ユーザー向け情報

閉じる

マイライブラリ
マイライブラリ

+ マイライブラリに追加

検索
検索

電話
テクニカルサポート利用方法

問い合わせ

新規お問い合わせ

電話（英語）

+7 (495) 789-45-86

フォーラム（英語）

お問い合わせ履歴

新規お問い合わせ

電話（英語）

+7 (495) 789-45-86

Profile

JP

RU CN DE EN ES FR IT JP KZ UZ PL BY
閉じる
サービス
スキャナー
Dr.Web vxCube
トライアル
ウイルスライブラリ
ナレッジベース

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

ニュース

Trojan.PWS.Siggen2.3404

Added to the Dr.Web virus database: 2018-04-04

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • %HOMEPATH%\Start Menu\Programs\Startup\<File name>.exe
Malicious functions:
Searches for registry branches where third party applications store passwords:
  • [<HKCU>\Software\Paltalk]
  • [<HKLM>\SOFTWARE\DVD Audio Extractor\Settings]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 H M Fashion Stuff]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Celebration Stuff]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Glamour Life Stuff]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Seasons]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Pets]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 1942 The Road to Rome]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Open For Business]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Nightlife]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2]
  • [<HKLM>\SOFTWARE\Electronic Arts\Electronic Arts\The Battle for Middle-earth II]
  • [<HKLM>\SOFTWARE\Valve\Day of Defeat\Settings]
  • [<HKLM>\SOFTWARE\CyberLink\PowerProducer\3.0\UserReg]
  • [<HKLM>\SOFTWARE\Cyberlink\PowerBar]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Family Fun Stuff]
  • [<HKLM>\SOFTWARE\Sierra\Empire Earth II]
  • [<HKLM>\SOFTWARE\Valve\Half-Life\Setting]
  • [<HKLM>\SOFTWARE\Electronic Arts\Electronic Arts\Crysis]
  • [<HKLM>\SOFTWARE\Sierra\CDKey]
  • [<HKLM>\SOFTWARE\Valve\Gunman]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Global Operations]
  • [<HKLM>\SOFTWARE\Headlight\GetRight]
  • [<HKLM>\SOFTWARE\THQ\Frontlines: Fuel of War]
  • [<HKLM>\SOFTWARE\THQ\Frontlines: Fuel of War Beta]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Distribution\Freedom Force]
  • [<HKLM>\SOFTWARE\Electronic Arts\Electronic Arts\FIFA 08]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\FIFA 07]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2005]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2004]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2003]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2002]
  • [<HKLM>\SOFTWARE\CRYTEK\FARCRY\UBI.COM]
  • [<HKLM>\SOFTWARE\F-Secure\BackWeb\iLauncher]
  • [<HKLM>\SOFTWARE\Cyberlink\PowerDVD]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 University]
  • [<HKLM>\SOFTWARE\Valve\Counter-Strike\Settings]
  • [<HKLM>\SOFTWARE\THQ\Company of Heroes]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\Hellgate: London]
  • [<HKLM>\SOFTWARE\Eugen Systems\ActOfWar]
  • [<HKLM>\SOFTWARE\ashampoo\Ashampoo WinOptimizer Platinum 3]
  • [<HKLM>\SOFTWARE\Sunflowers\Anno 1701]
  • [<HKLM>\SOFTWARE\Elcom\Advanced ZIP Password Recovery\Registration]
  • [<HKLM>\SOFTWARE\Elcom\Advanced PDF Password Recovery\Registration Pro]
  • [<HKLM>\SOFTWARE\Elcom\Advanced PDF Password Recovery\Registration]
  • [<HKLM>\SOFTWARE\Adobe\Photoshop\7.0\Registration]
  • [<HKLM>\SOFTWARE\ACD Systems\PicaView]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 1942]
  • [<HKLM>\SOFTWARE\ahead\Installation\BAK\Nero 7\Info]
  • [<HKLM>\SOFTWARE\Adobe\Golive\5.0\Registration]
  • [<HKLM>\SOFTWARE\SEGA\Medieval II Total War]
  • [<HKLM>\SOFTWARE\THQ\Dawn of War - Dark Crusade]
  • [<HKLM>\SOFTWARE\THQ\Dawn of War]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 1942 Secret Weapons of WWII]
  • [<HKLM>\SOFTWARE\Activision\Call of Duty 4]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\Battlefield 2]
  • [<HKLM>\Software\Electronic Arts\EA GAMES\Battlefield Vietnam]
  • [<HKLM>\SOFTWARE\Electronic Arts\Electronic Arts\Command and Conquer 3]
  • [<HKLM>\SOFTWARE\@stake\LC5\Registration]
  • [<HKLM>\SOFTWARE\Electronic Arts\Command and Conquer 3]
  • [<HKLM>\SOFTWARE\Westwood\Tiberian Sun]
  • [<HKLM>\SOFTWARE\Westwood\Red Alert]
  • [<HKLM>\SOFTWARE\Westwood\Red Alert 2]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Command and Conquer Generals Zero Hour]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Generals]
  • [<HKLM>\SOFTWARE\Codec Tweak Tool]
  • [<HKLM>\SOFTWARE\Techland\Chrome]
  • [<HKLM>\SOFTWARE\TechSmith\Camtasia Studio\4.0]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\Burnout Paradise]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\Boulder Dash Rocks]
  • [<HKLM>\Software\Electronic Arts\Black and White 2]
  • [<HKLM>\Software\Electronic Arts\EA GAMES\Black and White]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 2142]
  • [<HKLM>\SOFTWARE\Activision\Call of Duty WAW]
  • [<HKLM>\SOFTWARE\Illusion Softworks\Hidden & Dangerous 2]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\Nascar Racing 2002]
  • [<HKLM>\Software\LucasArts\Star Wars Battlefront II\1.0]
  • [<HKLM>\Software\GSC Game World\STALKER-SHOC]
  • [<HKLM>\Software\Silver Style Entertainment\Soldiers Of Anarchy]
  • [<HKLM>\Software\Network Associates, Inc.\Sniffer Pro\4.5\USER]
  • [<HKLM>\Software\Electronic Arts\Maxis\ Sim City 4 Deluxe]
  • [<HKLM>\Software\Ubisoft\SILENT HUNTER III\Keys]
  • [<HKLM>\Software\Steganos\SIAVPN]
  • [<HKLM>\Software\LucasArts\Star Wars Battlefront II\1.1]
  • [<HKLM>\Software\Red Storm Entertainment\RAVENSHIELD]
  • [<HKLM>\Software\KONAMI\PES2008]
  • [<HKLM>\Software\EnTech\PowerStrip]
  • [<HKLM>\Software\Passware\Windows Key\7\Registration]
  • [<HKLM>\Software\Passware\Encryption Analyzer\1\Registration,License]
  • [<HKLM>\Software\PowerQuest\PartitionMagic\8.0\UserInfo]
  • [<HKLM>\Software\Atari\Sid Meier's Pirates!]
  • [<HKLM>\Software\NuMega\SmartCheck]
  • [<HKLM>\Software\THQ\Gas Powered Games\Supreme Commander]
  • [<HKCU>\Software\Yahoo\Pager]
  • [<HKCU>\Software\Microsoft\MSNMessenger]
  • [<HKCU>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
  • [<HKCU>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Software\Microsoft\Internet Account Manager\Accounts]
  • [<HKCU>\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
  • [<HKCU>\Software\Microsoft\Internet Account Manager\Accounts]
  • [<HKCU>\Software\Google\Google Talk\Accounts]
  • [<HKLM>\Software\Nullsoft\Winamp]
  • [<HKLM>\Software\TuneUp\Utilities\8.0]
  • [<HKLM>\Software\TuneUp\Utilities\7.0]
  • [<HKLM>\Software\TuneUp\Utilities\6.0]
  • [<HKLM>\Software\Pegasys Inc.\TMPGEnc DVD Author\1.0]
  • [<HKLM>\Software\Electronic Arts\EA Games\The Orange Box]
  • [<HKLM>\Software\Electronic Arts\EA Games\The Battle for Middle-earth]
  • [<HKLM>\Software\TexasCalc\License]
  • [<HKLM>\Software\O&O\O&O Defrag\8.0\Pro\licenses]
  • [<HKLM>\Software\Electronic Arts\EA GAMES\Shogun Total War - Warlord Edition]
  • [<HKLM>\Software\OnlineTVPlayer\RegInfo]
  • [<HKLM>\Software\Westwood\Nox]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Medal of Honor Allied Assault Breakthrough]
  • [<HKLM>\SOFTWARE\IGI 2 Retail\CDKey]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\Medal of Honor: Heroes 2]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Medal of Honor Allied Assault Spearhead]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Medal of Honor Allied Assault Breakthrough]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Medal of Honor Allied Assault]
  • [<HKLM>\SOFTWARE\Electronic Arts\Medal of Honor Airborne]
  • [<HKLM>\SOFTWARE\JSG\Matrix Saver V2]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\Madden NFL 07]
  • [<HKLM>\SOFTWARE\Macromedia\Dreamweaver\7\Registration]
  • [<HKLM>\SOFTWARE\Macromedia\Fireworks\7\Registration]
  • [<HKLM>\SOFTWARE\Macromedia\Flash\7\Registration]
  • [<HKLM>\SOFTWARE\3d0\Status Legends of Might and Magic]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\James Bond 007 Nightfire]
  • [<HKLM>\SOFTWARE\AVConverter\iPod Converter]
  • [<HKLM>\SOFTWARE\JoWooD\InstalledGames\IG2]
  • [<HKLM>\SOFTWARE\mIRC]
  • [<HKLM>\SOFTWARE\Ahead\InCD]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\Nascar Racing 2003]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NHL 2002]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NHL 2003]
  • [<HKLM>\Software\Nero\Installation\Families\Nero 7\Info]
  • [<HKLM>\SOFTWARE\Ahead\Nero - Burning Rom\Info]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Need For Speed Underground 2]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Need For Speed Underground]
  • [<HKLM>\SOFTWARE\Electronic Arts\Electronic Arts\Need for Speed ProStreet]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Need for Speed Most Wanted]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Need For Speed Hot Pursuit 2]
  • [<HKLM>\SOFTWARE\Electronic Arts\Electronic Arts\Need for Speed Carbon]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NBA Live 08]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NBA LIVE 07]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NBA LIVE 2004]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NBA LIVE 2003]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NHL 2005]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NHL 2004]
  • [<HKLM>\SOFTWARE\Nero\Installation\Families\Nero 8\Info]
  • [<HKLM>\SOFTWARE\Activision\Call of Duty 2]
  • [<HKLM>\SOFTWARE\Activision\Call of Duty United Offensive]
  • [<HKLM>\SOFTWARE\Activision\Call of Duty]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 University]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2]
  • [<HKCU>\SOFTWARE\Electronic Arts\Electronic Arts\The Battle for Middle-earth II]
  • [<HKCU>\SOFTWARE\Valve\Day of Defeat\Settings]
  • [<HKCU>\SOFTWARE\CyberLink\PowerProducer\3.0\UserReg]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Open For Business]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Seasons]
  • [<HKCU>\SOFTWARE\Cyberlink\PowerBar]
  • [<HKCU>\SOFTWARE\Valve\Counter-Strike\Settings]
  • [<HKCU>\SOFTWARE\THQ\Company of Heroes]
  • [<HKCU>\SOFTWARE\Electronic Arts\Electronic Arts\Command and Conquer 3]
  • [<HKCU>\SOFTWARE\Electronic Arts\Command and Conquer 3]
  • [<HKCU>\SOFTWARE\Westwood\Tiberian Sun]
  • [<HKCU>\SOFTWARE\Cyberlink\PowerDVD]
  • [<HKCU>\SOFTWARE\Electronic Arts\Electronic Arts\Crysis]
  • [<HKCU>\SOFTWARE\THQ\Frontlines: Fuel of War]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Glamour Life Stuff]
  • [<HKCU>\SOFTWARE\Electronic Arts\Electronic Arts\FIFA 08]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\FIFA 07]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2005]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2004]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2003]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2002]
  • [<HKCU>\SOFTWARE\CRYTEK\FARCRY\UBI.COM]
  • [<HKCU>\SOFTWARE\F-Secure\BackWeb\iLauncher]
  • [<HKCU>\SOFTWARE\Sierra\CDKey]
  • [<HKCU>\SOFTWARE\Sierra\Empire Earth II]
  • [<HKCU>\SOFTWARE\DVD Audio Extractor\Settings]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Family Fun Stuff]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 H M Fashion Stuff]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Celebration Stuff]
  • [<HKCU>\SOFTWARE\Westwood\Red Alert]
  • [<HKCU>\SOFTWARE\Westwood\Red Alert 2]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Pets]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Command and Conquer Generals Zero Hour]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Generals]
  • [<HKCU>\SOFTWARE\Adobe\Photoshop\7.0\Registration]
  • [<HKCU>\SOFTWARE\Activision\Call of Duty WAW]
  • [<HKCU>\SOFTWARE\ACD Systems\PicaView]
  • [<HKCU>\SOFTWARE\ahead\Installation\BAK\Nero 7\Info]
  • [<HKCU>\SOFTWARE\Adobe\Golive\5.0\Registration]
  • [<HKCU>\SOFTWARE\SEGA\Medieval II Total War]
  • [<HKCU>\SOFTWARE\THQ\Dawn of War - Dark Crusade]
  • [<HKCU>\SOFTWARE\THQ\Dawn of War]
  • [<HKCU>\SOFTWARE\Activision\Call of Duty 4]
  • [<HKCU>\SOFTWARE\THQ\Frontlines: Fuel of War Beta]
  • [<HKCU>\SOFTWARE\Activision\Call of Duty 2]
  • [<HKCU>\SOFTWARE\Activision\Call of Duty United Offensive]
  • [<HKCU>\SOFTWARE\Activision\Call of Duty]
  • [<HKCU>\SOFTWARE\Ubisoft\Splinter Cell Chaos Theory\Keys]
  • [<HKCU>\SOFTWARE\Ubisoft\Splinter Cell Pandora Tomorrow]
  • [<HKCU>\SOFTWARE\Elcom\Advanced PDF Password Recovery\Registration]
  • [<HKCU>\SOFTWARE\Elcom\Advanced PDF Password Recovery\Registration Pro]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Distribution\Freedom Force]
  • [<HKCU>\SOFTWARE\Sunflowers\Anno 1701]
  • [<HKCU>\SOFTWARE\Elcom\Advanced ZIP Password Recovery\Registration]
  • [<HKCU>\SOFTWARE\Eugen Systems\ActOfWar]
  • [<HKCU>\SOFTWARE\Techland\Chrome]
  • [<HKCU>\SOFTWARE\TechSmith\Camtasia Studio\4.0]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\Burnout Paradise]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\Boulder Dash Rocks]
  • [<HKCU>\Software\Electronic Arts\Black and White 2]
  • [<HKCU>\Software\Electronic Arts\EA GAMES\Black and White]
  • [<HKCU>\Software\Electronic Arts\EA GAMES\Battlefield Vietnam]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 2142]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\Battlefield 2]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 1942 The Road to Rome]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 1942 Secret Weapons of WWII]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 1942]
  • [<HKCU>\SOFTWARE\@stake\LC5\Registration]
  • [<HKCU>\SOFTWARE\ashampoo\Ashampoo WinOptimizer Platinum 3]
  • [<HKCU>\SOFTWARE\Codec Tweak Tool]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Nightlife]
  • [<HKCU>\SOFTWARE\Headlight\GetRight]
  • [<HKCU>\Software\Ubisoft\SILENT HUNTER III\Keys]
  • [<HKCU>\SOFTWARE\Ahead\Nero - Burning Rom\Info]
  • [<HKCU>\Software\Atari\Sid Meier's Pirates!]
  • [<HKCU>\Software\Electronic Arts\EA GAMES\Shogun Total War - Warlord Edition]
  • [<HKCU>\Software\Red Storm Entertainment\RAVENSHIELD]
  • [<HKCU>\Software\KONAMI\PES2008]
  • [<HKCU>\Software\EnTech\PowerStrip]
  • [<HKCU>\Software\Passware\Windows Key\7\Registration]
  • [<HKCU>\Software\Passware\Encryption Analyzer\1\Registration,License]
  • [<HKCU>\Software\PowerQuest\PartitionMagic\8.0\UserInfo]
  • [<HKCU>\Software\O&O\O&O Defrag\8.0\Pro\licenses]
  • [<HKCU>\Software\OnlineTVPlayer\RegInfo]
  • [<HKCU>\Software\NuMega\SmartCheck]
  • [<HKCU>\Software\Westwood\Nox]
  • [<HKCU>\SOFTWARE\Nero\Installation\Families\Nero 8\Info]
  • [<HKCU>\Software\Nero\Installation\Families\Nero 7\Info]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Global Operations]
  • [<HKCU>\Software\Electronic Arts\Maxis\ Sim City 4 Deluxe]
  • [<HKCU>\Software\Network Associates, Inc.\Sniffer Pro\4.5\USER]
  • [<HKCU>\Software\Silver Style Entertainment\Soldiers Of Anarchy]
  • [<HKCU>\Software\GSC Game World\STALKER-SHOC]
  • [<HKLM>\SOFTWARE\Ubisoft\Splinter Cell Pandora Tomorrow]
  • [<HKCU>\Software\Nullsoft\Winamp]
  • [<HKCU>\Software\TuneUp\Utilities\8.0]
  • [<HKCU>\Software\TuneUp\Utilities\7.0]
  • [<HKCU>\Software\TuneUp\Utilities\6.0]
  • [<HKCU>\Software\Pegasys Inc.\TMPGEnc DVD Author\1.0]
  • [<HKCU>\Software\Electronic Arts\EA Games\The Orange Box]
  • [<HKCU>\Software\Electronic Arts\EA Games\The Battle for Middle-earth]
  • [<HKCU>\Software\TexasCalc\License]
  • [<HKCU>\Software\TechSmith\SnagIt\8]
  • [<HKCU>\Software\THQ\Gas Powered Games\Supreme Commander]
  • [<HKCU>\Software\Steganos\SIAVPN]
  • [<HKCU>\Software\LucasArts\Star Wars Battlefront II\1.1]
  • [<HKCU>\Software\LucasArts\Star Wars Battlefront II\1.0]
  • [<HKLM>\SOFTWARE\Ubisoft\Splinter Cell Chaos Theory\Keys]
  • [<HKLM>\Software\TechSmith\SnagIt\8]
  • [<HKCU>\Software\Microsoft\IdentityCRL]
  • [<HKCU>\SOFTWARE\Electronic Arts\Electronic Arts\Need for Speed ProStreet]
  • [<HKCU>\SOFTWARE\AVConverter\iPod Converter]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\Madden NFL 07]
  • [<HKCU>\SOFTWARE\Macromedia\Dreamweaver\7\Registration]
  • [<HKCU>\SOFTWARE\Macromedia\Fireworks\7\Registration]
  • [<HKCU>\SOFTWARE\Macromedia\Flash\7\Registration]
  • [<HKCU>\SOFTWARE\3d0\Status Legends of Might and Magic]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\James Bond 007 Nightfire]
  • [<HKCU>\SOFTWARE\JoWooD\InstalledGames\IG2]
  • [<HKCU>\SOFTWARE\Electronic Arts\Medal of Honor Airborne]
  • [<HKCU>\SOFTWARE\Ahead\InCD]
  • [<HKCU>\SOFTWARE\IGI 2 Retail\CDKey]
  • [<HKCU>\SOFTWARE\Illusion Softworks\Hidden & Dangerous 2]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\Hellgate: London]
  • [<HKCU>\SOFTWARE\Valve\Half-Life\Setting]
  • [<HKCU>\SOFTWARE\Valve\Gunman]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Need For Speed Underground]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Need For Speed Underground 2]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Medal of Honor Allied Assault]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\Medal of Honor: Heroes 2]
  • [<HKCU>\SOFTWARE\JSG\Matrix Saver V2]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Need for Speed Most Wanted]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Need For Speed Hot Pursuit 2]
  • [<HKCU>\SOFTWARE\Electronic Arts\Electronic Arts\Need for Speed Carbon]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\NBA Live 08]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\NBA LIVE 07]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\NBA LIVE 2004]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\NBA LIVE 2003]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\NHL 2005]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\NHL 2004]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\NHL 2003]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\NHL 2002]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\Nascar Racing 2003]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\Nascar Racing 2002]
  • [<HKCU>\SOFTWARE\mIRC]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Medal of Honor Allied Assault Spearhead]
  • [<HKCU>\Software\Microsoft\Windows Live Mail]
Modifies file system:
Creates the following files:
  • %APPDATA%\<File name>.il
  • %APPDATA%\<File name>.pdb
  • %APPDATA%\<File name>.exe
  • %TEMP%\passwordfox.exe
  • %TEMP%\firefox.txt
  • %TEMP%\iepv.exe
  • %TEMP%\mailpv.exe
  • %TEMP%\mail.txt
Deletes the following files:
  • %APPDATA%\<File name>.pdb
  • %APPDATA%\<File name>.il
  • %TEMP%\passwordfox.exe
  • %TEMP%\iepv.exe
  • %TEMP%\mailpv.exe
Network activity:
Connects to:
  • 'wp#d':80
  • 'oi###ill.xyz':80
TCP:
HTTP GET requests:
  • http://11#.#11.111.1/wpad.dat via wp#d
HTTP POST requests:
  • http://oi###ill.xyz/css/kc4/files/logs.php
UDP:
  • DNS ASK wp#d
  • DNS ASK oi###ill.xyz
Miscellaneous:
Creates and executes the following:
  • '%APPDATA%\<File name>.exe'
  • '%TEMP%\passwordfox.exe' /stext %TEMP%\firefox.txt
  • '%TEMP%\iepv.exe' /stext %TEMP%\ie.txt
  • '%TEMP%\mailpv.exe' /stext %TEMP%\mail.txt
Executes the following:
  • '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ilasm.exe' "%APPDATA%\<File name>.il"

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Free trial

 

Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

Free trial

 

Download Dr.Web

Download by serial number

Download on App Store

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

 

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

Free trial

14 days

Download now
Get it on Google Play