マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Trojan.DownLoader11.10672

Added to the Dr.Web virus database: 2014-05-22

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'coboqjeaqoxg' = '%HOMEPATH%\coboqjeaqoxg.exe'
Modifies file system :
Creates the following files:
  • %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\6a7ff02b-a99e-420a-b5f4-ebb0abaadb79
  • %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\22854291-cd09-46d7-87db-e04b290e7a6a
  • %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\079e6120-5f7d-498e-afd7-833d935df2d1
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\2514fa73-e471-463d-b6b1-11de1dc977b8
  • %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\274e8e6a-61a6-4b4f-af3c-32bf861feba2
  • %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\3570d19e-143e-4379-94bd-bb9422b2c386
  • %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\6adda84d-1fc0-4d07-801e-489959540dd8
  • %HOMEPATH%\coboqjeaqoxg.exe
  • %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\bac742ad-309f-433b-a3ab-25f847acfbcf
  • %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
  • %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\edd6b8ac-177c-45e8-a873-2eefe454ce0a
Sets the 'hidden' attribute to the following files:
  • %HOMEPATH%\coboqjeaqoxg.exe
Network activity:
Connects to:
  • 'sm##.live.com':25
UDP:
  • DNS ASK ma###egor.co.kr
  • DNS ASK sz###tufi.com
  • DNS ASK tr####y-works.com
  • DNS ASK ch###scope.com
  • DNS ASK su###france.com
  • DNS ASK ag#####des-druides.com
  • DNS ASK hi##ken.com
  • DNS ASK mo###ophoto.com
  • DNS ASK av###-ime.com
  • DNS ASK fr#####entauction.com
  • DNS ASK me###ies.org
  • DNS ASK wo#####dhillwinery.com
  • DNS ASK je###atz.com
  • DNS ASK au####direkt.net
  • DNS ASK th####ofhair.com
  • DNS ASK nd####nementiel.com
  • DNS ASK si####etalsinc.com
  • DNS ASK sc##edel.it
  • DNS ASK st###tives.org
  • DNS ASK we####llsstl.org
  • DNS ASK se###co-ind.com
  • DNS ASK sh###ales.co.uk
  • DNS ASK bo#r.cz
  • DNS ASK tr###alau.com
  • DNS ASK va###ardpkg.com
  • DNS ASK hi###nwiese.de
  • DNS ASK ms##ys.com
  • DNS ASK ce####kalip.com.tr
  • DNS ASK sa##s.net
  • DNS ASK be#####aelcenter.org
  • DNS ASK op###er.com.au
  • DNS ASK bo####ydesign.com
  • DNS ASK zi####rbatului.ro
  • DNS ASK sa####connection.ca
  • DNS ASK ph###type.com
  • DNS ASK st#####ldlifeart.com
  • DNS ASK ma#####siecologia.com
  • DNS ASK fa#####hofamerica.com
  • DNS ASK gi###imo.com
  • DNS ASK d-##b.net
  • DNS ASK ta##on.com
  • DNS ASK pe####sion.co.in
  • DNS ASK th#####ldsongroup.com
  • DNS ASK e-###rming.com
  • DNS ASK ia###obal.or.id
  • DNS ASK dj###taro.com
  • DNS ASK ge###r.gen.tr
  • DNS ASK ur####aproject.com
  • DNS ASK lo###rlookz.com
  • DNS ASK bu####ss-edge.com
  • DNS ASK so####oncorp.com
  • DNS ASK ar##for.com
  • DNS ASK av##ay.com
  • DNS ASK sa##y.com
  • DNS ASK 4p##p.com
  • DNS ASK ze###et.co.jp
  • DNS ASK fi###ara.com
  • DNS ASK ac#####oambiente.com
  • DNS ASK ma###-man.com
  • DNS ASK ac#####ificrepairs.com
  • DNS ASK wi#####emarketing.com
  • DNS ASK db####onents.com
  • DNS ASK ju####nnect.co.za
  • DNS ASK ca####eonline.com
  • DNS ASK ea##gen.com
  • DNS ASK ap###farm.org
  • DNS ASK ma###chn.com
  • DNS ASK is####arnataka.org
  • DNS ASK ko###-sa.com
  • DNS ASK d4###edia.com
  • DNS ASK de####scueusa.com
  • DNS ASK pa###ball.be
  • DNS ASK se##door.pl
  • DNS ASK ne#####xininstitute.com
  • DNS ASK th######inghouseltd.co.uk
  • DNS ASK vi###ria.com.pl
  • DNS ASK vi##lur.by
  • DNS ASK ic###ain.com
  • DNS ASK mo#####-vacaciones.com
  • DNS ASK c2##du.com
  • DNS ASK fl###ercorp.com
  • DNS ASK go####luecenter.com
  • DNS ASK cg###ngland.com
  • DNS ASK ae##ora.com
  • DNS ASK di##d.com
  • DNS ASK ga######onlinemagazine.com
  • DNS ASK to###nmeuse.com
  • DNS ASK al###wared.com
  • DNS ASK pb##.com
  • DNS ASK ti###urkey.com
  • DNS ASK my####center.com
  • DNS ASK es####-hotelier.com
  • DNS ASK ag##rno.ru
  • DNS ASK ch####clothes.com
  • DNS ASK le####shipforum.us
  • DNS ASK as#.co.jp
  • DNS ASK ma###acorp.com
  • DNS ASK je###mate.co.jp
  • DNS ASK cs##c.org
  • DNS ASK ts#.org
  • DNS ASK re###echre.com
  • DNS ASK ga###marine.com
  • DNS ASK ma####grimes.co.uk
  • DNS ASK ge###ermusa.com
  • DNS ASK pi##mia.com
  • DNS ASK re####efield.co.uk
  • DNS ASK ca#####citytuxedo.com
  • DNS ASK xi###group.com
  • DNS ASK ba######ramsevatrust.org
  • DNS ASK re####eretreat.com
  • DNS ASK me#####-jacquelin.com
  • DNS ASK ho##u.com
  • DNS ASK sh###zil.com
  • DNS ASK fr###spot.co.za
  • DNS ASK ch####ybarry.com
  • DNS ASK le###ridica.com
  • DNS ASK co###ne.or.id
  • DNS ASK ma##.#irmail.net
  • DNS ASK vi####agamba.com
  • DNS ASK tu####-saitama.com
  • DNS ASK sd#p.ie
  • DNS ASK un###.edu.bo
  • DNS ASK st##om.nl
  • DNS ASK fr#####high.school.nz
  • DNS ASK ni###.com.cn
  • DNS ASK ya###oto-sr.com
  • DNS ASK te####g-video.com
  • DNS ASK im###.com.pl
  • DNS ASK ar#####turadigital.com
  • DNS ASK st####ennygames.com
  • DNS ASK eg##.net
  • DNS ASK gu###man.com.br
  • DNS ASK e-###ukyaku.com
  • DNS ASK sm##.###global.yahoo.com
  • DNS ASK sm##.#ail.yahoo.com
  • DNS ASK sm##.live.com
  • DNS ASK pc##ds.com
  • DNS ASK na###ngcw.com
  • DNS ASK fl####adoubled.com
  • DNS ASK ad####ivechat.us
  • DNS ASK ix###ctor.com
  • DNS ASK no###uroya.com
  • DNS ASK pa###enna.com
  • DNS ASK sp##i.org
  • DNS ASK sm##.#irectcon.net
  • DNS ASK th###tospas.com
  • DNS ASK ro#####cintyre.com.au
  • DNS ASK br####arm.com.au
  • DNS ASK ka####ka.vic.edu.au
  • DNS ASK ph###clubs.com
  • DNS ASK nu###ech.com
  • DNS ASK kv###atoff.ru
  • DNS ASK de##ille.ca
  • DNS ASK mi####io-teatras.lt
  • DNS ASK ca###choice.org
  • DNS ASK eo##.net
  • DNS ASK na###sklep.pl
  • DNS ASK gr###web.net
  • DNS ASK au##ma.it
  • DNS ASK re###dhits.com
  • DNS ASK ws#####rontheweb.com
  • DNS ASK hp####rvices.com
  • DNS ASK ka####okuren.com
  • DNS ASK ma####grp-spb.ru
  • DNS ASK gc##cpa.com
  • DNS ASK go####rk-moossee.ch
  • DNS ASK sc####inpeach.com
  • DNS ASK om##p.co.jp
  • DNS ASK li####ist-uk.com
  • DNS ASK ho###hd.com.br
  • DNS ASK bi#####ultimedia.com
  • DNS ASK ch####supplies.net
  • DNS ASK so#####rganizing.com
  • DNS ASK ar###2aa.org
  • DNS ASK fr#####ckallergy.com
  • DNS ASK co##th.com
  • DNS ASK sa###david.com
  • DNS ASK to#####rthcare.com.au
  • DNS ASK sm##.#ompuserve.com
  • DNS ASK re##soft.ru
  • DNS ASK is#####ltarim.com.tr
  • DNS ASK co#.#ku.edu.cn
  • DNS ASK va##eks.com
  • DNS ASK bi##imex.pl
  • DNS ASK au#####ica-travel.com
  • DNS ASK gr###train.coop
  • DNS ASK co###rprint.nl
  • DNS ASK ha####ltimedia.com
  • DNS ASK th###rgery.com
  • DNS ASK fu###o-lab.com
  • DNS ASK ry###chi-jp.com
  • DNS ASK sg###nting.ca
  • DNS ASK ku###ci.or.jp
  • DNS ASK or####networks.net
  • DNS ASK na####ecurtiss.com
  • DNS ASK br###ndia.com
  • DNS ASK ru###eberg.com
  • DNS ASK ar####esajandek.hu
  • DNS ASK me###orti.com
  • DNS ASK www.tr###rush.com
  • DNS ASK gj#.com.pl
  • DNS ASK bu####llmedia.com
  • DNS ASK wk##.net
Miscellaneous:
Searches for the following windows:
  • ClassName: 'Indicator' WindowName: '(null)'

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android