マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Trojan.Inject1.33640

Added to the Dr.Web virus database: 2013-12-13

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Zk92081K72280' = '%HOMEPATH%\Ne27010L56246\PLANILLA.exe'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
  • Windows Task Manager (Taskmgr)
Creates and executes the following:
  • '%ALLUSERSPROFILE%\..exe'
  • '%HOMEPATH%\Ne27010L56246\PLANILLA.exe'
Executes the following:
  • '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe'
Injects code into
the following system processes:
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
Modifies file system :
Creates the following files:
  • %HOMEPATH%\Ne27010L56246\47220.RWX
  • %HOMEPATH%\Ne27010L56246\G55864R90312.KAG
  • %HOMEPATH%\Ne27010L56246\I37791S3591.UVE
  • %HOMEPATH%\Ne27010L56246\N28812F99158.HVB
  • %HOMEPATH%\Ne27010L56246\30694.AKQ
  • %HOMEPATH%\Ne27010L56246\I11880O28339.WYT
  • %HOMEPATH%\Ne27010L56246\18274.GUA
  • %HOMEPATH%\Ne27010L56246\92196.RTA
  • %HOMEPATH%\Ne27010L56246\9009.YBC
  • %HOMEPATH%\Ne27010L56246\84603.FHM
  • %HOMEPATH%\Ne27010L56246\X64946B86563.BFN
  • %HOMEPATH%\Ne27010L56246\12088.EBK
  • %HOMEPATH%\Ne27010L56246\R86242B43948.NSK
  • %HOMEPATH%\Ne27010L56246\87505.BOS
  • %HOMEPATH%\Ne27010L56246\65556.TCA
  • %HOMEPATH%\Ne27010L56246\S47685R88002.SNZ
  • %HOMEPATH%\Ne27010L56246\69655.ZTZ
  • %HOMEPATH%\Ne27010L56246\E88851I94342.VAV
  • %HOMEPATH%\Ne27010L56246\I49321M45537.LFJ
  • %HOMEPATH%\Ne27010L56246\32166.QBU
  • %HOMEPATH%\Ne27010L56246\A58368Z32397.KBL
  • %HOMEPATH%\Ne27010L56246\R9644A66641.LDS
  • %HOMEPATH%\Ne27010L56246\1741.JNJ
  • %HOMEPATH%\Ne27010L56246\S1902F55024.UOR
  • %HOMEPATH%\Ne27010L56246\A30090J25523.WQT
  • %HOMEPATH%\Ne27010L56246\11071.GTW
  • %HOMEPATH%\Ne27010L56246\H18820G44299.TXW
  • %HOMEPATH%\Ne27010L56246\9476.XBR
  • %HOMEPATH%\Ne27010L56246\69988.YQK
  • %HOMEPATH%\Ne27010L56246\47769.KAK
  • %HOMEPATH%\Ne27010L56246\R25954G79915.PJX
  • %HOMEPATH%\Ne27010L56246\88392.VAQ
  • %HOMEPATH%\Ne27010L56246\76254.RAF
  • %HOMEPATH%\Ne27010L56246\V2923W41685.WCC
  • %HOMEPATH%\Ne27010L56246\33214.NXI
  • %HOMEPATH%\Ne27010L56246\94458.SDP
  • %HOMEPATH%\Ne27010L56246\67484.ECM
  • %HOMEPATH%\Ne27010L56246\59949.QBL
  • %HOMEPATH%\Ne27010L56246\73668.GQQ
  • %HOMEPATH%\Ne27010L56246\66873.GAB
  • %HOMEPATH%\Ne27010L56246\D26078B4192.HFY
  • %HOMEPATH%\Ne27010L56246\36672.EIQ
  • %HOMEPATH%\Ne27010L56246\70949.KBT
  • %HOMEPATH%\Ne27010L56246\50961.IYX
  • %HOMEPATH%\Ne27010L56246\58974.XSL
  • %HOMEPATH%\Ne27010L56246\W1804G56506.LMD
  • %HOMEPATH%\Ne27010L56246\N85995B16743.SCR
  • %HOMEPATH%\Ne27010L56246\30471.GPW
  • %HOMEPATH%\Ne27010L56246\F54656T95118.GWA
  • %HOMEPATH%\Ne27010L56246\E14544C6060.GDS
  • %HOMEPATH%\Ne27010L56246\96070.PLV
  • %HOMEPATH%\Ne27010L56246\M13875Q44134.PDN
  • %HOMEPATH%\Ne27010L56246\56938.CVS
  • %HOMEPATH%\Ne27010L56246\X9654P64148.JCA
  • %HOMEPATH%\Ne27010L56246\Q56203Y27755.ZLF
  • %HOMEPATH%\Ne27010L56246\69723.RAD
  • %HOMEPATH%\Ne27010L56246\T48361N86055.IMS
  • %HOMEPATH%\Ne27010L56246\H10261Q81850.QNH
  • %HOMEPATH%\Ne27010L56246\G89970M1066.EMF
  • %HOMEPATH%\Ne27010L56246\C74399Z76736.ANJ
  • %HOMEPATH%\Ne27010L56246\Z5156I43923.JSN
  • %HOMEPATH%\Ne27010L56246\B47338W66089.RGL
  • %HOMEPATH%\Ne27010L56246\48744.XFB
  • %HOMEPATH%\Ne27010L56246\94692.NGW
  • %HOMEPATH%\Ne27010L56246\V42162B60697.WWP
  • %HOMEPATH%\Ne27010L56246\59856.JRP
  • %HOMEPATH%\Ne27010L56246\25386.OTW
  • %HOMEPATH%\Ne27010L56246\L50051W85090.ZNM
  • %HOMEPATH%\Ne27010L56246\88877.JXY
  • %HOMEPATH%\Ne27010L56246\22629.FQJ
  • %HOMEPATH%\Ne27010L56246\Q18219J8257.PWV
  • %HOMEPATH%\Ne27010L56246\22494.YVD
  • %HOMEPATH%\Ne27010L56246\27753.ZAV
  • %HOMEPATH%\Ne27010L56246\D49369U11174.JNC
  • %HOMEPATH%\Ne27010L56246\I15624E19564.TOC
  • %HOMEPATH%\Ne27010L56246\Y10776W34685.PDN
  • %HOMEPATH%\Ne27010L56246\75508.DPT
  • %HOMEPATH%\Ne27010L56246\V58752N60647.RGX
  • %HOMEPATH%\Ne27010L56246\J88254U83927.FPQ
  • %HOMEPATH%\Ne27010L56246\28465.WEV
  • %HOMEPATH%\Ne27010L56246\81459.ZCO
  • %HOMEPATH%\Ne27010L56246\Z91134I46998.PKE
  • %HOMEPATH%\Ne27010L56246\X97629B95807.FFD
  • %HOMEPATH%\Ne27010L56246\11198.CXG
  • %HOMEPATH%\Ne27010L56246\K39193A30098.APD
  • %HOMEPATH%\Ne27010L56246\23246.EBA
  • %HOMEPATH%\Ne27010L56246\74451.TCW
  • %HOMEPATH%\Ne27010L56246\G78065K77477.JWR
  • %HOMEPATH%\Ne27010L56246\I96499I76209.PLR
  • %HOMEPATH%\Ne27010L56246\95814.TQI
  • %HOMEPATH%\Ne27010L56246\40520.ZCW
  • %HOMEPATH%\Ne27010L56246\69214.HIK
  • %HOMEPATH%\Ne27010L56246\Z31121Y18909.HMG
  • %HOMEPATH%\Ne27010L56246\N72899W88973.AUZ
  • %HOMEPATH%\Ne27010L56246\A50025P16016.LRV
  • %HOMEPATH%\Ne27010L56246\I5030H33626.BQN
  • %HOMEPATH%\Ne27010L56246\82927.PJP
  • %HOMEPATH%\Ne27010L56246\G68647O85998.JPJ
  • %HOMEPATH%\Ne27010L56246\B67819E14816.TJH
  • %HOMEPATH%\Ne27010L56246\U79933H72700.GGA
  • %HOMEPATH%\Ne27010L56246\84483.NUA
  • %HOMEPATH%\Ne27010L56246\U98579R45847.NQA
  • %HOMEPATH%\Ne27010L56246\29281.UYQ
  • %HOMEPATH%\Ne27010L56246\63087.YWV
  • %HOMEPATH%\Ne27010L56246\T41251K2056.GGO
  • %HOMEPATH%\Ne27010L56246\A5373W40505.YAK
  • %HOMEPATH%\Ne27010L56246\T27965I71283.KQD
  • %HOMEPATH%\Ne27010L56246\41995.CVQ
  • %HOMEPATH%\Ne27010L56246\C67955H81597.SJG
  • %HOMEPATH%\Ne27010L56246\U54843R5525.APZ
  • %HOMEPATH%\Ne27010L56246\4451.GDX
  • %HOMEPATH%\Ne27010L56246\70841.JZE
  • %HOMEPATH%\Ne27010L56246\X7054Q41524.VXF
  • %HOMEPATH%\Ne27010L56246\62121.TWW
  • %HOMEPATH%\Ne27010L56246\S56563C4689.SAI
  • %HOMEPATH%\Ne27010L56246\H14416P22943.KLW
  • %HOMEPATH%\Ne27010L56246\I75514A86024.FKN
  • %HOMEPATH%\Ne27010L56246\N66675F38093.QHT
  • %HOMEPATH%\Ne27010L56246\Q89241H56291.BAI
  • %HOMEPATH%\Ne27010L56246\Z99615K27902.NIW
  • %HOMEPATH%\Ne27010L56246\X98256B57451.ZED
  • %HOMEPATH%\Ne27010L56246\3482.NWM
  • %HOMEPATH%\Ne27010L56246\92546.ZEL
  • %HOMEPATH%\Ne27010L56246\Y37613L30043.EEM
  • %HOMEPATH%\Ne27010L56246\68545.FPM
  • %HOMEPATH%\Ne27010L56246\56916.WTH
  • %HOMEPATH%\Ne27010L56246\L31858B56324.ZAL
  • %HOMEPATH%\Ne27010L56246\C37430Y64950.ZJC
  • %HOMEPATH%\Ne27010L56246\4041.PIJ
  • %HOMEPATH%\Ne27010L56246\17841.MYO
  • %HOMEPATH%\Ne27010L56246\I51454W15929.XME
  • %HOMEPATH%\Ne27010L56246\17454.ITU
  • %HOMEPATH%\Ne27010L56246\96045.WXU
  • %HOMEPATH%\Ne27010L56246\64864.ZFK
  • %HOMEPATH%\Ne27010L56246\T66150L16159.XSC
  • %HOMEPATH%\Ne27010L56246\O59699L37838.YFK
  • %HOMEPATH%\Ne27010L56246\F75254W19189.JTU
  • %HOMEPATH%\Ne27010L56246\82611.NAK
  • %HOMEPATH%\Ne27010L56246\H21239S22610.YRO
  • %HOMEPATH%\Ne27010L56246\36602.MLH
  • %HOMEPATH%\Ne27010L56246\Q60338W90272.ZFW
  • %HOMEPATH%\Ne27010L56246\32120.LJF
  • %HOMEPATH%\Ne27010L56246\16877.YFC
  • %HOMEPATH%\Ne27010L56246\42395.UAZ
  • %HOMEPATH%\Ne27010L56246\52988.CEE
  • %HOMEPATH%\Ne27010L56246\38340.YTA
  • %HOMEPATH%\Ne27010L56246\70506.UOX
  • %HOMEPATH%\Ne27010L56246\44138.AKA
  • %HOMEPATH%\Ne27010L56246\V3660U47794.VBB
  • %HOMEPATH%\Ne27010L56246\N42643Z49251.SYL
  • %HOMEPATH%\Ne27010L56246\59933.DPE
  • %HOMEPATH%\Ne27010L56246\P97092C70492.EPW
  • %HOMEPATH%\Ne27010L56246\35801.ANL
  • %HOMEPATH%\Ne27010L56246\U12976L87231.ZOG
  • %HOMEPATH%\Ne27010L56246\28684.CXB
  • %HOMEPATH%\Ne27010L56246\E87651N87811.QTB
  • %HOMEPATH%\Ne27010L56246\79392.YCP
  • %HOMEPATH%\Ne27010L56246\E74785A59037.VYB
  • %HOMEPATH%\Ne27010L56246\L26429D1755.NKD
  • %HOMEPATH%\Ne27010L56246\70677.UEQ
  • %HOMEPATH%\Ne27010L56246\Z98990N77831.XTQ
  • %HOMEPATH%\Ne27010L56246\P3844O27927.YYL
  • %HOMEPATH%\Ne27010L56246\Q51592Z9270.MXV
  • %HOMEPATH%\Ne27010L56246\J97486L53250.WCZ
  • %HOMEPATH%\Ne27010L56246\T14374L53826.EDS
  • %HOMEPATH%\Ne27010L56246\R86731B90236.TUY
  • %HOMEPATH%\Ne27010L56246\Q8417A88808.CRV
  • %HOMEPATH%\Ne27010L56246\F4424N21678.HLR
  • %HOMEPATH%\Ne27010L56246\94726.QDY
  • %HOMEPATH%\Ne27010L56246\98643.NCN
  • %HOMEPATH%\Ne27010L56246\Z85736I77899.FBD
  • %HOMEPATH%\Ne27010L56246\50151.ILN
  • %HOMEPATH%\Ne27010L56246\74886.DCV
  • %TEMP%\aut1.tmp
  • %HOMEPATH%\Zm69542P70117.txt
  • %ALLUSERSPROFILE%\..exe
  • %HOMEPATH%\Zf35592N36145.RM7
  • %HOMEPATH%\Ne27010L56246\36499.GDK
  • %HOMEPATH%\Ne27010L56246\59384.EPC
  • C:\PLANILLA.exe
  • %HOMEPATH%\Ne27010L56246\DP.OPU
  • %HOMEPATH%\Ne27010L56246\D32583X17393.UXX
  • %HOMEPATH%\Ne27010L56246\P6321G65217.QNQ
  • %HOMEPATH%\Ne27010L56246\70599.IGR
  • %HOMEPATH%\Ne27010L56246\C24230K10909.VZX
  • %HOMEPATH%\Ne27010L56246\D62104P1624.NJS
  • %HOMEPATH%\Ne27010L56246\R30600V61237.KYE
  • %HOMEPATH%\Ne27010L56246\48223.OIJ
  • %HOMEPATH%\Ne27010L56246\F83200N23909.VKZ
  • %HOMEPATH%\Ne27010L56246\19839.OKF
  • %HOMEPATH%\Ne27010L56246\J6520A1905.KLN
  • %HOMEPATH%\Ne27010L56246\64562.TAA
  • %HOMEPATH%\Ne27010L56246\N38925H92716.XML
  • %HOMEPATH%\Ne27010L56246\A36285T49349.MEK
  • %HOMEPATH%\Ne27010L56246\46055.ZQS
  • %HOMEPATH%\Ne27010L56246\6453.MWA
  • %HOMEPATH%\Ne27010L56246\S19989M23238.EZW
  • %HOMEPATH%\Ne27010L56246\I47576H92776.HBI
  • %HOMEPATH%\Ne27010L56246\42281.BUC
  • %HOMEPATH%\Ne27010L56246\32281.OFH
  • %HOMEPATH%\Ne27010L56246\75851.CEV
  • %HOMEPATH%\Ne27010L56246\68544.QCK
  • %HOMEPATH%\Ne27010L56246\B39563K66535.XLS
  • %HOMEPATH%\Ne27010L56246\Z5574R79057.REQ
  • %HOMEPATH%\Ne27010L56246\12491.QMN
  • %HOMEPATH%\Ne27010L56246\18654.WNW
  • %HOMEPATH%\Ne27010L56246\Z27453I38182.OHI
  • %HOMEPATH%\Ne27010L56246\B84162V41695.HCD
  • %HOMEPATH%\Ne27010L56246\B94720S96229.ERY
  • %HOMEPATH%\Ne27010L56246\D58703J26075.XJP
  • %HOMEPATH%\Ne27010L56246\61163.CEE
  • %HOMEPATH%\Ne27010L56246\T62570L99093.ZVM
  • %HOMEPATH%\Ne27010L56246\I96150I7328.DBG
  • %HOMEPATH%\Ne27010L56246\L33104E69957.OMS
  • %HOMEPATH%\Ne27010L56246\T77155B26628.TPN
  • %HOMEPATH%\Ne27010L56246\S43367O14112.UBC
  • %HOMEPATH%\Ne27010L56246\C86903P68254.WUL
  • %HOMEPATH%\Ne27010L56246\33471.HQL
  • %HOMEPATH%\Ne27010L56246\88916.UAC
  • %HOMEPATH%\Ne27010L56246\I10292E28946.VPO
  • %HOMEPATH%\Ne27010L56246\G50257N3523.OZG
  • %HOMEPATH%\Ne27010L56246\31243.IFM
  • %HOMEPATH%\Ne27010L56246\P71314M44012.WBE
  • %HOMEPATH%\Ne27010L56246\41038.YPG
  • %HOMEPATH%\Ne27010L56246\O50532G8207.TAL
  • %HOMEPATH%\Ne27010L56246\79136.DYF
  • %HOMEPATH%\Ne27010L56246\J22397O14988.NHG
  • %HOMEPATH%\Ne27010L56246\88819.PVB
  • %HOMEPATH%\Ne27010L56246\59343.MIV
  • %HOMEPATH%\Ne27010L56246\G92416G55322.OJI
  • %HOMEPATH%\Ne27010L56246\L53200R36660.GLD
  • %HOMEPATH%\Ne27010L56246\R97809O28560.OPP
  • %HOMEPATH%\Ne27010L56246\19014.KPJ
  • %HOMEPATH%\Ne27010L56246\O79026W15518.UUD
  • %HOMEPATH%\Ne27010L56246\67552.FQZ
  • %HOMEPATH%\Ne27010L56246\C58588A98349.JQV
  • %HOMEPATH%\Ne27010L56246\X61237B32164.HBK
  • %HOMEPATH%\Ne27010L56246\G40115P46519.UML
  • %HOMEPATH%\Ne27010L56246\26147.ZAC
  • %HOMEPATH%\Ne27010L56246\D44134M54036.BOJ
  • %HOMEPATH%\Ne27010L56246\X54657U85131.KSI
  • %HOMEPATH%\Ne27010L56246\Q42243E40509.IWL
  • %HOMEPATH%\Ne27010L56246\V83297Q94520.ZCF
  • %HOMEPATH%\Ne27010L56246\27912.VUM
  • %HOMEPATH%\Ne27010L56246\20457.YVL
  • %HOMEPATH%\Ne27010L56246\K82699M87995.ZIO
  • %HOMEPATH%\Ne27010L56246\64813.FSY
  • %HOMEPATH%\Ne27010L56246\K78074G84720.FIT
  • %HOMEPATH%\Ne27010L56246\D79217R96852.VHW
  • %HOMEPATH%\Ne27010L56246\V68721H83379.TQM
  • %HOMEPATH%\Ne27010L56246\I45371E56555.OAZ
  • %HOMEPATH%\Ne27010L56246\33099.VDC
  • %HOMEPATH%\Ne27010L56246\81885.NAY
  • %HOMEPATH%\Ne27010L56246\59694.AKO
  • %HOMEPATH%\Ne27010L56246\M99489I85277.FBR
  • %HOMEPATH%\Ne27010L56246\D40924T55617.PKO
  • %HOMEPATH%\Ne27010L56246\G29267C25662.WDF
  • %HOMEPATH%\Ne27010L56246\46216.NLO
  • %HOMEPATH%\Ne27010L56246\79687.HYA
  • %HOMEPATH%\Ne27010L56246\94354.JZV
  • %HOMEPATH%\Ne27010L56246\85107.NAQ
  • %HOMEPATH%\Ne27010L56246\80079.MHN
  • %HOMEPATH%\Ne27010L56246\W41322D46176.ORF
  • %HOMEPATH%\Ne27010L56246\54633.YKA
  • %HOMEPATH%\Ne27010L56246\21091.RRL
  • %HOMEPATH%\Ne27010L56246\46199.VIX
  • %HOMEPATH%\Ne27010L56246\41427.GYO
  • %HOMEPATH%\Ne27010L56246\L47451N90841.OZQ
  • %HOMEPATH%\Ne27010L56246\95257.YUN
  • %HOMEPATH%\Ne27010L56246\U82006N11126.DVU
  • %HOMEPATH%\Ne27010L56246\31254.LZJ
  • %HOMEPATH%\Ne27010L56246\A8307Y10987.GZP
  • %HOMEPATH%\Ne27010L56246\G86261H14035.YSB
  • %HOMEPATH%\Ne27010L56246\P55484K32238.NTN
  • %HOMEPATH%\Ne27010L56246\6302.JYH
  • %HOMEPATH%\Ne27010L56246\M65622Y76797.RVE
  • %HOMEPATH%\Ne27010L56246\Y34283Y73412.DEF
  • %HOMEPATH%\Ne27010L56246\8199.OGI
  • %HOMEPATH%\Ne27010L56246\T39163D1446.PTQ
  • %HOMEPATH%\Ne27010L56246\61966.ZKC
  • %HOMEPATH%\Ne27010L56246\B6735A76217.ICL
  • %HOMEPATH%\Ne27010L56246\P93531E52260.DMD
  • %HOMEPATH%\Ne27010L56246\77854.QDZ
  • %HOMEPATH%\Ne27010L56246\19916.FNM
  • %HOMEPATH%\Ne27010L56246\28067.DMJ
  • %HOMEPATH%\Ne27010L56246\43919.FEH
  • %HOMEPATH%\Ne27010L56246\D77124C37688.LTJ
  • %HOMEPATH%\Ne27010L56246\5843.WTD
  • %HOMEPATH%\Ne27010L56246\19396.MCT
  • %HOMEPATH%\Ne27010L56246\Z95688N2552.XER
  • %HOMEPATH%\Ne27010L56246\M90255O16820.SQU
  • %HOMEPATH%\Ne27010L56246\22561.WGZ
  • %HOMEPATH%\Ne27010L56246\10063.VZL
  • %HOMEPATH%\Ne27010L56246\86272.PUO
  • %HOMEPATH%\Ne27010L56246\F23625Y38527.VNE
  • %HOMEPATH%\Ne27010L56246\O45944U80667.FAO
  • %HOMEPATH%\Ne27010L56246\X68064H22585.ORA
  • %HOMEPATH%\Ne27010L56246\R96951H65152.SAH
  • %HOMEPATH%\Ne27010L56246\3386.XQI
  • %HOMEPATH%\Ne27010L56246\51862.RPT
  • %HOMEPATH%\Ne27010L56246\Q23021V15763.REF
  • %HOMEPATH%\Ne27010L56246\46449.ZKZ
  • %HOMEPATH%\Ne27010L56246\P48052F16518.HBJ
  • %HOMEPATH%\Ne27010L56246\58413.MUW
  • %HOMEPATH%\Ne27010L56246\83793.FKV
  • %HOMEPATH%\Ne27010L56246\O23696L49500.IHA
  • %HOMEPATH%\Ne27010L56246\81641.IDX
  • %HOMEPATH%\Ne27010L56246\T59257G31178.MXY
  • %HOMEPATH%\Ne27010L56246\G8266V61208.IUA
  • %HOMEPATH%\Ne27010L56246\J17992H44653.HHT
  • %HOMEPATH%\Ne27010L56246\21376.ZJY
  • %HOMEPATH%\Ne27010L56246\98668.GSV
  • %HOMEPATH%\Ne27010L56246\Q11662K79524.CSD
  • %HOMEPATH%\Ne27010L56246\L84088K26232.HCM
  • %HOMEPATH%\Ne27010L56246\37536.BSH
  • %HOMEPATH%\Ne27010L56246\46887.CHR
  • %HOMEPATH%\Ne27010L56246\K86362K70174.MDM
  • %HOMEPATH%\Ne27010L56246\54776.XII
  • %HOMEPATH%\Ne27010L56246\74111.AHH
  • %HOMEPATH%\Ne27010L56246\36948.FIA
  • %HOMEPATH%\Ne27010L56246\13270.PKR
  • %HOMEPATH%\Ne27010L56246\27714.WDY
  • %HOMEPATH%\Ne27010L56246\N23894I28766.YRH
  • %HOMEPATH%\Ne27010L56246\U99400Q28716.ARR
  • %HOMEPATH%\Ne27010L56246\22927.KRY
  • %HOMEPATH%\Ne27010L56246\R18960V13357.XHO
  • %HOMEPATH%\Ne27010L56246\N68452D49927.LZY
  • %HOMEPATH%\Ne27010L56246\Y76880M69192.PZM
  • %HOMEPATH%\Ne27010L56246\90511.YXI
  • %HOMEPATH%\Ne27010L56246\W28958I47191.ZDI
  • %HOMEPATH%\Ne27010L56246\T2533P48507.BGW
  • %HOMEPATH%\Ne27010L56246\B36806K91873.MLW
  • %HOMEPATH%\Ne27010L56246\V77281F17688.NJC
  • %HOMEPATH%\Ne27010L56246\W96709E39299.BJS
  • %HOMEPATH%\Ne27010L56246\X33827M60503.UCZ
  • %HOMEPATH%\Ne27010L56246\P19870O45858.TTH
  • %HOMEPATH%\Ne27010L56246\K23561I94387.OXX
  • %HOMEPATH%\Ne27010L56246\98063.LDH
  • %HOMEPATH%\Ne27010L56246\50104.QRC
  • %HOMEPATH%\Ne27010L56246\R91147V58064.KUY
  • %HOMEPATH%\Ne27010L56246\83705.LOK
  • %HOMEPATH%\Ne27010L56246\42517.GUP
  • %HOMEPATH%\Ne27010L56246\V20734Z78437.PFP
  • %HOMEPATH%\Ne27010L56246\Z37184L87952.ZVV
  • %HOMEPATH%\Ne27010L56246\63808.QYA
  • %HOMEPATH%\Ne27010L56246\96498.COH
  • %HOMEPATH%\Ne27010L56246\83987.EEN
  • %HOMEPATH%\Ne27010L56246\79455.GGG
  • %HOMEPATH%\Ne27010L56246\66543.XKD
  • %HOMEPATH%\Ne27010L56246\V9046K52535.OJS
  • %HOMEPATH%\Ne27010L56246\PLANILLA.exe
  • %HOMEPATH%\Ne27010L56246\37657.XZO
  • %HOMEPATH%\Ne27010L56246\I9331I52976.LAV
  • %HOMEPATH%\Ne27010L56246\92268.WPL
  • %HOMEPATH%\Ne27010L56246\5547.RGY
  • %HOMEPATH%\Ne27010L56246\K43080Y55752.YXY
  • %HOMEPATH%\Ne27010L56246\13083.YPO
  • %HOMEPATH%\Ne27010L56246\H57254N2929.BVC
  • %HOMEPATH%\Ne27010L56246\48776.TCP
  • %HOMEPATH%\Ne27010L56246\F45060A46657.ARA
  • %HOMEPATH%\Ne27010L56246\V43569R97556.HZN
  • %HOMEPATH%\Ne27010L56246\70375.KJC
  • %HOMEPATH%\Ne27010L56246\J66885K88891.XRR
  • %HOMEPATH%\Ne27010L56246\28770.BGG
  • %HOMEPATH%\Ne27010L56246\32705.YNC
  • %HOMEPATH%\Ne27010L56246\C60733C63716.LJW
  • %HOMEPATH%\Ne27010L56246\V68421X80273.URY
  • %HOMEPATH%\Ne27010L56246\F31961T40633.TDF
  • %HOMEPATH%\Ne27010L56246\E99448L46599.HDA
  • %HOMEPATH%\Ne27010L56246\26535.VWF
  • %HOMEPATH%\Ne27010L56246\C55096P55802.CQY
  • %HOMEPATH%\Ne27010L56246\M38809M92185.WWJ
  • %HOMEPATH%\Ne27010L56246\48112.VEZ
  • %HOMEPATH%\Ne27010L56246\V60759W70436.LVH
  • %HOMEPATH%\Ne27010L56246\M32708T61945.WVL
  • %HOMEPATH%\Ne27010L56246\54349.KYU
  • %HOMEPATH%\Ne27010L56246\32809.XUC
  • %HOMEPATH%\Ne27010L56246\U73481H12940.DOW
  • %HOMEPATH%\Ne27010L56246\G76374G21623.JAY
  • %HOMEPATH%\Ne27010L56246\L78755S89212.CHT
  • %HOMEPATH%\Ne27010L56246\97149.ZNM
  • %HOMEPATH%\Ne27010L56246\F18503D93292.LOQ
  • %HOMEPATH%\Ne27010L56246\34933.FCA
  • %HOMEPATH%\Ne27010L56246\82088.DRK
  • %HOMEPATH%\Ne27010L56246\W88668Z63430.UGX
  • %HOMEPATH%\Ne27010L56246\38149.YBN
  • %HOMEPATH%\Ne27010L56246\L1125D2013.TLF
  • %HOMEPATH%\Ne27010L56246\O37931E68382.AFB
  • %HOMEPATH%\Ne27010L56246\X38563R77267.FKC
  • %HOMEPATH%\Ne27010L56246\43184.HFV
  • %HOMEPATH%\Ne27010L56246\H5676S70812.SME
  • %HOMEPATH%\Ne27010L56246\E59665B85956.KSL
  • %HOMEPATH%\Ne27010L56246\V73353Z58302.VLK
  • %HOMEPATH%\Ne27010L56246\65337.KFK
  • %HOMEPATH%\Ne27010L56246\71568.RPS
  • %HOMEPATH%\Ne27010L56246\S4186K41210.VEZ
  • %HOMEPATH%\Ne27010L56246\Y67748Q82067.QXC
  • %HOMEPATH%\Ne27010L56246\P7473Q87451.IHK
  • %HOMEPATH%\Ne27010L56246\10652.TRY
  • %HOMEPATH%\Ne27010L56246\R92162C43771.WMU
  • %HOMEPATH%\Ne27010L56246\Q7790J37042.EIX
  • %HOMEPATH%\Ne27010L56246\86731.BDM
  • %HOMEPATH%\Ne27010L56246\R45939S21616.RRP
  • %HOMEPATH%\Ne27010L56246\35058.NXT
  • %HOMEPATH%\Ne27010L56246\59631.IRO
  • %HOMEPATH%\Ne27010L56246\J84637H72954.FCA
  • %HOMEPATH%\Ne27010L56246\S90833T47288.QII
  • %HOMEPATH%\Ne27010L56246\Q11556J2164.RZL
  • %HOMEPATH%\Ne27010L56246\79876.WAG
  • %HOMEPATH%\Ne27010L56246\81631.ONU
  • %HOMEPATH%\Ne27010L56246\32134.OPS
  • %HOMEPATH%\Ne27010L56246\30501.KKW
  • %HOMEPATH%\Ne27010L56246\36727.QLQ
  • %HOMEPATH%\Ne27010L56246\7943.VOV
  • %HOMEPATH%\Ne27010L56246\F88222B59598.ZRY
  • %HOMEPATH%\Ne27010L56246\96618.JUF
  • %HOMEPATH%\Ne27010L56246\C62814V30726.UNM
  • %HOMEPATH%\Ne27010L56246\Q62508D68982.ZNA
  • %HOMEPATH%\Ne27010L56246\E67354A57262.OJF
  • %HOMEPATH%\Ne27010L56246\69732.ZWL
  • %HOMEPATH%\Ne27010L56246\34601.RID
  • %HOMEPATH%\Ne27010L56246\C52899Z99286.MVF
  • %HOMEPATH%\Ne27010L56246\T98423F74236.RCJ
  • %HOMEPATH%\Ne27010L56246\71368.BSI
  • %HOMEPATH%\Ne27010L56246\U83004G35931.DPX
  • %HOMEPATH%\Ne27010L56246\L39438B74986.JWU
  • %HOMEPATH%\Ne27010L56246\I47040V89441.OHS
  • %HOMEPATH%\Ne27010L56246\23516.CKW
  • %HOMEPATH%\Ne27010L56246\37198.BOA
  • %HOMEPATH%\Ne27010L56246\A13588A60236.ZXR
  • %HOMEPATH%\Ne27010L56246\J24436X67020.EIW
  • %HOMEPATH%\Ne27010L56246\97370.SHE
  • %HOMEPATH%\Ne27010L56246\V70416W44515.BQK
  • %HOMEPATH%\Ne27010L56246\L11955B36401.WHB
  • %HOMEPATH%\Ne27010L56246\75203.TXI
  • %HOMEPATH%\Ne27010L56246\51985.HVQ
  • %HOMEPATH%\Ne27010L56246\P28044V47866.UST
  • %HOMEPATH%\Ne27010L56246\B55163T37822.QZV
  • %HOMEPATH%\Ne27010L56246\P52839B20650.HQH
  • %HOMEPATH%\Ne27010L56246\71102.UUT
  • %HOMEPATH%\Ne27010L56246\22585.XSD
  • %HOMEPATH%\Ne27010L56246\70555.CYJ
  • %HOMEPATH%\Ne27010L56246\J72506A59121.SLC
  • %HOMEPATH%\Ne27010L56246\47021.XDH
  • %HOMEPATH%\Ne27010L56246\78175.YYS
  • %HOMEPATH%\Ne27010L56246\X32525N35407.SHK
  • %HOMEPATH%\Ne27010L56246\74505.XKN
  • %HOMEPATH%\Ne27010L56246\J2569F20389.MOS
  • %HOMEPATH%\Ne27010L56246\98242.ZQP
  • %HOMEPATH%\Ne27010L56246\69846.QFG
  • %HOMEPATH%\Ne27010L56246\X30363M58967.IHR
  • %HOMEPATH%\Ne27010L56246\R35569L51238.WNZ
  • %HOMEPATH%\Ne27010L56246\41061.DWD
  • %HOMEPATH%\Ne27010L56246\38116.UNU
  • %HOMEPATH%\Ne27010L56246\O24215L87928.SBD
  • %HOMEPATH%\Ne27010L56246\9500.TMA
  • %HOMEPATH%\Ne27010L56246\K38348X49713.KRL
  • %HOMEPATH%\Ne27010L56246\J54657I60465.OCX
  • %HOMEPATH%\Ne27010L56246\Q95929G76074.OWW
  • %HOMEPATH%\Ne27010L56246\89602.KPT
  • %HOMEPATH%\Ne27010L56246\T3857H43096.QHP
  • %HOMEPATH%\Ne27010L56246\56545.NJU
  • %HOMEPATH%\Ne27010L56246\55662.SOF
  • %HOMEPATH%\Ne27010L56246\44888.EPR
  • %HOMEPATH%\Ne27010L56246\G48859V58613.ELR
  • %HOMEPATH%\Ne27010L56246\Z67807M75008.ZAY
  • %HOMEPATH%\Ne27010L56246\Y76729T11026.EAL
  • %HOMEPATH%\Ne27010L56246\S42571G10191.RMM
  • %HOMEPATH%\Ne27010L56246\B60925V78392.PEQ
  • %HOMEPATH%\Ne27010L56246\T24019T84124.KVM
  • %HOMEPATH%\Ne27010L56246\R99434A88188.JVC
  • %HOMEPATH%\Ne27010L56246\89571.NHS
  • %HOMEPATH%\Ne27010L56246\P36576H35940.CAG
  • %HOMEPATH%\Ne27010L56246\4248.WRP
  • %HOMEPATH%\Ne27010L56246\M84878K59755.OXO
  • %HOMEPATH%\Ne27010L56246\9137.XEP
  • %HOMEPATH%\Ne27010L56246\50859.SYI
  • %HOMEPATH%\Ne27010L56246\Z42588E50236.DPG
  • %HOMEPATH%\Ne27010L56246\11426.UZG
  • %HOMEPATH%\Ne27010L56246\91634.QJP
  • %HOMEPATH%\Ne27010L56246\15522.IAT
  • %HOMEPATH%\Ne27010L56246\65425.JUD
  • %HOMEPATH%\Ne27010L56246\S76471R51391.HGA
  • %HOMEPATH%\Ne27010L56246\V73359W2819.NBR
  • %HOMEPATH%\Ne27010L56246\X17974G97933.FLY
  • %HOMEPATH%\Ne27010L56246\X81039Y16529.RNY
  • %HOMEPATH%\Ne27010L56246\49495.PSE
  • %HOMEPATH%\Ne27010L56246\41594.XTA
  • %HOMEPATH%\Ne27010L56246\81608.FEJ
  • %HOMEPATH%\Ne27010L56246\F35060D61923.TBA
  • %HOMEPATH%\Ne27010L56246\R71512C73921.UHB
  • %HOMEPATH%\Ne27010L56246\L94829W85696.SAL
  • %HOMEPATH%\Ne27010L56246\Q51831W60022.LQY
  • %HOMEPATH%\Ne27010L56246\G24189A41256.ZPZ
  • %HOMEPATH%\Ne27010L56246\23097.DQI
  • %HOMEPATH%\Ne27010L56246\72520.DUA
  • %HOMEPATH%\Ne27010L56246\75627.ZCO
  • %HOMEPATH%\Ne27010L56246\65554.RPY
  • %HOMEPATH%\Ne27010L56246\61808.YCB
  • %HOMEPATH%\Ne27010L56246\34446.SGE
  • %HOMEPATH%\Ne27010L56246\86871.YNG
  • %HOMEPATH%\Ne27010L56246\96301.ZRV
  • %HOMEPATH%\Ne27010L56246\W81675O53895.JCP
  • %HOMEPATH%\Ne27010L56246\66967.ZKF
  • %HOMEPATH%\Ne27010L56246\90165.OTM
  • %HOMEPATH%\Ne27010L56246\53745.MZR
  • %HOMEPATH%\Ne27010L56246\W96033V49756.PYT
  • %HOMEPATH%\Ne27010L56246\M51048V35213.WDW
  • %HOMEPATH%\Ne27010L56246\P11332Z80275.AJW
  • %HOMEPATH%\Ne27010L56246\B39065U73144.PSX
  • %HOMEPATH%\Ne27010L56246\13899.LYB
  • %HOMEPATH%\Ne27010L56246\T10528N74896.NOS
  • %HOMEPATH%\Ne27010L56246\32149.UEM
  • %HOMEPATH%\Ne27010L56246\64025.JSC
  • %HOMEPATH%\Ne27010L56246\79760.KWU
  • %HOMEPATH%\Ne27010L56246\31819.QPO
  • %HOMEPATH%\Ne27010L56246\96978.UII
  • %HOMEPATH%\Ne27010L56246\J52935E95197.NZB
  • %HOMEPATH%\Ne27010L56246\20306.AHD
  • %HOMEPATH%\Ne27010L56246\X99466G22288.WLV
  • %HOMEPATH%\Ne27010L56246\O33074I84926.MMT
  • %HOMEPATH%\Ne27010L56246\N75233X26857.WCX
  • %HOMEPATH%\Ne27010L56246\F85544F32541.JSR
  • %HOMEPATH%\Ne27010L56246\Y83772S95263.YPL
  • %HOMEPATH%\Ne27010L56246\T40988M62502.BOQ
  • %HOMEPATH%\Ne27010L56246\42128.HGH
Sets the 'hidden' attribute to the following files:
  • %HOMEPATH%\Zf35592N36145.RM7
  • %HOMEPATH%\Zm69542P70117.txt
Deletes the following files:
  • %HOMEPATH%\Zf35592N36145.RM7
  • %TEMP%\aut1.tmp
Miscellaneous:
Searches for the following windows:
  • ClassName: 'Indicator' WindowName: '(null)'
  • ClassName: 'Shell_TrayWnd' WindowName: '(null)'
  • ClassName: 'EDIT' WindowName: '(null)'

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android