Trojan.DownLoader10.2862

Добавлен в вирусную базу Dr.Web: 2013-08-13

Описание добавлено: 2013-08-13

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WER53c6.dir00\svchost.exe.hdmp 16325836412028932
'<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WER53c6.dir00\svchost.exe.mdmp 16325836412027956

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\Help\Tours\htmlTour\kxkzvszq.exe
%WINDIR%\Help\Tours\htmlTour\lrhwxcwk.exe
%WINDIR%\Help\Tours\htmlTour\tjxhsker.exe
%WINDIR%\Help\Tours\htmlTour\klbvejnk.exe
%WINDIR%\Help\Tours\htmlTour\trsecbvb.exe
%WINDIR%\Help\Tours\htmlTour\lwnssrtv.exe
%WINDIR%\Help\Tours\htmlTour\skersqzb.exe
%WINDIR%\Help\Tours\htmlTour\hjhecvkh.exe
%WINDIR%\Help\Tours\htmlTour\lhhjrkjk.exe
%WINDIR%\Help\Tours\htmlTour\qejnhetj.exe
%WINDIR%\Help\tsbjbtvn.exe
%WINDIR%\Help\Tours\htmlTour\wwvjntek.exe
%WINDIR%\Help\Tours\htmlTour\kzerbzks.exe
%WINDIR%\Help\Tours\htmlTour\nleqhveh.exe
%WINDIR%\Help\Tours\htmlTour\cxjclkkc.exe
%WINDIR%\Help\Tours\htmlTour\kzkzkjkb.exe
%WINDIR%\Help\Tours\htmlTour\njnrhctz.exe
%WINDIR%\Help\Tours\htmlTour\lbsbbjlx.exe
%WINDIR%\Help\Tours\htmlTour\knwbcncs.exe
%WINDIR%\Help\Tours\WindowsMediaPlayer\Cnt\tjnbzhbh.exe
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\lllknblj.exe
%WINDIR%\Help\Tours\htmlTour\xslbknlk.exe
%WINDIR%\Help\Tours\htmlTour\rzjnrbeb.exe
%WINDIR%\Help\Tours\htmlTour\zbcwlstj.exe
%WINDIR%\Help\Tours\htmlTour\ekwlsjzj.exe
%WINDIR%\Help\Tours\htmlTour\rqkjqjqb.exe
%WINDIR%\Help\Tours\htmlTour\ewrlklcs.exe
%WINDIR%\Help\Tours\htmlTour\blkkzrtt.exe
%WINDIR%\Help\Tours\htmlTour\ztssweeh.exe
%WINDIR%\Help\Tours\htmlTour\rbnesqvr.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%TEMP%\WER53c6.dir00\svchost.exe.hdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%TEMP%\WER53c6.dir00\svchost.exe.mdmp
<SYSTEM32>\urdvxc.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%WINDIR%\Help\jbnshhqj.exe
%WINDIR%\Help\jjlenkbt.exe
%WINDIR%\Help\hwexrtne.exe
%WINDIR%\Help\bzehxvnz.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%TEMP%\WER53c6.dir00\appcompat.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%TEMP%\WER53c6.dir00\manifest.txt

Самоудаляется.

Сетевая активность:

Подключается к:

'20#.#08.55.172':9988
'20#.#08.165.85':445
'20#.#08.247.152':9988
'20#.#08.42.53':9988
'20#.#08.121.254':445
'20#.#08.86.136':445
'20#.#08.34.185':445
'20#.#08.117.152':445
'20#.#08.24.69':445
'20#.#08.67.169':9988
'20#.#08.70.230':9988
'20#.#08.146.10':9988
'20#.#08.45.149':9988
'20#.#08.191.215':9988
'20#.#08.163.147':9988
'20#.#08.185.124':9988
'20#.#08.36.111':9988
'20#.#08.130.170':9988
'20#.#08.152.102':9988
'20#.#08.163.36':445
'20#.#08.237.47':445
'20#.#08.154.182':445
'20#.#08.42.76':445
'20#.#08.184.122':445
'20#.#08.131.247':445
'20#.#08.89.11':445
'20#.#08.7.107':445
'20#.#08.26.36':445
'20#.#08.221.78':445
'20#.#08.53.78':445
'20#.#08.221.240':445
'20#.#08.34.215':445
'20#.#08.59.137':445
'20#.#08.236.124':445
'20#.#08.101.90':445
'20#.#08.137.116':445
'20#.#08.25.41':445
'20#.#08.75.193':445
'20#.#08.237.47':9988
'20#.#08.75.193':9988
'20#.#08.117.152':9988
'20#.#08.101.90':9988
'20#.#08.42.76':9988
'20#.#08.121.254':9988
'20#.#08.34.215':9988
'20#.#08.7.107':9988
'20#.#08.154.182':9988
'20#.#08.236.124':9988
'20#.#08.35.167':9988
'20#.#08.86.136':9988
'20#.#08.117.148':9988
'20#.#08.68.230':9988
'20#.#08.34.185':9988
'20#.#08.221.240':9988
'20#.#08.184.122':9988
'20#.#08.24.69':9988
'20#.#08.165.85':9988
'20#.#08.147.242':9988
'20#.#08.26.36':9988
'20#.#08.89.11':9988
'20#.#08.137.116':9988
'20#.#08.147.3':9988
'20#.#08.21.102':9988
'20#.#08.163.36':9988
'20#.#08.25.41':9988
'20#.#08.158.220':9988
'20#.#08.228.125':9988
'20#.#08.59.137':9988
'20#.#08.150.120':9988
'20#.#08.218.185':9988
'20#.#08.53.78':9988
'20#.#08.243.113':9988
'20#.#08.195.190':9988
'20#.#08.131.247':9988
'20#.#08.221.78':9988
'20#.#08.253.20':9988
'20#.#08.70.230':445
'20#.#08.163.36':139
'20#.#08.45.149':139
'20#.#08.150.120':139
'20#.#08.7.107':139
'20#.#08.147.242':139
'20#.#08.195.190':139
'20#.#08.243.113':139
'20#.#08.26.36':139
'20#.#08.228.125':139
'20#.#08.70.230':139
'20#.#08.221.240':139
'20#.#08.131.247':139
'20#.#08.137.116':139
'20#.#08.42.76':139
'20#.#08.236.124':139
'20#.#08.89.11':139
'20#.#08.184.122':139
'20#.#08.154.182':139
'20#.#08.237.47':139
'20#.#08.152.102':139
'20#.#08.67.169':139
'20#.#08.117.148':139
'20#.#08.36.111':139
'20#.#08.42.53':139
'20#.#08.55.172':139
'20#.#08.35.167':139
'20#.#08.247.152':139
'20#.#08.68.230':139
'20#.#08.185.124':139
'20#.#08.191.215':139
'20#.#08.21.102':139
'20#.#08.218.185':139
'20#.#08.158.220':139
'20#.#08.146.10':139
'20#.#08.163.147':139
'20#.#08.147.3':139
'20#.#08.253.20':139
'20#.#08.130.170':139
'20#.#08.146.10':445
'20#.#08.130.170':445
'20#.#08.158.220':445
'20#.#08.21.102':445
'20#.#08.163.147':445
'20#.#08.152.102':445
'20#.#08.117.148':445
'20#.#08.36.111':445
'20#.#08.185.124':445
'20#.#08.191.215':445
'20#.#08.243.113':445
'20#.#08.218.185':445
'20#.#08.147.242':445
'20#.#08.195.190':445
'20#.#08.228.125':445
'20#.#08.147.3':445
'20#.#08.253.20':445
'20#.#08.45.149':445
'20#.#08.150.120':445
'20#.#08.86.136':139
'20#.#08.165.85':139
'20#.#08.24.69':139
'20#.#08.221.78':139
'20#.#08.25.41':139
'20#.#08.53.78':139
'20#.#08.34.215':139
'20#.#08.117.152':139
'20#.#08.101.90':139
'20#.#08.75.193':139
'20#.#08.42.53':445
'20#.#08.247.152':445
'20#.#08.67.169':445
'20#.#08.68.230':445
'20#.#08.55.172':445
'20#.#08.59.137':139
'20#.#08.34.185':139
'20#.#08.35.167':445
'20#.#08.121.254':139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней