マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Trojan.DownLoader10.55046

Added to the Dr.Web virus database: 2013-11-27

Virus description added:

Technical Information

Malicious functions:
Creates and executes the following:
  • '%HOMEPATH%\Z81M\microsof.exe'
Executes the following:
  • '<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %HOMEPATH%\Z81M\590a4e926d4c.jpg
Modifies file system :
Creates the following files:
  • %HOMEPATH%\Z81M\L47442N53471.UDT
  • %HOMEPATH%\Z81M\L35071T54324.GCV
  • %HOMEPATH%\Z81M\L60509D49224.AZV
  • %HOMEPATH%\Z81M\L48501Z97234.ACT
  • %HOMEPATH%\Z81M\L32447H27602.EPU
  • %HOMEPATH%\Z81M\L3135R23467.YHE
  • %HOMEPATH%\Z81M\K80817B60366.VZF
  • %HOMEPATH%\Z81M\L29543M2605.RXJ
  • %HOMEPATH%\Z81M\L18254X9353.HFC
  • %HOMEPATH%\Z81M\M33866Q73032.VNG
  • %HOMEPATH%\Z81M\M28340A2418.BNJ
  • %HOMEPATH%\Z81M\M43674P88928.NRG
  • %HOMEPATH%\Z81M\M40963S67925.PDM
  • %HOMEPATH%\Z81M\L96756D74653.YLK
  • %HOMEPATH%\Z81M\L90874A5691.WWG
  • %HOMEPATH%\Z81M\L62182N83533.JAQ
  • %HOMEPATH%\Z81M\L93913U54852.LHU
  • %HOMEPATH%\Z81M\L92047G87788.XAG
  • %HOMEPATH%\Z81M\K73275Q84296.SIW
  • %HOMEPATH%\Z81M\J58433Q15448.CUN
  • %HOMEPATH%\Z81M\J53519D37173.LZO
  • %HOMEPATH%\Z81M\J75639Y29504.ABS
  • %HOMEPATH%\Z81M\J74949D13294.QAE
  • %HOMEPATH%\Z81M\J53243M4042.XMW
  • %HOMEPATH%\Z81M\J41281M82382.TTL
  • %HOMEPATH%\Z81M\J32518J4211.DIH
  • %HOMEPATH%\Z81M\J44579D46898.ZHP
  • %HOMEPATH%\Z81M\J42187D44578.DGS
  • %HOMEPATH%\Z81M\K47169T32194.CBA
  • %HOMEPATH%\Z81M\K29850O99083.WJF
  • %HOMEPATH%\Z81M\K60894D22468.EPM
  • %HOMEPATH%\Z81M\K51707W11424.SUW
  • %HOMEPATH%\Z81M\K29432X65550.NVL
  • %HOMEPATH%\Z81M\J97507K10862.MJB
  • %HOMEPATH%\Z81M\J78328B90138.FZW
  • %HOMEPATH%\Z81M\K9230W92968.HXB
  • %HOMEPATH%\Z81M\K1781X94600.DCA
  • %HOMEPATH%\Z81M\M47672S70747.XMZ
  • %HOMEPATH%\Z81M\O80603H12356.EHK
  • %HOMEPATH%\Z81M\O69854P57843.YWX
  • %HOMEPATH%\Z81M\O82038F96222.TTL
  • %HOMEPATH%\Z81M\O81287X48749.KMO
  • %HOMEPATH%\Z81M\O69370V20349.CON
  • %HOMEPATH%\Z81M\O50625J90169.XWF
  • %HOMEPATH%\Z81M\O14600P86141.HAP
  • %HOMEPATH%\Z81M\O68938E74310.IXN
  • %HOMEPATH%\Z81M\O59235Q6749.OVG
  • %HOMEPATH%\Z81M\P29136I13203.CCQ
  • %HOMEPATH%\Z81M\P23935J80437.DCL
  • %HOMEPATH%\Z81M\P43777T55085.UOB
  • %HOMEPATH%\Z81M\P34971T80851.UUD
  • %HOMEPATH%\Z81M\P14088U66076.MKD
  • %HOMEPATH%\Z81M\P9805Z6372.CLR
  • %HOMEPATH%\Z81M\O97653P50222.TGN
  • %HOMEPATH%\Z81M\P10305K1852.QUA
  • %HOMEPATH%\Z81M\P10122E33346.QTP
  • %HOMEPATH%\Z81M\O12342K34290.ZYS
  • %HOMEPATH%\Z81M\N48193M18199.EYA
  • %HOMEPATH%\Z81M\N44776K53599.WQC
  • %HOMEPATH%\Z81M\N55108R99543.GNB
  • %HOMEPATH%\Z81M\N51921L95113.XHD
  • %HOMEPATH%\Z81M\N40903U52789.PIW
  • %HOMEPATH%\Z81M\microsof.exe
  • %HOMEPATH%\Z81M\M99340R94412.LRL
  • %HOMEPATH%\Z81M\N30760F85675.FVE
  • %HOMEPATH%\Z81M\N25431J83925.TSZ
  • %HOMEPATH%\Z81M\N85348R31182.OUI
  • %HOMEPATH%\Z81M\N84343O59769.OBT
  • %HOMEPATH%\Z81M\O2853C16977.VAM
  • %HOMEPATH%\Z81M\N86590U70459.PLX
  • %HOMEPATH%\Z81M\N74002E32875.IMF
  • %HOMEPATH%\Z81M\N61155Y32031.BWJ
  • %HOMEPATH%\Z81M\N58084C92523.KNE
  • %HOMEPATH%\Z81M\N66460D6332.ORO
  • %HOMEPATH%\Z81M\N64511M56200.DMV
  • %HOMEPATH%\Z81M\J26459K22413.DIT
  • %HOMEPATH%\Z81M\F72876X57857.RGE
  • %HOMEPATH%\Z81M\F67907T46273.HRD
  • %HOMEPATH%\Z81M\F87581S1522.VEJ
  • %HOMEPATH%\Z81M\F80663Q94860.BJE
  • %HOMEPATH%\Z81M\F66582T24893.MJB
  • %HOMEPATH%\Z81M\F45430T88529.JHQ
  • %HOMEPATH%\Z81M\F40899L28221.ULB
  • %HOMEPATH%\Z81M\F64919B61582.HWR
  • %HOMEPATH%\Z81M\F64601I78794.GKM
  • %HOMEPATH%\Z81M\G27821J81846.FUG
  • %HOMEPATH%\Z81M\G8357Q83318.WGK
  • %HOMEPATH%\Z81M\G33233C93019.CZZ
  • %HOMEPATH%\Z81M\G28213J54867.SIV
  • %HOMEPATH%\Z81M\G8334U63132.TYP
  • %HOMEPATH%\Z81M\F95082N95308.RPT
  • %HOMEPATH%\Z81M\F92966Y50366.LJW
  • %HOMEPATH%\Z81M\G7977Z18525.IOL
  • %HOMEPATH%\Z81M\F98475M53874.QWM
  • %HOMEPATH%\Z81M\F33481A93296.WSR
  • %HOMEPATH%\Z81M\E58614L89924.KMB
  • %HOMEPATH%\Z81M\E42791J37182.ZGZ
  • %HOMEPATH%\Z81M\E67652M44734.ZXI
  • %HOMEPATH%\Z81M\E67157R72023.ARA
  • %HOMEPATH%\Z81M\E36456C38058.TEZ
  • %HOMEPATH%\Z81M\E6113K61024.JZD
  • %HOMEPATH%\Z81M\E5167Z32426.OZF
  • %HOMEPATH%\Z81M\E34188Q94928.HDQ
  • %HOMEPATH%\Z81M\E22402P95594.KVP
  • %HOMEPATH%\Z81M\F6692Z57537.RGZ
  • %HOMEPATH%\Z81M\F6441E37934.EVH
  • %HOMEPATH%\Z81M\F13605R76722.KWZ
  • %HOMEPATH%\Z81M\F12957E51068.ZPA
  • %HOMEPATH%\Z81M\F2821E12176.BBC
  • %HOMEPATH%\Z81M\E92048Z77025.DTP
  • %HOMEPATH%\Z81M\E88969V22575.PBS
  • %HOMEPATH%\Z81M\F1205Q74162.APV
  • %HOMEPATH%\Z81M\E97478T12007.JFF
  • %HOMEPATH%\Z81M\G37173I69074.QWM
  • %HOMEPATH%\Z81M\I35080V43705.BIX
  • %HOMEPATH%\Z81M\I24119J1371.GMR
  • %HOMEPATH%\Z81M\I47881K83288.KBI
  • %HOMEPATH%\Z81M\I45410T55542.ARQ
  • %HOMEPATH%\Z81M\I20518T83165.AWY
  • %HOMEPATH%\Z81M\I11649R13771.CHE
  • %HOMEPATH%\Z81M\I2428V38496.NXP
  • %HOMEPATH%\Z81M\I19181Y86418.JVY
  • %HOMEPATH%\Z81M\I12443D95765.BPR
  • %HOMEPATH%\Z81M\I94640U12388.VVS
  • %HOMEPATH%\Z81M\I80377P86100.NJI
  • %HOMEPATH%\Z81M\J23812C86877.GAH
  • %HOMEPATH%\Z81M\J20309R22418.XGX
  • %HOMEPATH%\Z81M\I78051Z54053.HCV
  • %HOMEPATH%\Z81M\I63481C55544.URD
  • %HOMEPATH%\Z81M\I62806Q13300.VBP
  • %HOMEPATH%\Z81M\I73672M62338.VMQ
  • %HOMEPATH%\Z81M\I69636X32737.GJD
  • %HOMEPATH%\Z81M\H95036L86024.UMA
  • %HOMEPATH%\Z81M\G91860Y33940.EDG
  • %HOMEPATH%\Z81M\G91119H15412.QVN
  • %HOMEPATH%\Z81M\H5675O53508.CPE
  • %HOMEPATH%\Z81M\G94524J51368.TPV
  • %HOMEPATH%\Z81M\G81752N39785.AMD
  • %HOMEPATH%\Z81M\G58225W5466.ITC
  • %HOMEPATH%\Z81M\G49944V55017.VZA
  • %HOMEPATH%\Z81M\G72821B67089.SMK
  • %HOMEPATH%\Z81M\G58400W2617.SGB
  • %HOMEPATH%\Z81M\H48690L80668.IRD
  • %HOMEPATH%\Z81M\H34901O55320.YOM
  • %HOMEPATH%\Z81M\H86988R99211.EKU
  • %HOMEPATH%\Z81M\H83632A31004.HTE
  • %HOMEPATH%\Z81M\H23712F99761.EAH
  • %HOMEPATH%\Z81M\H11535Z93896.OEH
  • %HOMEPATH%\Z81M\H10392E33195.MXL
  • %HOMEPATH%\Z81M\H20842E26508.ZEE
  • %HOMEPATH%\Z81M\H15094S39278.CMH
  • %HOMEPATH%\Z81M\Y70901Z43833.PEG
  • %HOMEPATH%\Z81M\Y54655M30401.KII
  • %HOMEPATH%\Z81M\Y94252W91862.IZS
  • %HOMEPATH%\Z81M\Y78504D34168.VEH
  • %HOMEPATH%\Z81M\Y44408U34852.XPK
  • %HOMEPATH%\Z81M\Y36725S46743.DUP
  • %HOMEPATH%\Z81M\Y29531P46275.NXK
  • %HOMEPATH%\Z81M\Y43044V19446.MQW
  • %HOMEPATH%\Z81M\Y42036Z60171.FTN
  • %HOMEPATH%\Z81M\Z70159I6717.RHS
  • %HOMEPATH%\Z81M\Z62314K47448.YEK
  • %HOMEPATH%\Z81M\Z75774A52937.RDC
  • %HOMEPATH%\Z81M\Z72553O75090.IYF
  • %HOMEPATH%\Z81M\Z38816G98103.DPF
  • %HOMEPATH%\Z81M\Z11821D17037.VIU
  • %HOMEPATH%\Z81M\Z1012X60137.IQW
  • %HOMEPATH%\Z81M\Z33430V78445.AWI
  • %HOMEPATH%\Z81M\Z23820H84687.FNG
  • %HOMEPATH%\Z81M\Y20301A27250.EJR
  • %HOMEPATH%\Z81M\X26817Z71309.AUS
  • %HOMEPATH%\Z81M\X20950L92942.DBO
  • %HOMEPATH%\Z81M\X53913C64943.HIZ
  • %HOMEPATH%\Z81M\X26981O88157.UZI
  • %HOMEPATH%\Z81M\X2434S51128.QBP
  • %HOMEPATH%\Z81M\W74136L8760.XIQ
  • %HOMEPATH%\Z81M\W56342T16735.RHV
  • %HOMEPATH%\Z81M\W93350B40107.FUX
  • %HOMEPATH%\Z81M\W82339L77223.GUH
  • %HOMEPATH%\Z81M\X97885J87530.QAH
  • %HOMEPATH%\Z81M\X93267M21015.CFA
  • %HOMEPATH%\Z81M\Y17672Y51935.GSF
  • %HOMEPATH%\Z81M\Y17664H13881.TRX
  • %HOMEPATH%\Z81M\X90045Y44356.SIJ
  • %HOMEPATH%\Z81M\X59754E68770.WMH
  • %HOMEPATH%\Z81M\X59681W46019.PIW
  • %HOMEPATH%\Z81M\X71614O34556.CRG
  • %HOMEPATH%\Z81M\X65382W53661.SFB
  • %HOMEPATH%\Z81M\Z75840I64920.AAH
  • %HOMEPATH%\Z81M\11277.YTC
  • %HOMEPATH%\Z81M\11104.HNE
  • %HOMEPATH%\Z81M\12796.YDR
  • %HOMEPATH%\Z81M\12736.VBG
  • %HOMEPATH%\Z81M\10728.TFF
  • %HOMEPATH%\Z81M\9847.JUT
  • %HOMEPATH%\Z81M\9173.ZND
  • %HOMEPATH%\Z81M\10028.HRY
  • %HOMEPATH%\Z81M\9922.CSL
  • %HOMEPATH%\Recent\Z81M.lnk
  • %HOMEPATH%\Recent\590a4e926d4c.lnk
  • %HOMEPATH%\R55E60.LX9
  • %TEMP%\aut1.tmp
  • %HOMEPATH%\Z81M\14590.PZK
  • %HOMEPATH%\Z81M\13802.COL
  • %HOMEPATH%\Z81M\13286.YET
  • %HOMEPATH%\Z81M\14399.NHO
  • %HOMEPATH%\Z81M\14351.AER
  • %HOMEPATH%\Z81M\8869.RRS
  • %HOMEPATH%\Z81M\2888.ZYU
  • %HOMEPATH%\Z81M\2755.QBK
  • %HOMEPATH%\Z81M\3638.TRE
  • %HOMEPATH%\Z81M\3615.RJQ
  • %HOMEPATH%\Z81M\2280.DYQ
  • %HOMEPATH%\Z81M\590a4e926d4c.jpg
  • %HOMEPATH%\Z81M\Z91408U25759.BRW
  • %HOMEPATH%\Z81M\1143.LGM
  • %HOMEPATH%\Z81M\1129.ALJ
  • %HOMEPATH%\Z81M\8150.NCB
  • %HOMEPATH%\Z81M\7384.IDF
  • %HOMEPATH%\Z81M\8426.QLU
  • %HOMEPATH%\Z81M\8153.CCZ
  • %HOMEPATH%\Z81M\6645.NYG
  • %HOMEPATH%\Z81M\4784.ZOT
  • %HOMEPATH%\Z81M\4198.MCQ
  • %HOMEPATH%\Z81M\5456.QKA
  • %HOMEPATH%\Z81M\5016.UBI
  • %HOMEPATH%\Z81M\W31837Z93958.QMT
  • %HOMEPATH%\Z81M\R65133K39808.PBX
  • %HOMEPATH%\Z81M\R48203S92836.VOU
  • %HOMEPATH%\Z81M\R84286H10197.OWF
  • %HOMEPATH%\Z81M\R72636T91920.LJN
  • %HOMEPATH%\Z81M\R37572J69137.CLN
  • %HOMEPATH%\Z81M\R30564T51061.CFM
  • %HOMEPATH%\Z81M\R30314Q73054.RHB
  • %HOMEPATH%\Z81M\R33813G66052.FMH
  • %HOMEPATH%\Z81M\R30717N42888.VQD
  • %HOMEPATH%\Z81M\S78871X9771.GQF
  • %HOMEPATH%\Z81M\S59802M92967.DET
  • %HOMEPATH%\Z81M\T9809D82961.RJG
  • %HOMEPATH%\Z81M\S98609L13301.VZB
  • %HOMEPATH%\Z81M\S46773Z75632.KXH
  • %HOMEPATH%\Z81M\R91356F27331.USS
  • %HOMEPATH%\Z81M\R87068L99926.UQR
  • %HOMEPATH%\Z81M\S45754F35950.HEA
  • %HOMEPATH%\Z81M\S39265I39172.GCB
  • %HOMEPATH%\Z81M\R21789Q27627.AJC
  • %HOMEPATH%\Z81M\Q9645N21924.ABH
  • %HOMEPATH%\Z81M\Q3494E37521.BKT
  • %HOMEPATH%\Z81M\Q21924L62414.GSD
  • %HOMEPATH%\Z81M\Q18770Q22261.ASN
  • %HOMEPATH%\Z81M\Q1555S73711.JGI
  • %HOMEPATH%\Z81M\P76815O2720.XZR
  • %HOMEPATH%\Z81M\P44965S1608.WBU
  • %HOMEPATH%\Z81M\P93247T87741.MUD
  • %HOMEPATH%\Z81M\P90046E28200.ZHV
  • %HOMEPATH%\Z81M\R11888G53859.DYS
  • %HOMEPATH%\Z81M\Q83328M99507.HAF
  • %HOMEPATH%\Z81M\R21683J48786.GZE
  • %HOMEPATH%\Z81M\R17416A73885.QBN
  • %HOMEPATH%\Z81M\Q77295I29070.RGQ
  • %HOMEPATH%\Z81M\Q35611K37303.UXE
  • %HOMEPATH%\Z81M\Q25540S6779.HUM
  • %HOMEPATH%\Z81M\Q61885O36711.OKH
  • %HOMEPATH%\Z81M\Q49150V43366.JTG
  • %HOMEPATH%\Z81M\T12687R91888.NGK
  • %HOMEPATH%\Z81M\V17316M99148.ZYH
  • %HOMEPATH%\Z81M\V13154S70243.DKP
  • %HOMEPATH%\Z81M\V44537J54060.XLQ
  • %HOMEPATH%\Z81M\V33493S93393.NNL
  • %HOMEPATH%\Z81M\V7555Y50356.LDU
  • %HOMEPATH%\Z81M\U79466K34097.URZ
  • %HOMEPATH%\Z81M\U71289D21670.NKF
  • %HOMEPATH%\Z81M\U91823Z30971.XJD
  • %HOMEPATH%\Z81M\U86202C9139.ZGB
  • %HOMEPATH%\Z81M\W16343E16208.JLS
  • %HOMEPATH%\Z81M\W14833J95277.LNR
  • %HOMEPATH%\Z81M\W26089D99079.ZQH
  • %HOMEPATH%\Z81M\W18709S4061.SHS
  • %HOMEPATH%\Z81M\W12750X15021.WCC
  • %HOMEPATH%\Z81M\V75812R14513.JXA
  • %HOMEPATH%\Z81M\V56929U11957.XRE
  • %HOMEPATH%\Z81M\W10977D99367.PBZ
  • %HOMEPATH%\Z81M\V96704W54242.JGM
  • %HOMEPATH%\Z81M\U71284J5647.VSL
  • %HOMEPATH%\Z81M\T57124E83775.ZLU
  • %HOMEPATH%\Z81M\T52265W68180.NGJ
  • %HOMEPATH%\Z81M\T84292D65293.BZF
  • %HOMEPATH%\Z81M\T66522W73690.XHZ
  • %HOMEPATH%\Z81M\T46113K91040.QMU
  • %HOMEPATH%\Z81M\T20720Q58563.NJK
  • %HOMEPATH%\Z81M\T18221A43222.QVJ
  • %HOMEPATH%\Z81M\T35046F28318.CXN
  • %HOMEPATH%\Z81M\T31866J16984.MWT
  • %HOMEPATH%\Z81M\U44987D92065.IVY
  • %HOMEPATH%\Z81M\U35386V23691.TOK
  • %HOMEPATH%\Z81M\U68960N12364.ZUU
  • %HOMEPATH%\Z81M\U48701T68274.ZRH
  • %HOMEPATH%\Z81M\U27869T45447.DMW
  • %HOMEPATH%\Z81M\U4310J52814.DIN
  • %HOMEPATH%\Z81M\T97371J36085.HTB
  • %HOMEPATH%\Z81M\U21408A23332.DUR
  • %HOMEPATH%\Z81M\U11963Y67927.UNP
  • %HOMEPATH%\Z81M\47074.BNN
  • %HOMEPATH%\Z81M\46735.JNC
  • %HOMEPATH%\Z81M\47363.AUI
  • %HOMEPATH%\Z81M\47153.UWB
  • %HOMEPATH%\Z81M\46242.XKL
  • %HOMEPATH%\Z81M\45651.LKA
  • %HOMEPATH%\Z81M\45647.UEY
  • %HOMEPATH%\Z81M\46206.LPL
  • %HOMEPATH%\Z81M\45906.ZCM
  • %HOMEPATH%\Z81M\49619.WOV
  • %HOMEPATH%\Z81M\49577.QCG
  • %HOMEPATH%\Z81M\50725.AOC
  • %HOMEPATH%\Z81M\50205.HGN
  • %HOMEPATH%\Z81M\49047.FZQ
  • %HOMEPATH%\Z81M\47892.MFQ
  • %HOMEPATH%\Z81M\47887.IAH
  • %HOMEPATH%\Z81M\48163.NNC
  • %HOMEPATH%\Z81M\48052.PIU
  • %HOMEPATH%\Z81M\45568.PSP
  • %HOMEPATH%\Z81M\39565.IYN
  • %HOMEPATH%\Z81M\39466.ZIQ
  • %HOMEPATH%\Z81M\40828.LTN
  • %HOMEPATH%\Z81M\39589.JAU
  • %HOMEPATH%\Z81M\39464.ELR
  • %HOMEPATH%\Z81M\38783.LYX
  • %HOMEPATH%\Z81M\38760.CCV
  • %HOMEPATH%\Z81M\39365.SZV
  • %HOMEPATH%\Z81M\39186.ULM
  • %HOMEPATH%\Z81M\44491.OKP
  • %HOMEPATH%\Z81M\43438.EHI
  • %HOMEPATH%\Z81M\45002.FFS
  • %HOMEPATH%\Z81M\44551.RAL
  • %HOMEPATH%\Z81M\42702.XWG
  • %HOMEPATH%\Z81M\41326.FSB
  • %HOMEPATH%\Z81M\41149.SRT
  • %HOMEPATH%\Z81M\42427.TLF
  • %HOMEPATH%\Z81M\41788.AHY
  • %HOMEPATH%\Z81M\51498.ISI
  • %HOMEPATH%\Z81M\61016.DPH
  • %HOMEPATH%\Z81M\60775.OZY
  • %HOMEPATH%\Z81M\61473.NMJ
  • %HOMEPATH%\Z81M\61027.MGT
  • %HOMEPATH%\Z81M\60595.MTF
  • %HOMEPATH%\Z81M\59530.WNV
  • %HOMEPATH%\Z81M\58760.TUY
  • %HOMEPATH%\Z81M\60517.FGK
  • %HOMEPATH%\Z81M\60280.YSQ
  • %HOMEPATH%\Z81M\63565.ZVD
  • %HOMEPATH%\Z81M\63297.WUO
  • %HOMEPATH%\Z81M\63694.ATV
  • %HOMEPATH%\Z81M\63690.XBV
  • %HOMEPATH%\Z81M\63144.QJJ
  • %HOMEPATH%\Z81M\62185.URO
  • %HOMEPATH%\Z81M\61934.AUC
  • %HOMEPATH%\Z81M\62483.GGR
  • %HOMEPATH%\Z81M\62279.TXJ
  • %HOMEPATH%\Z81M\58562.GEW
  • %HOMEPATH%\Z81M\53721.SSV
  • %HOMEPATH%\Z81M\53377.LKA
  • %HOMEPATH%\Z81M\54078.ENF
  • %HOMEPATH%\Z81M\53968.YOB
  • %HOMEPATH%\Z81M\53185.UBF
  • %HOMEPATH%\Z81M\51954.SSJ
  • %HOMEPATH%\Z81M\51568.LXI
  • %HOMEPATH%\Z81M\53149.JPM
  • %HOMEPATH%\Z81M\52475.WYS
  • %HOMEPATH%\Z81M\56539.BEB
  • %HOMEPATH%\Z81M\56309.TDX
  • %HOMEPATH%\Z81M\57670.PAG
  • %HOMEPATH%\Z81M\56694.FMA
  • %HOMEPATH%\Z81M\56065.DIA
  • %HOMEPATH%\Z81M\55614.WPW
  • %HOMEPATH%\Z81M\54620.BYZ
  • %HOMEPATH%\Z81M\55970.HRI
  • %HOMEPATH%\Z81M\55698.ZRR
  • %HOMEPATH%\Z81M\38717.TDR
  • %HOMEPATH%\Z81M\21300.TWS
  • %HOMEPATH%\Z81M\20691.UKF
  • %HOMEPATH%\Z81M\21830.JSB
  • %HOMEPATH%\Z81M\21617.PJN
  • %HOMEPATH%\Z81M\20595.DZQ
  • %HOMEPATH%\Z81M\20048.CDO
  • %HOMEPATH%\Z81M\19183.SZY
  • %HOMEPATH%\Z81M\20567.XVY
  • %HOMEPATH%\Z81M\20066.MVZ
  • %HOMEPATH%\Z81M\24704.TKF
  • %HOMEPATH%\Z81M\24660.EIW
  • %HOMEPATH%\Z81M\24873.LHA
  • %HOMEPATH%\Z81M\24719.YBB
  • %HOMEPATH%\Z81M\24606.BQS
  • %HOMEPATH%\Z81M\23342.GTE
  • %HOMEPATH%\Z81M\22325.VTF
  • %HOMEPATH%\Z81M\24032.QXC
  • %HOMEPATH%\Z81M\23792.QAG
  • %HOMEPATH%\Z81M\19105.OYB
  • %HOMEPATH%\Z81M\17301.FJK
  • %HOMEPATH%\Z81M\16893.IQL
  • %HOMEPATH%\Z81M\18019.HOV
  • %HOMEPATH%\Z81M\17524.PTW
  • %HOMEPATH%\Z81M\16779.LQX
  • %HOMEPATH%\Z81M\14891.CKK
  • %HOMEPATH%\Z81M\14700.LYO
  • %HOMEPATH%\Z81M\15864.LHD
  • %HOMEPATH%\Z81M\15032.XUI
  • %HOMEPATH%\Z81M\18760.PXR
  • %HOMEPATH%\Z81M\18691.JGU
  • %HOMEPATH%\Z81M\18932.XYR
  • %HOMEPATH%\Z81M\18760.VTF
  • %HOMEPATH%\Z81M\18672.SNC
  • %HOMEPATH%\Z81M\18099.WYS
  • %HOMEPATH%\Z81M\18072.LQY
  • %HOMEPATH%\Z81M\18305.KVB
  • %HOMEPATH%\Z81M\18230.NQG
  • %HOMEPATH%\Z81M\25100.GZA
  • %HOMEPATH%\Z81M\34021.HSH
  • %HOMEPATH%\Z81M\33529.KQO
  • %HOMEPATH%\Z81M\34945.KNI
  • %HOMEPATH%\Z81M\34635.KPT
  • %HOMEPATH%\Z81M\33462.RRE
  • %HOMEPATH%\Z81M\32258.HYY
  • %HOMEPATH%\Z81M\31598.HKZ
  • %HOMEPATH%\Z81M\32926.ZCQ
  • %HOMEPATH%\Z81M\32789.JCQ
  • %HOMEPATH%\Z81M\36681.DKJ
  • %HOMEPATH%\Z81M\36528.MFH
  • %HOMEPATH%\Z81M\37908.WAM
  • %HOMEPATH%\Z81M\36739.COG
  • %HOMEPATH%\Z81M\36256.SRX
  • %HOMEPATH%\Z81M\35424.JMD
  • %HOMEPATH%\Z81M\35361.PMG
  • %HOMEPATH%\Z81M\36032.GGM
  • %HOMEPATH%\Z81M\35512.PXS
  • %HOMEPATH%\Z81M\31217.ZZG
  • %HOMEPATH%\Z81M\27380.UQF
  • %HOMEPATH%\Z81M\27150.FBY
  • %HOMEPATH%\Z81M\27735.DJE
  • %HOMEPATH%\Z81M\27548.TLS
  • %HOMEPATH%\Z81M\26490.HMJ
  • %HOMEPATH%\Z81M\26214.KXR
  • %HOMEPATH%\Z81M\25839.LXJ
  • %HOMEPATH%\Z81M\26489.XJR
  • %HOMEPATH%\Z81M\26361.IAG
  • %HOMEPATH%\Z81M\29203.AXT
  • %HOMEPATH%\Z81M\29200.TZK
  • %HOMEPATH%\Z81M\31215.PHI
  • %HOMEPATH%\Z81M\30591.TJX
  • %HOMEPATH%\Z81M\29047.UFU
  • %HOMEPATH%\Z81M\28282.PYF
  • %HOMEPATH%\Z81M\28081.SRW
  • %HOMEPATH%\Z81M\28809.JVA
  • %HOMEPATH%\Z81M\28491.XUQ
  • %HOMEPATH%\Z81M\99017.XVS
  • %HOMEPATH%\Z81M\98615.NXM
  • %HOMEPATH%\Z81M\A4960I87548.KMK
  • %HOMEPATH%\Z81M\99455.EQU
  • %HOMEPATH%\Z81M\98607.AXH
  • %HOMEPATH%\Z81M\97263.KGI
  • %HOMEPATH%\Z81M\97167.SUA
  • %HOMEPATH%\Z81M\98526.NMM
  • %HOMEPATH%\Z81M\97568.IXY
  • %HOMEPATH%\Z81M\A86554G9192.QLK
  • %HOMEPATH%\Z81M\A69905X49952.IUI
  • %HOMEPATH%\Z81M\A99699N55175.PXF
  • %HOMEPATH%\Z81M\A96154P68521.LGJ
  • %HOMEPATH%\Z81M\A67807S77241.SKC
  • %HOMEPATH%\Z81M\A9308I23682.SIP
  • %HOMEPATH%\Z81M\A6546E72649.HQY
  • %HOMEPATH%\Z81M\A43308A29239.MTU
  • %HOMEPATH%\Z81M\A32000Y25344.PLY
  • %HOMEPATH%\Z81M\95636.AEV
  • %HOMEPATH%\Z81M\90330.IHL
  • %HOMEPATH%\Z81M\90114.ZNW
  • %HOMEPATH%\Z81M\92433.ZUE
  • %HOMEPATH%\Z81M\92405.MXB
  • %HOMEPATH%\Z81M\89165.LBP
  • %HOMEPATH%\Z81M\86261.UZV
  • %HOMEPATH%\Z81M\86131.WRQ
  • %HOMEPATH%\Z81M\87431.UME
  • %HOMEPATH%\Z81M\86985.DCE
  • %HOMEPATH%\Z81M\94736.VWH
  • %HOMEPATH%\Z81M\94363.HSU
  • %HOMEPATH%\Z81M\95355.KLJ
  • %HOMEPATH%\Z81M\94872.SSM
  • %HOMEPATH%\Z81M\94339.PHP
  • %HOMEPATH%\Z81M\92639.LBM
  • %HOMEPATH%\Z81M\92495.RSH
  • %HOMEPATH%\Z81M\93495.NSB
  • %HOMEPATH%\Z81M\93256.RRP
  • %HOMEPATH%\Z81M\AS.NZR
  • %HOMEPATH%\Z81M\C96609R89476.LUF
  • %HOMEPATH%\Z81M\C85498C56434.XCI
  • %HOMEPATH%\Z81M\D17004H20441.YOU
  • %HOMEPATH%\Z81M\D10160M20973.GYT
  • %HOMEPATH%\Z81M\C70240F94474.FNR
  • %HOMEPATH%\Z81M\C61905W45327.OHF
  • %HOMEPATH%\Z81M\C52049J1801.ZUK
  • %HOMEPATH%\Z81M\C67245O82690.EVN
  • %HOMEPATH%\Z81M\C62694E43862.TFJ
  • %HOMEPATH%\Z81M\D72747A54424.KXM
  • %HOMEPATH%\Z81M\D70257C5491.CUA
  • %HOMEPATH%\Z81M\D89963F25056.ZWD
  • %HOMEPATH%\Z81M\D78102N3076.HXS
  • %HOMEPATH%\Z81M\D69312Q14924.EPU
  • %HOMEPATH%\Z81M\D21000R5309.ULH
  • %HOMEPATH%\Z81M\D18743X26853.KMJ
  • %HOMEPATH%\Z81M\D69117P16177.CAB
  • %HOMEPATH%\Z81M\D30524X40424.BHC
  • %HOMEPATH%\Z81M\C40685Q3296.AIB
  • %HOMEPATH%\Z81M\B57634M69261.AVL
  • %HOMEPATH%\Z81M\B43923L5268.RXS
  • %HOMEPATH%\Z81M\B73322R15436.EZR
  • %HOMEPATH%\Z81M\B68768V57401.FID
  • %HOMEPATH%\Z81M\B38580R95756.CWD
  • %HOMEPATH%\Z81M\B13035A30071.ANG
  • %HOMEPATH%\Z81M\B3492B30482.CMU
  • %HOMEPATH%\Z81M\B31697K30317.IVP
  • %HOMEPATH%\Z81M\B14316G65424.VGQ
  • %HOMEPATH%\Z81M\C22773K19564.LSH
  • %HOMEPATH%\Z81M\C21928Z4914.RIY
  • %HOMEPATH%\Z81M\C38148K13141.MQH
  • %HOMEPATH%\Z81M\C35076D95681.JGF
  • %HOMEPATH%\Z81M\C21281G17342.UHK
  • %HOMEPATH%\Z81M\B87033S42158.LTF
  • %HOMEPATH%\Z81M\B75685S44220.UAM
  • %HOMEPATH%\Z81M\C9271K65625.ODT
  • %HOMEPATH%\Z81M\B87376U23815.QHT
  • %HOMEPATH%\Z81M\85747.FIK
  • %HOMEPATH%\Z81M\70128.YWP
  • %HOMEPATH%\Z81M\69684.AFE
  • %HOMEPATH%\Z81M\70363.CYG
  • %HOMEPATH%\Z81M\70198.UIL
  • %HOMEPATH%\Z81M\69672.TSF
  • %HOMEPATH%\Z81M\69430.TFB
  • %HOMEPATH%\Z81M\69304.FVD
  • %HOMEPATH%\Z81M\69600.KSV
  • %HOMEPATH%\Z81M\69588.PIW
  • %HOMEPATH%\Z81M\72547.AEW
  • %HOMEPATH%\Z81M\72532.TMD
  • %HOMEPATH%\Z81M\73028.HBZ
  • %HOMEPATH%\Z81M\72926.ACN
  • %HOMEPATH%\Z81M\72403.GJD
  • %HOMEPATH%\Z81M\70524.NUB
  • %HOMEPATH%\Z81M\70368.UIC
  • %HOMEPATH%\Z81M\71763.SGX
  • %HOMEPATH%\Z81M\71544.XYN
  • %HOMEPATH%\Z81M\68650.ROB
  • %HOMEPATH%\Z81M\64513.CSN
  • %HOMEPATH%\Z81M\64245.IFU
  • %HOMEPATH%\Z81M\65052.QEO
  • %HOMEPATH%\Z81M\64881.ZQF
  • %HOMEPATH%\Z81M\64144.JUY
  • %HOMEPATH%\Z81M\64030.AJG
  • %HOMEPATH%\Z81M\63893.PKO
  • %HOMEPATH%\Z81M\64030.MJE
  • %HOMEPATH%\Z81M\64030.BPG
  • %HOMEPATH%\Z81M\67566.YZJ
  • %HOMEPATH%\Z81M\67254.RCT
  • %HOMEPATH%\Z81M\68399.IDO
  • %HOMEPATH%\Z81M\68368.UYY
  • %HOMEPATH%\Z81M\66790.GUA
  • %HOMEPATH%\Z81M\66229.ASK
  • %HOMEPATH%\Z81M\65301.UUG
  • %HOMEPATH%\Z81M\66331.MEX
  • %HOMEPATH%\Z81M\66241.ERH
  • %HOMEPATH%\Z81M\73167.CXM
  • %HOMEPATH%\Z81M\81452.BOF
  • %HOMEPATH%\Z81M\81113.XCS
  • %HOMEPATH%\Z81M\81796.QTJ
  • %HOMEPATH%\Z81M\81596.ABO
  • %HOMEPATH%\Z81M\80840.LXV
  • %HOMEPATH%\Z81M\80157.DGN
  • %HOMEPATH%\Z81M\79648.RBV
  • %HOMEPATH%\Z81M\80455.DAF
  • %HOMEPATH%\Z81M\80428.AWJ
  • %HOMEPATH%\Z81M\84624.MSU
  • %HOMEPATH%\Z81M\82979.UQS
  • %HOMEPATH%\Z81M\85409.EZE
  • %HOMEPATH%\Z81M\85063.IBS
  • %HOMEPATH%\Z81M\82978.SYF
  • %HOMEPATH%\Z81M\82094.AVO
  • %HOMEPATH%\Z81M\82013.FKL
  • %HOMEPATH%\Z81M\82753.XCJ
  • %HOMEPATH%\Z81M\82737.ZFC
  • %HOMEPATH%\Z81M\79551.CXF
  • %HOMEPATH%\Z81M\75254.OCO
  • %HOMEPATH%\Z81M\74396.ERV
  • %HOMEPATH%\Z81M\76565.REL
  • %HOMEPATH%\Z81M\75680.XYE
  • %HOMEPATH%\Z81M\74229.BFZ
  • %HOMEPATH%\Z81M\73803.TSJ
  • %HOMEPATH%\Z81M\73235.QYO
  • %HOMEPATH%\Z81M\73929.WNC
  • %HOMEPATH%\Z81M\73911.SMK
  • %HOMEPATH%\Z81M\78525.MJI
  • %HOMEPATH%\Z81M\78442.GFE
  • %HOMEPATH%\Z81M\79362.BXK
  • %HOMEPATH%\Z81M\78663.FSM
  • %HOMEPATH%\Z81M\78351.ZSN
  • %HOMEPATH%\Z81M\77183.DIW
  • %HOMEPATH%\Z81M\76790.UBW
  • %HOMEPATH%\Z81M\77605.OLN
  • %HOMEPATH%\Z81M\77536.YYP
Sets the 'hidden' attribute to the following files:
  • %HOMEPATH%\R55E60.LX9
Deletes the following files:
  • %HOMEPATH%\R55E60.LX9
  • %TEMP%\aut1.tmp
Network activity:
Connects to:
  • '21#.#.208.76':7824
Miscellaneous:
Searches for the following windows:
  • ClassName: 'ShImgVw:CPreviewWnd' WindowName: '(null)'
  • ClassName: 'Shell_TrayWnd' WindowName: '(null)'
  • ClassName: 'EDIT' WindowName: '(null)'

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android