Trojan.DownLoader10.3438

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'<SYSTEM32>\urdvxc.exe' /service
'<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
'<SYSTEM32>\urdvxc.exe' /installservice
'<SYSTEM32>\urdvxc.exe' /start

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%CommonProgramFiles%\System\ado\tsektjkj.exe
<SYSTEM32>\urdvxc.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe

Deletes itself.

Network activity:

Connects to:

'80.##3.229.93':139
'80.##3.193.56':139
'80.##3.145.207':139
'80.##3.136.226':139
'80.##3.122.216':139
'80.##3.52.32':139
'80.##3.8.132':139
'80.##3.0.145':139
'80.##3.48.18':139
'80.##3.130.155':139
'80.##3.18.189':139
'80.#23.5.9':139
'80.##3.114.168':445
'80.##3.238.142':445
'80.##3.196.41':445
'80.##3.67.124':445
'80.##3.142.129':445
'80.##3.194.147':445
'80.##3.6.140':445
'80.##3.112.238':139
'80.##3.40.226':139
'80.##3.78.19':445
'80.##3.89.52':445
'80.##3.191.248':445
'80.##3.18.76':139
'80.##3.9.181':445
'80.##3.34.31':445
'80.##3.175.128':445
'80.##3.194.147':139
'80.##3.114.168':139
'80.##3.196.41':139
'80.#23.9.44':445
'80.##3.6.140':139
'80.##3.78.19':139
'80.##3.121.226':445
'80.##3.21.142':445
'80.##3.61.175':445
'80.##3.206.135':139
'80.##3.167.164':139
'80.##3.142.159':139
'80.#23.26.2':139
'80.##3.95.43':139
'80.##3.173.94':139
'80.##3.67.124':139
'80.##3.137.1':139
'80.##3.238.142':139
'80.##3.142.129':139
'80.##3.157.114':139
'80.##3.56.158':139
'80.##3.233.138':139
'80.##3.172.228':139
'80.##3.39.87':139
'80.##3.153.206':139
'80.##3.116.105':139
'80.##3.138.226':139
'80.##3.130.151':139
'80.##3.151.100':139
'80.##3.101.35':139
'80.##3.206.201':139
'80.##3.39.33':139
'80.##3.58.131':139
'80.##3.35.252':139
'80.##3.46.249':139
'80.##3.101.112':139
'80.##3.30.214':139
'80.##3.55.40':139
'80.##3.108.214':139
'80.##3.200.246':139
'80.##3.12.126':139
'80.##3.58.153':139
'80.##3.153.206':445
'80.##3.36.57':445
'80.##3.22.109':139
'80.##3.36.57':139
'80.#23.26.2':445
'80.##3.95.43':445
'80.##3.173.94':445
'80.##3.8.132':445
'80.##3.48.18':445
'80.##3.18.76':445
'80.##3.56.158':445
'80.##3.157.114':445
'80.##3.137.1':445
'80.##3.206.135':445
'80.##3.167.164':445
'80.##3.142.159':445
'80.##3.52.32':445
'80.##3.136.226':445
'80.##3.229.93':445
'80.##3.112.238':445
'80.##3.40.226':445
'80.##3.122.216':445
'80.##3.18.189':445
'80.##3.0.145':445
'80.#23.5.9':445
'80.##3.193.56':445
'80.##3.145.207':445
'80.##3.130.155':445
'80.##3.89.52':139
'80.##3.1.129':445
'80.#23.83.0':445
'80.##3.248.152':445
'80.##3.218.44':445
'80.##3.117.64':445
'80.##3.192.175':445
'80.##3.152.207':445
'80.##3.55.240':445
'80.##3.91.113':445
'80.##3.152.38':445
'80.##3.174.177':445
'80.##3.175.248':445
'80.##3.65.13':445
'80.##3.11.20':445
'80.##3.211.3':445
'80.##3.17.214':445
'80.#23.46.7':445
'80.##3.32.38':445
'80.##3.159.45':445
'80.##3.200.233':445
'80.##3.52.18':445
'80.##3.53.135':445
'80.##3.178.159':445
'80.##3.254.119':445
'80.##3.155.12':445
'80.##3.22.60':445
'80.##3.120.249':445
'80.##3.2.181':445
'80.##3.73.32':445
'80.##3.194.91':445
'80.##3.92.237':445
'80.##3.204.185':445
'80.##3.191.95':445
'80.##3.34.229':445
'80.##3.84.175':445
'80.##3.228.190':445
'80.##3.146.80':445
'80.##3.235.149':445
'80.##3.191.231':445
'80.##3.61.70':445
'80.##3.74.193':445
'80.##3.211.174':445
'80.##3.183.149':445
'80.##3.221.80':445
'80.##3.193.193':445
'80.##3.98.196':445
'80.##3.112.59':445
'80.##3.80.160':445
'80.##3.83.66':445
'80.#23.9.44':139
'80.##3.61.175':139
'80.##3.121.226':139
'80.##3.162.239':445
'80.##3.9.181':139
'80.##3.8.122':445
'80.##3.175.128':139
'80.##3.45.81':139
'80.##3.138.152':139
'80.##3.21.142':139
'80.##3.162.239':139
'80.##3.34.31':139
'80.##3.242.46':445
'80.##3.30.233':445
'80.##3.6.146':445
'80.##3.191.248':139
'80.##3.138.152':445
'80.##3.60.20':445
'80.##3.160.203':445
'80.##3.146.108':445
'80.##3.136.122':445
'80.##3.45.81':445
'80.##3.144.182':445
'80.##3.207.90':445
'80.##3.30.233':139
'80.##3.151.4':445
'80.##3.167.185':445
'80.##3.198.146':445
'80.##3.177.86':445
'80.##3.25.34':445
'80.##3.251.228':445
'80.##3.175.107':445
'80.##3.71.49':445
'80.##3.9.218':445
'80.##3.36.181':445
'80.##3.165.208':445
'80.##3.153.65':445
'80.##3.207.90':139
'80.##3.144.182':139
'80.##3.160.203':139
'80.##3.242.46':139
'80.##3.60.20':139
'80.##3.6.146':139
'80.##3.94.68':445
'80.##3.243.182':445
'80.##3.177.12':445
'80.##3.136.122':139
'80.##3.146.108':139
'80.##3.171.91':445
'80.##3.121.132':139
'80.##3.56.249':139
'80.##3.253.4':139
'80.##3.87.174':139
'80.##3.161.213':139
'80.##3.192.197':139
'80.##3.143.191':139
'80.##3.11.108':139
'80.##3.33.122':139
'80.##3.164.185':139
'80.##3.110.108':139
'80.##3.72.205':139
'80.##3.70.63':139
'80.##3.85.109':139
'80.##3.165.193':139
'80.##3.236.3':139
'80.##3.60.118':445
'80.##3.210.169':445
'80.##3.9.172':139
'80.##3.119.89':139
'80.##3.88.45':139
'80.##3.237.222':139
'80.##3.153.54':139
'80.##3.103.66':139
'80.##3.40.77':139
'80.##3.201.199':139
'80.##3.32.52':445
'80.##3.52.65':445
'80.##3.65.14':445
'80.##3.210.169':139
'80.##3.85.123':445
'80.##3.150.121':445
'80.#23.8.83':445
'80.##3.83.167':445
'80.##3.167.107':445
'80.##3.245.172':445
'80.##3.244.188':445
'80.##3.189.8':445
'80.##3.71.184':139
'80.##3.89.120':139
'80.##3.216.223':139
'80.##3.237.86':139
'80.##3.11.13':139
'80.##3.27.59':139
'80.##3.60.118':139
'80.##3.174.69':139
'80.##3.140.135':139
'80.##3.60.136':139
'80.##3.214.39':139
'80.##3.51.205':139
'80.##3.178.94':139
'80.##3.85.109':445
'80.##3.165.193':445
'80.##3.206.221':139
'80.##3.9.220':139
'80.##3.9.172':445
'80.##3.161.213':445
'80.##3.192.197':445
'80.##3.88.45':445
'80.##3.153.54':445
'80.##3.236.3':445
'80.##3.143.191':445
'80.##3.180.30':139
'80.##3.174.230':139
'80.##3.129.191':139
'80.##3.186.161':139
'80.##3.34.12':139
'80.##3.25.65':139
'80.##3.6.175':139
'80.##3.43.78':139
'80.##3.39.101':139
'80.##3.31.56':139
'80.##3.96.59':139
'80.#23.44.4':139
'80.##3.103.66':445
'80.##3.71.184':445
'80.##3.27.59':445
'80.##3.89.120':445
'80.##3.11.13':445
'80.##3.201.199':445
'80.##3.237.86':445
'80.##3.51.205':445
'80.##3.174.69':445
'80.##3.140.135':445
'80.##3.60.136':445
'80.##3.216.223':445
'80.##3.214.39':445
'80.##3.56.249':445
'80.##3.253.4':445
'80.##3.72.205':445
'80.##3.119.89':445
'80.##3.40.77':445
'80.##3.237.222':445
'80.##3.87.174':445
'80.##3.110.108':445
'80.##3.164.185':445
'80.##3.70.63':445
'80.##3.33.122':445
'80.##3.11.108':445
'80.##3.123.34':445
'80.##3.246.208':139
'80.##3.100.229':139
'80.##3.248.248':139
'80.##3.100.62':139
'80.##3.39.219':139
'80.##3.34.158':139
'80.##3.248.200':139
'80.##3.50.62':139
'80.##3.99.77':139
'80.##3.245.228':139
'80.##3.191.143':139
'80.##3.200.246':445
'80.##3.46.249':445
'80.##3.101.112':445
'80.#23.0.64':139
'80.##3.30.214':445
'80.##3.133.108':445
'80.##3.121.132':445
'80.##3.185.180':139
'80.##3.9.185':139
'80.##3.181.36':139
'80.##3.41.161':139
'80.##3.140.9':139
'80.##3.40.137':139
'80.##3.56.101':139
'80.##3.172.228':445
'80.##3.130.151':445
'80.##3.39.33':445
'80.##3.206.201':445
'80.##3.101.35':445
'80.##3.58.131':445
'80.##3.104.76':139
'80.##3.118.174':139
'80.##3.133.108':139
'80.##3.55.104':139
'80.##3.206.55':139
'80.##3.151.100':445
'80.##3.223.144':139
'80.##3.123.71':139
'80.##3.233.138':445
'80.##3.85.65':139
'80.##3.204.7':139
'80.##3.25.76':139
'80.##3.116.105':445
'80.##3.58.153':445
'80.##3.138.226':445
'80.##3.12.126':445
'80.##3.39.87':445
'80.##3.22.109':445
'80.##3.55.162':139
'80.##3.67.221':139
'80.##3.221.89':139
'80.##3.83.167':139
'80.##3.167.107':139
'80.##3.123.34':139
'80.##3.39.219':445
'80.##3.40.137':445
'80.#23.0.64':445
'80.##3.100.62':445
'80.##3.185.180':445
'80.##3.41.161':445
'80.##3.85.123':139
'80.##3.150.121':139
'80.##3.32.52':139
'80.##3.55.162':445
'80.##3.67.221':445
'80.##3.221.89':445
'80.##3.244.188':139
'80.##3.189.8':139
'80.#23.8.83':139
'80.##3.52.65':139
'80.##3.65.14':139
'80.##3.245.172':139
'80.##3.9.185':445
'80.##3.123.71':445
'80.##3.204.7':445
'80.##3.206.55':445
'80.##3.99.77':445
'80.##3.85.65':445
'80.##3.223.144':445
'80.##3.55.40':445
'80.##3.118.174':445
'80.##3.35.252':445
'80.##3.104.76':445
'80.##3.55.104':445
'80.##3.108.214':445
'80.##3.100.229':445
'80.##3.248.248':445
'80.##3.34.158':445
'80.##3.245.228':445
'80.##3.246.208':445
'80.##3.181.36':445
'80.##3.50.62':445
'80.##3.191.143':445
'80.##3.25.76':445
'80.##3.140.9':445
'80.##3.56.101':445
'80.##3.248.200':445
'80.##3.159.234':445
'80.##3.74.201':139
'80.##3.27.226':139
'80.##3.106.116':139
'80.##3.68.37':139
'80.##3.195.249':139
'80.##3.5.181':139
'80.#23.1.4':139
'80.#23.4.86':139
'80.##3.86.86':139
'80.##3.116.66':139
'80.##3.65.199':139
'80.##3.200.0':139
'80.##3.16.140':139
'80.##3.186.48':139
'80.##3.175.32':139
'80.##3.197.155':139
'80.##3.13.243':139
'80.##3.119.103':139
'80.##3.77.92':139
'80.##3.10.82':139
'80.##3.42.90':139
'80.#23.32.0':139
'80.##3.222.130':139
'80.##3.59.181':139
'80.##3.85.134':139
'80.##3.144.208':139
'80.##3.22.167':139
'80.##3.195.45':9988
'80.##3.233.82':139
'80.##3.171.87':139
'80.##3.247.45':139
'80.##3.247.136':445
'80.##3.207.187':445
'80.##3.116.58':445
'80.##3.214.64':9988
'80.##3.212.117':445
'80.##3.236.64':445
'80.##3.41.90':139
'80.##3.102.41':139
'80.##3.29.113':139
'80.##3.133.201':139
'80.##3.68.161':139
'80.##3.116.41':139
'80.##3.17.152':139
'80.##3.24.29':139
'80.##3.94.15':139
'80.##3.29.99':139
'80.##3.121.194':139
'80.##3.0.235':139
'80.##3.68.37':445
'80.##3.195.249':445
'80.##3.42.90':445
'80.##3.10.82':445
'80.##3.222.130':445
'80.##3.59.181':445
'80.#23.1.4':445
'80.##3.106.116':445
'80.##3.29.113':445
'80.##3.5.181':445
'80.##3.74.201':445
'80.##3.102.41':445
'80.##3.112.226':445
'80.##3.132.243':139
'80.##3.197.155':445
'80.##3.187.186':445
'80.##3.197.56':139
'80.##3.175.32':445
'80.##3.13.243':445
'80.##3.16.140':445
'80.#23.32.0':445
'80.##3.119.103':445
'80.##3.130.197':445
'80.##3.186.48':445
'80.##3.200.0':445
'80.##3.94.15':445
'80.##3.22.167':445
'80.##3.233.82':445
'80.##3.0.235':445
'80.##3.17.152':445
'80.##3.24.29':445
'80.##3.112.226':139
'80.##3.187.186':139
'80.##3.130.197':139
'80.##3.247.45':445
'80.##3.171.87':445
'80.##3.144.208':445
'80.##3.86.86':445
'80.##3.85.134':445
'80.#23.4.86':445
'80.##3.27.226':445
'80.##3.65.199':445
'80.##3.116.66':445
'80.##3.116.41':445
'80.##3.29.99':445
'80.##3.121.194':445
'80.##3.68.161':445
'80.##3.133.201':445
'80.##3.41.90':445
'80.##3.193.18':445
'80.##3.51.20':139
'80.##3.149.156':139
'80.##3.152.201':139
'80.##3.128.129':139
'80.##3.236.179':139
'80.##3.195.45':139
'80.##3.83.190':139
'80.##3.69.129':139
'80.##3.39.224':139
'80.##3.46.200':139
'80.##3.44.195':139
'80.##3.55.50':139
'80.##3.201.175':139
'80.##3.193.18':139
'80.##3.84.200':139
'80.##3.207.187':139
'80.##3.116.58':139
'80.##3.231.64':139
'80.##3.207.108':139
'80.##3.214.64':139
'80.##3.85.143':139
'80.##3.35.53':139
'80.##3.107.210':139
'80.##3.20.40':139
'80.##3.25.207':139
'80.##3.164.84':139
'80.##3.72.30':139
'80.##3.221.24':139
'80.##3.174.161':139
'80.##3.80.120':139
'80.##3.65.83':139
'80.##3.16.137':139
'80.##3.41.43':139
'80.##3.28.45':139
'80.##3.189.93':139
'80.##3.156.105':139
'80.##3.52.181':139
'80.##3.253.219':139
'80.##3.220.87':139
'80.##3.73.238':139
'80.##3.236.230':139
'80.##3.213.5':139
'80.##3.218.69':139
'80.##3.35.219':139
'80.##3.34.248':139
'80.##3.237.244':139
'80.##3.14.165':139
'80.##3.117.236':139
'80.##3.199.231':139
'80.##3.44.195':445
'80.##3.39.224':445
'80.##3.218.69':445
'80.##3.83.190':445
'80.##3.253.219':445
'80.##3.65.83':445
'80.##3.236.230':445
'80.##3.236.179':445
'80.##3.195.45':445
'80.##3.128.129':445
'80.##3.51.20':445
'80.##3.46.200':445
'80.##3.84.200':445
'80.##3.107.210':445
'80.##3.20.40':445
'80.##3.35.53':445
'80.##3.201.175':445
'80.##3.231.64':445
'80.##3.25.207':445
'80.##3.213.5':445
'80.##3.149.156':445
'80.##3.207.108':445
'80.##3.214.64':445
'80.##3.85.143':445
'80.##3.55.50':445
'80.##3.156.105':445
'80.##3.174.161':445
'80.##3.41.43':445
'80.##3.221.24':445
'80.##3.14.165':445
'80.##3.199.231':445
'80.##3.247.136':139
'80.##3.212.117':139
'80.##3.236.64':139
'80.##3.16.137':445
'80.##3.52.181':445
'80.##3.28.45':445
'80.##3.164.84':445
'80.##3.117.236':445
'80.##3.73.238':445
'80.##3.152.201':445
'80.##3.69.129':445
'80.##3.72.30':445
'80.##3.220.87':445
'80.##3.189.93':445
'80.##3.34.248':445
'80.##3.35.219':445
'80.##3.237.244':445
'80.##3.80.120':445
'80.##3.77.92':445
'80.##3.193.193':139
'80.##3.194.91':139
'80.##3.92.237':139
'80.##3.146.80':139
'80.##3.22.60':139
'80.##3.2.181':139
'80.##3.32.95':445
'80.##3.94.119':445
'80.##3.4.246':445
'80.##3.164.253':139
'80.##3.84.175':139
'80.##3.27.233':445
'80.##3.80.160':139
'80.##3.34.229':139
'80.##3.159.234':139
'80.##3.112.59':139
'80.##3.83.66':139
'80.##3.221.80':139
'80.##3.120.249':139
'80.##3.204.185':139
'80.##3.73.32':139
'80.##3.98.196':139
'80.##3.191.95':139
'80.##3.228.190':139
'80.##3.184.147':445
'80.##3.4.246':139
'80.##3.118.84':139
'80.#23.4.37':139
'80.##3.59.137':139
'80.##3.61.225':139
'80.##3.184.147':139
'80.##3.235.118':139
'80.##3.214.71':139
'80.##3.160.162':445
'80.##3.254.216':139
'80.##3.253.9':139
'80.##3.9.235':139
'80.##3.253.9':445
'80.##3.118.84':445
'80.##3.254.216':445
'80.##3.61.225':445
'80.##3.59.137':445
'80.#23.4.37':445
'80.##3.32.95':139
'80.##3.27.233':139
'80.##3.94.119':139
'80.##3.235.118':445
'80.##3.9.235':445
'80.##3.214.71':445
'80.##3.36.181':139
'80.#23.46.7':139
'80.##3.198.146':139
'80.##3.53.135':139
'80.##3.211.3':139
'80.##3.153.65':139
'80.##3.171.91':139
'80.##3.177.12':139
'80.##3.251.228':139
'80.##3.178.159':139
'80.##3.165.208':139
'80.##3.243.182':139
'80.##3.9.218':139
'80.##3.25.34':139
'80.##3.32.38':139
'80.##3.164.253':445
'80.##3.151.4':139
'80.##3.175.107':139
'80.##3.177.86':139
'80.##3.65.13':139
'80.##3.159.45':139
'80.##3.71.49':139
'80.##3.17.214':139
'80.##3.11.20':139
'80.##3.94.68':139
'80.##3.91.113':139
'80.##3.155.12':139
'80.##3.13.58':445
'80.#23.83.0':139
'80.##3.174.177':139
'80.##3.55.240':139
'80.##3.235.149':139
'80.##3.211.174':139
'80.##3.61.70':139
'80.##3.191.231':139
'80.##3.74.193':139
'80.##3.183.149':139
'80.##3.52.18':139
'80.##3.117.64':139
'80.##3.218.44':139
'80.##3.167.185':139
'80.##3.254.119':139
'80.##3.200.233':139
'80.##3.152.207':139
'80.##3.248.152':139
'80.##3.152.38':139
'80.##3.1.129':139
'80.##3.192.175':139
'80.##3.175.248':139
'80.##3.16.121':445
'80.##3.87.90':139
'80.##3.131.220':139
'80.##3.165.48':139
'80.##3.51.243':139
'80.##3.102.223':139
'80.##3.64.196':139
'80.##3.43.168':139
'80.##3.235.105':139
'80.##3.209.234':139
'80.##3.48.210':139
'80.##3.94.251':139
'80.#23.6.39':139
'80.##3.158.46':139
'80.##3.208.10':139
'80.#23.4.57':139
'80.##3.16.121':139
'80.##3.177.16':139
'80.##3.115.11':139
'80.##3.36.189':139
'80.##3.218.207':139
'80.##3.66.212':139
'80.##3.198.178':139
'80.##3.163.97':139
'80.##3.146.221':139
'80.##3.192.164':139
'80.##3.78.251':139
'80.##3.138.207':139
'80.#23.47.2':139
'80.##3.106.148':139
'80.##3.13.250':139
'80.##3.13.104':139
'80.##3.12.166':139
'80.##3.166.152':139
'80.##3.153.29':139
'80.##3.98.251':139
'80.##3.53.121':139
'80.##3.207.12':139
'80.##3.163.123':139
'80.##3.255.125':139
'80.##3.202.216':139
'80.##3.56.163':139
'80.##3.106.56':139
'80.##3.90.196':139
'80.##3.144.200':139
'80.##3.108.145':139
'80.##3.40.202':139
'80.##3.153.29':445
'80.##3.132.243':445
'80.##3.197.56':445
'80.##3.90.196':445
'80.#23.4.57':445
'80.##3.198.178':445
'80.##3.48.210':445
'80.##3.192.164':445
'80.##3.131.220':445
'80.##3.36.189':445
'80.##3.51.243':445
'80.##3.56.163':445
'80.##3.218.207':445
'80.##3.163.97':445
'80.##3.66.212':445
'80.##3.115.11':445
'80.##3.208.10':445
'80.##3.158.46':445
'80.##3.32.197':445
'80.##3.162.132':445
'80.##3.177.16':445
'80.##3.43.168':445
'80.##3.144.200':445
'80.#23.6.39':445
'80.##3.94.251':445
'80.##3.146.221':445
'80.##3.202.216':445
'80.##3.102.223':445
'80.##3.166.152':445
'80.##3.53.121':445
'80.##3.13.104':445
'80.##3.207.12':445
'80.##3.12.166':445
'80.##3.138.207':445
'80.##3.162.132':139
'80.##3.160.162':139
'80.##3.32.197':139
'80.#23.47.2':445
'80.##3.78.251':445
'80.##3.98.251':445
'80.##3.235.105':445
'80.##3.108.145':445
'80.##3.255.125':445
'80.##3.64.196':445
'80.##3.87.90':445
'80.##3.165.48':445
'80.##3.40.202':445
'80.##3.106.148':445
'80.##3.13.250':445
'80.##3.209.234':445
'80.##3.106.56':445
'80.##3.163.123':445

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial