Trojan.Starman.6689

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs

Modifies file system :

Creates the following files:

%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Network activity:

Connects to:

'59.#1.7.141':445
'59.##.25.160':445
'59.##.59.228':445
'59.##.83.214':445
'59.#1.43.27':445
'59.#1.73.38':445
'59.##.112.141':445
'59.##.33.240':445
'59.#1.87.34':445
'59.##.231.78':445
'59.#1.1.1':445
'59.##.163.108':445
'59.##.233.130':445
'59.##.155.52':139
'59.##.112.168':139
'59.#1.71.23':139
'59.##.242.252':139
'59.##.94.208':139
'59.#1.51.46':139
'59.##.56.194':445
'59.##.13.242':445
'59.##.180.183':445
'59.##.123.154':445
'59.##.113.33':445
'59.##.100.169':445
'59.##.93.200':445
'59.##.134.179':445
'59.##.179.167':445
'59.##.10.135':445
'59.##.203.215':445
'59.##.195.53':445
'59.##.127.59':445
'59.##.27.127':445
'59.##.163.20':445
'59.#1.71.66':445
'59.##.242.252':445
'59.##.94.208':445
'59.#1.94.80':445
'59.##.242.135':445
'59.##.62.247':445
'59.##.198.177':445
'59.#1.78.5':445
'59.#1.70.4':445
'59.#1.59.94':445
'59.##.153.208':445
'59.##.177.225':445
'59.#1.88.38':445
'59.##.249.232':445
'59.##.225.57':445
'59.##.120.237':445
'59.##.95.239':445
'59.##.94.154':445
'59.##.111.12':445
'59.#1.43.27':139
'59.#1.73.38':139
'59.#1.7.141':139
'59.##.180.183':139
'59.##.123.154':139
'59.##.83.214':139
'59.##.25.160':139
'59.##.163.108':139
'59.##.233.130':139
'59.##.33.240':139
'59.##.59.228':139
'59.##.112.141':139
'59.#1.1.1':139
'59.##.30.219':445
'59.##.238.143':445
'59.#1.33.93':445
'59.##.43.225':445
'59.##.131.68':445
'59.##.218.159':445
'59.##.183.20':445
'59.##.100.169':139
'59.##.93.200':139
'59.##.13.242':139
'59.##.28.192':445
'59.##.56.194':139
'59.##.113.33':139
'59.#1.87.34':139
'59.##.127.59':139
'59.##.27.127':139
'59.##.179.167':139
'59.##.225.57':139
'59.##.120.237':139
'59.##.195.53':139
'59.##.10.135':139
'59.##.62.247':139
'59.#1.71.66':139
'59.#1.94.80':139
'59.##.203.215':139
'59.##.163.20':139
'59.##.242.135':139
'59.##.153.208':139
'59.##.177.225':139
'59.##.198.177':139
'59.##.231.78':139
'59.##.134.179':139
'59.#1.59.94':139
'59.#1.78.5':139
'59.#1.88.38':139
'59.##.111.12':139
'59.##.249.232':139
'59.##.95.239':139
'59.#1.70.4':139
'59.##.94.154':139
'59.##.147.98':445
'59.##.18.147':445
'59.##.36.188':445
'59.##.115.41':445
'59.##.199.25':445
'59.##.72.242':445
'59.##.188.217':445
'59.##.107.171':445
'59.##.106.16':445
'59.##.62.237':445
'59.##.217.240':445
'59.##.30.204':445
'59.##.72.113':445
'59.##.141.161':445
'59.#1.82.32':445
'59.##.219.97':445
'59.#1.33.78':139
'59.##.36.239':139
'59.##.249.70':445
'59.##.152.96':445
'59.##.93.160':445
'59.##.255.226':445
'59.#1.8.58':445
'59.##.164.219':445
'59.##.166.164':445
'59.##.28.137':445
'59.##.207.38':445
'59.#1.101.9':445
'59.##.91.220':445
'59.#1.47.1':445
'59.##.39.242':445
'59.##.54.242':445
'59.##.89.155':445
'59.##.241.46':445
'59.#1.3.201':445
'59.#1.33.78':445
'59.##.36.239':445
'59.##.170.249':445
'59.##.205.33':445
'59.##.51.205':445
'59.##.201.246':445
'59.#1.30.18':445
'59.#1.86.26':445
'59.#1.21.61':445
'59.##.67.177':445
'59.##.224.67':445
'59.#1.31.97':445
'59.#1.93.6':445
'59.#1.178.6':445
'59.##.242.20':445
'59.##.110.153':445
'59.##.193.173':445
'59.#1.57.79':445
'59.##.199.25':139
'59.##.72.242':139
'59.##.147.98':139
'59.##.28.137':139
'59.#1.8.58':139
'59.##.115.41':139
'59.##.18.147':139
'59.##.30.204':139
'59.##.72.113':139
'59.##.107.171':139
'59.##.217.240':139
'59.##.188.217':139
'59.##.36.188':139
'59.#1.71.23':445
'59.##.249.70':139
'59.##.141.161':139
'59.#1.51.46':445
'59.##.112.168':445
'59.##.155.52':445
'59.#1.82.32':139
'59.##.166.164':139
'59.##.255.226':139
'59.##.93.160':139
'59.##.219.97':139
'59.##.152.96':139
'59.##.164.219':139
'59.##.106.16':139
'59.##.39.242':139
'59.##.89.155':139
'59.#1.101.9':139
'59.#1.178.6':139
'59.##.242.20':139
'59.##.54.242':139
'59.##.91.220':139
'59.##.205.33':139
'59.##.51.205':139
'59.#1.3.201':139
'59.#1.47.1':139
'59.##.241.46':139
'59.##.170.249':139
'59.##.67.177':139
'59.##.224.67':139
'59.##.201.246':139
'59.##.62.237':139
'59.##.207.38':139
'59.#1.21.61':139
'59.#1.30.18':139
'59.##.193.173':139
'59.#1.57.79':139
'59.#1.93.6':139
'59.#1.86.26':139
'59.#1.31.97':139
'59.##.110.153':139
'59.#1.4.213':445
'59.##.48.153':445
'59.##.114.183':445
'59.##.125.43':445
'59.##.211.167':445
'59.##.147.185':445
'59.##.78.244':445
'59.##.91.214':445
'59.##.23.214':445
'59.#1.25.37':445
'59.##.221.152':445
'59.#1.105.3':445
'59.##.217.233':445
'59.##.99.182':445
'59.##.19.231':445
'59.##.66.218':445
'59.##.226.98':445
'59.##.171.34':445
'59.##.63.217':445
'59.##.204.30':445
'59.#1.46.47':445
'59.##.52.214':445
'59.##.235.70':445
'59.##.69.178':445
'59.##.101.253':445
'59.##.98.104':445
'59.##.22.209':445
'59.##.74.134':445
'59.##.90.181':445
'59.##.126.237':445
'59.##.163.252':445
'59.##.49.194':445
'59.##.79.150':445
'59.##.109.71':445
'59.##.171.34':9988
'59.##.63.217':9988
'59.##.99.182':9988
'59.##.141.37':445
'59.##.223.231':445
'59.##.230.155':9988
'59.#1.29.26':445
'59.##.134.219':445
'59.##.72.146':445
'59.#1.41.51':445
'59.#1.84.14':445
'59.##.47.219':445
'59.##.253.39':445
'59.##.62.158':445
'59.#1.4.46':445
'59.##.184.129':445
'59.##.27.110':445
'59.##.13.167':445
'59.##.195.86':445
'59.##.211.167':139
'59.##.147.185':139
'59.#1.4.213':139
'59.##.52.214':139
'59.##.235.70':139
'59.##.125.43':139
'59.##.48.153':139
'59.#1.105.3':139
'59.##.217.233':139
'59.##.91.214':139
'59.##.114.183':139
'59.##.78.244':139
'59.##.221.152':139
'59.##.171.34':139
'59.##.63.217':139
'59.##.99.182':139
'59.##.230.155':139
'59.##.226.98':139
'59.##.56.226':139
'59.##.19.231':139
'59.##.101.253':139
'59.##.98.104':139
'59.#1.46.47':139
'59.##.66.218':139
'59.##.204.30':139
'59.##.69.178':139
'59.##.23.214':139
'59.##.49.194':139
'59.##.79.150':139
'59.##.74.134':139
'59.#1.4.46':139
'59.##.184.129':139
'59.##.163.252':139
'59.##.90.181':139
'59.##.223.231':139
'59.##.230.155':445
'59.##.56.226':445
'59.##.126.237':139
'59.##.109.71':139
'59.##.141.37':139
'59.#1.84.14':139
'59.##.47.219':139
'59.#1.29.26':139
'59.#1.25.37':139
'59.##.22.209':139
'59.#1.41.51':139
'59.##.134.219':139
'59.##.13.167':139
'59.##.195.86':139
'59.##.62.158':139
'59.##.72.146':139
'59.##.253.39':139
'59.##.27.110':139
'59.##.212.133':445
'59.##.47.213':445
'59.##.132.209':445
'59.##.15.116':445
'59.##.229.191':445
'59.##.128.137':445
'59.#1.83.9':445
'59.##.236.192':445
'59.##.78.141':445
'59.#1.3.46':445
'59.##.164.137':445
'59.##.115.83':445
'59.##.79.191':445
'59.##.131.68':139
'59.##.218.159':139
'59.##.30.219':139
'59.##.242.39':139
'59.##.40.116':139
'59.##.43.225':139
'59.##.238.143':139
'59.##.46.183':445
'59.##.176.75':445
'59.#1.23.72':445
'59.#1.33.93':139
'59.##.183.20':139
'59.##.28.192':139
'59.##.205.42':445
'59.##.193.186':445
'59.##.212.75':445
'59.##.132.125':445
'59.##.153.63':445
'59.##.160.165':445
'59.##.149.240':445
'59.##.35.200':445
'59.##.40.179':445
'59.##.242.39':445
'59.##.40.116':445
'59.#1.96.72':445
'59.##.154.154':445
'59.##.188.45':445
'59.##.240.186':445
'59.##.219.29':445
'59.##.82.226':445
'59.##.214.103':445
'59.#1.56.38':445
'59.##.14.223':445
'59.##.112.187':445
'59.##.205.74':445
'59.#1.26.53':445
'59.##.217.252':445
'59.##.92.194':445
'59.#1.26.91':445
'59.##.101.191':445
'59.##.229.191':139
'59.##.128.137':139
'59.##.212.133':139
'59.##.46.183':139
'59.#1.23.72':139
'59.##.15.116':139
'59.##.47.213':139
'59.##.115.83':139
'59.##.79.191':139
'59.##.236.192':139
'59.##.132.209':139
'59.#1.83.9':139
'59.##.164.137':139
'59.##.114.183':9988
'59.##.221.152':9988
'59.#1.105.3':9988
'59.##.69.178':9988
'59.#1.46.47':9988
'59.##.125.43':9988
'59.#1.25.37':9988
'59.##.27.110':9988
'59.##.74.134':9988
'59.##.176.75':139
'59.##.217.233':9988
'59.##.22.209':9988
'59.##.47.219':9988
'59.##.78.141':139
'59.##.160.165':139
'59.##.149.240':139
'59.##.193.186':139
'59.#1.26.53':139
'59.##.217.252':139
'59.##.153.63':139
'59.##.212.75':139
'59.##.154.154':139
'59.##.188.45':139
'59.##.40.179':139
'59.##.132.125':139
'59.##.35.200':139
'59.#1.96.72':139
'59.#1.56.38':139
'59.##.14.223':139
'59.##.240.186':139
'59.#1.3.46':139
'59.##.205.42':139
'59.##.214.103':139
'59.##.219.29':139
'59.#1.26.91':139
'59.##.101.191':139
'59.##.205.74':139
'59.##.82.226':139
'59.##.112.187':139
'59.##.92.194':139

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial