Trojan.Starman.4977

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Malicious functions:

Executes the following:

'<SYSTEM32>\svchost.exe' -k netsvcs

Modifies file system :

Creates the following files:

%CommonProgramFiles%\System\ado\tsektjkj.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
%PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe

Network activity:

Connects to:

'67.#3.69.49':445
'67.##.152.90':445
'67.##.199.66':445
'67.##.138.66':445
'67.##.209.76':445
'67.##.205.209':445
'67.##.127.74':445
'67.##.83.207':445
'67.##.172.156':445
'67.##.199.169':445
'67.##.62.225':445
'67.##.246.241':445
'67.##.105.213':445
'67.##.165.42':445
'67.##.80.250':445
'67.##.84.231':445
'67.#3.14.43':445
'67.##.188.193':445
'67.##.66.125':445
'67.##.201.10':445
'67.##.243.33':445
'67.##.212.242':445
'67.##.250.155':445
'67.##.182.197':445
'67.#3.19.56':445
'67.##.239.208':445
'67.##.240.46':139
'67.##.226.233':139
'67.##.210.109':445
'67.##.145.165':445
'67.##.111.45':445
'67.##.38.137':139
'67.##.26.168':139
'67.##.27.106':139
'67.##.66.227':139
'67.##.133.99':139
'67.##.219.102':139
'67.#3.30.50':445
'67.#3.0.49':445
'67.#3.8.83':445
'67.#3.38.97':445
'67.#3.40.76':445
'67.#3.68.88':445
'67.##.252.216':445
'67.##.75.119':445
'67.##.116.201':445
'67.##.223.14':445
'67.#3.54.93':445
'67.##.83.143':445
'67.##.211.124':445
'67.##.143.249':445
'67.#3.19.56':139
'67.##.201.10':139
'67.##.243.33':139
'67.##.84.231':139
'67.##.250.155':139
'67.##.182.197':139
'67.##.209.76':139
'67.##.205.209':139
'67.#3.69.49':139
'67.##.212.242':139
'67.##.105.213':139
'67.##.138.66':139
'67.##.80.250':139
'67.#3.16.4':445
'67.#3.54.53':445
'67.##.48.246':445
'67.##.120.92':445
'67.##.112.58':445
'67.##.225.29':445
'67.##.188.193':139
'67.##.66.125':139
'67.##.165.42':139
'67.##.156.211':445
'67.##.143.249':139
'67.#3.14.43':139
'67.##.211.124':139
'67.##.75.119':139
'67.##.116.201':139
'67.#3.38.97':139
'67.#3.54.93':139
'67.##.83.143':139
'67.##.145.165':139
'67.##.111.45':139
'67.##.239.208':139
'67.##.223.14':139
'67.#3.30.50':139
'67.##.210.109':139
'67.#3.8.83':139
'67.##.62.225':139
'67.##.246.241':139
'67.##.127.74':139
'67.##.152.90':139
'67.##.199.66':139
'67.##.199.169':139
'67.#3.68.88':139
'67.##.252.216':139
'67.#3.0.49':139
'67.##.83.207':139
'67.##.172.156':139
'67.#3.40.76':139
'67.##.240.46':445
'67.##.94.223':445
'67.##.104.53':445
'67.##.35.153':445
'67.##.112.253':445
'67.##.16.243':445
'67.#3.53.7':445
'67.#3.34.42':445
'67.##.196.33':445
'67.##.211.12':445
'67.##.45.128':445
'67.##.86.216':445
'67.##.181.51':445
'67.##.182.88':445
'67.##.171.41':445
'67.##.172.170':445
'67.##.120.172':445
'67.##.177.103':445
'67.##.222.208':445
'67.#3.42.59':445
'67.#3.121.2':445
'67.#3.164.0':445
'67.##.148.217':445
'67.##.223.120':445
'67.##.110.83':445
'67.#3.2.43':445
'67.##.231.74':445
'67.##.231.246':139
'67.##.40.200':139
'67.##.254.126':445
'67.##.212.253':445
'67.##.251.206':445
'67.##.162.168':139
'67.##.115.209':139
'67.#3.14.14':139
'67.##.103.88':139
'67.#3.51.75':139
'67.##.138.36':139
'67.##.211.21':445
'67.##.42.128':445
'67.##.14.140':445
'67.#3.6.125':445
'67.##.104.81':445
'67.##.75.229':445
'67.#3.85.85':445
'67.##.72.143':445
'67.##.105.207':445
'67.#3.6.235':445
'67.#3.26.6':445
'67.##.156.78':445
'67.##.139.67':445
'67.##.57.214':445
'67.#3.2.43':139
'67.#3.121.2':139
'67.#3.164.0':139
'67.##.120.172':139
'67.##.223.120':139
'67.##.110.83':139
'67.##.16.243':139
'67.#3.53.7':139
'67.##.94.223':139
'67.##.148.217':139
'67.##.182.88':139
'67.##.112.253':139
'67.##.172.170':139
'67.##.219.102':445
'67.##.38.137':445
'67.##.26.168':445
'67.##.226.233':445
'67.##.66.227':445
'67.##.133.99':445
'67.##.222.208':139
'67.#3.42.59':139
'67.##.171.41':139
'67.##.27.106':445
'67.##.57.214':139
'67.##.177.103':139
'67.##.139.67':139
'67.##.72.143':139
'67.##.105.207':139
'67.#3.6.125':139
'67.#3.26.6':139
'67.##.156.78':139
'67.##.212.253':139
'67.##.251.206':139
'67.##.231.74':139
'67.#3.6.235':139
'67.##.211.21':139
'67.##.254.126':139
'67.##.14.140':139
'67.##.86.216':139
'67.##.181.51':139
'67.#3.34.42':139
'67.##.104.53':139
'67.##.35.153':139
'67.##.45.128':139
'67.##.75.229':139
'67.#3.85.85':139
'67.##.42.128':139
'67.##.196.33':139
'67.##.211.12':139
'67.##.104.81':139
'67.##.14.194':445
'67.##.147.105':445
'67.##.194.150':445
'67.##.218.82':445
'67.##.223.243':445
'67.##.178.53':445
'67.##.111.182':445
'67.##.248.194':445
'67.##.189.215':445
'67.##.20.239':445
'67.#3.14.70':445
'67.##.40.241':445
'67.##.147.41':445
'67.##.243.138':445
'67.##.217.123':445
'67.##.153.252':445
'67.#3.235.8':445
'67.##.175.154':445
'67.##.26.187':445
'67.#3.13.41':445
'67.##.151.134':445
'67.##.202.23':445
'67.##.47.116':445
'67.##.96.129':445
'67.##.117.231':445
'67.##.196.220':445
'67.##.209.64':445
'67.##.136.31':445
'67.##.110.84':445
'67.##.149.190':445
'67.##.201.35':445
'67.##.169.209':445
'67.##.125.51':445
'67.##.228.124':445
'67.##.38.118':445
'67.##.233.161':445
'67.##.32.221':445
'67.##.51.232':445
'67.##.114.221':445
'67.##.76.232':445
'67.#3.17.80':445
'67.##.21.234':445
'67.##.210.46':445
'67.#3.89.39':445
'67.##.239.167':445
'67.#3.55.79':445
'67.##.50.163':445
'67.#3.21.71':445
'67.##.226.21':445
'67.##.129.226':445
'67.#3.5.88':445
'67.##.61.211':139
'67.##.147.105':139
'67.##.194.150':139
'67.##.218.82':139
'67.##.223.243':139
'67.##.178.53':139
'67.##.111.182':139
'67.##.248.194':139
'67.##.189.215':139
'67.##.20.239':139
'67.#3.14.70':139
'67.##.40.241':139
'67.##.147.41':139
'67.##.243.138':139
'67.##.153.252':139
'67.##.175.154':139
'67.#3.235.8':139
'67.#3.13.41':139
'67.##.217.123':139
'67.##.26.187':139
'67.##.151.134':139
'67.##.202.23':139
'67.##.47.116':139
'67.##.96.129':139
'67.##.117.231':139
'67.##.196.220':139
'67.##.169.209':139
'67.##.136.31':139
'67.##.110.84':139
'67.##.149.190':139
'67.##.201.35':139
'67.##.209.64':139
'67.##.125.51':139
'67.##.228.124':139
'67.##.38.118':139
'67.##.233.161':139
'67.##.32.221':139
'67.##.51.232':139
'67.##.114.221':139
'67.##.76.232':139
'67.#3.17.80':139
'67.##.21.234':139
'67.##.210.46':139
'67.#3.89.39':139
'67.##.239.167':139
'67.#3.55.79':139
'67.##.50.163':139
'67.#3.21.71':139
'67.##.226.21':139
'67.##.129.226':139
'67.#3.5.88':139
'67.##.61.211':445
'67.##.154.132':445
'67.#3.87.70':445
'67.#3.52.17':445
'67.#3.31.57':445
'67.##.224.30':445
'67.##.139.145':445
'67.##.165.105':445
'67.##.187.132':445
'67.##.24.228':445
'67.##.157.100':445
'67.##.222.156':445
'67.#3.33.92':445
'67.##.57.211':445
'67.##.233.57':445
'67.##.217.69':445
'67.#3.26.37':445
'67.##.242.44':445
'67.##.230.225':445
'67.##.140.159':445
'67.##.251.198':445
'67.##.193.92':445
'67.#3.71.65':445
'67.#3.9.75':445
'67.##.103.163':445
'67.#3.30.16':445
'67.##.249.132':445
'67.##.14.194':139
'67.##.120.92':139
'67.#3.84.28':445
'67.#3.86.84':445
'67.##.147.141':445
'67.#3.54.53':139
'67.##.48.246':139
'67.##.156.211':139
'67.##.112.58':139
'67.##.225.29':139
'67.#3.16.4':139
'67.#3.28.81':445
'67.#3.7.132':445
'67.##.221.248':445
'67.##.50.132':445
'67.#3.38.88':445
'67.#3.29.39':445
'67.#3.75.14':445
'67.##.213.87':445
'67.#3.0.213':445
'67.#3.81.0':445
'67.##.119.57':445
'67.#3.67.40':445
'67.#3.88.22':445
'67.#3.88.54':445
'67.#3.30.16':139
'67.##.251.198':139
'67.##.193.92':139
'67.#3.26.37':139
'67.#3.9.75':139
'67.##.103.163':139
'67.##.224.30':139
'67.##.139.145':139
'67.##.154.132':139
'67.#3.71.65':139
'67.##.57.211':139
'67.#3.31.57':139
'67.##.217.69':139
'67.##.239.167':9988
'67.##.136.31':9988
'67.##.125.51':9988
'67.##.223.243':9988
'67.##.40.241':9988
'67.##.210.46':9988
'67.##.230.225':139
'67.##.140.159':139
'67.##.233.57':139
'67.##.38.118':9988
'67.#3.88.54':139
'67.##.242.44':139
'67.#3.88.22':139
'67.##.213.87':139
'67.#3.0.213':139
'67.##.50.132':139
'67.##.119.57':139
'67.#3.67.40':139
'67.#3.86.84':139
'67.##.147.141':139
'67.##.249.132':139
'67.#3.81.0':139
'67.#3.28.81':139
'67.#3.84.28':139
'67.##.221.248':139
'67.##.222.156':139
'67.#3.33.92':139
'67.##.165.105':139
'67.#3.87.70':139
'67.#3.52.17':139
'67.##.157.100':139
'67.#3.29.39':139
'67.#3.75.14':139
'67.#3.7.132':139
'67.##.187.132':139
'67.##.24.228':139
'67.#3.38.88':139

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial