Trojan.DownLoader10.8569

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WER9d94.dir00\svchost.exe.mdmp 16325836412032316

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WER9d94.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'14.#28.19.7':139
'14.##8.128.32':139
'14.##8.63.74':139
'14.##8.122.228':139
'14.##8.35.222':139
'14.##8.78.28':139
'14.##8.86.225':139
'14.##8.96.73':139
'14.##8.29.59':139
'14.##8.2.146':139
'14.##8.228.163':139
'14.##8.160.149':445
'14.##8.112.252':445
'14.##8.88.36':445
'14.##8.159.105':445
'14.##8.112.236':445
'14.##8.105.209':445
'14.##8.163.49':139
'14.##8.43.165':445
'14.##8.47.105':445
'14.##8.131.164':445
'14.##8.106.172':139
'14.##8.6.112':139
'14.##8.104.209':139
'14.##8.74.195':139
'14.##8.35.79':139
'14.##8.163.49':445
'14.##8.228.163':445
'14.##8.236.225':139
'14.##8.29.228':139
'14.##8.124.107':139
'14.##8.218.9':139
'14.##8.49.95':139
'14.##8.147.13':139
'14.##8.213.39':139
'14.##8.209.123':139
'14.##8.39.38':139
'14.##8.8.121':139
'14.##8.22.39':139
'14.##8.185.243':139
'14.##8.66.145':139
'14.##8.9.185':139
'14.##8.249.157':139
'14.##8.239.4':139
'14.##8.29.186':139
'14.##8.130.173':139
'14.##8.199.130':139
'14.##8.101.120':139
'14.##8.204.180':139
'14.##8.66.28':139
'14.##8.185.126':139
'14.##8.14.143':139
'14.#28.4.34':445
'14.##8.40.161':445
'14.##8.147.29':445
'14.##8.162.122':445
'14.##8.247.64':445
'14.##8.148.121':445
'14.##8.212.150':445
'14.##8.19.230':445
'14.##8.113.158':445
'14.##8.170.53':445
'14.##8.168.223':445
'14.##8.239.4':445
'14.##8.185.126':445
'14.##8.249.157':445
'14.##8.199.130':445
'14.##8.29.186':445
'14.##8.204.180':445
'14.##8.43.21':445
'14.##8.101.120':445
'14.##8.14.143':445
'14.##8.66.28':445
'14.##8.130.173':445
'14.##8.88.36':139
'14.##8.160.149':139
'14.##8.112.236':139
'14.##8.43.21':139
'14.##8.159.105':139
'14.##8.43.165':139
'14.##8.105.209':139
'14.##8.131.164':139
'14.##8.112.252':139
'14.##8.47.105':139
'14.##8.80.184':445
'14.##8.175.146':445
'14.##8.80.145':445
'14.##8.12.209':445
'14.##8.45.185':445
'14.##8.227.156':445
'14.##8.91.114':445
'14.##8.219.85':445
'14.##8.178.158':445
'14.##8.85.179':445
'14.##8.186.174':445
'14.##8.66.169':139
'14.##8.22.141':139
'14.#28.5.85':139
'14.##8.91.114':139
'14.##8.35.125':139
'14.##8.222.235':445
'14.##8.225.186':445
'14.##8.67.105':445
'14.##8.102.74':139
'14.##8.136.102':139
'14.##8.52.119':139
'14.##8.219.224':139
'14.##8.114.2':139
'14.##8.118.149':139
'14.##8.2.119':139
'14.##8.40.122':139
'14.##8.34.120':139
'14.##8.10.147':139
'14.##8.56.241':139
'14.##8.184.56':139
'14.##8.32.45':139
'14.##8.22.141':445
'14.##8.102.74':445
'14.##8.66.169':445
'14.##8.35.125':445
'14.#28.5.85':445
'14.##8.200.121':139
'14.##8.158.167':139
'14.#28.8.80':139
'14.##8.136.102':445
'14.##8.227.185':139
'14.##8.147.13':445
'14.##8.66.145':445
'14.##8.49.95':445
'14.##8.39.38':445
'14.##8.213.39':445
'14.##8.22.39':445
'14.##8.218.9':445
'14.##8.8.121':445
'14.##8.9.185':445
'14.##8.185.243':445
'14.##8.209.123':445
'14.#28.19.7':445
'14.##8.128.32':445
'14.##8.63.74':445
'14.##8.122.228':445
'14.##8.35.222':445
'14.##8.78.28':445
'14.##8.86.225':445
'14.##8.96.73':445
'14.##8.29.59':445
'14.##8.2.146':445
'14.##8.80.145':139
'14.##8.80.184':139
'14.##8.45.185':139
'14.##8.186.174':139
'14.##8.12.209':139
'14.##8.219.85':139
'14.##8.227.156':139
'14.##8.85.179':139
'14.##8.175.146':139
'14.##8.178.158':139
'14.##8.225.186':139
'14.##8.106.172':445
'14.##8.6.112':445
'14.##8.104.209':445
'14.##8.74.195':445
'14.##8.35.79':445
'14.##8.67.105':139
'14.##8.222.235':139
'14.##8.236.225':445
'14.##8.29.228':445
'14.##8.124.107':445
'14.##8.110.203':445
'14.##8.28.132':445
'14.##8.135.28':445
'14.##8.131.167':445
'14.##8.87.178':445
'14.##8.167.210':445
'14.##8.219.18':445
'14.##8.132.219':445
'14.##8.22.30':445
'14.##8.147.111':445
'14.##8.36.12':445
'14.##8.40.140':445
'14.##8.89.133':139
'14.##8.123.238':139
'14.##8.106.135':139
'14.##8.249.244':139
'14.##8.181.241':139
'14.##8.164.45':139
'14.##8.82.191':445
'14.##8.19.173':139
'14.#28.7.1':139
'14.##8.163.162':139
'14.#28.7.61':445
'14.##8.202.139':445
'14.##8.76.38':445
'14.##8.46.220':445
'14.##8.115.246':445
'14.#28.69.5':445
'14.##8.111.115':445
'14.##8.206.107':445
'14.##8.86.108':445
'14.##8.182.155':445
'14.##8.2.122':445
'14.##8.111.147':445
'14.##8.250.190':445
'14.##8.156.192':445
'14.##8.85.216':445
'14.##8.216.179':445
'14.#28.4.32':445
'14.##8.174.245':445
'14.##8.118.123':445
'14.##8.155.250':445
'14.##8.16.242':445
'14.##8.156.192':139
'14.##8.111.147':139
'14.##8.216.179':139
'14.##8.132.219':139
'14.##8.85.216':139
'14.##8.118.123':139
'14.#28.4.32':139
'14.##8.16.242':139
'14.##8.250.190':139
'14.##8.155.250':139
'14.##8.219.18':139
'14.##8.40.140':139
'14.##8.131.167':139
'14.##8.82.191':139
'14.##8.87.178':139
'14.##8.167.210':139
'14.##8.36.12':139
'14.##8.22.30':139
'14.##8.147.111':139
'14.##8.28.132':139
'14.##8.135.28':139
'14.##8.21.227':139
'14.##8.15.106':139
'14.##8.43.205':139
'14.##8.111.115':139
'14.#28.12.3':139
'14.##8.81.185':139
'14.##8.126.116':139
'14.##8.185.98':139
'14.##8.21.47':139
'14.##8.72.38':139
'14.#28.69.5':139
'14.##8.115.246':139
'14.##8.76.38':139
'14.##8.46.220':139
'14.##8.174.245':139
'14.##8.2.122':139
'14.##8.182.155':139
'14.##8.206.107':139
'14.##8.86.108':139
'14.#28.7.61':139
'14.##8.202.139':139
'14.##8.162.122':139
'14.##8.40.161':139
'14.##8.148.121':139
'14.##8.110.203':139
'14.##8.247.64':139
'14.##8.113.158':139
'14.##8.19.230':139
'14.##8.168.223':139
'14.##8.147.29':139
'14.##8.170.53':139
'14.##8.183.194':139
'14.##8.242.114':139
'14.##8.155.170':139
'14.##8.19.133':139
'14.##8.251.221':139
'14.#28.91.4':139
'14.##8.48.196':139
'14.##8.146.183':139
'14.##8.179.0':139
'14.##8.2.241':139
'14.##8.224.191':139
'14.##8.155.170':445
'14.##8.2.241':445
'14.##8.242.114':445
'14.#28.91.4':445
'14.##8.19.133':445
'14.##8.146.183':445
'14.##8.183.194':445
'14.##8.48.196':445
'14.##8.224.191':445
'14.##8.179.0':445
'14.##8.251.221':445
'14.##8.75.19':445
'14.##8.53.222':445
'14.##8.43.188':445
'14.##8.212.150':139
'14.#28.4.34':139
'14.##8.82.81':445
'14.##8.164.58':445
'14.##8.204.60':445
'14.##8.38.54':445
'14.##8.62.205':445
'14.#28.7.1':445
'14.##8.163.162':445
'14.##8.123.238':445
'14.##8.106.135':445
'14.##8.89.133':445
'14.##8.28.132':9988
'14.##8.87.178':9988
'14.##8.82.191':9988
'14.##8.19.173':445
'14.##8.164.45':445
'14.##8.181.241':445
'14.##8.15.106':445
'14.##8.21.47':445
'14.##8.21.227':445
'14.#28.12.3':445
'14.##8.43.205':445
'14.##8.126.116':445
'14.##8.249.244':445
'14.##8.81.185':445
'14.##8.72.38':445
'14.##8.185.98':445
'14.##8.75.19':139
'14.##8.53.222':139
'14.##8.43.188':139
'14.##8.111.115':9988
'14.##8.106.135':9988
'14.##8.82.81':139
'14.##8.164.58':139
'14.##8.204.60':139
'14.##8.38.54':139
'14.##8.62.205':139
'14.##8.86.108':9988
'14.##8.111.147':9988
'14.##8.2.122':9988
'14.##8.156.192':9988
'14.##8.36.12':9988
'14.##8.216.179':9988
'14.#28.7.61':9988
'14.##8.202.139':9988
'14.##8.76.38':9988
'14.##8.46.220':9988
'14.##8.115.246':9988

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней