マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Trojan.DownLoader10.3512

Added to the Dr.Web virus database: 2013-08-14

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates the following services:
  • [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
  • '<SYSTEM32>\urdvxc.exe' /service
  • '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
  • '<SYSTEM32>\urdvxc.exe' /installservice
  • '<SYSTEM32>\urdvxc.exe' /start
Executes the following:
  • '<SYSTEM32>\svchost.exe' -k netsvcs
  • '<SYSTEM32>\dumprep.exe' 1108 -dm 7 7 %TEMP%\WER35d5.dir00\svchost.exe.mdmp 16325836412032916
Modifies file system :
Creates the following files:
  • %WINDIR%\Help\Tours\htmlTour\lhhjrkjk.exe
  • %WINDIR%\Help\Tours\htmlTour\wwvjntek.exe
  • %WINDIR%\Help\Tours\htmlTour\cxjclkkc.exe
  • %WINDIR%\Help\Tours\htmlTour\qejnhetj.exe
  • %WINDIR%\Help\hwexrtne.exe
  • %WINDIR%\Help\jjlenkbt.exe
  • %WINDIR%\Help\tsbjbtvn.exe
  • %WINDIR%\Help\Tours\htmlTour\nleqhveh.exe
  • %WINDIR%\Help\Tours\htmlTour\kxkzvszq.exe
  • %WINDIR%\Help\Tours\htmlTour\klbvejnk.exe
  • %WINDIR%\Help\Tours\htmlTour\skersqzb.exe
  • %WINDIR%\Help\Tours\htmlTour\lrhwxcwk.exe
  • %WINDIR%\Help\Tours\htmlTour\kzerbzks.exe
  • %WINDIR%\Help\Tours\htmlTour\hjhecvkh.exe
  • %WINDIR%\Help\Tours\htmlTour\tjxhsker.exe
  • %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
  • %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
  • %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
  • %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
  • <SYSTEM32>\urdvxc.exe
  • %TEMP%\WER35d5.dir00\svchost.exe.mdmp
  • %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
  • %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
  • %WINDIR%\Help\jbnshhqj.exe
  • %WINDIR%\Help\bzehxvnz.exe
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
Deletes itself.
Network activity:
Connects to:
  • '80.##.230.213':139
  • '80.##.90.195':139
  • '80.##.144.115':139
  • '80.#0.7.188':139
  • '80.##.136.63':139
  • '80.##.79.158':139
  • '80.##.19.130':139
  • '80.##.69.248':139
  • '80.##.248.113':139
  • '80.##.103.109':139
  • '80.##.109.173':139
  • '80.#0.53.54':139
  • '80.#0.49.78':139
  • '80.##.16.112':139
  • '80.##.109.53':139
  • '80.##.168.63':139
  • '80.#0.81.3':139
  • '80.##.196.142':139
  • '80.##.160.167':139
  • '80.##.108.199':139
  • '80.#0.3.206':139
  • '80.#0.8.95':139
  • '80.#0.19.31':139
  • '80.#0.1.138':139
  • '80.##.137.140':139
  • '80.##.167.232':139
  • '80.#0.28.79':139
  • '80.##.117.118':139
  • '80.##.41.229':139
  • '80.##.153.29':139
  • '80.##.173.100':139
  • '80.##.181.80':139
  • '80.##.86.201':139
  • '80.##.167.157':445
  • '80.#0.32.73':139
  • '80.##.181.80':445
  • '80.##.86.201':445
  • '80.#0.1.59':139
  • '80.##.251.67':445
  • '80.##.189.147':445
  • '80.##.148.13':445
  • '80.#0.14.57':445
  • '80.##.26.190':445
  • '80.##.175.99':445
  • '80.#0.99.76':445
  • '80.#0.76.26':445
  • '80.##.60.238':139
  • '80.#0.94.28':139
  • '80.#0.4.216':139
  • '80.##.251.154':139
  • '80.##.100.225':139
  • '80.##.33.160':139
  • '80.##.131.251':139
  • '80.#0.68.23':139
  • '80.##.161.239':139
  • '80.#0.1.59':445
  • '80.#0.32.73':445
  • '80.##.86.161':139
  • '80.##.62.223':139
  • '80.##.88.135':139
  • '80.##.135.86':139
  • '80.#0.3.244':139
  • '80.##.168.63':445
  • '80.#0.81.3':445
  • '80.##.196.142':445
  • '80.##.160.167':445
  • '80.##.108.199':445
  • '80.#0.3.206':445
  • '80.#0.8.95':445
  • '80.#0.19.31':445
  • '80.#0.1.138':445
  • '80.##.137.140':445
  • '80.##.167.232':445
  • '80.#0.28.79':445
  • '80.##.117.118':445
  • '80.##.41.229':445
  • '80.##.153.29':445
  • '80.##.46.107':445
  • '80.##.40.106':445
  • '80.#0.48.57':445
  • '80.##.153.251':139
  • '80.##.105.50':139
  • '80.##.123.126':139
  • '80.#0.51.15':139
  • '80.##.160.194':445
  • '80.##.33.200':445
  • '80.##.180.249':445
  • '80.#0.3.244':445
  • '80.##.160.194':139
  • '80.##.46.107':139
  • '80.##.40.106':139
  • '80.#0.48.57':139
  • '80.##.136.63':445
  • '80.##.60.238':445
  • '80.#0.94.28':445
  • '80.#0.4.216':445
  • '80.##.251.154':445
  • '80.##.100.225':445
  • '80.##.33.160':445
  • '80.##.131.251':445
  • '80.#0.68.23':445
  • '80.##.161.239':445
  • '80.##.33.200':139
  • '80.##.180.249':139
  • '80.##.86.161':445
  • '80.##.62.223':445
  • '80.##.88.135':445
  • '80.##.135.86':445
  • '80.##.90.195':445
  • '80.##.144.115':445
  • '80.##.69.248':445
  • '80.##.230.213':445
  • '80.##.79.158':445
  • '80.##.19.130':445
  • '80.#0.7.188':445
  • '80.#0.49.78':445
  • '80.##.103.109':445
  • '80.##.109.173':445
  • '80.##.173.100':445
  • '80.##.248.113':445
  • '80.##.16.112':445
  • '80.##.109.53':445
  • '80.#0.53.54':445
  • '80.##.74.214':445
  • '80.#0.97.32':139
  • '80.##.198.21':139
  • '80.#0.22.97':139
  • '80.##.110.158':139
  • '80.#0.63.99':139
  • '80.#0.42.87':139
  • '80.##.239.110':139
  • '80.#0.98.16':445
  • '80.##.229.70':139
  • '80.#0.71.10':139
  • '80.##.218.186':139
  • '80.#0.98.16':139
  • '80.##.229.70':445
  • '80.#0.71.10':445
  • '80.##.218.186':445
  • '80.##.93.223':139
  • '80.##.223.115':139
  • '80.#0.24.80':139
  • '80.##.176.12':139
  • '80.#0.3.79':139
  • '80.#0.17.57':139
  • '80.##.211.23':139
  • '80.##.129.217':139
  • '80.##.118.149':139
  • '80.##.50.149':139
  • '80.#0.7.68':139
  • '80.##.148.118':139
  • '80.##.229.254':139
  • '80.##.208.141':139
  • '80.##.140.125':139
  • '80.##.15.103':445
  • '80.#0.27.23':445
  • '80.##.223.77':445
  • '80.##.79.236':445
  • '80.##.136.64':445
  • '80.##.192.31':445
  • '80.##.14.163':445
  • '80.##.226.181':445
  • '80.##.147.135':445
  • '80.#0.92.74':445
  • '80.##.79.206':445
  • '80.##.147.112':445
  • '80.##.171.80':445
  • '80.##.21.211':445
  • '80.##.211.139':445
  • '80.##.148.71':445
  • '80.##.236.69':445
  • '80.##.172.116':445
  • '80.##.131.68':445
  • '80.##.16.164':445
  • '80.##.74.238':445
  • '80.##.44.106':445
  • '80.#0.61.72':445
  • '80.##.179.50':445
  • '80.##.162.24':445
  • '80.##.60.157':445
  • '80.##.17.176':445
  • '80.##.106.216':445
  • '80.#0.4.156':445
  • '80.##.57.204':445
  • '80.##.16.225':445
  • '80.##.134.175':139
  • '80.##.93.223':445
  • '80.##.223.115':445
  • '80.#0.24.80':445
  • '80.##.176.12':445
  • '80.#0.3.79':445
  • '80.#0.17.57':445
  • '80.##.211.23':445
  • '80.##.129.217':445
  • '80.##.118.149':445
  • '80.##.50.149':445
  • '80.#0.7.68':445
  • '80.##.148.118':445
  • '80.##.229.254':445
  • '80.##.208.141':445
  • '80.##.140.125':445
  • '80.##.99.146':445
  • '80.##.125.133':445
  • '80.##.71.126':445
  • '80.##.66.192':445
  • '80.##.47.152':445
  • '80.##.217.37':445
  • '80.#0.37.9':445
  • '80.##.223.24':445
  • '80.#0.12.82':445
  • '80.##.123.137':445
  • '80.##.134.175':445
  • '80.##.125.30':445
  • '80.#0.25.20':445
  • '80.##.46.194':445
  • '80.##.164.195':445
  • '80.#0.63.99':445
  • '80.##.66.192':139
  • '80.##.99.146':139
  • '80.##.125.133':139
  • '80.#0.37.9':139
  • '80.##.74.214':139
  • '80.##.47.152':139
  • '80.##.217.37':139
  • '80.##.71.126':139
  • '80.##.125.30':139
  • '80.#0.12.82':139
  • '80.##.123.137':139
  • '80.##.164.195':139
  • '80.##.223.24':139
  • '80.#0.25.20':139
  • '80.##.46.194':139
  • '80.##.198.21':445
  • '80.#0.22.97':445
  • '80.##.167.157':139
  • '80.#0.97.32':445
  • '80.#0.42.87':445
  • '80.##.239.110':445
  • '80.##.110.158':445
  • '80.##.251.67':139
  • '80.##.189.147':139
  • '80.##.148.13':139
  • '80.#0.14.57':139
  • '80.##.26.190':139
  • '80.##.175.99':139
  • '80.#0.99.76':139
  • '80.#0.76.26':139
  • '80.##.104.135':445
  • '80.##.181.77':445
  • '80.#0.56.16':445
  • '80.##.178.192':445
  • '80.##.178.106':445
  • '80.#0.2.55':445
  • '80.#0.130.5':445
  • '80.##.87.128':445
  • '80.##.181.125':445
  • '80.#0.15.1':445
  • '80.##.115.138':445
  • '80.##.241.204':445
  • '80.#0.3.37':445
  • '80.##.162.76':445
  • '80.##.87.172':445
  • '80.##.110.143':445
  • '80.#0.42.27':445
  • '80.##.129.89':445
  • '80.#0.54.72':445
  • '80.##.75.103':445
  • '80.##.251.69':445
  • '80.#0.29.54':445
  • '80.##.146.61':445
  • '80.##.100.250':445
  • '80.##.26.181':445
  • '80.##.248.126':445
  • '80.##.104.186':445
  • '80.##.90.142':445
  • '80.##.141.227':445
  • '80.##.20.209':445
  • '80.##.79.214':445
  • '80.#0.54.72':139
  • '80.##.110.143':139
  • '80.#0.42.27':139
  • '80.#0.29.54':139
  • '80.##.87.109':139
  • '80.##.75.103':139
  • '80.##.251.69':139
  • '80.##.129.89':139
  • '80.##.104.186':139
  • '80.##.100.250':139
  • '80.##.26.181':139
  • '80.##.20.209':139
  • '80.##.146.61':139
  • '80.##.90.142':139
  • '80.##.141.227':139
  • '80.##.217.165':445
  • '80.##.106.154':445
  • '80.#0.0.116':445
  • '80.##.45.126':445
  • '80.##.184.204':445
  • '80.##.75.125':445
  • '80.##.38.107':445
  • '80.##.200.107':445
  • '80.##.15.201':139
  • '80.##.226.62':139
  • '80.#0.161.2':139
  • '80.##.175.38':139
  • '80.##.93.227':445
  • '80.#0.66.54':139
  • '80.##.54.229':139
  • '80.##.87.109':445
  • '80.##.156.224':139
  • '80.##.117.235':139
  • '80.##.255.222':139
  • '80.##.95.187':139
  • '80.##.227.126':139
  • '80.##.185.48':139
  • '80.##.203.143':139
  • '80.##.223.235':139
  • '80.##.167.28':139
  • '80.#0.5.153':139
  • '80.##.153.25':139
  • '80.##.156.204':139
  • '80.#0.54.48':139
  • '80.#0.36.78':139
  • '80.##.209.41':139
  • '80.##.238.16':139
  • '80.##.59.156':139
  • '80.##.94.163':139
  • '80.##.135.14':139
  • '80.##.129.232':139
  • '80.##.217.93':139
  • '80.##.206.159':139
  • '80.#0.79.31':139
  • '80.##.183.121':139
  • '80.#0.25.84':139
  • '80.##.140.90':139
  • '80.##.233.231':139
  • '80.##.142.159':139
  • '80.##.237.209':139
  • '80.##.126.129':139
  • '80.##.24.208':139
  • '80.##.27.208':445
  • '80.##.106.102':139
  • '80.##.54.240':139
  • '80.##.153.107':445
  • '80.##.100.146':139
  • '80.##.106.102':445
  • '80.##.54.240':445
  • '80.##.153.107':139
  • '80.##.15.201':445
  • '80.##.226.62':445
  • '80.#0.161.2':445
  • '80.##.175.38':445
  • '80.##.27.208':139
  • '80.#0.66.54':445
  • '80.##.54.229':445
  • '80.#0.24.13':139
  • '80.##.200.185':139
  • '80.##.64.125':139
  • '80.##.233.55':139
  • '80.##.208.30':139
  • '80.##.37.131':139
  • '80.##.188.70':139
  • '80.##.111.145':139
  • '80.##.63.173':139
  • '80.##.124.132':139
  • '80.##.132.172':139
  • '80.##.150.53':139
  • '80.#0.2.212':139
  • '80.##.35.233':139
  • '80.#0.59.41':139
  • '80.##.248.126':139
  • '80.##.136.187':139
  • '80.##.99.244':139
  • '80.##.101.203':139
  • '80.#0.94.94':139
  • '80.##.123.126':445
  • '80.#0.51.15':445
  • '80.##.153.251':445
  • '80.##.153.186':139
  • '80.##.63.237':139
  • '80.##.25.117':139
  • '80.##.53.227':139
  • '80.##.70.246':139
  • '80.#0.152.4':139
  • '80.##.163.77':139
  • '80.##.187.161':139
  • '80.##.229.134':445
  • '80.##.170.161':445
  • '80.#0.0.2':445
  • '80.#0.4.230':445
  • '80.##.216.88':445
  • '80.##.150.79':445
  • '80.#0.118.4':445
  • '80.##.174.150':445
  • '80.##.134.156':445
  • '80.##.156.105':445
  • '80.##.105.50':445
  • '80.##.154.134':445
  • '80.##.178.90':445
  • '80.##.151.141':445
  • '80.##.138.154':445
  • '80.#0.10.81':139
  • '80.#0.4.230':139
  • '80.##.229.134':139
  • '80.##.170.161':139
  • '80.#0.118.4':139
  • '80.##.176.159':139
  • '80.##.216.88':139
  • '80.##.150.79':139
  • '80.#0.0.2':139
  • '80.##.154.134':139
  • '80.##.134.156':139
  • '80.##.156.105':139
  • '80.##.138.154':139
  • '80.##.174.150':139
  • '80.##.178.90':139
  • '80.##.151.141':139
  • '80.##.128.74':139
  • '80.##.73.113':139
  • '80.##.29.185':139
  • '80.##.247.53':139
  • '80.#0.1.98':139
  • '80.##.234.25':139
  • '80.#0.92.8':139
  • '80.##.82.130':139
  • '80.##.93.118':139
  • '80.##.132.110':139
  • '80.##.190.12':139
  • '80.#0.146.4':139
  • '80.##.53.160':139
  • '80.##.204.82':139
  • '80.#0.86.81':139
  • '80.##.176.159':445
  • '80.##.45.126':139
  • '80.##.217.165':139
  • '80.##.106.154':139
  • '80.##.38.107':139
  • '80.##.79.214':139
  • '80.##.184.204':139
  • '80.##.75.125':139
  • '80.#0.0.116':139
  • '80.##.104.31':445
  • '80.##.222.94':445
  • '80.##.245.89':139
  • '80.##.209.50':445
  • '80.##.200.107':139
  • '80.##.93.227':139
  • '80.##.245.89':445
  • '80.##.104.135':139
  • '80.##.181.77':139
  • '80.#0.56.16':139
  • '80.##.178.192':139
  • '80.##.178.106':139
  • '80.#0.2.55':139
  • '80.#0.130.5':139
  • '80.##.87.128':139
  • '80.##.181.125':139
  • '80.#0.15.1':139
  • '80.##.115.138':139
  • '80.##.241.204':139
  • '80.#0.3.37':139
  • '80.##.162.76':139
  • '80.##.87.172':139
  • '80.##.209.50':139
  • '80.##.128.74':445
  • '80.##.73.113':445
  • '80.##.29.185':445
  • '80.##.247.53':445
  • '80.#0.1.98':445
  • '80.##.234.25':445
  • '80.#0.92.8':445
  • '80.##.82.130':445
  • '80.##.93.118':445
  • '80.##.132.110':445
  • '80.##.190.12':445
  • '80.#0.146.4':445
  • '80.##.53.160':445
  • '80.##.204.82':445
  • '80.#0.86.81':445
  • '80.##.99.244':445
  • '80.##.101.203':445
  • '80.##.153.186':445
  • '80.##.136.187':445
  • '80.##.104.31':139
  • '80.##.222.94':139
  • '80.#0.94.94':445
  • '80.#0.152.4':445
  • '80.##.25.117':445
  • '80.##.53.227':445
  • '80.#0.10.81':445
  • '80.##.63.237':445
  • '80.##.163.77':445
  • '80.##.187.161':445
  • '80.##.70.246':445
  • '80.##.212.89':445
  • '80.#0.17.33':139
  • '80.##.14.148':139
  • '80.#0.1.155':139
  • '80.##.104.94':139
  • '80.##.145.30':139
  • '80.##.198.16':139
  • '80.##.175.212':139
  • '80.##.74.167':139
  • '80.#0.4.113':139
  • '80.##.112.187':139
  • '80.##.117.194':139
  • '80.#0.38.25':139
  • '80.##.224.64':139
  • '80.##.157.210':139
  • '80.##.153.66':139
  • '80.##.147.24':445
  • '80.#0.25.54':445
  • '80.##.197.68':445
  • '80.##.54.215':445
  • '80.#0.50.96':445
  • '80.##.117.138':445
  • '80.##.242.78':445
  • '80.##.224.102':445
  • '80.#0.56.56':445
  • '80.#0.1.46':139
  • '80.#0.46.6':139
  • '80.#0.16.15':445
  • '80.##.78.235':445
  • '80.##.211.45':445
  • '80.##.141.110':445
  • '80.##.152.106':139
  • '80.#0.50.96':139
  • '80.##.117.138':139
  • '80.##.242.78':139
  • '80.##.85.131':139
  • '80.#0.21.33':139
  • '80.##.83.152':139
  • '80.#0.35.36':139
  • '80.##.54.215':139
  • '80.##.78.235':139
  • '80.##.211.45':139
  • '80.##.141.110':139
  • '80.##.224.102':139
  • '80.##.147.24':139
  • '80.#0.25.54':139
  • '80.##.197.68':139
  • '80.##.100.81':139
  • '80.##.178.185':139
  • '80.#0.17.66':139
  • '80.#0.51.51':139
  • '80.##.96.247':139
  • '80.##.11.151':445
  • '80.##.212.132':139
  • '80.##.70.130':139
  • '80.##.43.139':139
  • '80.##.121.165':139
  • '80.##.165.252':139
  • '80.##.132.49':139
  • '80.#0.5.73':139
  • '80.##.54.111':139
  • '80.##.240.74':139
  • '80.##.85.131':445
  • '80.##.127.127':139
  • '80.##.40.156':445
  • '80.##.195.195':445
  • '80.##.78.141':139
  • '80.##.231.22':139
  • '80.##.238.200':139
  • '80.##.61.130':139
  • '80.##.90.173':445
  • '80.#0.173.0':139
  • '80.#0.1.46':445
  • '80.#0.46.6':445
  • '80.##.90.173':139
  • '80.#0.173.0':445
  • '80.##.40.156':139
  • '80.##.195.195':139
  • '80.##.102.25':139
  • '80.#0.25.14':139
  • '80.##.170.230':139
  • '80.##.36.102':139
  • '80.##.206.132':139
  • '80.##.255.252':139
  • '80.##.245.231':139
  • '80.#0.56.40':139
  • '80.#0.7.168':139
  • '80.##.74.117':139
  • '80.##.50.186':139
  • '80.##.106.99':139
  • '80.##.39.222':139
  • '80.##.55.210':139
  • '80.#0.31.14':139
  • '80.##.145.30':445
  • '80.##.70.130':445
  • '80.#0.5.73':445
  • '80.##.54.111':445
  • '80.#0.17.66':445
  • '80.#0.51.51':445
  • '80.##.100.81':445
  • '80.##.178.185':445
  • '80.##.240.74':445
  • '80.#0.21.33':445
  • '80.##.83.152':445
  • '80.#0.35.36':445
  • '80.##.165.252':445
  • '80.##.132.49':445
  • '80.##.43.139':445
  • '80.##.121.165':445
  • '80.##.14.148':445
  • '80.#0.1.155':445
  • '80.##.74.167':445
  • '80.#0.17.33':445
  • '80.##.198.16':445
  • '80.##.175.212':445
  • '80.##.104.94':445
  • '80.##.224.64':445
  • '80.##.152.106':445
  • '80.##.96.247':445
  • '80.##.212.132':445
  • '80.##.112.187':445
  • '80.##.157.210':445
  • '80.#0.38.25':445
  • '80.#0.4.113':445
  • '80.#0.16.15':139
  • '80.##.235.111':139
  • '80.##.138.196':139
  • '80.##.254.244':139
  • '80.#0.76.19':139
  • '80.##.247.151':139
  • '80.##.151.219':139
  • '80.##.96.135':139
  • '80.##.244.174':139
  • '80.##.252.238':139
  • '80.##.142.22':139
  • '80.##.118.175':139
  • '80.#0.45.64':139
  • '80.##.174.147':139
  • '80.##.77.171':139
  • '80.##.221.58':139
  • '80.##.39.159':445
  • '80.##.67.100':445
  • '80.#0.62.58':445
  • '80.##.165.187':445
  • '80.##.69.171':445
  • '80.##.224.145':445
  • '80.##.145.37':445
  • '80.##.133.195':445
  • '80.#0.93.80':139
  • '80.##.85.119':139
  • '80.##.191.247':139
  • '80.##.119.93':139
  • '80.##.122.196':445
  • '80.##.171.104':445
  • '80.##.204.192':139
  • '80.##.105.47':139
  • '80.##.156.206':139
  • '80.##.69.171':139
  • '80.##.224.145':139
  • '80.#0.13.6':139
  • '80.##.141.72':139
  • '80.##.84.201':139
  • '80.##.54.189':139
  • '80.##.145.37':139
  • '80.##.122.196':139
  • '80.##.133.195':139
  • '80.##.171.104':139
  • '80.#0.62.58':139
  • '80.##.165.187':139
  • '80.##.39.159':139
  • '80.##.67.100':139
  • '80.#0.11.56':139
  • '80.##.35.253':139
  • '80.##.247.19':139
  • '80.##.24.112':139
  • '80.##.120.254':139
  • '80.##.216.22':139
  • '80.#0.49.59':139
  • '80.##.13.148':139
  • '80.##.105.140':139
  • '80.#0.0.52':139
  • '80.##.93.105':139
  • '80.##.88.127':139
  • '80.#0.91.90':139
  • '80.##.87.148':139
  • '80.#0.32.88':139
  • '80.##.156.206':445
  • '80.##.141.72':9988
  • '80.##.85.119':9988
  • '80.##.204.192':445
  • '80.##.247.151':9988
  • '80.##.24.112':9988
  • '80.##.138.196':9988
  • '80.##.145.37':9988
  • '80.##.119.93':445
  • '80.##.151.219':445
  • '80.##.96.135':445
  • '80.#0.76.19':445
  • '80.##.247.151':445
  • '80.#0.93.80':445
  • '80.##.85.119':445
  • '80.##.191.247':445
  • '80.#0.32.88':9988
  • '80.#0.62.58':9988
  • '80.##.171.104':9988
  • '80.##.69.171':9988
  • '80.#0.56.56':139
  • '80.#0.45.64':9988
  • '80.##.39.159':9988
  • '80.##.247.19':9988
  • '80.#0.76.19':9988
  • '80.##.133.195':9988
  • '80.##.224.145':9988
  • '80.##.88.127':9988
  • '80.##.35.253':9988
  • '80.#0.0.52':9988
  • '80.#0.13.6':9988
  • '80.##.235.111':445
  • '80.#0.91.90':445
  • '80.##.87.148':445
  • '80.#0.32.88':445
  • '80.##.13.148':445
  • '80.#0.11.56':445
  • '80.##.35.253':445
  • '80.##.247.19':445
  • '80.##.88.127':445
  • '80.##.84.201':445
  • '80.##.54.189':445
  • '80.#0.13.6':445
  • '80.##.141.72':445
  • '80.##.105.140':445
  • '80.#0.0.52':445
  • '80.##.93.105':445
  • '80.##.77.171':445
  • '80.##.221.58':445
  • '80.#0.45.64':445
  • '80.##.174.147':445
  • '80.##.138.196':445
  • '80.##.254.244':445
  • '80.##.244.174':445
  • '80.##.252.238':445
  • '80.##.216.22':445
  • '80.#0.49.59':445
  • '80.##.24.112':445
  • '80.##.120.254':445
  • '80.##.142.22':445
  • '80.##.118.175':445
  • '80.##.105.47':445
  • '80.#0.89.80':445
  • '80.#0.81.97':445
  • '80.##.63.113':445
  • '80.#0.69.74':445
  • '80.##.248.131':445
  • '80.##.94.229':445
  • '80.##.234.69':445
  • '80.##.14.103':445
  • '80.#0.38.91':445
  • '80.##.196.140':445
  • '80.##.227.40':445
  • '80.##.103.95':445
  • '80.#0.19.96':445
  • '80.##.140.113':445
  • '80.##.242.29':445
  • '80.##.222.151':139
  • '80.##.230.161':139
  • '80.#0.27.36':139
  • '80.#0.92.40':445
  • '80.##.222.151':445
  • '80.##.230.161':445
  • '80.#0.27.36':445
  • '80.#0.92.40':139
  • '80.##.70.144':445
  • '80.##.170.141':445
  • '80.##.213.124':445
  • '80.#0.41.97':445
  • '80.##.249.169':445
  • '80.#0.36.17':445
  • '80.##.113.226':445
  • '80.##.131.60':445
  • '80.##.227.175':445
  • '80.##.156.66':445
  • '80.##.213.195':445
  • '80.##.232.155':445
  • '80.#0.27.10':445
  • '80.##.232.15':445
  • '80.#0.113.5':445
  • '80.##.173.27':445
  • '80.#0.41.97':139
  • '80.##.70.144':139
  • '80.##.144.190':445
  • '80.##.113.226':139
  • '80.##.237.117':445
  • '80.##.249.169':139
  • '80.#0.36.17':139
  • '80.##.218.41':445
  • '80.##.153.22':445
  • '80.##.12.227':445
  • '80.#0.31.57':445
  • '80.##.108.92':445
  • '80.##.29.205':445
  • '80.##.166.30':445
  • '80.##.25.194':445
  • '80.##.201.158':445
  • '80.##.192.218':445
  • '80.##.211.148':445
  • '80.#0.13.19':445
  • '80.##.193.119':445
  • '80.##.53.162':445
  • '80.##.189.38':445
  • '80.##.31.113':139
  • '80.##.16.164':139
  • '80.##.236.69':139
  • '80.##.172.116':139
  • '80.#0.61.72':139
  • '80.##.15.103':139
  • '80.##.74.238':139
  • '80.##.44.106':139
  • '80.##.131.68':139
  • '80.##.106.216':139
  • '80.##.162.24':139
  • '80.##.60.157':139
  • '80.##.16.225':139
  • '80.##.179.50':139
  • '80.#0.4.156':139
  • '80.##.57.204':139
  • '80.##.141.189':445
  • '80.##.117.89':445
  • '80.#0.9.172':445
  • '80.#0.21.49':445
  • '80.##.131.148':445
  • '80.##.232.46':445
  • '80.##.46.161':445
  • '80.##.156.216':445
  • '80.#0.53.90':445
  • '80.##.71.140':445
  • '80.##.31.113':445
  • '80.##.153.53':445
  • '80.##.171.48':445
  • '80.##.79.169':445
  • '80.##.169.153':445
  • '80.##.17.176':139
  • '80.#0.21.49':139
  • '80.##.141.189':139
  • '80.##.117.89':139
  • '80.##.46.161':139
  • '80.##.212.89':139
  • '80.##.131.148':139
  • '80.##.232.46':139
  • '80.#0.9.172':139
  • '80.##.153.53':139
  • '80.#0.53.90':139
  • '80.##.71.140':139
  • '80.##.169.153':139
  • '80.##.156.216':139
  • '80.##.171.48':139
  • '80.##.79.169':139
  • '80.#0.27.23':139
  • '80.##.223.77':139
  • '80.##.79.236':139
  • '80.##.136.64':139
  • '80.##.192.31':139
  • '80.##.14.163':139
  • '80.##.226.181':139
  • '80.##.147.135':139
  • '80.#0.92.74':139
  • '80.##.79.206':139
  • '80.##.147.112':139
  • '80.##.171.80':139
  • '80.##.21.211':139
  • '80.##.211.139':139
  • '80.##.148.71':139
  • '80.##.144.190':139
  • '80.#0.25.14':445
  • '80.##.170.230':445
  • '80.#0.56.40':445
  • '80.##.102.25':445
  • '80.##.255.252':445
  • '80.##.245.231':445
  • '80.##.36.102':445
  • '80.##.39.222':445
  • '80.##.74.117':445
  • '80.##.50.186':445
  • '80.##.231.22':445
  • '80.#0.7.168':445
  • '80.##.55.210':445
  • '80.#0.31.14':445
  • '80.##.106.99':445
  • '80.##.205.222':445
  • '80.##.149.39':445
  • '80.##.113.205':445
  • '80.#0.30.70':445
  • '80.##.64.141':445
  • '80.##.46.127':445
  • '80.##.240.115':445
  • '80.##.42.134':445
  • '80.##.58.245':445
  • '80.##.67.142':445
  • '80.##.206.132':445
  • '80.##.192.240':445
  • '80.##.212.17':445
  • '80.#0.51.91':445
  • '80.##.168.142':445
  • '80.##.238.200':445
  • '80.#0.30.70':139
  • '80.##.205.222':139
  • '80.##.149.39':139
  • '80.##.240.115':139
  • '80.#0.53.64':139
  • '80.##.64.141':139
  • '80.##.46.127':139
  • '80.##.113.205':139
  • '80.##.192.240':139
  • '80.##.58.245':139
  • '80.##.67.142':139
  • '80.##.168.142':139
  • '80.##.42.134':139
  • '80.##.212.17':139
  • '80.#0.51.91':139
  • '80.##.173.22':139
  • '80.#0.88.31':139
  • '80.##.76.220':139
  • '80.##.229.79':139
  • '80.##.61.130':445
  • '80.##.78.141':445
  • '80.##.127.127':445
  • '80.##.176.109':139
  • '80.#0.88.12':139
  • '80.##.23.143':139
  • '80.##.235.241':139
  • '80.##.20.204':139
  • '80.##.147.36':139
  • '80.##.36.153':139
  • '80.#0.22.44':139
  • '80.#0.53.64':445
  • '80.##.29.205':139
  • '80.##.166.30':139
  • '80.#0.31.57':139
  • '80.##.108.92':139
  • '80.##.196.140':139
  • '80.##.227.40':139
  • '80.##.131.60':139
  • '80.##.218.41':139
  • '80.##.53.162':139
  • '80.##.189.38':139
  • '80.#0.13.19':139
  • '80.##.193.119':139
  • '80.##.153.22':139
  • '80.##.12.227':139
  • '80.##.25.194':139
  • '80.##.234.69':139
  • '80.#0.69.74':139
  • '80.#0.89.80':139
  • '80.##.94.229':139
  • '80.##.170.141':139
  • '80.##.213.124':139
  • '80.##.248.131':139
  • '80.#0.81.97':139
  • '80.##.242.29':139
  • '80.##.103.95':139
  • '80.#0.38.91':139
  • '80.##.140.113':139
  • '80.##.63.113':139
  • '80.##.14.103':139
  • '80.#0.19.96':139
  • '80.##.201.158':139
  • '80.##.173.22':445
  • '80.#0.88.31':445
  • '80.##.76.220':445
  • '80.##.229.79':445
  • '80.##.118.58':139
  • '80.#0.5.43':139
  • '80.#0.14.23':139
  • '80.##.176.109':445
  • '80.#0.88.12':445
  • '80.##.23.143':445
  • '80.##.235.241':445
  • '80.##.20.204':445
  • '80.##.147.36':445
  • '80.##.36.153':445
  • '80.#0.22.44':445
  • '80.#0.113.5':139
  • '80.##.232.155':139
  • '80.##.227.175':139
  • '80.##.232.15':139
  • '80.##.192.218':139
  • '80.##.211.148':139
  • '80.#0.27.10':139
  • '80.##.156.66':139
  • '80.##.118.58':445
  • '80.#0.14.23':445
  • '80.##.164.157':139
  • '80.##.164.157':445
  • '80.##.213.195':139
  • '80.##.173.27':139
  • '80.##.237.117':139

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android