マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Adware.Shopper.481

Added to the Dr.Web virus database: 2014-05-08

Virus description added:

Technical Information

Malicious functions:
Terminates or attempts to terminate
the following user processes:
  • iexplore.exe
  • firefox.exe
  • chrome.exe
Modifies settings of Windows Internet Explorer:
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '0'
Modifies file system :
Creates the following files:
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\loader.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\list.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\match-pattern.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\namespace.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\memory.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\light-traits.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\functional.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\file.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\globals.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\hidden-frame.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\heritage.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\self.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\sandbox.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\system.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\timer.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\text-streams.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\runtime.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\plain-text-console.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\observer-service.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\preferences-service.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\querystring.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\promise.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\addon-kit\lib\page-mod.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\locales.json
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\addon-kit\lib\private-browsing.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\addon-kit\lib\windows.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\addon-kit\lib\request.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\install.rdf
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\bootstrap.js
  • %TEMP%\nsg2.tmp\nsisSqlPlugin.dll
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\harness-options.json
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\icon64.png
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\icon.png
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\deprecate.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\cuddlefish.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\environment.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\events.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\errors.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\cortex.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\base64.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\api-utils.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\byte-streams.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\content.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\collection.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\traceback.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\traits\core.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\tabs\utils.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\utils\data.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\utils\registry.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\utils\object.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\tabs\tab.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\private-browsing\utils.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\l10n\prefs.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\system\events.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\tabs\observer.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\tabs\events.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\CouponDownloader\data\icon64.png
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\CouponDownloader\data\icon.png
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\CouponDownloader\lib\main.js
  • %PROGRAM_FILES%\Coupon Downloader\uninstall.exe
  • %PROGRAM_FILES%\Coupon Downloader\64.ico
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\windows\tabs.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\window\utils.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\utils\thumbnail.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\windows\dom.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\windows\observer.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\windows\loader.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\xul-app.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\xpcom.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\addon\runner.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\content\content-worker.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\content\content-proxy.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\xhr.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\unload.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\traits.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\url.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\window-utils.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\uuid.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\l10n\core.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\events\assembler.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\l10n\html.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\l10n\locale.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\l10n\loader.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\event\target.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\content\symbiont.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\content\loader.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\content\worker.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\event\core.js
  • %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\CouponDownloader@jetpack\resources\api-utils\lib\dom\events.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\list.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\light-traits.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\loader.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\memory.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\match-pattern.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\hidden-frame.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\file.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\events.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\functional.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\heritage.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\globals.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\sandbox.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\runtime.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\self.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\text-streams.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\system.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\querystring.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\observer-service.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\namespace.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\plain-text-console.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\promise.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\preferences-service.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\locales.json
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\install.rdf
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\addon-kit\lib\page-mod.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\addon-kit\lib\request.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\addon-kit\lib\private-browsing.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\icon64.png
  • %TEMP%\nsg2.tmp\KillProc.dll
  • %TEMP%\nsg2.tmp\System.dll
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\bootstrap.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\icon.png
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\harness-options.json
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\cuddlefish.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\cortex.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\deprecate.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\errors.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\environment.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\content.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\api-utils.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\addon-kit\lib\windows.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\base64.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\collection.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\byte-streams.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\timer.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\tabs\utils.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\tabs\tab.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\traits\core.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\utils\object.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\utils\data.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\tabs\observer.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\l10n\prefs.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\l10n\locale.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\private-browsing\utils.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\tabs\events.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\system\events.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\CouponDownloader\data\icon.png
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\windows\tabs.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\CouponDownloader\data\icon64.png
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\CouponDownloader\lib\main.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\prefs.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\windows\observer.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\utils\thumbnail.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\utils\registry.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\window\utils.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\windows\loader.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\windows\dom.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\xpcom.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\xhr.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\xul-app.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\content\content-proxy.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\addon\runner.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\window-utils.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\traits.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\traceback.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\unload.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\uuid.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\url.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\events\assembler.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\event\target.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\l10n\core.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\l10n\loader.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\l10n\html.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\event\core.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\content\loader.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\content\content-worker.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\content\symbiont.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\dom\events.js
  • %HOMEPATH%\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack\resources\api-utils\lib\content\worker.js
Deletes the following files:
  • %TEMP%\nsg2.tmp\System.dll
  • %TEMP%\nsg2.tmp\nsisSqlPlugin.dll
  • %TEMP%\nsg2.tmp\KillProc.dll

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android