Trojan.DownLoader12.29150

Добавлен в вирусную базу Dr.Web: 2015-02-21

Описание добавлено: 2015-02-21

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'81.##.204.146':445
'81.##.227.89':445
'81.#3.18.99':445
'81.##.106.161':445
'81.##.138.192':445
'81.#3.8.3':445
'81.#3.0.192':445
'81.##.191.111':445
'81.##.37.245':445
'81.##.234.181':139
'81.#3.39.51':139
'81.#3.36.79':139
'81.##.167.36':139
'81.#3.45.86':445
'81.#3.63.3':445
'81.##.129.174':445
'81.##.189.217':445
'81.##.104.137':445
'81.##.144.194':445
'81.#3.24.90':445
'81.##.16.106':445
'81.##.204.234':445
'81.#3.12.92':445
'81.##.205.244':445
'81.##.84.205':445
'81.#3.23.75':445
'81.##.214.222':445
'81.#3.7.149':445
'81.##.174.201':445
'81.##.146.33':445
'81.##.205.252':445
'81.##.165.92':445
'81.##.123.222':445
'81.##.66.175':445
'81.##.143.184':445
'81.##.66.175':139
'81.##.143.184':139
'81.#3.7.149':139
'81.##.174.201':139
'81.##.214.222':139
'81.##.16.106':139
'81.##.165.92':139
'81.##.123.222':139
'81.##.205.252':139
'81.#3.0.192':139
'81.##.191.111':139
'81.##.204.146':139
'81.##.227.89':139
'81.##.104.137':139
'81.##.146.33':139
'81.##.138.192':139
'81.#3.8.3':139
'81.##.204.234':139
'81.##.127.228':139
'81.#3.32.86':139
'81.##.28.154':139
'81.##.80.120':139
'81.#3.70.27':139
'81.##.143.241':139
'81.##.163.50':139
'81.##.92.121':139
'81.##.31.121':139
'81.##.84.205':139
'81.#3.23.75':139
'81.##.144.194':139
'81.#3.24.90':139
'81.##.200.43':139
'81.##.56.154':139
'81.#3.12.92':139
'81.##.205.244':139
'81.##.200.43':445
'81.##.132.166':139
'81.##.100.232':139
'81.#3.73.58':139
'81.##.78.213':139
'81.##.201.170':139
'81.#3.93.34':139
'81.##.68.142':139
'81.##.69.231':139
'81.##.248.247':139
'81.#3.87.17':139
'81.##.198.229':139
'81.##.236.249':139
'81.##.79.123':139
'81.##.171.160':139
'81.##.10.188':139
'81.##.156.198':139
'81.##.160.156':139
'81.##.149.111':139
'81.##.16.173':139
'81.#3.7.186':139
'81.##.49.137':139
'81.##.223.48':139
'81.#3.27.24':139
'81.#3.53.54':139
'81.#3.7.207':139
'81.##.15.222':139
'81.#3.41.69':139
'81.#3.5.131':139
'81.##.111.19':139
'81.##.221.159':139
'81.##.154.100':139
'81.##.212.243':139
'81.##.114.254':139
'81.##.250.110':139
'81.##.56.146':139
'81.##.167.36':445
'81.##.234.181':445
'81.##.143.241':445
'81.#3.36.79':445
'81.##.244.147':139
'81.#3.57.60':139
'81.#3.39.51':445
'81.#3.194.0':139
'81.#3.70.27':445
'81.##.28.154':445
'81.##.80.120':445
'81.##.56.154':445
'81.##.31.121':445
'81.##.163.50':445
'81.##.92.121':445
'81.##.127.228':445
'81.#3.32.86':445
'81.##.150.62':139
'81.##.141.154':139
'81.##.65.142':139
'81.##.237.155':139
'81.##.196.31':139
'81.##.102.13':139
'81.##.249.250':139
'81.##.142.65':139
'81.##.36.142':139
'81.##.155.89':139
'81.##.244.147':445
'81.#3.57.60':445
'81.#3.2.67':139
'81.#3.194.0':445
'81.#3.75.20':139
'81.#3.90.74':139
'81.##.150.62':445
'81.#3.2.67':445
'81.##.106.161':139
'81.##.162.236':139
'81.##.77.162':139
'81.##.117.131':139
'81.#3.236.7':139
'81.##.223.127':139
'81.#3.59.19':445
'81.#3.6.185':139
'81.##.166.38':139
'81.#3.192.6':139
'81.#3.1.182':139
'81.##.100.162':139
'81.##.175.62':139
'81.#3.0.81':139
'81.##.107.164':139
'81.##.158.208':139
'81.##.45.126':139
'81.##.177.45':139
'81.##.158.61':445
'81.##.197.236':445
'81.#3.53.33':445
'81.#3.48.51':445
'81.#3.83.87':445
'81.##.174.124':445
'81.##.205.33':445
'81.##.86.170':445
'81.##.60.179':445
'81.##.103.143':445
'81.##.76.190':445
'81.#3.10.85':445
'81.##.73.254':445
'81.##.106.209':445
'81.#3.40.23':445
'81.##.140.69':445
'81.##.119.100':445
'81.##.93.243':445
'81.#3.48.51':139
'81.#3.83.87':139
'81.##.140.69':139
'81.##.103.143':139
'81.##.86.170':139
'81.##.60.179':139
'81.##.197.236':139
'81.#3.53.33':139
'81.#3.40.23':139
'81.##.73.254':139
'81.##.106.209':139
'81.##.158.61':139
'81.#3.59.19':139
'81.##.119.100':139
'81.##.93.243':139
'81.##.76.190':139
'81.#3.10.85':139
'81.##.174.124':139
'81.##.167.112':139
'81.#3.96.21':139
'81.#3.64.15':139
'81.##.61.250':139
'81.##.202.29':139
'81.##.149.20':139
'81.##.222.132':139
'81.##.186.170':139
'81.##.181.82':139
'81.##.56.141':139
'81.#3.96.92':139
'81.##.205.33':139
'81.##.217.156':139
'81.##.244.61':139
'81.##.76.147':139
'81.##.101.152':139
'81.##.245.129':139
'81.##.217.156':445
'81.##.93.243':9988
'81.##.158.61':9988
'81.##.60.179':9988
'81.#3.48.51':9988
'81.##.140.69':9988
'81.##.106.209':9988
'81.#3.53.33':9988
'81.##.76.190':9988
'81.##.73.254':9988
'81.##.101.152':9988
'81.##.244.61':9988
'81.##.76.147':9988
'81.##.119.100':9988
'81.#3.59.19':9988
'81.##.205.33':9988
'81.##.217.156':9988
'81.#3.83.87':9988
'81.##.56.141':9988
'81.##.129.174':139
'81.##.189.217':139
'81.##.203.17':445
'81.#3.9.69':445
'81.##.37.245':139
'81.#3.18.99':139
'81.#3.45.86':139
'81.#3.63.3':139
'81.##.46.121':445
'81.##.254.164':139
'81.##.46.121':139
'81.##.174.124':9988
'81.##.62.247':139
'81.##.62.247':445
'81.##.254.164':445
'81.##.203.17':139
'81.#3.9.69':139
'81.##.222.132':445
'81.##.186.170':445
'81.##.167.112':445
'81.#3.96.21':445
'81.##.175.62':445
'81.#3.0.81':445
'81.##.202.29':445
'81.##.149.20':445
'81.##.61.250':445
'81.##.101.152':445
'81.##.245.129':445
'81.##.56.141':445
'81.#3.96.92':445
'81.##.181.82':445
'81.#3.64.15':445
'81.##.244.61':445
'81.##.76.147':445
'81.#3.1.182':445
'81.##.166.38':445
'81.##.223.127':445
'81.##.77.162':445
'81.#3.6.185':445
'81.##.86.170':9988
'81.#3.40.23':9988
'81.#3.10.85':9988
'81.##.61.250':9988
'81.##.162.236':445
'81.##.177.45':445
'81.##.107.164':445
'81.##.100.162':445
'81.##.45.126':445
'81.##.117.131':445
'81.#3.236.7':445
'81.##.158.208':445
'81.#3.192.6':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней