62.##8.14.44':139
'62.##8.126.87':139
'62.##8.90.69':139
'62.##8.97.84':139
'62.##8.71.61':139
'62.##8.255.212':139
'62.##8.95.221':139
'62.##8.119.182':139
'62.##8.205.25':139
'62.##8.63.178':139
'62.##8.163.121':139
'62.##8.111.26':139
'62.##8.69.41':139
'62.##8.143.27':139
'62.##8.14.81':139
'62.##8.42.188':139
'62.##8.212.12':139
'62.##8.242.219':139
'62.##8.196.51':139
'62.##8.194.242':139
'62.##8.37.17':139
'62.##8.138.172':445
'62.#48.0.66':445
'62.##8.6.110':445
'62.##8.233.151':445
'62.##8.26.196':445
'62.##8.239.26':445
'62.##8.148.216':445
'62.##8.35.149':445
'62.##8.135.200':445
'62.##8.18.82':445
'62.##8.44.234':445
'62.##8.215.254':445
'62.##8.249.198':445
'62.##8.157.1':445
'62.##8.194.67':445
'62.##8.34.234':445
'62.##8.219.140':445
'62.##8.217.152':445
'62.##8.132.143':445
'62.##8.16.227':445
'62.##8.47.137':445
'62.##8.22.79':445
'62.##8.58.248':445
'62.##8.250.221':445
'62.##8.65.192':445
'62.##8.111.206':445
'62.##8.80.168':445
'62.##8.130.80':445
'62.##8.69.130':445
'62.##8.80.63':445
'62.##8.164.80':445
'62.##8.168.163':445
'62.##8.186.174':139
'62.##8.233.185':139
'62.##8.4.234':139
'62.#48.97.1':445
'62.##8.82.54':445
'62.##8.193.40':139
'62.##8.68.36':445
'62.##8.119.126':445
'62.##8.244.211':445
'62.##8.246.244':445
'62.##8.162.111':445
'62.##8.252.161':445
'62.##8.232.202':445
'62.##8.39.184':445
'62.##8.126.24':445
'62.##8.208.126':445
'62.##8.88.185':445
'62.##8.187.115':445
'62.##8.144.55':445
'62.##8.249.198':139
'62.##8.233.151':139
'62.##8.26.196':139
'62.##8.16.227':139
'62.##8.47.137':139
'62.##8.22.79':139
'62.##8.6.110':139
'62.##8.18.82':139
'62.##8.44.234':139
'62.##8.239.26':139
'62.##8.138.172':139
'62.#48.0.66':139
'62.##8.65.192':139
'62.##8.214.55':445
'62.##8.219.140':139
'62.##8.217.152':139
'62.##8.56.180':445
'62.##8.22.31':445
'62.##8.105.177':445
'62.##8.34.234':139
'62.##8.58.248':139
'62.##8.250.221':139
'62.##8.132.143':139
'62.##8.157.1':139
'62.##8.194.67':139
'62.##8.215.254':139
'62.##8.68.36':139
'62.##8.80.63':139
'62.##8.164.80':139
'62.##8.39.184':139
'62.##8.126.24':139
'62.##8.208.126':139
'62.##8.69.130':139
'62.#48.97.1':139
'62.##8.82.54':139
'62.##8.168.163':139
'62.##8.80.168':139
'62.##8.130.80':139
'62.##8.144.55':139
'62.##8.111.206':139
'62.##8.162.111':139
'62.##8.252.161':139
'62.##8.148.216':139
'62.##8.35.149':139
'62.##8.135.200':139
'62.##8.246.244':139
'62.##8.88.185':139
'62.##8.187.115':139
'62.##8.232.202':139
'62.##8.119.126':139
'62.##8.244.211':139
'62.##8.218.196':445
'62.##8.29.69':445
'62.##8.248.28':445
'62.#48.89.2':445
'62.##8.46.89':445
'62.##8.141.46':445
'62.##8.62.75':445
'62.##8.78.84':445
'62.##8.237.215':445
'62.##8.172.155':445
'62.##8.15.225':445
'62.##8.75.66':445
'62.##8.238.224':445
'62.##8.139.138':445
'62.##8.231.123':445
'62.##8.133.231':445
'62.#48.0.86':445
'62.##8.202.133':445
'62.##8.228.201':445
'62.##8.67.63':445
'62.##8.71.139':445
'62.##8.96.32':445
'62.##8.59.229':445
'62.##8.23.60':445
'62.##8.206.41':445
'62.##8.56.199':445
'62.##8.50.231':445
'62.##8.185.50':445
'62.##8.42.127':445
'62.##8.136.52':445
'62.##8.53.26':445
'62.##8.177.130':445
'62.##8.152.94':445
'62.##8.143.89':445
'62.##8.27.143':445
'62.##8.21.251':445
'62.##8.203.199':445
'62.##8.73.204':445
'62.##8.218.8':445
'62.##8.188.247':445
'62.##8.232.208':445
'62.##8.98.232':445
'62.##8.161.179':445
'62.##8.149.161':445
'62.##8.116.83':445
'62.##8.140.183':445
'62.##8.148.17':445
'62.#48.9.78':445
'62.##8.6.126':445
'62.##8.131.251':445
'62.##8.50.183':445
'62.##8.218.196':139
'62.##8.29.69':139
'62.##8.248.28':139
'62.#48.89.2':139
'62.##8.46.89':139
'62.##8.141.46':139
'62.##8.62.75':139
'62.##8.78.84':139
'62.##8.237.215':139
'62.##8.172.155':139
'62.##8.15.225':139
'62.##8.75.66':139
'62.##8.238.224':139
'62.##8.139.138':139
'62.##8.133.231':139
'62.##8.228.201':139
'62.#48.0.86':139
'62.##8.202.133':139
'62.##8.231.123':139
'62.##8.67.63':139
'62.##8.71.139':139
'62.##8.96.32':139
'62.##8.59.229':139
'62.##8.23.60':139
'62.##8.206.41':139
'62.##8.56.199':139
'62.##8.50.231':139
'62.##8.185.50':139
'62.##8.42.127':139
'62.##8.136.52':139
'62.##8.53.26':139
'62.##8.177.130':139
'62.##8.152.94':139
'62.##8.143.89':139
'62.##8.27.143':139
'62.##8.21.251':139
'62.##8.203.199':139
'62.##8.73.204':139
'62.##8.218.8':139
'62.##8.188.247':139
'62.##8.232.208':139
'62.##8.98.232':139
'62.##8.161.179':139
'62.##8.149.161':139
'62.##8.116.83':139
'62.##8.140.183':139
'62.##8.148.17':139
'62.#48.9.78':139
'62.##8.6.126':139
'62.##8.131.251':139
'62.##8.50.183':139
'62.##8.199.134':445
'62.##8.18.217':445
'62.##8.48.130':445
'62.##8.49.232':445
'62.##8.129.49':445
'62.##8.38.82':445
'62.##8.124.232':445
'62.##8.80.27':445
'62.##8.21.106':445
'62.##8.234.6':445
'62.##8.8.113':445
'62.##8.121.133':445
'62.##8.113.136':445
'62.##8.68.11':445
'62.##8.41.27':445
'62.##8.138.80':445
'62.##8.187.192':445
'62.##8.8.195':445
'62.##8.58.143':445
'62.##8.153.120':445
'62.#48.5.55':445
'62.##8.33.226':445
'62.##8.120.250':445
'62.##8.96.130':445
'62.##8.30.216':445
'62.##8.134.205':445
'62.#48.7.71':445
'62.##8.165.168':445
'62.##8.237.13':445
'62.##8.32.254':445
'62.##8.135.26':445
'62.##8.121.209':445
'62.##8.167.142':139
'62.##8.122.60':139
'62.##8.159.61':139
'62.##8.128.9':445
'62.#48.99.2':445
'62.##8.4.121':139
'62.##8.74.93':445
'62.##8.2.239':445
'62.##8.41.72':445
'62.##8.65.47':445
'62.##8.30.234':445
'62.##8.186.108':445
'62.##8.61.218':445
'62.##8.187.205':445
'62.##8.34.202':445
'62.##8.157.58':445
'62.##8.230.86':445
'62.##8.106.32':445
'62.##8.155.141':445
'62.##8.113.136':139
'62.##8.49.232':139
'62.##8.129.49':139
'62.##8.153.120':139
'62.#48.5.55':139
'62.##8.33.226':139
'62.##8.48.130':139
'62.##8.234.6':139
'62.##8.8.113':139
'62.##8.38.82':139
'62.##8.199.134':139
'62.##8.18.217':139
'62.##8.30.216':139
'62.##8.188.247':9988
'62.##8.187.192':139
'62.##8.8.195':139
'62.##8.59.229':9988
'62.#48.0.86':9988
'62.##8.23.60':9988
'62.##8.138.80':139
'62.##8.120.250':139
'62.##8.96.130':139
'62.##8.58.143':139
'62.##8.68.11':139
'62.##8.41.27':139
'62.##8.121.133':139
'62.##8.157.58':139
'62.##8.32.254':139
'62.##8.135.26':139
'62.##8.187.205':139
'62.##8.34.202':139
'62.##8.74.93':139
'62.##8.237.13':139
'62.##8.128.9':139
'62.#48.99.2':139
'62.##8.121.209':139
'62.#48.7.71':139
'62.##8.165.168':139
'62.##8.155.141':139
'62.##8.134.205':139
'62.##8.30.234':139
'62.##8.186.108':139
'62.##8.124.232':139
'62.##8.80.27':139
'62.##8.21.106':139
'62.##8.65.47':139
'62.##8.230.86':139
'62.##8.106.32':139
'62.##8.61.218':139
'62.##8.2.239':139
'62.##8.41.72':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней