Trojan.DownLoader8.33191

Техническая информация

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует запуск следующих системных утилит:

Диспетчера задач (Taskmgr)
Редактора реестра (RegEdit)

Запускает на исполнение:

<SYSTEM32>\net1.exe stop "Trend NT Realtime Service"
<SYSTEM32>\net.exe stop "McAfee WSC Integration"
<SYSTEM32>\net1.exe stop "PC-cillin Personal Firewall"
<SYSTEM32>\net.exe stop "Webroot Spy Sweeper Engine"
<SYSTEM32>\net.exe stop "McAfee Task Scheduler"
<SYSTEM32>\net1.exe stop "NOD32 Kernel Service"
<SYSTEM32>\net1.exe stop "Webroot Spy Sweeper Engine"
<SYSTEM32>\net.exe stop "McAfee Internet Guard Dog Pro"
<SYSTEM32>\net.exe stop "McAfee.com McShield"
<SYSTEM32>\net1.exe stop "SyGateService"
<SYSTEM32>\net1.exe stop "avast! iAVS4 Control Service"
<SYSTEM32>\net.exe stop "Trend NT Realtime Service"
<SYSTEM32>\net1.exe stop "avast! Antivirus"
<SYSTEM32>\net1.exe stop "eTrust Antivirus RPC Server"
<SYSTEM32>\net.exe stop "PC-cillin Personal Firewall"
<SYSTEM32>\net1.exe stop "Trend ServerProtect"
<SYSTEM32>\net1.exe stop "Panda Antivirus"
<SYSTEM32>\net.exe stop "NOD32 Kernel Service"
<SYSTEM32>\net1.exe stop "Trend ServerProtect Agent"
<SYSTEM32>\net.exe stop "SyGateService"
<SYSTEM32>\net1.exe stop "KAV Monitor Service"
<SYSTEM32>\net1.exe stop "VSMON"
<SYSTEM32>\net.exe stop "zaplus"
<SYSTEM32>\net1.exe stop "AVP Control Centre Service"
<SYSTEM32>\net1.exe stop "IPSEC Services"
<SYSTEM32>\net1.exe stop "zaplus"
<SYSTEM32>\net1.exe stop "Zonealarm.exe"
<SYSTEM32>\net1.exe stop "zlclient"
<SYSTEM32>\net.exe stop "Zonealarm.exe"
<SYSTEM32>\net1.exe stop "ZONEALARM"
<SYSTEM32>\net.exe stop "KAV Monitor Service"
<SYSTEM32>\net1.exe stop "McAfee WSC Integration"
<SYSTEM32>\net.exe stop "IPSEC Services"
<SYSTEM32>\net.exe stop "AVP Control Centre Service"
<SYSTEM32>\net1.exe stop "McAfee Task Scheduler"
<SYSTEM32>\net.exe stop "ZONEALARM"
<SYSTEM32>\net.exe stop "zlclient"
<SYSTEM32>\net1.exe stop "McAfee Internet Guard Dog Pro"
<SYSTEM32>\net.exe stop "VSMON"
<SYSTEM32>\net1.exe stop "McAfee.com McShield"
<SYSTEM32>\net1.exe stop "Tiny Personal Firewall"
<SYSTEM32>\net.exe stop "LOCKDOWN2000"
<SYSTEM32>\net1.exe stop "AntiVir PersonalEdition Classic Guard"
<SYSTEM32>\net.exe stop "Fprot.exe"
<SYSTEM32>\net.exe stop "Blackice Defender"
<SYSTEM32>\net.exe stop "Sygate Personal Firewall Pro"
<SYSTEM32>\net1.exe stop "Fprot.exe"
<SYSTEM32>\net1.exe stop "F-Prot.exe"
<SYSTEM32>\net.exe stop "WyvernWorks Firewall"
<SYSTEM32>\net1.exe stop "Sybergen Secure Desktop"
<SYSTEM32>\net.exe stop "AntiVir PersonalEdition Classic Guard"
<SYSTEM32>\net.exe stop "Tiny Personal Firewall"
<SYSTEM32>\net.exe stop "Norton AntiVirus Server"
<SYSTEM32>\net.exe stop "Norton Personal Firewall 2001"
<SYSTEM32>\net.exe stop "Norton Internet Security"
<SYSTEM32>\net.exe stop "F-Prot.exe"
<SYSTEM32>\net1.exe stop "Norton AntiVirus Server"
<SYSTEM32>\net1.exe stop "Norton Internet Security"
<SYSTEM32>\net1.exe stop "Norton Personal Firewall 2001"
<SYSTEM32>\net.exe stop "Sybergen Secure Desktop"
<SYSTEM32>\net.exe stop "avast! iAVS4 Control Service"
<SYSTEM32>\net1.exe stop "Sophos Anti-Virus"
<SYSTEM32>\net.exe stop "avast! Antivirus"
<SYSTEM32>\net.exe stop "eTrust Antivirus RPC Server"
<SYSTEM32>\net1.exe stop "Sygate Personal Firewall"
<SYSTEM32>\net1.exe stop "eTrust Antivirus Realtime Server"
<SYSTEM32>\net.exe stop "Panda Antivirus"
<SYSTEM32>\net.exe stop "Trend ServerProtect"
<SYSTEM32>\net.exe stop "Trend ServerProtect Agent"
<SYSTEM32>\net1.exe stop "eTrust Antivirus Job Server"
<SYSTEM32>\net1.exe stop "LOCKDOWN2000"
<SYSTEM32>\net.exe stop "Sophos Anti-Virus"
<SYSTEM32>\net.exe stop "Sygate Personal Firewall"
<SYSTEM32>\net.exe stop " Sygate Personal Firewall Pro"
<SYSTEM32>\net1.exe stop "Blackice Defender"
<SYSTEM32>\net1.exe stop "Sygate Personal Firewall Pro"
<SYSTEM32>\net1.exe stop " Sygate Personal Firewall Pro"
<SYSTEM32>\net.exe stop "eTrust Antivirus Realtime Server"
<SYSTEM32>\net.exe stop "eTrust Antivirus Job Server"
<SYSTEM32>\net1.exe stop "WyvernWorks Firewall"

Изменения в файловой системе:

Создает следующие файлы:

Сетевая активность:

Подключается к:

'un######0tnet.opendns.be':6667

UDP:

DNS ASK un######0tnet.opendns.be

Демо бесплатно на 14 дней

Выдаётся при установке

Скачать с сайта

Скачать с Google Play

Завантажте
Dr.Web для Android

Безкоштовно на 3 місяці
Всі компоненти захисту
Подовження демо в
AppGallery/Google Pay

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней