マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Trojan.MulDrop5.42872

Added to the Dr.Web virus database: 2014-12-10

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Eb97635S17211' = '%HOMEPATH%\Cn37382M38695\svchost.exe.exe'
Malicious functions:
Creates and executes the following:
  • '%HOMEPATH%\Cn37382M38695\svchost.exe.exe'
Modifies file system :
Creates the following files:
  • %HOMEPATH%\Cn37382M38695\E42520L64233.NRI
  • %HOMEPATH%\Cn37382M38695\39670.BDB
  • %HOMEPATH%\Cn37382M38695\C36732F61174.DWE
  • %HOMEPATH%\Cn37382M38695\94242.PFO
  • %HOMEPATH%\Cn37382M38695\59631.WXF
  • %HOMEPATH%\Cn37382M38695\A21748D20681.PMP
  • %HOMEPATH%\Cn37382M38695\15958.KOP
  • %HOMEPATH%\Cn37382M38695\70419.YPM
  • %HOMEPATH%\Cn37382M38695\18445.PWZ
  • %HOMEPATH%\Cn37382M38695\M25585B59991.LZL
  • %HOMEPATH%\Cn37382M38695\35322.OMO
  • %HOMEPATH%\Cn37382M38695\48919.GYX
  • %HOMEPATH%\Cn37382M38695\22775.AGP
  • %HOMEPATH%\Cn37382M38695\Q36198J87042.QUK
  • %HOMEPATH%\Cn37382M38695\X56490B2828.GIY
  • %HOMEPATH%\Cn37382M38695\O56785N13429.MZY
  • %HOMEPATH%\Cn37382M38695\S37101F2777.CTN
  • %HOMEPATH%\Cn37382M38695\T66693J44799.TKY
  • %HOMEPATH%\Cn37382M38695\95668.IJC
  • %HOMEPATH%\Cn37382M38695\D13316D85419.NYZ
  • %HOMEPATH%\Cn37382M38695\G84757B94863.JTU
  • %HOMEPATH%\Cn37382M38695\32467.LBG
  • %HOMEPATH%\Cn37382M38695\21266.OGF
  • %HOMEPATH%\Cn37382M38695\9222.VWP
  • %HOMEPATH%\Cn37382M38695\U54966E11089.MYH
  • %HOMEPATH%\Cn37382M38695\85290.NUZ
  • %HOMEPATH%\Cn37382M38695\X15097H16219.QDD
  • %HOMEPATH%\Cn37382M38695\O24818R83849.XWC
  • %HOMEPATH%\Cn37382M38695\67628.YEW
  • %HOMEPATH%\Cn37382M38695\Q65042B36133.FUX
  • %HOMEPATH%\Cn37382M38695\84126.NBJ
  • %HOMEPATH%\Cn37382M38695\99218.NTL
  • %HOMEPATH%\Cn37382M38695\96302.ICZ
  • %HOMEPATH%\Cn37382M38695\21262.ZIS
  • %HOMEPATH%\Cn37382M38695\74136.ZPK
  • %HOMEPATH%\Cn37382M38695\J70258Q79006.XEQ
  • %HOMEPATH%\Cn37382M38695\J57701O57515.FDI
  • %HOMEPATH%\Cn37382M38695\Z78181J28900.GGG
  • %HOMEPATH%\Cn37382M38695\57629.KAW
  • %HOMEPATH%\Cn37382M38695\26215.CVW
  • %HOMEPATH%\Cn37382M38695\88544.NSS
  • %HOMEPATH%\Cn37382M38695\I33528N60085.YNJ
  • %HOMEPATH%\Cn37382M38695\30122.BWN
  • %HOMEPATH%\Cn37382M38695\22976.KKZ
  • %HOMEPATH%\Cn37382M38695\41961.CKH
  • %HOMEPATH%\Cn37382M38695\73334.RWX
  • %HOMEPATH%\Cn37382M38695\T5625P13733.KRN
  • %HOMEPATH%\Cn37382M38695\L58514O40277.OYK
  • %HOMEPATH%\Cn37382M38695\R84654V42290.XOI
  • %HOMEPATH%\Cn37382M38695\13797.AKR
  • %HOMEPATH%\Cn37382M38695\A98945G36283.UGZ
  • %HOMEPATH%\Cn37382M38695\92768.SQX
  • %HOMEPATH%\Cn37382M38695\L69433K89765.SSB
  • %HOMEPATH%\Cn37382M38695\I60200W7066.DCA
  • %HOMEPATH%\Cn37382M38695\I80242S71851.ZVR
  • %HOMEPATH%\Cn37382M38695\54484.BYV
  • %HOMEPATH%\Cn37382M38695\92735.WNP
  • %HOMEPATH%\Cn37382M38695\N98016R32792.OBP
  • %HOMEPATH%\Cn37382M38695\85175.ZME
  • %HOMEPATH%\Cn37382M38695\82201.KDH
  • %HOMEPATH%\Cn37382M38695\95301.PRY
  • %HOMEPATH%\Cn37382M38695\30370.TFH
  • %HOMEPATH%\Cn37382M38695\W27027J99360.TTO
  • %HOMEPATH%\Cn37382M38695\88594.WXC
  • %HOMEPATH%\Cn37382M38695\E13311A17914.PRR
  • %HOMEPATH%\Cn37382M38695\R82094G1991.WUP
  • %HOMEPATH%\Cn37382M38695\37318.TYX
  • %HOMEPATH%\Cn37382M38695\54522.DRP
  • %HOMEPATH%\Cn37382M38695\81911.PFT
  • %HOMEPATH%\Cn37382M38695\42042.HIG
  • %HOMEPATH%\Cn37382M38695\17572.JHU
  • %HOMEPATH%\Cn37382M38695\57100.AGH
  • %HOMEPATH%\Cn37382M38695\B1901C18305.UGE
  • %HOMEPATH%\Cn37382M38695\35927.YII
  • %HOMEPATH%\Cn37382M38695\32506.KIA
  • %HOMEPATH%\Cn37382M38695\52057.IDJ
  • %HOMEPATH%\Cn37382M38695\Z57747D88749.KYA
  • %HOMEPATH%\Cn37382M38695\87052.FKL
  • %HOMEPATH%\Cn37382M38695\53426.EXZ
  • %HOMEPATH%\Cn37382M38695\J48622I64788.CRP
  • %HOMEPATH%\Cn37382M38695\W64272V26032.MAV
  • %HOMEPATH%\Cn37382M38695\I77634H72088.TEA
  • %HOMEPATH%\Cn37382M38695\W3193P95900.ODZ
  • %HOMEPATH%\Cn37382M38695\88470.NPS
  • %HOMEPATH%\Cn37382M38695\J61600Q50069.MPV
  • %HOMEPATH%\Cn37382M38695\80424.NMW
  • %HOMEPATH%\Cn37382M38695\85704.LDM
  • %HOMEPATH%\Cn37382M38695\A5680R38086.MID
  • %HOMEPATH%\Cn37382M38695\N3976M11808.KWS
  • %HOMEPATH%\Cn37382M38695\N66615T29577.LWL
  • %HOMEPATH%\Cn37382M38695\21980.HYH
  • %HOMEPATH%\Cn37382M38695\66860.RXM
  • %HOMEPATH%\Cn37382M38695\W23564N4279.YHB
  • %HOMEPATH%\Cn37382M38695\F60261M12542.MHX
  • %HOMEPATH%\Cn37382M38695\N98227V4875.CVT
  • %HOMEPATH%\Cn37382M38695\O26495L74232.QTI
  • %HOMEPATH%\Cn37382M38695\B16923M53700.RSW
  • %HOMEPATH%\Cn37382M38695\42489.BPZ
  • %HOMEPATH%\Cn37382M38695\24812.NRR
  • %HOMEPATH%\Cn37382M38695\82910.NVT
  • %HOMEPATH%\Cn37382M38695\14054.CTN
  • %HOMEPATH%\Cn37382M38695\22411.AKD
  • %HOMEPATH%\Cn37382M38695\O27540T61161.VYE
  • %HOMEPATH%\Cn37382M38695\84131.KUG
  • %HOMEPATH%\Cn37382M38695\Z79342Z55688.UMA
  • %HOMEPATH%\Cn37382M38695\47151.QFE
  • %HOMEPATH%\Cn37382M38695\I26465N54165.VHR
  • %HOMEPATH%\Cn37382M38695\1607.NMK
  • %HOMEPATH%\Cn37382M38695\15293.TNY
  • %HOMEPATH%\Cn37382M38695\56907.YBM
  • %HOMEPATH%\Cn37382M38695\T54174K74778.LLY
  • %HOMEPATH%\Cn37382M38695\P14886P45384.WDZ
  • %HOMEPATH%\Cn37382M38695\82135.FQN
  • %HOMEPATH%\Cn37382M38695\45596.SXD
  • %HOMEPATH%\Cn37382M38695\X71408T94345.FMU
  • %HOMEPATH%\Cn37382M38695\U22581G68063.XYI
  • %HOMEPATH%\Cn37382M38695\G70377W73312.POL
  • %HOMEPATH%\Cn37382M38695\L4748A21344.WXN
  • %HOMEPATH%\Cn37382M38695\62416.SAV
  • %HOMEPATH%\Cn37382M38695\Z38248Q73118.BNF
  • %HOMEPATH%\Cn37382M38695\Q19736B84130.HMM
  • %HOMEPATH%\Cn37382M38695\B25435C9679.QPD
  • %HOMEPATH%\Cn37382M38695\M66498P99773.VYZ
  • %HOMEPATH%\Cn37382M38695\72968.HFU
  • %HOMEPATH%\Cn37382M38695\L82164Z77507.QBY
  • %HOMEPATH%\Cn37382M38695\C49668Q59359.FAF
  • %HOMEPATH%\Cn37382M38695\78596.WYM
  • %HOMEPATH%\Cn37382M38695\88208.CQF
  • %HOMEPATH%\Cn37382M38695\L97665L57454.UXX
  • %HOMEPATH%\Cn37382M38695\53900.QAX
  • %HOMEPATH%\Cn37382M38695\87055.IGH
  • %HOMEPATH%\Cn37382M38695\46772.KTJ
  • %HOMEPATH%\Cn37382M38695\15148.QHN
  • %HOMEPATH%\Cn37382M38695\R23365Z86746.ZUG
  • %HOMEPATH%\Cn37382M38695\1164.BKJ
  • %HOMEPATH%\Cn37382M38695\62316.BNW
  • %HOMEPATH%\Cn37382M38695\H84748U87124.MLQ
  • %HOMEPATH%\Cn37382M38695\Y89642Y19672.KAJ
  • %HOMEPATH%\Cn37382M38695\43106.KUM
  • %HOMEPATH%\Cn37382M38695\12492.FFV
  • %HOMEPATH%\Cn37382M38695\Z70399U73529.NZI
  • %HOMEPATH%\Cn37382M38695\7436.GHM
  • %HOMEPATH%\Cn37382M38695\Y94944N5681.HDA
  • %HOMEPATH%\Cn37382M38695\T20393P72204.SUH
  • %HOMEPATH%\Cn37382M38695\U93499K31917.TKQ
  • %HOMEPATH%\Cn37382M38695\87836.DWW
  • %HOMEPATH%\Cn37382M38695\42502.UYP
  • %HOMEPATH%\Cn37382M38695\M40675L5612.IOA
  • %HOMEPATH%\Cn37382M38695\H44496P71388.UZB
  • %HOMEPATH%\Cn37382M38695\J29282Q46493.ZAT
  • %HOMEPATH%\Cn37382M38695\91242.FDI
  • %HOMEPATH%\Cn37382M38695\76827.LCI
  • %HOMEPATH%\Cn37382M38695\28387.QBJ
  • %HOMEPATH%\Cn37382M38695\10797.QWS
  • %HOMEPATH%\Cn37382M38695\C98385C95190.IAZ
  • %HOMEPATH%\Cn37382M38695\E96138L40028.EAY
  • %HOMEPATH%\Cn37382M38695\M86267F28086.DBI
  • %HOMEPATH%\Cn37382M38695\E22606E85242.KMW
  • %HOMEPATH%\Cn37382M38695\G74103V90752.CRX
  • %HOMEPATH%\Cn37382M38695\64659.SYC
  • %HOMEPATH%\Cn37382M38695\54451.XJT
  • %HOMEPATH%\Cn37382M38695\Z17418K94017.EOI
  • %HOMEPATH%\Cn37382M38695\6793.INM
  • %HOMEPATH%\Cn37382M38695\C63315X58430.ALN
  • %HOMEPATH%\Cn37382M38695\I85996T14727.KWK
  • %HOMEPATH%\Cn37382M38695\V62229R10396.GPF
  • %HOMEPATH%\Cn37382M38695\84160.VCZ
  • %HOMEPATH%\Cn37382M38695\RP.IVB
  • %TEMP%\aut1.tmp
  • %HOMEPATH%\Aj33493H82320.BI5
  • %HOMEPATH%\Cn37382M38695\49176.ZTU
  • %HOMEPATH%\Cn37382M38695\2749.YID
  • %HOMEPATH%\Cn37382M38695\P8649S98365.NMS
  • %HOMEPATH%\Cn37382M38695\88520.ZNK
  • %HOMEPATH%\Cn37382M38695\G68296C43433.QSK
  • %HOMEPATH%\Cn37382M38695\3562.DAV
  • %HOMEPATH%\Cn37382M38695\P84560K99833.EGI
  • %HOMEPATH%\Cn37382M38695\T74104C83221.RCM
  • %HOMEPATH%\Cn37382M38695\C53787W36035.YHO
  • %HOMEPATH%\Cn37382M38695\Q9310J47943.HRD
  • %HOMEPATH%\Cn37382M38695\Y65560B76465.VLX
  • %HOMEPATH%\Cn37382M38695\96253.WVT
  • %HOMEPATH%\Cn37382M38695\55861.XQH
  • %HOMEPATH%\Cn37382M38695\99268.GPW
  • %HOMEPATH%\Cn37382M38695\91386.UCU
  • %HOMEPATH%\Cn37382M38695\60874.ILW
  • %HOMEPATH%\Cn37382M38695\O22768U19609.TOK
  • %HOMEPATH%\Cn37382M38695\T56874G58521.MED
  • %HOMEPATH%\Cn37382M38695\H49926I3333.OXE
  • %HOMEPATH%\Cn37382M38695\96928.ZGJ
  • %HOMEPATH%\Cn37382M38695\51632.EVM
  • %HOMEPATH%\Cn37382M38695\W17944N81700.FYV
  • %HOMEPATH%\Cn37382M38695\J52008G37482.OUR
  • %HOMEPATH%\Cn37382M38695\75389.CPX
  • %HOMEPATH%\Cn37382M38695\M65669E4542.IQV
  • %HOMEPATH%\Cn37382M38695\53113.VZA
  • %HOMEPATH%\Cn37382M38695\87707.GEU
  • %HOMEPATH%\Cn37382M38695\A33297V12640.QMX
  • %HOMEPATH%\Cn37382M38695\Q69349X62829.QFT
  • %HOMEPATH%\Cn37382M38695\40970.UZP
  • %HOMEPATH%\Cn37382M38695\81048.DGZ
  • %HOMEPATH%\Cn37382M38695\H43040I25289.GIS
  • %HOMEPATH%\Cn37382M38695\F79896Y8138.WGR
  • %HOMEPATH%\Cn37382M38695\15894.TGG
  • %HOMEPATH%\Cn37382M38695\I23143B91936.BIF
  • %HOMEPATH%\Cn37382M38695\6019.BCE
  • %HOMEPATH%\Cn37382M38695\T54156F33024.VNA
  • %HOMEPATH%\Cn37382M38695\1622.ELE
  • %HOMEPATH%\Cn37382M38695\38224.CZP
  • %HOMEPATH%\Cn37382M38695\47078.FHF
  • %HOMEPATH%\Cn37382M38695\V73436X87369.FOF
  • %HOMEPATH%\Cn37382M38695\92576.IRK
  • %HOMEPATH%\Cn37382M38695\97223.AGK
  • %HOMEPATH%\Cn37382M38695\U9056F4916.GRL
  • %HOMEPATH%\Cn37382M38695\27992.LUL
  • %HOMEPATH%\Cn37382M38695\O50343I87983.HVY
  • %HOMEPATH%\Cn37382M38695\76028.NLH
  • %HOMEPATH%\Cn37382M38695\R43410F42935.HGA
  • %HOMEPATH%\Cn37382M38695\67325.JIX
  • %HOMEPATH%\Cn37382M38695\7955.EDO
  • %HOMEPATH%\Cn37382M38695\S30000W42039.PEW
  • %HOMEPATH%\Cn37382M38695\L76398G12139.FDS
  • %HOMEPATH%\Cn37382M38695\41468.CUA
  • %HOMEPATH%\Cn37382M38695\43818.IXY
  • %HOMEPATH%\Cn37382M38695\5909.LAT
  • %HOMEPATH%\Cn37382M38695\R26579X36843.OEZ
  • %HOMEPATH%\Cn37382M38695\2182.MLO
  • %HOMEPATH%\Cn37382M38695\43504.TVD
  • %HOMEPATH%\Cn37382M38695\B91916L14495.MLN
  • %HOMEPATH%\Cn37382M38695\C27432U82711.HBM
  • %HOMEPATH%\Cn37382M38695\77226.NIP
  • %HOMEPATH%\Cn37382M38695\99049.EWV
  • %HOMEPATH%\Cn37382M38695\28309.YXP
  • %HOMEPATH%\Cn37382M38695\P99560Y82211.CPR
  • %HOMEPATH%\Cn37382M38695\X35965J67416.OEF
  • %HOMEPATH%\Cn37382M38695\N56566C93771.QWC
  • %HOMEPATH%\Cn37382M38695\53328.CLP
  • %HOMEPATH%\Cn37382M38695\24013.JVG
  • %HOMEPATH%\Cn37382M38695\44101.HVY
  • %HOMEPATH%\Cn37382M38695\F73290U14177.LRG
  • %HOMEPATH%\Cn37382M38695\74329.PCN
  • %HOMEPATH%\Cn37382M38695\Q37517J79876.RMP
  • %HOMEPATH%\Cn37382M38695\F66634N38620.VWP
  • %HOMEPATH%\Cn37382M38695\65269.HDR
  • %HOMEPATH%\Cn37382M38695\40365.JHZ
  • %HOMEPATH%\Cn37382M38695\N17802S39344.ORT
  • %HOMEPATH%\Cn37382M38695\63808.ETZ
  • %HOMEPATH%\Cn37382M38695\51796.JPH
  • %HOMEPATH%\Cn37382M38695\K38965V7496.BWU
  • %HOMEPATH%\Cn37382M38695\E90262C70898.LVL
  • %HOMEPATH%\Cn37382M38695\U73383X29790.QIV
  • %HOMEPATH%\Cn37382M38695\V71910Q22723.KZR
  • %HOMEPATH%\Cn37382M38695\9784.PDG
  • %HOMEPATH%\Cn37382M38695\20604.POE
  • %HOMEPATH%\Cn37382M38695\L1189E41846.VPG
  • %HOMEPATH%\Cn37382M38695\47065.WWA
  • %HOMEPATH%\Cn37382M38695\I81488F53044.KRE
  • %HOMEPATH%\Cn37382M38695\5538.UQU
  • %HOMEPATH%\Cn37382M38695\N76687K79657.SDP
  • %HOMEPATH%\Cn37382M38695\T8188P3297.UXV
  • %HOMEPATH%\Cn37382M38695\P35257L82266.NSD
  • %HOMEPATH%\Cn37382M38695\X59601B57854.NEO
  • %HOMEPATH%\Cn37382M38695\63708.TTK
  • %HOMEPATH%\Cn37382M38695\N10097B81894.WQU
  • %HOMEPATH%\Cn37382M38695\83513.KEA
  • %HOMEPATH%\Cn37382M38695\74493.YQX
  • %HOMEPATH%\Cn37382M38695\Z53425A42281.HHM
  • %HOMEPATH%\Cn37382M38695\Z26510U65015.WSP
  • %HOMEPATH%\Cn37382M38695\48057.LST
  • %HOMEPATH%\Cn37382M38695\50775.YMW
  • %HOMEPATH%\Cn37382M38695\73568.KOK
  • %HOMEPATH%\Cn37382M38695\A92410I20037.FQJ
  • %HOMEPATH%\Cn37382M38695\64027.XKE
  • %HOMEPATH%\Cn37382M38695\V13417Q54683.RGZ
  • %HOMEPATH%\Cn37382M38695\B23901V37783.LRM
  • %HOMEPATH%\Cn37382M38695\N52657S43596.OSA
  • %HOMEPATH%\Cn37382M38695\H52847Y15126.XNO
  • %HOMEPATH%\Cn37382M38695\K30013M28336.WGI
  • %HOMEPATH%\Cn37382M38695\81821.CEZ
  • %HOMEPATH%\Cn37382M38695\5106.GFJ
  • %HOMEPATH%\Cn37382M38695\N90760O20880.TJQ
  • %HOMEPATH%\Cn37382M38695\31690.LSA
  • %HOMEPATH%\Cn37382M38695\V70945Q59238.MBO
  • %HOMEPATH%\Cn37382M38695\89430.PCR
  • %HOMEPATH%\Cn37382M38695\51947.VJF
  • %HOMEPATH%\Cn37382M38695\38618.RCI
  • %HOMEPATH%\Cn37382M38695\43282.RSY
  • %HOMEPATH%\Cn37382M38695\30278.KYN
  • %HOMEPATH%\Cn37382M38695\P83929H60554.ZQW
  • %HOMEPATH%\Cn37382M38695\53212.BIN
  • %HOMEPATH%\Cn37382M38695\58255.KMM
  • %HOMEPATH%\Cn37382M38695\V69343Q85549.LMZ
  • %HOMEPATH%\Cn37382M38695\U99912I9958.IHP
  • %HOMEPATH%\Cn37382M38695\2658.RDX
  • %HOMEPATH%\Cn37382M38695\68173.IHS
  • %HOMEPATH%\Cn37382M38695\21775.BYB
  • %HOMEPATH%\Cn37382M38695\9506.WRS
  • %HOMEPATH%\Cn37382M38695\N41938N65969.OJQ
  • %HOMEPATH%\Cn37382M38695\F17691E71351.EIH
  • %HOMEPATH%\Cn37382M38695\V18051W65756.MQZ
  • %HOMEPATH%\Cn37382M38695\F72379X39160.RIJ
  • %HOMEPATH%\Cn37382M38695\50176.RVD
  • %HOMEPATH%\Cn37382M38695\4937.IRQ
  • %HOMEPATH%\Cn37382M38695\53761.SVW
  • %HOMEPATH%\Cn37382M38695\A34090N66567.MJT
  • %HOMEPATH%\Cn37382M38695\88966.AWK
  • %HOMEPATH%\Cn37382M38695\33320.CVV
  • %HOMEPATH%\Cn37382M38695\A72735J76780.LWA
  • %HOMEPATH%\Cn37382M38695\A50197L42198.DWM
  • %HOMEPATH%\Cn37382M38695\O2645D4666.CWO
  • %HOMEPATH%\Cn37382M38695\R31712M68427.GPE
  • %HOMEPATH%\Cn37382M38695\H54252U56915.MJN
  • %HOMEPATH%\Cn37382M38695\G65406S26995.QJT
  • %HOMEPATH%\Cn37382M38695\42024.VIL
  • %HOMEPATH%\Cn37382M38695\E34492U81267.JWG
  • %HOMEPATH%\Cn37382M38695\12604.VVM
  • %HOMEPATH%\Cn37382M38695\59682.EFR
  • %HOMEPATH%\Cn37382M38695\50754.DZY
  • %HOMEPATH%\Cn37382M38695\E75519M87528.YMD
  • %HOMEPATH%\Cn37382M38695\P23464H3636.AIY
  • %HOMEPATH%\Cn37382M38695\90117.GQR
  • %HOMEPATH%\Cn37382M38695\E26758F49229.ZIO
  • %HOMEPATH%\Cn37382M38695\J46002Z67922.MPX
  • %HOMEPATH%\Cn37382M38695\61524.QKK
  • %HOMEPATH%\Cn37382M38695\48346.NVX
  • %HOMEPATH%\Cn37382M38695\8454.XUX
  • %HOMEPATH%\Cn37382M38695\V26432L55324.TBH
  • %HOMEPATH%\Cn37382M38695\J54265U53711.XAG
  • %HOMEPATH%\Cn37382M38695\97835.NZH
  • %HOMEPATH%\Cn37382M38695\Z90715Q47636.EHU
  • %HOMEPATH%\Cn37382M38695\E67292F17849.YWO
  • %HOMEPATH%\Cn37382M38695\R77192G92888.QJG
  • %HOMEPATH%\Cn37382M38695\C23254H92013.AKS
  • %HOMEPATH%\Cn37382M38695\53916.DBZ
  • %HOMEPATH%\Cn37382M38695\N37771I85722.AWN
  • %HOMEPATH%\Cn37382M38695\37332.HYU
  • %HOMEPATH%\Cn37382M38695\L53296V79915.VHL
  • %HOMEPATH%\Cn37382M38695\U60696R87922.NFB
  • %HOMEPATH%\Cn37382M38695\M58566V57881.IKT
  • %HOMEPATH%\Cn37382M38695\svchost.exe.exe
  • %HOMEPATH%\Cn37382M38695\95554.VQF
  • %HOMEPATH%\Cn37382M38695\19984.TMT
  • %HOMEPATH%\Cn37382M38695\P71624I57971.IEF
  • %HOMEPATH%\Cn37382M38695\38797.YVD
  • %HOMEPATH%\Cn37382M38695\E61475E7800.FYJ
  • %HOMEPATH%\Cn37382M38695\B27764O70685.PNQ
  • %HOMEPATH%\Cn37382M38695\13057.SLU
  • %HOMEPATH%\Cn37382M38695\Z65927Z27040.AYQ
  • %HOMEPATH%\Cn37382M38695\79873.DZH
  • %HOMEPATH%\Cn37382M38695\O6505A16012.AGN
  • %HOMEPATH%\Cn37382M38695\7599.MIR
  • %HOMEPATH%\Cn37382M38695\P53629V9229.URQ
  • %HOMEPATH%\Cn37382M38695\W62302Z34055.KOX
  • %HOMEPATH%\Cn37382M38695\3577.IUG
  • %HOMEPATH%\Cn37382M38695\43503.OAQ
  • %HOMEPATH%\Cn37382M38695\A10317O75822.UBL
  • %HOMEPATH%\Cn37382M38695\13608.TDT
  • %HOMEPATH%\Cn37382M38695\13080.ALU
  • %HOMEPATH%\Cn37382M38695\L32574K16352.IXI
  • %HOMEPATH%\Cn37382M38695\21538.BUA
  • %HOMEPATH%\Cn37382M38695\53002.WOK
  • %HOMEPATH%\Cn37382M38695\84179.DWB
  • %HOMEPATH%\Cn37382M38695\R99147I38470.FMP
  • %HOMEPATH%\Cn37382M38695\61199.ZEM
  • %HOMEPATH%\Cn37382M38695\J90769C18662.KCH
  • %HOMEPATH%\Cn37382M38695\18394.CYQ
  • %HOMEPATH%\Cn37382M38695\B22391C65851.DJN
  • %HOMEPATH%\Cn37382M38695\K80972R87944.FBA
  • %HOMEPATH%\Cn37382M38695\O56751W15405.KQV
  • %HOMEPATH%\Cn37382M38695\18997.JSY
  • %HOMEPATH%\Cn37382M38695\H17195F27194.IWG
  • %HOMEPATH%\Cn37382M38695\94890.COJ
  • %HOMEPATH%\Cn37382M38695\16282.XQF
  • %HOMEPATH%\Cn37382M38695\M65122F11870.FKK
  • %HOMEPATH%\Cn37382M38695\A23192S68769.YGK
  • %HOMEPATH%\Cn37382M38695\83210.EYG
  • %HOMEPATH%\Cn37382M38695\98566.SAN
  • %HOMEPATH%\Cn37382M38695\T88194T31380.AWV
  • %HOMEPATH%\Cn37382M38695\84592.XPK
  • %HOMEPATH%\Cn37382M38695\W85159Z10940.CDG
  • %HOMEPATH%\Cn37382M38695\T63793Z43876.YUW
  • %HOMEPATH%\Cn37382M38695\44934.KRP
  • %HOMEPATH%\Cn37382M38695\H37652K57221.NXQ
  • %HOMEPATH%\Cn37382M38695\X45377A1242.VHV
  • %HOMEPATH%\Cn37382M38695\44954.YRM
  • %HOMEPATH%\Cn37382M38695\4192.YBD
  • %HOMEPATH%\Cn37382M38695\52223.ZYM
  • %HOMEPATH%\Cn37382M38695\95327.EGM
  • %HOMEPATH%\Cn37382M38695\42134.SEC
  • %HOMEPATH%\Cn37382M38695\14591.YNP
  • %HOMEPATH%\Cn37382M38695\93263.CPM
  • %HOMEPATH%\Cn37382M38695\38587.TXM
  • %HOMEPATH%\Cn37382M38695\10776.LZQ
  • %HOMEPATH%\Cn37382M38695\W66939O75212.QFM
  • %HOMEPATH%\Cn37382M38695\L57111W19553.GQR
  • %HOMEPATH%\Cn37382M38695\T36132W47154.QTP
  • %HOMEPATH%\Cn37382M38695\21989.CCD
  • %HOMEPATH%\Cn37382M38695\4297.FKT
  • %HOMEPATH%\Cn37382M38695\L89725J93324.DIG
  • %HOMEPATH%\Cn37382M38695\B87447D23458.XNF
  • %HOMEPATH%\Cn37382M38695\99353.TCE
  • %HOMEPATH%\Cn37382M38695\L64619E72471.FGC
  • %HOMEPATH%\Cn37382M38695\G15128B83068.DVE
  • %HOMEPATH%\Cn37382M38695\57893.TOB
  • %HOMEPATH%\Cn37382M38695\T90234W84332.YVJ
  • %HOMEPATH%\Cn37382M38695\E98587R77125.THV
  • %HOMEPATH%\Cn37382M38695\68820.EFN
  • %HOMEPATH%\Cn37382M38695\O70488B4435.VTO
  • %HOMEPATH%\Cn37382M38695\10804.CXR
  • %HOMEPATH%\Cn37382M38695\I46813S73537.NYL
  • %HOMEPATH%\Cn37382M38695\71635.ZQR
  • %HOMEPATH%\Cn37382M38695\H18739G15221.WYJ
  • %HOMEPATH%\Cn37382M38695\9789.UYJ
  • %HOMEPATH%\Cn37382M38695\V41869Z77568.FCA
  • %HOMEPATH%\Cn37382M38695\59499.QCA
  • %HOMEPATH%\Cn37382M38695\82013.QZR
  • %HOMEPATH%\Cn37382M38695\H23544G79265.FLL
  • %HOMEPATH%\Cn37382M38695\J68319P40519.DIP
  • %HOMEPATH%\Cn37382M38695\93061.DBS
  • %HOMEPATH%\Cn37382M38695\I38564G56729.MRA
  • %HOMEPATH%\Cn37382M38695\E45695R35443.FJW
  • %HOMEPATH%\Cn37382M38695\D73818X58674.REQ
  • %HOMEPATH%\Cn37382M38695\L73741W5870.GBK
  • %HOMEPATH%\Cn37382M38695\41051.JID
  • %HOMEPATH%\Cn37382M38695\C89480V35422.CLK
  • %HOMEPATH%\Cn37382M38695\62068.TCJ
  • %HOMEPATH%\Cn37382M38695\P24794C46853.KTJ
  • %HOMEPATH%\Cn37382M38695\B69260N28431.HLY
  • %HOMEPATH%\Cn37382M38695\O24923C90447.DTG
  • %HOMEPATH%\Cn37382M38695\20239.BEZ
  • %HOMEPATH%\Cn37382M38695\F88811K38549.YWK
  • %HOMEPATH%\Cn37382M38695\P23921R56476.TXG
  • %HOMEPATH%\Cn37382M38695\4875.WMF
  • %HOMEPATH%\Cn37382M38695\82296.QPN
  • %HOMEPATH%\Cn37382M38695\M6402H69329.LNQ
  • %HOMEPATH%\Cn37382M38695\W7024O32400.WWF
  • %HOMEPATH%\Cn37382M38695\E78666M49716.YCB
  • %HOMEPATH%\Cn37382M38695\38616.XAL
  • %HOMEPATH%\Cn37382M38695\68609.JTR
  • %HOMEPATH%\Cn37382M38695\73509.ZJY
  • %HOMEPATH%\Cn37382M38695\T46012L62615.YHI
  • %HOMEPATH%\Cn37382M38695\J50242D9486.WSN
  • %HOMEPATH%\Cn37382M38695\21756.CNQ
  • %HOMEPATH%\Cn37382M38695\V60679R25315.FSQ
  • %HOMEPATH%\Cn37382M38695\33718.SYM
  • %HOMEPATH%\Cn37382M38695\16864.RIF
  • %HOMEPATH%\Cn37382M38695\Q40066J62093.NWK
  • %HOMEPATH%\Cn37382M38695\O34691D10564.VGX
  • %HOMEPATH%\Cn37382M38695\P32879F76507.DTL
  • %HOMEPATH%\Cn37382M38695\3294.KBR
  • %HOMEPATH%\Cn37382M38695\R72340H80063.OOZ
  • %HOMEPATH%\Cn37382M38695\O35179E99588.PLN
  • %HOMEPATH%\Cn37382M38695\84394.XYF
  • %HOMEPATH%\Cn37382M38695\79537.GNE
  • %HOMEPATH%\Cn37382M38695\O46862D85700.ECC
  • %HOMEPATH%\Cn37382M38695\49913.WZO
  • %HOMEPATH%\Cn37382M38695\28136.XDR
  • %HOMEPATH%\Cn37382M38695\P91290X97160.DSZ
  • %HOMEPATH%\Cn37382M38695\15117.AAT
  • %HOMEPATH%\Cn37382M38695\Z67779I37620.VHS
  • %HOMEPATH%\Cn37382M38695\S81216Y18472.TUM
  • %HOMEPATH%\Cn37382M38695\O46633L64447.OUR
  • %HOMEPATH%\Cn37382M38695\T42197S38490.QFY
  • %HOMEPATH%\Cn37382M38695\76611.UVR
  • %HOMEPATH%\Cn37382M38695\39784.VWQ
  • %HOMEPATH%\Cn37382M38695\18173.SFX
  • %HOMEPATH%\Cn37382M38695\I4388P72398.FAJ
  • %HOMEPATH%\Cn37382M38695\J61381D72514.UCV
  • %HOMEPATH%\Cn37382M38695\N60135F60605.GYG
  • %HOMEPATH%\Cn37382M38695\35233.TUE
  • %HOMEPATH%\Cn37382M38695\10199.BEP
  • %HOMEPATH%\Cn37382M38695\G21816D2112.MMZ
  • %HOMEPATH%\Cn37382M38695\59066.BCR
  • %HOMEPATH%\Cn37382M38695\Q43806C13569.GRG
  • %HOMEPATH%\Cn37382M38695\C6279M87116.BFQ
  • %HOMEPATH%\Cn37382M38695\Y34174Q47041.AVO
  • %HOMEPATH%\Cn37382M38695\M63596Q51264.FXC
  • %HOMEPATH%\Cn37382M38695\50713.PEL
  • %HOMEPATH%\Cn37382M38695\7301.DHT
  • %HOMEPATH%\Cn37382M38695\K34339N19318.DOW
  • %HOMEPATH%\Cn37382M38695\X57826C86141.AZR
  • %HOMEPATH%\Cn37382M38695\60144.LSR
  • %HOMEPATH%\Cn37382M38695\80914.PVR
  • %HOMEPATH%\Cn37382M38695\8201.IBJ
  • %HOMEPATH%\Cn37382M38695\E1487Q65293.EDL
  • %HOMEPATH%\Cn37382M38695\57021.RYR
  • %HOMEPATH%\Cn37382M38695\P98144L64646.JOJ
  • %HOMEPATH%\Cn37382M38695\W84491O13664.BLR
  • %HOMEPATH%\Cn37382M38695\G7164F79174.SOV
  • %HOMEPATH%\Cn37382M38695\L22279U88143.OQI
  • %HOMEPATH%\Cn37382M38695\J72308M53458.LUM
  • %HOMEPATH%\Cn37382M38695\E77203R83852.NGU
  • %HOMEPATH%\Cn37382M38695\76712.VIW
  • %HOMEPATH%\Cn37382M38695\G62865G8854.BTK
  • %HOMEPATH%\Cn37382M38695\26161.DDL
  • %HOMEPATH%\Cn37382M38695\W55321H78930.UKE
  • %HOMEPATH%\Cn37382M38695\36991.OPW
  • %HOMEPATH%\Cn37382M38695\G65213B26313.HCX
  • %HOMEPATH%\Cn37382M38695\75570.GQQ
  • %HOMEPATH%\Cn37382M38695\S42689R15910.HOY
  • %HOMEPATH%\Cn37382M38695\80171.VJY
  • %HOMEPATH%\Cn37382M38695\N92672A44136.RES
  • %HOMEPATH%\Cn37382M38695\A92212M21852.TNQ
  • %HOMEPATH%\Cn37382M38695\9476.YTD
  • %HOMEPATH%\Cn37382M38695\S41695R79866.CWY
  • %HOMEPATH%\Cn37382M38695\16674.NBM
  • %HOMEPATH%\Cn37382M38695\V6064B3696.QDO
  • %HOMEPATH%\Cn37382M38695\K50406C26166.WPI
  • %HOMEPATH%\Cn37382M38695\U27235U90297.XIK
Sets the 'hidden' attribute to the following files:
  • %HOMEPATH%\Aj33493H82320.BI5
Deletes the following files:
  • %TEMP%\aut1.tmp
Miscellaneous:
Searches for the following windows:
  • ClassName: 'Shell_TrayWnd' WindowName: ''
  • ClassName: 'EDIT' WindowName: ''

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android