Trojan.Starman.5049

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1120 -dm 7 7 %TEMP%\WER16a3.dir00\svchost.exe.mdmp 16325836412032176

Изменения в файловой системе:

Создает следующие файлы:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%TEMP%\WER16a3.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Сетевая активность:

Подключается к:

'13#.#16.126.233':139
'13#.#16.61.24':139
'13#.#16.24.114':139
'13#.#16.195.237':139
'13#.#16.244.78':139
'13#.#16.139.183':139
'13#.#16.87.146':139
'13#.#16.201.211':139
'13#.#16.173.128':139
'13#.#16.246.194':139
'13#.#16.231.126':139
'13#.#16.75.135':139
'13#.#16.166.19':139
'13#.#16.81.241':139
'13#.#16.47.99':139
'13#.#16.36.115':139
'13#.#16.43.89':139
'13#.#16.190.168':139
'13#.#16.211.42':139
'13#.#16.136.150':139
'13#.#16.42.220':139
'13#.#16.61.28':139
'13#.#16.36.115':445
'13#.#16.81.241':445
'13#.#16.47.99':445
'13#.#16.212.229':445
'13#.#16.154.130':445
'13#.#16.42.220':445
'13#.#16.211.42':445
'13#.#16.136.150':445
'13#.#16.75.135':445
'13#.#16.166.19':445
'13#.#16.19.220':445
'13#.#16.47.26':139
'13#.#16.163.46':139
'13#.#16.181.46':139
'13#.#16.125.244':139
'13#.#16.127.125':139
'13#.#16.251.38':445
'13#.#16.219.250':445
'13#.#16.38.131':445
'13#.#16.58.167':139
'13#.#16.131.88':445
'13#.#16.154.130':139
'13#.#16.30.78':139
'13#.#16.219.30':139
'13#.#16.77.143':139
'13#.#16.106.13':139
'13#.#16.143.105':139
'13#.#16.118.110':139
'13#.#16.57.56':139
'13#.#16.60.43':139
'13#.#16.38.219':139
'13#.#16.85.39':139
'13#.#16.97.203':139
'13#.#16.46.186':445
'13#.#16.26.9':445
'13#.#16.53.61':445
'13#.#16.115.15':445
'13#.#16.213.206':445
'13#.#16.35.83':139
'13#.#16.120.102':139
'13#.#16.111.30':139
'13#.#16.139.128':139
'13#.#16.92.34':139
'13#.#16.139.128':445
'13#.#16.57.56':445
'13#.#16.131.88':139
'13#.#16.118.110':445
'13#.#16.85.39':445
'13#.#16.60.43':445
'13#.#16.19.220':139
'13#.#16.212.229':139
'13#.#16.219.250':139
'13#.#16.38.131':139
'13#.#16.251.38':139
'13#.#16.38.219':445
'13#.#16.120.102':445
'13#.#16.97.203':445
'13#.#16.35.83':445
'13#.#16.92.34':445
'13#.#16.111.30':445
'13#.#16.30.78':445
'13#.#16.219.30':445
'13#.#16.77.143':445
'13#.#16.106.13':445
'13#.#16.143.105':445
'13#.#16.44.241':139
'13#.#16.6.96':139
'13#.#16.100.88':139
'13#.#16.114.99':139
'13#.#16.88.114':139
'13#.#16.4.166':139
'13#.#16.99.45':139
'13#.#16.7.210':139
'13#.#16.204.147':139
'13#.#16.209.203':139
'13#.#16.127.64':139
'13#.#16.24.100':445
'13#.#16.81.68':445
'13#.#16.8.221':445
'13#.#16.191.225':445
'13#.#16.226.191':445
'13#.#16.172.82':139
'13#.#16.49.27':139
'13#.#16.44.65':445
'13#.#16.232.139':445
'13#.#16.217.221':445
'13#.#16.24.64':139
'13#.#16.169.104':139
'13#.#16.103.219':139
'13#.#16.173.86':139
'13#.#16.45.98':139
'13#.#16.55.69':139
'13#.#16.164.180':139
'13#.#16.207.187':139
'13#.#16.200.226':139
'13#.#16.90.130':139
'13#.#16.75.123':139
'13#.#16.21.148':139
'13#.#16.103.162':139
'13#.#16.157.211':139
'13#.#16.161.150':139
'13#.#16.139.24':139
'13#.#16.150.138':139
'13#.#16.63.73':139
'13#.#16.41.13':139
'13#.#16.134.181':139
'13#.#16.224.179':139
'13#.#16.161.106':139
'13#.#16.225.152':445
'13#.#16.125.244':445
'13#.#16.127.125':445
'13#.#16.61.28':445
'13#.#16.139.183':445
'13#.#16.87.146':445
'13#.#16.58.167':445
'13#.#16.230.120':139
'13#.#16.163.46':445
'13#.#16.181.46':445
'13#.#16.47.26':445
'13#.#16.201.211':445
'13#.#16.195.237':445
'13#.#16.244.78':445
'13#.#16.231.126':445
'13#.#16.43.89':445
'13#.#16.190.168':445
'13#.#16.173.128':445
'13#.#16.246.194':445
'13#.#16.61.24':445
'13#.#16.24.114':445
'13#.#16.126.233':445
'13#.#16.157.156':139
'13#.#16.230.120':445
'13#.#16.157.156':445
'13#.#16.44.65':139
'13#.#16.232.139':139
'13#.#16.217.221':139
'13#.#16.237.14':445
'13#.#16.122.244':445
'13#.#16.94.37':445
'13#.#16.65.201':445
'13#.#16.145.65':445
'13#.#16.81.68':139
'13#.#16.237.14':139
'13#.#16.122.244':139
'13#.#16.94.37':139
'13#.#16.65.201':139
'13#.#16.145.65':139
'13#.#16.8.221':139
'13#.#16.24.100':139
'13#.#16.226.191':139
'13#.#16.225.152':139
'13#.#16.191.225':139
'13#.#16.158.172':445
'13#.#16.11.82':445
'13#.#16.104.229':445
'13#.#16.97.83':445
'13#.#16.4.57':445
'13#.#16.195.198':445
'13#.#16.177.204':445
'13#.#16.230.163':445
'13#.#16.234.250':445
'13#.#16.20.226':445
'13#.#16.87.154':445
'13#.#16.68.114':445
'13#.#16.194.34':139
'13#.#16.130.193':139
'13#.#16.89.90':139
'13#.#16.162.226':139
'13#.#16.222.130':139
'13#.#16.99.46':445
'13#.#16.122.132':445
'13#.#16.130.164':445
'13#.#16.228.146':139
'13#.#16.22.108':139
'13#.#16.233.7':445
'13#.#16.39.130':445
'13#.#16.135.48':445
'13#.#16.74.136':445
'13#.#16.138.16':445
'13#.#16.70.45':445
'13#.#16.0.245':445
'13#.#16.58.26':445
'13#.#16.100.154':445
'13#.#16.91.124':445
'13#.#16.165.45':445
'13#.#16.75.2':445
'13#.#16.20.158':445
'13#.#16.117.47':445
'13#.#16.180.108':445
'13#.#16.84.2':445
'13#.#16.108.83':445
'13#.#16.68.27':445
'13#.#16.19.36':445
'13#.#16.27.83':445
'13#.#16.113.37':445
'13#.#16.84.88':445
'13#.#16.10.45':139
'13#.#16.233.7':139
'13#.#16.84.2':139
'13#.#16.230.163':139
'13#.#16.234.250':139
'13#.#16.177.204':139
'13#.#16.117.47':139
'13#.#16.113.37':139
'13#.#16.20.158':139
'13#.#16.108.83':139
'13#.#16.180.108':139
'13#.#16.87.154':139
'13#.#16.68.114':139
'13#.#16.4.57':139
'13#.#16.122.132':139
'13#.#16.99.46':139
'13#.#16.130.164':139
'13#.#16.104.229':139
'13#.#16.20.226':139
'13#.#16.11.82':139
'13#.#16.195.198':139
'13#.#16.97.83':139
'13#.#16.84.88':139
'13#.#16.95.67':139
'13#.#16.225.87':139
'13#.#16.58.26':139
'13#.#16.100.154':139
'13#.#16.0.245':139
'13#.#16.34.77':139
'13#.#16.118.253':139
'13#.#16.243.86':139
'13#.#16.134.244':139
'13#.#16.50.161':139
'13#.#16.165.45':139
'13#.#16.75.2':139
'13#.#16.138.16':139
'13#.#16.19.36':139
'13#.#16.27.83':139
'13#.#16.68.27':139
'13#.#16.135.48':139
'13#.#16.91.124':139
'13#.#16.39.130':139
'13#.#16.70.45':139
'13#.#16.74.136':139
'13#.#16.237.232':445
'13#.#16.162.11':445
'13#.#16.26.9':139
'13#.#16.53.61':139
'13#.#16.46.186':139
'13#.#16.146.227':445
'13#.#16.94.161':445
'13#.#16.224.224':445
'13#.#16.113.168':445
'13#.#16.235.144':445
'13#.#16.213.206':139
'13#.#16.18.4':139
'13#.#16.70.231':139
'13#.#16.127.71':139
'13#.#16.118.97':139
'13#.#16.37.98':139
'13#.#16.158.172':139
'13#.#16.115.15':139
'13#.#16.59.236':139
'13#.#16.224.70':139
'13#.#16.88.225':139
'13#.#16.4.94':445
'13#.#16.37.98':445
'13#.#16.127.71':445
'13#.#16.118.97':445
'13#.#16.163.103':445
'13#.#16.64.76':445
'13#.#16.88.225':445
'13#.#16.59.236':445
'13#.#16.224.70':445
'13#.#16.18.4':445
'13#.#16.70.231':445
'13#.#16.19.95':445
'13#.#16.104.242':445
'13#.#16.42.43':445
'13#.#16.92.44':445
'13#.#16.81.4':445
'13#.#16.156.80':445
'13#.#16.15.160':445
'13#.#16.105.100':445
'13#.#16.221.76':445
'13#.#16.108.59':445
'13#.#16.22.130':445
'13#.#16.64.76':139
'13#.#16.22.108':445
'13#.#16.130.164':9988
'13#.#16.228.146':445
'13#.#16.194.34':445
'13#.#16.130.193':445
'13#.#16.87.154':9988
'13#.#16.233.7':9988
'13#.#16.97.83':9988
'13#.#16.122.132':9988
'13#.#16.99.46':9988
'13#.#16.89.90':445
'13#.#16.50.161':445
'13#.#16.243.86':445
'13#.#16.134.244':445
'13#.#16.95.67':445
'13#.#16.225.87':445
'13#.#16.162.226':445
'13#.#16.222.130':445
'13#.#16.10.45':445
'13#.#16.34.77':445
'13#.#16.118.253':445
'13#.#16.108.83':9988
'13#.#16.108.59':139
'13#.#16.22.130':139
'13#.#16.42.43':139
'13#.#16.92.44':139
'13#.#16.104.242':139
'13#.#16.19.95':139
'13#.#16.163.103':139
'13#.#16.105.100':139
'13#.#16.221.76':139
'13#.#16.15.160':139
'13#.#16.156.80':139
'13#.#16.113.168':139
'13#.#16.235.144':139
'13#.#16.162.11':139
'13#.#16.75.2':9988
'13#.#16.237.232':139
'13#.#16.4.94':139
'13#.#16.81.4':139
'13#.#16.94.161':139
'13#.#16.224.224':139
'13#.#16.146.227':139

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней