Trojan.Starman.5902

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER1168.dir00\svchost.exe.mdmp 16325836412032196

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER1168.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'89.##1.114.8':445
'89.##1.231.141':445
'89.##1.117.234':445
'89.##1.135.218':445
'89.#21.92.7':445
'89.##1.14.92':445
'89.##1.166.248':445
'89.##1.104.161':445
'89.##1.225.48':445
'89.##1.70.139':445
'89.##1.169.178':445
'89.##1.27.119':445
'89.##1.107.184':445
'89.##1.39.46':445
'89.##1.148.34':445
'89.##1.123.248':445
'89.##1.8.231':445
'89.##1.78.118':445
'89.##1.52.142':445
'89.##1.68.34':445
'89.##1.65.210':445
'89.##1.31.68':445
'89.##1.26.13':445
'89.##1.121.193':445
'89.##1.58.113':445
'89.##1.231.26':139
'89.##1.108.112':139
'89.##1.12.219':139
'89.##1.180.141':445
'89.##1.47.62':139
'89.##1.221.64':139
'89.##1.135.178':139
'89.##1.162.110':139
'89.##1.47.62':445
'89.#21.1.21':139
'89.##1.149.202':139
'89.##1.103.162':139
'89.##1.176.120':445
'89.##1.212.83':445
'89.##1.71.199':445
'89.##1.45.48':445
'89.##1.147.219':445
'89.##1.79.238':445
'89.##1.69.107':445
'89.##1.10.205':445
'89.##1.237.66':445
'89.##1.87.13':445
'89.##1.119.121':445
'89.##1.77.226':445
'89.##1.205.104':445
'89.##1.63.10':445
'89.##1.26.13':139
'89.##1.121.193':139
'89.##1.58.113':139
'89.##1.39.46':139
'89.##1.148.34':139
'89.##1.123.248':139
'89.##1.107.184':139
'89.##1.135.218':139
'89.#21.92.7':139
'89.##1.68.34':139
'89.##1.65.210':139
'89.##1.31.68':139
'89.##1.52.142':139
'89.##1.159.171':445
'89.##1.217.3':445
'89.##1.175.216':445
'89.##1.187.191':445
'89.##1.243.155':445
'89.##1.88.50':445
'89.##1.63.10':139
'89.##1.8.231':139
'89.##1.78.118':139
'89.#21.6.11':445
'89.#21.16.2':445
'89.##1.207.116':139
'89.##1.119.121':139
'89.##1.77.226':139
'89.##1.205.104':139
'89.##1.212.83':139
'89.##1.71.199':139
'89.##1.45.48':139
'89.##1.176.120':139
'89.##1.180.141':139
'89.##1.207.116':445
'89.##1.10.205':139
'89.##1.237.66':139
'89.##1.87.13':139
'89.##1.69.107':139
'89.##1.117.234':139
'89.##1.70.139':139
'89.##1.169.178':139
'89.##1.14.92':139
'89.##1.114.8':139
'89.##1.231.141':139
'89.##1.225.48':139
'89.##1.147.219':139
'89.##1.79.238':139
'89.##1.27.119':139
'89.##1.166.248':139
'89.##1.104.161':139
'89.##1.10.207':445
'89.##1.109.143':445
'89.##1.107.168':445
'89.##1.227.28':445
'89.##1.28.244':445
'89.##1.87.219':445
'89.##1.92.127':445
'89.##1.180.198':445
'89.##1.122.180':445
'89.##1.153.76':445
'89.##1.188.149':445
'89.##1.191.100':445
'89.##1.176.183':445
'89.##1.187.113':445
'89.##1.63.144':445
'89.##1.11.145':445
'89.##1.87.94':445
'89.##1.121.93':445
'89.##1.60.210':445
'89.##1.76.186':445
'89.##1.203.76':445
'89.##1.183.203':445
'89.##1.182.205':445
'89.##1.53.182':445
'89.##1.10.239':445
'89.##1.188.133':139
'89.##1.151.8':139
'89.##1.18.151':139
'89.##1.189.27':445
'89.##1.228.189':445
'89.##1.127.228':139
'89.##1.156.226':139
'89.##1.134.204':139
'89.##1.96.172':139
'89.##1.28.80':139
'89.##1.16.128':139
'89.##1.189.111':139
'89.##1.116.90':445
'89.##1.196.47':445
'89.##1.26.196':445
'89.##1.252.26':445
'89.##1.0.113':445
'89.##1.100.43':445
'89.##1.47.161':445
'89.##1.160.118':445
'89.##1.68.24':445
'89.##1.149.219':445
'89.##1.28.252':445
'89.##1.79.182':445
'89.##1.225.210':445
'89.##1.139.248':445
'89.##1.182.205':139
'89.##1.53.182':139
'89.##1.10.239':139
'89.##1.187.113':139
'89.##1.63.144':139
'89.##1.11.145':139
'89.##1.176.183':139
'89.##1.227.28':139
'89.##1.28.244':139
'89.##1.76.186':139
'89.##1.203.76':139
'89.##1.183.203':139
'89.##1.60.210':139
'89.##1.12.219':445
'89.#21.1.21':445
'89.##1.149.202':445
'89.##1.221.64':445
'89.##1.231.26':445
'89.##1.108.112':445
'89.##1.139.248':139
'89.##1.87.94':139
'89.##1.121.93':139
'89.##1.103.162':445
'89.##1.135.178':445
'89.##1.162.110':445
'89.##1.28.252':139
'89.##1.79.182':139
'89.##1.225.210':139
'89.##1.196.47':139
'89.##1.26.196':139
'89.##1.252.26':139
'89.##1.116.90':139
'89.##1.189.27':139
'89.##1.228.189':139
'89.##1.160.118':139
'89.##1.68.24':139
'89.##1.149.219':139
'89.##1.47.161':139
'89.##1.107.168':139
'89.##1.153.76':139
'89.##1.188.149':139
'89.##1.87.219':139
'89.##1.10.207':139
'89.##1.109.143':139
'89.##1.122.180':139
'89.##1.0.113':139
'89.##1.100.43':139
'89.##1.191.100':139
'89.##1.92.127':139
'89.##1.180.198':139
'89.##1.192.127':445
'89.##1.65.130':445
'89.##1.173.121':445
'89.##1.56.60':445
'89.##1.13.15':445
'89.##1.30.195':445
'89.##1.31.197':445
'89.##1.57.202':445
'89.##1.228.11':445
'89.##1.52.78':445
'89.##1.162.180':445
'89.##1.117.10':445
'89.##1.12.117':445
'89.##1.174.203':445
'89.##1.93.64':445
'89.##1.12.191':445
'89.##1.156.34':445
'89.##1.70.224':445
'89.##1.64.199':445
'89.##1.190.220':445
'89.##1.183.90':445
'89.##1.156.180':445
'89.##1.204.89':445
'89.##1.248.155':445
'89.##1.96.27':445
'89.##1.36.123':445
'89.##1.248.245':445
'89.##1.56.248':445
'89.##1.66.54':445
'89.##1.186.222':445
'89.##1.157.93':445
'89.##1.177.94':445
'89.##1.182.248':445
'89.##1.184.221':445
'89.##1.87.14':445
'89.##1.215.149':445
'89.##1.93.216':445
'89.##1.248.93':445
'89.##1.147.63':445
'89.##1.167.108':445
'89.##1.116.34':445
'89.##1.121.115':445
'89.##1.18.110':445
'89.##1.136.72':445
'89.##1.108.164':445
'89.##1.230.7':445
'89.##1.37.173':445
'89.##1.96.115':445
'89.##1.245.121':445
'89.##1.48.195':445
'89.##1.5.127':445
'89.##1.219.125':139
'89.##1.65.130':139
'89.##1.173.121':139
'89.##1.56.60':139
'89.##1.13.15':139
'89.##1.30.195':139
'89.##1.31.197':139
'89.##1.57.202':139
'89.##1.228.11':139
'89.##1.52.78':139
'89.##1.162.180':139
'89.##1.117.10':139
'89.##1.12.117':139
'89.##1.174.203':139
'89.##1.93.64':139
'89.##1.12.191':139
'89.##1.156.34':139
'89.##1.64.199':139
'89.##1.190.220':139
'89.##1.70.224':139
'89.##1.183.90':139
'89.##1.156.180':139
'89.##1.204.89':139
'89.##1.248.155':139
'89.##1.96.27':139
'89.##1.36.123':139
'89.##1.248.245':139
'89.##1.56.248':139
'89.##1.66.54':139
'89.##1.186.222':139
'89.##1.157.93':139
'89.##1.177.94':139
'89.##1.182.248':139
'89.##1.184.221':139
'89.##1.87.14':139
'89.##1.215.149':139
'89.##1.93.216':139
'89.##1.248.93':139
'89.##1.147.63':139
'89.##1.167.108':139
'89.##1.116.34':139
'89.##1.121.115':139
'89.##1.18.110':139
'89.##1.136.72':139
'89.##1.108.164':139
'89.##1.230.7':139
'89.##1.37.173':139
'89.##1.96.115':139
'89.##1.245.121':139
'89.##1.48.195':139
'89.##1.5.127':139
'89.##1.254.193':445
'89.##1.89.176':445
'89.##1.151.236':445
'89.##1.66.18':445
'89.##1.179.135':445
'89.##1.251.133':445
'89.##1.16.178':445
'89.##1.152.160':445
'89.##1.70.182':445
'89.##1.55.154':445
'89.##1.86.148':445
'89.##1.199.60':445
'89.##1.159.211':445
'89.##1.255.161':445
'89.##1.214.17':445
'89.##1.28.214':445
'89.##1.86.103':445
'89.##1.87.10':445
'89.##1.17.245':445
'89.##1.32.125':445
'89.##1.212.156':445
'89.##1.180.153':445
'89.##1.224.28':445
'89.##1.129.223':445
'89.##1.211.129':445
'89.##1.187.191':139
'89.##1.243.155':139
'89.##1.88.50':139
'89.##1.237.73':445
'89.##1.127.187':139
'89.##1.192.127':139
'89.#21.6.11':139
'89.#21.16.2':139
'89.##1.127.187':445
'89.##1.159.171':139
'89.##1.217.3':139
'89.##1.175.216':139
'89.##1.163.163':445
'89.##1.210.129':445
'89.##1.63.15':445
'89.##1.170.62':445
'89.##1.118.232':445
'89.##1.78.127':445
'89.##1.60.194':445
'89.##1.247.111':445
'89.##1.217.184':445
'89.#21.47.5':445
'89.##1.243.169':445
'89.##1.111.192':445
'89.##1.111.67':445
'89.##1.80.197':445
'89.##1.224.28':139
'89.##1.129.223':139
'89.##1.211.129':139
'89.##1.255.161':139
'89.##1.214.17':139
'89.##1.28.214':139
'89.##1.159.211':139
'89.##1.66.18':139
'89.##1.179.135':139
'89.##1.32.125':139
'89.##1.212.156':139
'89.##1.180.153':139
'89.##1.17.245':139
'89.##1.156.180':9988
'89.##1.18.110':9988
'89.##1.136.72':9988
'89.##1.219.125':445
'89.##1.64.199':9988
'89.##1.12.191':9988
'89.##1.80.197':139
'89.##1.86.103':139
'89.##1.87.10':139
'89.##1.186.222':9988
'89.##1.248.93':9988
'89.##1.187.17':139
'89.##1.243.169':139
'89.##1.111.192':139
'89.##1.111.67':139
'89.##1.210.129':139
'89.##1.63.15':139
'89.##1.170.62':139
'89.##1.163.163':139
'89.##1.237.73':139
'89.##1.187.17':445
'89.##1.247.111':139
'89.##1.217.184':139
'89.#21.47.5':139
'89.##1.60.194':139
'89.##1.151.236':139
'89.##1.55.154':139
'89.##1.86.148':139
'89.##1.251.133':139
'89.##1.254.193':139
'89.##1.89.176':139
'89.##1.70.182':139
'89.##1.118.232':139
'89.##1.78.127':139
'89.##1.199.60':139
'89.##1.16.178':139
'89.##1.152.160':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней