Trojan.DownLoader9.56170

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1116 -dm 7 7 %TEMP%\WERf3bf.dir00\svchost.exe.mdmp 16325836412030152

Modifies file system :

Creates the following files:

%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
<SYSTEM32>\urdvxc.exe
%TEMP%\WERf3bf.dir00\svchost.exe.mdmp
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe

Deletes itself.

Network activity:

Connects to:

'21#.#51.21.190':445
'21#.#51.124.165':445
'21#.#51.193.57':445
'21#.#51.58.30':445
'21#.#51.17.67':445
'21#.#51.216.33':139
'21#.#51.62.164':139
'21#.#51.82.43':139
'21#.#51.1.161':139
'21#.#51.106.158':445
'21#.#51.155.109':445
'21#.#51.81.194':445
'21#.#51.127.131':445
'21#.#51.237.108':445
'21#.#51.84.200':445
'21#.#51.235.119':445
'21#.#51.20.179':445
'21#.#51.38.132':445
'21#.#51.213.37':445
'21#.#51.181.58':139
'21#.#51.148.184':139
'21#.#51.88.174':139
'21#.#51.125.70':139
'21#.#51.12.150':139
'21#.#51.80.88':139
'21#.#51.100.148':139
'21#.#51.121.100':139
'21#.#51.119.221':139
'21#.#51.148.68':139
'21#.#51.9.249':139
'21#.#51.226.251':139
'21#.#51.171.250':139
'21#.#51.44.172':139
'21#.#51.156.32':139
'21#.#51.43.155':139
'21#.#51.42.137':139
'21#.#51.247.239':139
'21#.#51.243.154':139
'21#.#51.40.208':139
'21#.#51.215.214':445
'21#.#51.166.215':445
'21#.#51.107.116':445
'21#.#51.215.39':445
'21#.#51.119.166':445
'21#.#51.99.93':445
'21#.#51.57.0':445
'21#.#51.20.26':445
'21#.#51.143.100':445
'21#.#51.246.30':445
'21#.#51.17.67':139
'21#.#51.93.159':445
'21#.#51.21.190':139
'21#.#51.124.165':139
'21#.#51.145.166':445
'21#.#51.128.92':445
'21#.#51.128.128':445
'21#.#51.104.236':445
'21#.#51.92.105':445
'21#.#51.141.62':445
'21#.#51.43.189':445
'21#.#51.38.43':445
'21#.#51.183.21':445
'21#.#51.56.74':445
'21#.#51.52.38':445
'21#.#51.198.69':445
'21#.#51.20.198':445
'21#.#51.230.52':445
'21#.#51.241.78':445
'21#.#51.3.100':445
'21#.#51.243.94':445
'21#.#51.212.250':445
'21#.#51.15.172':445
'21#.#51.95.16':445
'21#.#51.15.127':445
'21#.#51.28.143':445
'21#.#51.90.225':445
'21#.#51.208.212':445
'21#.#51.8.163':445
'21#.#51.57.121':445
'21#.#51.180.57':445
'21#.#51.100.148':445
'21#.#51.121.100':445
'21#.#51.209.179':445
'21#.#51.26.123':445
'21#.#51.92.187':445
'21#.#51.55.104':445
'21#.#51.137.222':445
'21#.#51.148.68':445
'21#.#51.9.249':445
'21#.#51.125.70':445
'21#.#51.42.137':445
'21#.#51.247.239':445
'21#.#51.12.150':445
'21#.#51.80.88':445
'21#.#51.119.221':445
'21#.#51.148.184':445
'21#.#51.88.174':445
'21#.#51.12.229':445
'21#.#51.22.201':445
'21#.#51.103.22':445
'21#.#51.36.144':445
'21#.#51.201.35':445
'21#.#51.160.102':445
'21#.#51.174.0':445
'21#.#51.190.35':445
'21#.#51.250.239':445
'21#.#51.178.36':445
'21#.#51.37.10':445
'21#.#51.133.68':445
'21#.#51.133.96':445
'21#.#51.61.13':445
'21#.#51.68.61':445
'21#.#51.13.229':445
'21#.#51.9.247':445
'21#.#51.214.122':445
'21#.#51.165.48':445
'21#.#51.15.36':445
'21#.#51.13.229':139
'21#.#51.165.48':139
'21#.#51.133.68':139
'21#.#51.133.96':139
'21#.#51.15.36':139
'21#.#51.37.10':139
'21#.#51.36.144':139
'21#.#51.9.247':139
'21#.#51.214.122':139
'21#.#51.68.61':139
'21#.#51.209.179':139
'21#.#51.55.104':139
'21#.#51.57.121':139
'21#.#51.180.57':139
'21#.#51.137.222':139
'21#.#51.12.229':139
'21#.#51.61.13':139
'21#.#51.26.123':139
'21#.#51.92.187':139
'21#.#51.201.35':139
'21#.#51.44.172':445
'21#.#51.156.32':445
'21#.#51.62.164':445
'21#.#51.181.58':445
'21#.#51.226.251':445
'21#.#51.243.154':445
'21#.#51.40.208':445
'21#.#51.171.250':445
'21#.#51.43.155':445
'21#.#51.216.33':445
'21#.#51.160.102':139
'21#.#51.250.239':139
'21#.#51.22.201':139
'21#.#51.103.22':139
'21#.#51.178.36':139
'21#.#51.82.43':445
'21#.#51.1.161':445
'21#.#51.174.0':139
'21#.#51.190.35':139
'21#.#51.58.30':139
'21#.#51.51.119':445
'21#.#51.113.126':445
'21#.#51.148.70':139
'21#.#51.199.121':139
'21#.#51.70.63':445
'21#.#51.34.1':445
'21#.#51.14.165':445
'21#.#51.104.115':445
'21#.#51.79.154':445
'21#.#51.47.195':139
'21#.#51.200.152':139
'21#.#51.208.8':139
'21#.#51.236.71':139
'21#.#51.180.196':139
'21#.#51.243.124':139
'21#.#51.133.237':139
'21#.#51.69.133':139
'21#.#51.221.109':139
'21#.#51.39.41':139
'21#.#51.138.143':445
'21#.#51.207.12':445
'21#.#51.14.11':445
'21#.#51.231.10':445
'21#.#51.40.27':445
'21#.#51.117.14':445
'21#.#51.1.17':445
'21#.#51.96.244':445
'21#.#51.68.107':445
'21#.#51.75.60':445
'21#.#51.196.132':445
'21#.#51.0.61':445
'21#.#51.3.128':445
'21#.#51.117.67':445
'21#.#51.66.171':445
'21#.#51.51.118':445
'21#.#51.93.166':445
'21#.#51.25.54':445
'21#.#51.183.50':445
'21#.#51.194.35':445
'21#.#51.51.118':139
'21#.#51.183.50':139
'21#.#51.0.61':139
'21#.#51.3.128':139
'21#.#51.194.35':139
'21#.#51.196.132':139
'21#.#51.231.10':139
'21#.#51.93.166':139
'21#.#51.25.54':139
'21#.#51.66.171':139
'21#.#51.51.119':139
'21#.#51.104.115':139
'21#.#51.113.126':139
'21#.#51.70.63':139
'21#.#51.79.154':139
'21#.#51.138.143':139
'21#.#51.117.67':139
'21#.#51.34.1':139
'21#.#51.14.165':139
'21#.#51.40.27':139
'21#.#51.223.239':139
'21#.#51.41.83':139
'21#.#51.214.156':139
'21#.#51.17.251':139
'21#.#51.117.164':139
'21#.#51.211.52':139
'21#.#51.69.211':139
'21#.#51.50.109':139
'21#.#51.39.133':139
'21#.#51.69.243':139
'21#.#51.117.14':139
'21#.#51.68.107':139
'21#.#51.207.12':139
'21#.#51.14.11':139
'21#.#51.75.60':139
'21#.#51.173.221':139
'21#.#51.12.180':139
'21#.#51.1.17':139
'21#.#51.96.244':139
'21#.#51.212.250':139
'21#.#51.15.127':139
'21#.#51.95.16':139
'21#.#51.243.94':139
'21#.#51.208.212':139
'21#.#51.90.225':139
'21#.#51.3.100':139
'21#.#51.8.163':139
'21#.#51.28.143':139
'21#.#51.15.172':139
'21#.#51.166.215':139
'21#.#51.119.166':139
'21#.#51.215.39':139
'21#.#51.215.214':139
'21#.#51.20.26':139
'21#.#51.57.0':139
'21#.#51.141.62':139
'21#.#51.143.100':139
'21#.#51.99.93':139
'21#.#51.183.21':139
'21#.#51.84.200':139
'21#.#51.38.132':139
'21#.#51.155.109':139
'21#.#51.81.194':139
'21#.#51.213.37':139
'21#.#51.106.158':139
'21#.#51.193.57':139
'21#.#51.235.119':139
'21#.#51.20.179':139
'21#.#51.237.108':139
'21#.#51.38.43':139
'21#.#51.52.38':139
'21#.#51.56.74':139
'21#.#51.43.189':139
'21#.#51.230.52':139
'21#.#51.20.198':139
'21#.#51.127.131':139
'21#.#51.241.78':139
'21#.#51.198.69':139
'21#.#51.236.71':445
'21#.#51.180.196':445
'21#.#51.211.52':445
'21#.#51.69.211':445
'21#.#51.200.152':445
'21#.#51.221.109':445
'21#.#51.39.41':445
'21#.#51.208.8':445
'21#.#51.243.124':445
'21#.#51.39.133':445
'21#.#51.69.243':445
'21#.#51.214.156':445
'21#.#51.173.221':445
'21#.#51.12.180':445
'21#.#51.17.251':445
'21#.#51.117.164':445
'21#.#51.50.109':445
'21#.#51.223.239':445
'21#.#51.41.83':445
'21#.#51.133.237':445
'21#.#51.145.166':139
'21#.#51.104.236':139
'21#.#51.69.133':9988
'21#.#51.93.159':139
'21#.#51.92.105':139
'21#.#51.246.30':139
'21#.#51.107.116':139
'21#.#51.128.92':139
'21#.#51.128.128':139
'21#.#51.41.83':9988
'21#.#51.148.70':445
'21#.#51.199.121':445
'21#.#51.69.133':445
'21#.#51.47.195':445
'21#.#51.70.63':9988
'21#.#51.1.17':9988
'21#.#51.96.244':9988
'21#.#51.79.154':9988
'21#.#51.231.10':9988

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial