Trojan.DownLoader10.3247

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WERa3d8.dir00\svchost.exe.mdmp 16325836412032480

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WERa3d8.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'20#.#41.188.176':445
'20#.#41.204.196':445
'20#.#41.13.79':445
'20#.#41.48.169':445
'20#.#41.139.39':445
'20#.#41.229.41':139
'20#.#41.105.23':139
'20#.#41.11.141':445
'20#.#41.165.138':445
'20#.241.4.0':445
'20#.#41.47.109':445
'20#.#41.63.131':445
'20#.#41.174.60':445
'20#.#41.212.11':445
'20#.#41.90.134':445
'20#.#41.0.203':445
'20#.#41.18.223':445
'20#.#41.112.183':445
'20#.#41.118.197':445
'20#.#41.143.109':139
'20#.#41.139.234':139
'20#.#41.13.180':139
'20#.#41.80.88':139
'20#.#41.54.66':139
'20#.#41.156.17':139
'20#.#41.17.47':139
'20#.#41.138.242':139
'20#.#41.24.96':139
'20#.#41.235.33':139
'20#.#41.201.170':139
'20#.#41.8.202':139
'20#.#41.5.189':139
'20#.#41.137.149':139
'20#.#41.3.144':139
'20#.#41.81.211':139
'20#.#41.199.129':139
'20#.#41.86.166':139
'20#.#41.122.35':139
'20#.#41.81.24':139
'20#.#41.28.33':445
'20#.#41.233.244':445
'20#.#41.182.186':445
'20#.#41.237.208':445
'20#.#41.232.38':445
'20#.#41.84.189':445
'20#.#41.27.7':445
'20#.#41.110.26':445
'20#.#41.159.241':445
'20#.#41.6.188':445
'20#.#41.165.254':445
'20#.#41.204.196':139
'20#.#41.139.39':139
'20#.#41.188.176':139
'20#.#41.48.169':139
'20#.#41.165.138':139
'20#.#41.193.135':445
'20#.#41.129.206':445
'20#.#41.11.141':139
'20#.#41.105.241':445
'20#.#41.99.110':445
'20#.#41.196.159':445
'20#.#41.222.82':445
'20#.#41.138.81':445
'20#.#41.0.219':445
'20#.#41.144.238':445
'20#.#41.31.205':445
'20#.#41.32.125':445
'20#.#41.37.125':445
'20#.#41.250.99':445
'20#.#41.84.240':445
'20#.#41.36.129':445
'20#.#41.60.36':445
'20#.#41.2.247':445
'20#.#41.223.180':445
'20#.#41.119.135':445
'20#.#41.132.145':445
'20#.#41.38.72':445
'20#.#41.220.83':445
'20#.#41.194.103':445
'20#.#41.169.182':139
'20#.#41.233.202':445
'20#.#41.202.172':445
'20#.#41.169.182':445
'20#.#41.30.245':445
'20#.#41.95.131':445
'20#.#41.227.148':445
'20#.#41.167.96':445
'20#.#41.19.107':445
'20#.#41.161.159':445
'20#.#41.138.242':445
'20#.#41.80.88':445
'20#.#41.139.234':445
'20#.#41.54.66':445
'20#.#41.201.170':445
'20#.#41.156.17':445
'20#.#41.235.33':445
'20#.#41.17.47':445
'20#.#41.13.180':445
'20#.#41.24.96':445
'20#.#41.67.141':445
'20#.#41.190.106':445
'20#.#41.116.141':445
'20#.#41.184.234':445
'20#.#41.106.119':445
'20#.#41.27.67':445
'20#.#41.250.51':445
'20#.#41.13.168':445
'20#.#41.108.61':445
'20#.#41.52.141':445
'20#.#41.37.25':445
'20#.#41.0.253':445
'20#.#41.96.14':445
'20#.#41.192.52':445
'20#.#41.39.195':445
'20#.#41.10.234':445
'20#.#41.15.130':445
'20#.#41.9.131':445
'20#.#41.237.154':445
'20#.#41.73.238':445
'20#.#41.86.166':445
'20#.#41.96.14':139
'20#.#41.10.234':139
'20#.#41.39.195':139
'20#.#41.0.253':139
'20#.#41.237.154':139
'20#.#41.15.130':139
'20#.#41.37.25':139
'20#.#41.73.238':139
'20#.#41.9.131':139
'20#.#41.192.52':139
'20#.#41.233.202':139
'20#.#41.95.131':139
'20#.#41.30.245':139
'20#.#41.202.172':139
'20#.#41.19.107':139
'20#.#41.167.96':139
'20#.#41.67.141':139
'20#.#41.161.159':139
'20#.#41.227.148':139
'20#.#41.184.234':139
'20#.#41.137.149':445
'20#.#41.5.189':445
'20#.#41.143.109':445
'20#.#41.3.144':445
'20#.#41.8.202':445
'20#.#41.199.129':445
'20#.#41.81.24':445
'20#.#41.81.211':445
'20#.#41.122.35':445
'20#.#41.105.23':445
'20#.#41.116.141':139
'20#.#41.27.67':139
'20#.#41.106.119':139
'20#.#41.190.106':139
'20#.#41.108.61':139
'20#.#41.13.168':139
'20#.#41.229.41':445
'20#.#41.52.141':139
'20#.#41.250.51':139
'20#.#41.13.79':139
'20#.#41.162.113':445
'20#.#41.120.243':445
'20#.#41.84.221':139
'20#.#41.111.208':445
'20#.#41.251.39':445
'20#.#41.175.230':445
'20#.#41.100.52':445
'20#.#41.97.154':445
'20#.#41.68.250':445
'20#.#41.193.213':139
'20#.#41.171.159':139
'20#.#41.186.81':139
'20#.#41.30.59':139
'20#.#41.174.72':139
'20#.#41.19.98':139
'20#.#41.149.32':139
'20#.#41.112.149':139
'20#.#41.119.78':139
'20#.#41.34.29':139
'20#.#41.164.245':445
'20#.#41.97.208':445
'20#.#41.144.186':445
'20#.#41.121.102':445
'20#.#41.72.70':445
'20#.#41.86.24':445
'20#.#41.109.169':445
'20#.#41.156.171':445
'20#.#41.248.180':445
'20#.#41.148.118':445
'20#.#41.56.126':445
'20#.#41.115.228':445
'20#.#41.126.183':445
'20#.#41.130.151':445
'20#.#41.113.38':445
'20#.#41.193.244':445
'20#.#41.235.99':445
'20#.#41.230.138':445
'20#.#41.215.190':445
'20#.#41.30.21':445
'20#.#41.110.81':139
'20#.#41.126.183':139
'20#.#41.193.244':139
'20#.#41.113.38':139
'20#.#41.115.228':139
'20#.#41.215.190':139
'20#.#41.230.138':139
'20#.#41.56.126':139
'20#.#41.30.21':139
'20#.#41.235.99':139
'20#.#41.130.151':139
'20#.#41.162.113':139
'20#.#41.111.208':139
'20#.#41.251.39':139
'20#.#41.120.243':139
'20#.#41.97.154':139
'20#.#41.100.52':139
'20#.#41.164.245':139
'20#.#41.68.250':139
'20#.#41.175.230':139
'20#.#41.121.102':139
'20#.#41.193.128':139
'20#.#41.86.7':139
'20#.#41.47.20':139
'20#.#41.90.140':139
'20#.#41.223.244':139
'20#.#41.36.69':139
'20#.#41.97.198':139
'20#.#41.101.195':139
'20#.#41.68.198':139
'20#.#41.29.197':139
'20#.#41.144.186':139
'20#.#41.86.24':139
'20#.#41.72.70':139
'20#.#41.97.208':139
'20#.#41.248.180':139
'20#.#41.156.171':139
'20#.#41.28.254':139
'20#.#41.148.118':139
'20#.#41.109.169':139
'20#.#41.28.254':445
'20#.#41.60.36':139
'20#.#41.119.135':139
'20#.#41.223.180':139
'20#.#41.36.129':139
'20#.#41.220.83':139
'20#.#41.38.72':139
'20#.#41.84.240':139
'20#.#41.194.103':139
'20#.#41.132.145':139
'20#.#41.2.247':139
'20#.#41.182.186':139
'20#.#41.84.189':139
'20#.#41.232.38':139
'20#.#41.233.244':139
'20#.#41.159.241':139
'20#.#41.110.26':139
'20#.#41.99.110':139
'20#.#41.6.188':139
'20#.#41.27.7':139
'20#.#41.138.81':139
'20#.#41.47.109':139
'20#.#41.90.134':139
'20#.#41.212.11':139
'20#.#41.63.131':139
'20#.#41.112.183':139
'20#.#41.18.223':139
'20#.241.4.0':139
'20#.#41.118.197':139
'20#.#41.0.203':139
'20#.#41.174.60':139
'20#.#41.222.82':139
'20#.#41.144.238':139
'20#.#41.0.219':139
'20#.#41.196.159':139
'20#.#41.37.125':139
'20#.#41.32.125':139
'20#.#41.28.33':139
'20#.#41.250.99':139
'20#.#41.31.205':139
'20#.#41.237.208':139
'20#.#41.174.72':445
'20#.#41.171.159':445
'20#.#41.110.81':445
'20#.#41.30.59':445
'20#.#41.186.81':445
'20#.#41.34.29':445
'20#.#41.149.32':445
'20#.#41.19.98':445
'20#.#41.119.78':445
'20#.#41.223.244':445
'20#.#41.90.140':445
'20#.#41.193.128':445
'20#.#41.29.197':445
'20#.#41.47.20':445
'20#.#41.86.7':445
'20#.#41.68.198':445
'20#.#41.97.198':445
'20#.#41.101.195':445
'20#.#41.36.69':445
'20#.#41.112.149':445
'20#.#41.171.159':9988
'20#.#41.36.69':9988
'20#.#41.72.70':9988
'20#.#41.86.24':9988
'20#.#41.101.195':9988
'20#.#41.129.206':139
'20#.#41.165.254':139
'20#.#41.105.241':139
'20#.#41.193.135':139
'20#.#41.121.102':9988
'20#.#41.175.230':9988
'20#.#41.115.228':9988
'20#.#41.193.213':445
'20#.#41.84.221':445
'20#.#41.120.243':9988
'20#.#41.193.244':9988
'20#.#41.56.126':9988
'20#.#41.126.183':9988
'20#.#41.97.154':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней